Analysis
-
max time kernel
113s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 13:44
Behavioral task
behavioral1
Sample
RippleSpoofer.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
RippleSpoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
RippleSpoofer.exe
-
Size
15.6MB
-
MD5
76ed914a265f60ff93751afe02cf35a4
-
SHA1
4f8ea583e5999faaec38be4c66ff4849fcf715c6
-
SHA256
51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b
-
SHA512
83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac
-
SSDEEP
393216:QAiUmWQEnjaa4cqmAa4ICSSF1a0HPRV8gtFlSiZh5ZlZ:bhnGhMAXSmHXFA+
Malware Config
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ RippleSpoofer.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 5104 netsh.exe 1652 netsh.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RippleSpoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RippleSpoofer.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 3964 cmd.exe 3612 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 4460 mac.exe 3452 mac.exe -
Loads dropped DLL 33 IoCs
pid Process 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe 3452 mac.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1100-5-0x0000000000670000-0x00000000022F0000-memory.dmp themida behavioral2/memory/1100-6-0x0000000000670000-0x00000000022F0000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RippleSpoofer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 57 discord.com 58 discord.com 60 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 50 ip-api.com -
pid Process 4412 cmd.exe 4864 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 2236 tasklist.exe 884 tasklist.exe 212 tasklist.exe 3528 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 5112 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1100 RippleSpoofer.exe -
resource yara_rule behavioral2/files/0x0007000000023c93-140.dat upx behavioral2/memory/3452-144-0x00007FFA54590000-0x00007FFA54B78000-memory.dmp upx behavioral2/files/0x0009000000023bbb-201.dat upx behavioral2/files/0x0009000000023bba-200.dat upx behavioral2/files/0x0007000000023c97-199.dat upx behavioral2/memory/3452-204-0x00007FFA65D90000-0x00007FFA65DA9000-memory.dmp upx behavioral2/memory/3452-202-0x00007FFA65DD0000-0x00007FFA65DE9000-memory.dmp upx behavioral2/memory/3452-208-0x00007FFA62220000-0x00007FFA6224E000-memory.dmp upx behavioral2/memory/3452-207-0x00007FFA5BEE0000-0x00007FFA5C053000-memory.dmp upx behavioral2/memory/3452-213-0x00007FFA65E00000-0x00007FFA65E24000-memory.dmp upx behavioral2/memory/3452-212-0x00007FFA53D60000-0x00007FFA540D5000-memory.dmp upx behavioral2/memory/3452-219-0x00007FFA60150000-0x00007FFA60164000-memory.dmp upx behavioral2/memory/3452-218-0x00007FFA65D90000-0x00007FFA65DA9000-memory.dmp upx behavioral2/memory/3452-224-0x00007FFA5BEE0000-0x00007FFA5C053000-memory.dmp upx behavioral2/memory/3452-223-0x00007FFA60050000-0x00007FFA6006B000-memory.dmp upx behavioral2/memory/3452-226-0x00007FFA60030000-0x00007FFA60049000-memory.dmp upx behavioral2/memory/3452-229-0x00007FFA5D110000-0x00007FFA5D15D000-memory.dmp upx behavioral2/memory/3452-234-0x00007FFA65D70000-0x00007FFA65D85000-memory.dmp upx behavioral2/memory/3452-235-0x00007FFA5D0D0000-0x00007FFA5D0EE000-memory.dmp upx behavioral2/memory/3452-233-0x00007FFA60140000-0x00007FFA6014A000-memory.dmp upx behavioral2/memory/3452-232-0x00007FFA5CBC0000-0x00007FFA5CBF2000-memory.dmp upx behavioral2/memory/3452-236-0x00007FFA42DB0000-0x00007FFA435AB000-memory.dmp upx behavioral2/memory/3452-231-0x00007FFA5D0F0000-0x00007FFA5D101000-memory.dmp upx behavioral2/memory/3452-230-0x00007FFA53D60000-0x00007FFA540D5000-memory.dmp upx behavioral2/memory/3452-238-0x00007FFA5CB00000-0x00007FFA5CB37000-memory.dmp upx behavioral2/memory/3452-237-0x00007FFA60150000-0x00007FFA60164000-memory.dmp upx behavioral2/memory/3452-227-0x00007FFA5BE20000-0x00007FFA5BED8000-memory.dmp upx behavioral2/memory/3452-225-0x00007FFA62220000-0x00007FFA6224E000-memory.dmp upx behavioral2/memory/3452-222-0x00007FFA5BD00000-0x00007FFA5BE1C000-memory.dmp upx behavioral2/memory/3452-221-0x00007FFA62250000-0x00007FFA62273000-memory.dmp upx behavioral2/memory/3452-220-0x00007FFA60070000-0x00007FFA60092000-memory.dmp upx behavioral2/memory/3452-217-0x00007FFA60170000-0x00007FFA60184000-memory.dmp upx behavioral2/memory/3452-216-0x00007FFA62200000-0x00007FFA62212000-memory.dmp upx behavioral2/memory/3452-215-0x00007FFA65DD0000-0x00007FFA65DE9000-memory.dmp upx behavioral2/memory/3452-214-0x00007FFA65D70000-0x00007FFA65D85000-memory.dmp upx behavioral2/memory/3452-245-0x00007FFA60070000-0x00007FFA60092000-memory.dmp upx behavioral2/memory/3452-210-0x00007FFA5BE20000-0x00007FFA5BED8000-memory.dmp upx behavioral2/memory/3452-209-0x00007FFA54590000-0x00007FFA54B78000-memory.dmp upx behavioral2/memory/3452-206-0x00007FFA62250000-0x00007FFA62273000-memory.dmp upx behavioral2/memory/3452-205-0x00007FFA62280000-0x00007FFA622AD000-memory.dmp upx behavioral2/memory/3452-203-0x00007FFA65DC0000-0x00007FFA65DCD000-memory.dmp upx behavioral2/files/0x0007000000023c95-198.dat upx behavioral2/files/0x0007000000023c94-197.dat upx behavioral2/files/0x0007000000023c91-196.dat upx behavioral2/files/0x0007000000023c8c-195.dat upx behavioral2/files/0x0007000000023c8a-194.dat upx behavioral2/memory/3452-280-0x00007FFA60050000-0x00007FFA6006B000-memory.dmp upx behavioral2/memory/3452-281-0x00007FFA60020000-0x00007FFA6002D000-memory.dmp upx behavioral2/memory/3452-154-0x00007FFA65DF0000-0x00007FFA65DFF000-memory.dmp upx behavioral2/files/0x0007000000023c8b-153.dat upx behavioral2/memory/3452-152-0x00007FFA65E00000-0x00007FFA65E24000-memory.dmp upx behavioral2/files/0x0008000000023bc1-150.dat upx behavioral2/memory/3452-297-0x00007FFA60030000-0x00007FFA60049000-memory.dmp upx behavioral2/memory/3452-298-0x00007FFA5D110000-0x00007FFA5D15D000-memory.dmp upx behavioral2/memory/3452-299-0x00007FFA5CBC0000-0x00007FFA5CBF2000-memory.dmp upx behavioral2/memory/3452-320-0x00007FFA53D60000-0x00007FFA540D5000-memory.dmp upx behavioral2/memory/3452-335-0x00007FFA5CB00000-0x00007FFA5CB37000-memory.dmp upx behavioral2/memory/3452-322-0x00007FFA62200000-0x00007FFA62212000-memory.dmp upx behavioral2/memory/3452-337-0x00007FFA42DB0000-0x00007FFA435AB000-memory.dmp upx behavioral2/memory/3452-321-0x00007FFA65D70000-0x00007FFA65D85000-memory.dmp upx behavioral2/memory/3452-319-0x00007FFA5BE20000-0x00007FFA5BED8000-memory.dmp upx behavioral2/memory/3452-318-0x00007FFA62220000-0x00007FFA6224E000-memory.dmp upx behavioral2/memory/3452-309-0x00007FFA54590000-0x00007FFA54B78000-memory.dmp upx behavioral2/memory/3452-317-0x00007FFA5BEE0000-0x00007FFA5C053000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4284 sc.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral2/files/0x000e000000023bab-49.dat pyinstaller -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1760 netsh.exe 1912 cmd.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 3260 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 3448 WMIC.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion RippleSpoofer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RippleSpoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer RippleSpoofer.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3260 NETSTAT.EXE 212 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1160 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 792 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{939BF6CB-A6C8-4785-BFA7-B2A9E5015E11} RippleSpoofer.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 3612 powershell.exe 3612 powershell.exe 3612 powershell.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe 1100 RippleSpoofer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1100 RippleSpoofer.exe Token: 33 1304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1304 AUDIODG.EXE Token: SeDebugPrivilege 792 taskkill.exe Token: SeIncreaseQuotaPrivilege 4864 WMIC.exe Token: SeSecurityPrivilege 4864 WMIC.exe Token: SeTakeOwnershipPrivilege 4864 WMIC.exe Token: SeLoadDriverPrivilege 4864 WMIC.exe Token: SeSystemProfilePrivilege 4864 WMIC.exe Token: SeSystemtimePrivilege 4864 WMIC.exe Token: SeProfSingleProcessPrivilege 4864 WMIC.exe Token: SeIncBasePriorityPrivilege 4864 WMIC.exe Token: SeCreatePagefilePrivilege 4864 WMIC.exe Token: SeBackupPrivilege 4864 WMIC.exe Token: SeRestorePrivilege 4864 WMIC.exe Token: SeShutdownPrivilege 4864 WMIC.exe Token: SeDebugPrivilege 4864 WMIC.exe Token: SeSystemEnvironmentPrivilege 4864 WMIC.exe Token: SeRemoteShutdownPrivilege 4864 WMIC.exe Token: SeUndockPrivilege 4864 WMIC.exe Token: SeManageVolumePrivilege 4864 WMIC.exe Token: 33 4864 WMIC.exe Token: 34 4864 WMIC.exe Token: 35 4864 WMIC.exe Token: 36 4864 WMIC.exe Token: SeIncreaseQuotaPrivilege 4864 WMIC.exe Token: SeSecurityPrivilege 4864 WMIC.exe Token: SeTakeOwnershipPrivilege 4864 WMIC.exe Token: SeLoadDriverPrivilege 4864 WMIC.exe Token: SeSystemProfilePrivilege 4864 WMIC.exe Token: SeSystemtimePrivilege 4864 WMIC.exe Token: SeProfSingleProcessPrivilege 4864 WMIC.exe Token: SeIncBasePriorityPrivilege 4864 WMIC.exe Token: SeCreatePagefilePrivilege 4864 WMIC.exe Token: SeBackupPrivilege 4864 WMIC.exe Token: SeRestorePrivilege 4864 WMIC.exe Token: SeShutdownPrivilege 4864 WMIC.exe Token: SeDebugPrivilege 4864 WMIC.exe Token: SeSystemEnvironmentPrivilege 4864 WMIC.exe Token: SeRemoteShutdownPrivilege 4864 WMIC.exe Token: SeUndockPrivilege 4864 WMIC.exe Token: SeManageVolumePrivilege 4864 WMIC.exe Token: 33 4864 WMIC.exe Token: 34 4864 WMIC.exe Token: 35 4864 WMIC.exe Token: 36 4864 WMIC.exe Token: SeDebugPrivilege 212 tasklist.exe Token: SeDebugPrivilege 3528 tasklist.exe Token: SeDebugPrivilege 2236 tasklist.exe Token: SeDebugPrivilege 3612 powershell.exe Token: SeIncreaseQuotaPrivilege 3448 WMIC.exe Token: SeSecurityPrivilege 3448 WMIC.exe Token: SeTakeOwnershipPrivilege 3448 WMIC.exe Token: SeLoadDriverPrivilege 3448 WMIC.exe Token: SeSystemProfilePrivilege 3448 WMIC.exe Token: SeSystemtimePrivilege 3448 WMIC.exe Token: SeProfSingleProcessPrivilege 3448 WMIC.exe Token: SeIncBasePriorityPrivilege 3448 WMIC.exe Token: SeCreatePagefilePrivilege 3448 WMIC.exe Token: SeBackupPrivilege 3448 WMIC.exe Token: SeRestorePrivilege 3448 WMIC.exe Token: SeShutdownPrivilege 3448 WMIC.exe Token: SeDebugPrivilege 3448 WMIC.exe Token: SeSystemEnvironmentPrivilege 3448 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1100 wrote to memory of 792 1100 RippleSpoofer.exe 93 PID 1100 wrote to memory of 792 1100 RippleSpoofer.exe 93 PID 1100 wrote to memory of 4460 1100 RippleSpoofer.exe 95 PID 1100 wrote to memory of 4460 1100 RippleSpoofer.exe 95 PID 4460 wrote to memory of 3452 4460 mac.exe 96 PID 4460 wrote to memory of 3452 4460 mac.exe 96 PID 3452 wrote to memory of 1632 3452 mac.exe 97 PID 3452 wrote to memory of 1632 3452 mac.exe 97 PID 3452 wrote to memory of 3972 3452 mac.exe 99 PID 3452 wrote to memory of 3972 3452 mac.exe 99 PID 3452 wrote to memory of 624 3452 mac.exe 100 PID 3452 wrote to memory of 624 3452 mac.exe 100 PID 3972 wrote to memory of 4864 3972 cmd.exe 103 PID 3972 wrote to memory of 4864 3972 cmd.exe 103 PID 624 wrote to memory of 212 624 cmd.exe 104 PID 624 wrote to memory of 212 624 cmd.exe 104 PID 3452 wrote to memory of 5112 3452 mac.exe 105 PID 3452 wrote to memory of 5112 3452 mac.exe 105 PID 5112 wrote to memory of 3804 5112 cmd.exe 107 PID 5112 wrote to memory of 3804 5112 cmd.exe 107 PID 3452 wrote to memory of 1836 3452 mac.exe 108 PID 3452 wrote to memory of 1836 3452 mac.exe 108 PID 1836 wrote to memory of 3528 1836 cmd.exe 110 PID 1836 wrote to memory of 3528 1836 cmd.exe 110 PID 3452 wrote to memory of 2508 3452 mac.exe 111 PID 3452 wrote to memory of 2508 3452 mac.exe 111 PID 3452 wrote to memory of 2520 3452 mac.exe 112 PID 3452 wrote to memory of 2520 3452 mac.exe 112 PID 3452 wrote to memory of 3920 3452 mac.exe 113 PID 3452 wrote to memory of 3920 3452 mac.exe 113 PID 3452 wrote to memory of 3964 3452 mac.exe 114 PID 3452 wrote to memory of 3964 3452 mac.exe 114 PID 2508 wrote to memory of 3064 2508 cmd.exe 119 PID 2508 wrote to memory of 3064 2508 cmd.exe 119 PID 3064 wrote to memory of 2240 3064 cmd.exe 120 PID 3064 wrote to memory of 2240 3064 cmd.exe 120 PID 3964 wrote to memory of 3612 3964 cmd.exe 121 PID 3964 wrote to memory of 3612 3964 cmd.exe 121 PID 2520 wrote to memory of 4140 2520 cmd.exe 122 PID 2520 wrote to memory of 4140 2520 cmd.exe 122 PID 3920 wrote to memory of 2236 3920 cmd.exe 123 PID 3920 wrote to memory of 2236 3920 cmd.exe 123 PID 4140 wrote to memory of 4604 4140 cmd.exe 124 PID 4140 wrote to memory of 4604 4140 cmd.exe 124 PID 3452 wrote to memory of 4412 3452 mac.exe 125 PID 3452 wrote to memory of 4412 3452 mac.exe 125 PID 3452 wrote to memory of 1912 3452 mac.exe 127 PID 3452 wrote to memory of 1912 3452 mac.exe 127 PID 4412 wrote to memory of 1160 4412 cmd.exe 129 PID 4412 wrote to memory of 1160 4412 cmd.exe 129 PID 1912 wrote to memory of 1760 1912 cmd.exe 130 PID 1912 wrote to memory of 1760 1912 cmd.exe 130 PID 4412 wrote to memory of 3208 4412 cmd.exe 132 PID 4412 wrote to memory of 3208 4412 cmd.exe 132 PID 4412 wrote to memory of 3448 4412 cmd.exe 133 PID 4412 wrote to memory of 3448 4412 cmd.exe 133 PID 4412 wrote to memory of 1052 4412 cmd.exe 134 PID 4412 wrote to memory of 1052 4412 cmd.exe 134 PID 1052 wrote to memory of 4260 1052 net.exe 135 PID 1052 wrote to memory of 4260 1052 net.exe 135 PID 4412 wrote to memory of 4144 4412 cmd.exe 136 PID 4412 wrote to memory of 4144 4412 cmd.exe 136 PID 4144 wrote to memory of 2496 4144 query.exe 137 PID 4144 wrote to memory of 2496 4144 query.exe 137 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3804 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:1632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""4⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"5⤵
- Views/modifies file attributes
PID:3804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"4⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\cmd.execmd.exe /c chcp5⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\chcp.comchcp6⤵PID:2240
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"4⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\cmd.execmd.exe /c chcp5⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\system32\chcp.comchcp6⤵PID:4604
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"4⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard5⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"4⤵
- Network Service Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
PID:1160
-
-
C:\Windows\system32\HOSTNAME.EXEhostname5⤵PID:3208
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername5⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-
C:\Windows\system32\net.exenet user5⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user6⤵PID:4260
-
-
-
C:\Windows\system32\query.exequery user5⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"6⤵PID:2496
-
-
-
C:\Windows\system32\net.exenet localgroup5⤵PID:3088
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup6⤵PID:820
-
-
-
C:\Windows\system32\net.exenet localgroup administrators5⤵PID:5064
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators6⤵PID:5016
-
-
-
C:\Windows\system32\net.exenet user guest5⤵PID:3012
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest6⤵PID:2160
-
-
-
C:\Windows\system32\net.exenet user administrator5⤵PID:4396
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator6⤵PID:4484
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command5⤵PID:1936
-
-
C:\Windows\system32\tasklist.exetasklist /svc5⤵
- Enumerates processes with tasklist
PID:884
-
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
PID:212
-
-
C:\Windows\system32\ROUTE.EXEroute print5⤵PID:2552
-
-
C:\Windows\system32\ARP.EXEarp -a5⤵
- Network Service Discovery
PID:4864
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano5⤵
- System Network Connections Discovery
- Gathers network information
PID:3260
-
-
C:\Windows\system32\sc.exesc query type= service state= all5⤵
- Launches sc.exe
PID:4284
-
-
C:\Windows\system32\netsh.exenetsh firewall show state5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5104
-
-
C:\Windows\system32\netsh.exenetsh firewall show config5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:3980
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:3704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:3660
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:2636
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x514 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:1304
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
3System Information Discovery
5System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.6MB
MD5d1291397afba61f29aa4edf736846e0a
SHA17689fa6f0981abf689cf530db90b5362290f3417
SHA25626f760c4a2ed24f038075e77622205d8052316eed2bdf5ec9176f7656d6549b0
SHA5129d8f4d07e84f462c3e696dbdfd00170e0dc114101da76476af40c8a65bd80060aa031dd001ab0cdb8908ae24287034a3b970696c46ee519aeac8a22044a5a12a
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
34KB
MD51b8ce772a230a5da8cbdccd8914080a5
SHA140d4faf1308d1af6ef9f3856a4f743046fd0ead5
SHA256fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f
SHA512d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603
-
Filesize
46KB
MD580c69a1d87f0c82d6c4268e5a8213b78
SHA1bae059da91d48eaac4f1bb45ca6feee2c89a2c06
SHA256307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87
SHA512542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d
-
Filesize
57KB
MD5b4c41a4a46e1d08206c109ce547480c7
SHA19588387007a49ec2304160f27376aedca5bc854d
SHA2569925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9
SHA51230debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33
-
Filesize
21KB
MD59313c86e7bae859f0174a1c8b6aba58b
SHA1dce67fd1da5da8dc4ba406c544e55a83d6536cc9
SHA256af9675ac90bae8a0d8623f6fdaff9d39e1b8810e8e46a5b044baaa3396e745b3
SHA5122ec64fce4a86bc52dc6c485fd94d203020617df92698ca91ae25c4901984899e21c7dd92881ec52d6850edfa547701aab9b0cd1b8d076e6779b1a13324cdd3a4
-
Filesize
21KB
MD5854458ad55c39a9dfd1e350a51be02b8
SHA15013cf58de5a0b55e026ace967e9842b3b131c2a
SHA256f918b0c45f59b2cb29f1eb3653d2f2679095e85e082a1198c933a76edf1f33ef
SHA512faa41a5031033f7e86efebc47777f915e95617f4b05d93833066c206d9c092855d8072c7bd142898f5a2bd1f94b646d98933302ddeb5a9ca0d5930c7b2241b98
-
Filesize
21KB
MD57ad2034acd0f296fe9eed320e5ad7591
SHA1fe1b217e3f4567905968f7a3d48a7611e3cf3f7b
SHA2560d859a866d1bcefe1a1bc5adb88dcf2765567ecc31dfb4e472b512d033d88bb4
SHA51206d017b0ef9d081bc627f7f33d51ef2fe64e2cc5023204771032c4ed7bf26c0c6106b69d78f7bdd880fa59e8e4048b2da8848784bc92d7780155df140c952420
-
Filesize
21KB
MD512ea48ce605ebb204a21ae7d86db3417
SHA15fb0ff9ba4105cd76ee4470ae4cad0a39ae68c66
SHA256189bbbd739526a986e53518865e741cde8c5967aacd5ed687408cec3d8781f1c
SHA51239b486fb72c9dff4e391673a872e957dbf0545d4d26914d0b0a475624e40b4feec3a9a17549e87ba806b1a90bf6f7784a187c506daa1db5201561cef90ff6e81
-
Filesize
21KB
MD5201ff3cd2ffe7d222f46574d4ac40a70
SHA1b43f19bbb8fd1c8aa05ba67dea38a7785dbe57b6
SHA256b83a71978215fdba477c4ea61340168947a1021324d118e6b7159054985f2d1a
SHA5123f99d7b501c1db470a6d91af856ebbede05522acb5763d928f4fb28c74db2339b46df108745ed8ebd8c6c1298d9495358c245d188f055638b0d6dd568fa596d2
-
Filesize
25KB
MD54b328f140a3ae7fedb21ca50cc23d938
SHA19e71b4c2cf030a644d2050188c4b77e638c0ee14
SHA256e55b200643e8b078e7f5eb0c97de44fead21b11d06590ebedbcb84214d063345
SHA5124c349f45ca4db4f1247aa405e5627f22b7ccfe66234d8d970475e71471ebb251f7a0f781a33d0e4ec893f86653b0a1c8508adf576e923d0ce86b43f552204614
-
Filesize
21KB
MD54a060eec454c222a5381cd359dc00b81
SHA121e1bc115d04a74779e955ea16a16bd71454d9bb
SHA256e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df
SHA51216fb1f4ccdad05d07feb62e0cd078401f4023f9fab0fb15e52b927ca413e65eb32c2932ba59dbfa7f7ee0e8a8053748e27f2757e82e600db812271aa44a9433c
-
Filesize
20KB
MD550abf0a7ee67f00f247bada185a7661c
SHA10cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
-
Filesize
21KB
MD54166d703abc9c6de65d5b269d3a5425e
SHA116bcd7191312b94bdf38368d188e5a5cc479a36c
SHA2560a351c2a2889a42886017e7dbcf75f45e3cb24d2f55e72205624272487e4a056
SHA512f722dba410cab727c753e9cce0bc47663e22f45828f5df0bac5bd6331497a2f15f6d9330b5203d3ff735f1ce6397e63c1b21d3ea6c5ceab817b5f83ec296882b
-
Filesize
21KB
MD5993b5bc35dac959bed58b77fe42ac77a
SHA12abad159cbab86ff423d6446143427daab751366
SHA256b998ff8d173c34505e1d5984134282866de910b09919cf9a322fce760b75c80b
SHA512ca19e949dcc8460af53c9dad17995a0cbffd971bb731b7fcb53bb9384d227357926231c9fadfaa5aef09055bebae9d5c23ee73eb6eca04d6a52a3df0847e10ab
-
Filesize
21KB
MD50b65672b91c6a12d769dd777f810b149
SHA12d527b45dcbe653a91e10365891c7e589f5e51e0
SHA256c09eb307b2eb747b73c516267a99a23bb73204452326d41bdeb6f43598f6d62e
SHA512f090bb0b8f3616cf2d77ff25523bc823918e1452f626a1298c95003def1867c785566a4e85ccd7f5a20f14631caec5dd392777db2d00368c3fdf3597e0f51788
-
Filesize
21KB
MD5259b4186004bb41e706dd781e29f5c5b
SHA185751d31fe233ed51c46466f214f497d01be8d87
SHA256b3ba83880986f2522d05a88c52fe69eda9c9fadbc5192a063e36bba777cc877f
SHA512f8a06252e96f40965668c978c4808305d424de698f47f420643d713751926636f2049dd34c8156ba5bbbf5a5b2f4d5c19a978cf27d3aaebd728d7a3de8f0afa2
-
Filesize
21KB
MD54c26932f8f1f490017add31f5ec0a533
SHA10da01a7c89b506fe3fd939344bb51b976efb3207
SHA256dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23
SHA512eb2b87d187991fdc8e3a6577f20622d2d4a2a994dd375d8c27e1434ce786596533eacfbde8714db9959d88d6bcb91fdc8079c60c23f0eb920ba45c546a44e523
-
Filesize
21KB
MD541e0b7cb0eecba317cf321b1ada084d7
SHA14ce1f13188fc00eb29c726717eae489c524c1c8a
SHA256db978830b1fbcc0521582a6a79864b0fd83179248fa374926c8097bc02cd6383
SHA512f0961cde8dc83b845b2b91e42436ed8b42d2fb19caaabf49b300fa9cbbae9fab84009b4714c3899ab4a703315a135a61e508db29239d823a1cc11462ce6ffab7
-
Filesize
21KB
MD57e751952f122f4e8be1317087dc9dc71
SHA1f65884c8cfbb8ad565b3df3a51af11b1617c7092
SHA256d078a9a9958a7c816dea989bef24f32befc6651aea5e07f97a7b5d50df73f799
SHA512960922ac1309bdcf42d6900a0bea30d4096d1411ec6a97f328520d4a59f71fc04e6f4a7b8d2b346012530329f76897607369c8e1ed1fe9c589d7f7682987c043
-
Filesize
21KB
MD56d0762a2ba4263d0901ca7aaa0725c0c
SHA1e36d2d049116bd2d84121cdfa179098ac03650b4
SHA2562ee9434cc5f40f4514c7284e14b90db5c7a33000afda834d7c1dc063baa3d805
SHA51294616b2bfc0497ca2dbbc23c1aa4ecb04113a53d75fa570f6bb5e2561e5cdb940792e2cb290562133d226400c78d91377fdd312ba2858679084c66ff1ae9031d
-
Filesize
21KB
MD5abaabc1df36c7a0674f20fb83247fd71
SHA1345db0ffea0cb2531b79d464ad69347ac71ee2b9
SHA256ba55f8481d8a9d225b8c430eb010f675250c5afa64d9eeb15ff31dc159a19f5a
SHA5127c01b8f46e9fbe08784066a9df03723b3485fa714f22f4ab7e1cbe719b0a91ab1a5d597ef9d567836375de929ea9397ce0685f00b908f3d0aa4d0288eb59f7ba
-
Filesize
21KB
MD5a6776c201baae1dd6f88048d7747d14c
SHA1646119d2e440e6dad0ffb0fe449ab4fc27f09fbe
SHA256ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112
SHA512a9137af8529fd96dbba22c5179a16d112ec0bfab9792babe0a9f1cca27408eff73ba89f498cb5f941a5aa44555529ee10484e6ca4a3fbf1627523acfde622b45
-
Filesize
21KB
MD5fb731a1f96c9e34347cba5bb18e54581
SHA188a62edfbbd806b1043b4a1266c4708e1d47be1d
SHA256c4c1d381f419731c848e4a20aef02a4436758935c9a274896228b9451956cc8e
SHA512be6c94d6015edae41fa0d6464c7dc5976adbc3617e02b293b9a39e645ec173071f1f282959ddf264a133ce3b3bb9c434eb2e65fc607136f11d8eb07538168ffc
-
Filesize
21KB
MD58aad6a3a2fe9052ef218d5c8ce1995e1
SHA133748750e57cdc165fcdd186ae53003649607221
SHA256e44d56d10ee14d4c4767a25839c2ef6826adbea3e15c2705b1d79676a63905b4
SHA512841c70c63b243dea68c2ac9cd886731b6171dcf76a60932191fb29402585d6bbfcc98d11868fc6032f08c29d8e0040a2b896c32c2fb4697bd54dea2a52589ae6
-
Filesize
21KB
MD52ebacbbda70b888b1bcc5e816d14f3a2
SHA1ebf1763b0cee267040312deccb3dad61af1b9cf4
SHA25696b11fa8aca734f4b1ddee377c84427d384f8e06affd99c63128797289fc9304
SHA512af15fc2b1ff31a3550ae4e9ae45f7bbe728d839b288d6dc5f04859e27463ed946d5b2619736223ae401cee504e683b9fe9dffb65754280644dda91527eb46c5e
-
Filesize
21KB
MD587c57eddf837c1e7aaaddb451d3d981e
SHA15287af84ca9cdfa928355c3c899a43051169a2fd
SHA256e65305c73e3540491a0c62103764d50d827a13d749f76cb2af593a800c93cf44
SHA5120900608072d807082087275bd71061f7118534ea20d4cbd9b0e8190f500cd57feabe0bf7f9fac6438a7c4655ac405dd4ec17fd5f1a48b4f5dc70eb25e6f0e8ae
-
Filesize
21KB
MD52914ea20c9b8d79b1e98ea6b6dd85450
SHA12e25617bb4f3f6391658b5778f5248d9e6762c6b
SHA256047d09b49dae9a101eb55277aa37c31390ea6c7187379b448122d77bd77bf005
SHA512c0731aaecbca9b70151e7630e0dbc7d744d534effe56ad703df881f09c7820cb143873dbf95d57357d51be44d53a3b9862d0c6483ca6c70aad01a3f11350abc9
-
Filesize
21KB
MD5e496d42d228b5e90c7b96350dbb1159c
SHA1746ba35a931e05aebda957608a6e28c1699237aa
SHA2561ff617fb9d681551fb456aabaae078c0ac7f96580ac1144ea441826a6d98caef
SHA512ce555cb7fc0625d7568b002306e203e013f03127aad7383ce26774cb1f1fa820f5fa6145dc9f5930b4d0791631bdbce2ee2e4ee3efa7720b1b2c413ff782e197
-
Filesize
21KB
MD510d466341e7ece8cf75b5d026105741b
SHA131d1e9b9a4511156695b5aa33d65b6a36f8139c2
SHA2565ce391edb33c7055e724a4c3cecc64d16ba2aa4724cb99cd5aed00b0cecfbc82
SHA5128778fd10c7360bd87db048a2b2ca6603455fd8cb4d0e18709f106b55db7cc92e7d6dc45385ff9def445b368376462e7d253442728d5e759faa97299b67a59e21
-
Filesize
21KB
MD58222b0f8bcf884433a55996253963a96
SHA135914b003bbe6527e2479d7f897024915821500f
SHA2567f18dc2971d15434bfe03c4842dced10b466e849d782a1c8e398d96c2e2b12e2
SHA5125e67b25af8a1f23450cf8807135fea1ec39dfe8ff7cd3858e492ae9e016a23967ed6009da8868cd9dc87d583c3b7e6fb66d00bd48a7bba6b0eea638716514cc6
-
Filesize
21KB
MD55bc2660d94760af50f96b1999de6cfab
SHA175dec9b15bf9181f0e8015992b678bac718d8c0b
SHA25603bebf73df97beed5da608cae73324df2aaec092277d53ce8c119031cf8e21fd
SHA5127e9c67b5e46b35ba3f733110cf7fe35ac9dc1b41a4f7633180cd69631d1b82bcac99f8b94b6f36a373f72bc4fd7eeaac21a8fb51830914a32e19d738208ca636
-
Filesize
25KB
MD54bb011d3e58e958e94ca23ae05a8e958
SHA1741af22136c1d6dce03c75c68e977c05d76ac027
SHA25606b0fd7e6d7cbe35177af8fc17863f247bd5caee64543e3a9a125253d51af777
SHA51207668515aa4099c390ce30ef3415e412113483da792d7cd02bb3ddce561719e808d6be81b90d599f4a7fa50ba27382c8d84ecb45292200bba7094a5204ff7715
-
Filesize
21KB
MD516a97489dab15db9b9713c53726f3411
SHA1c15ad01807955374283805104233bd56760b25c9
SHA2569c06541d13c7088f313aab0be5af20b72e583f34e442df3d2fc29953640d4812
SHA51254ffa278e4d0975830c1a8eff9b7fc41d487cd9e8390d0e14f58cff62efadfc5816bcda3ca11e2b1cbaeecb20546839593f7c6ea9500eef433f299861d205822
-
Filesize
21KB
MD53491700e847fb9e9c4413fc82a0ad285
SHA103694cd43a06bb2fff6a1d85f73bd7b87198e07e
SHA256ed969fae3cf64f46b5f4d2447980befd6f0a7fd05802529dbc793f3c014bc46c
SHA51207e81eabcef621ec6a84e1932e299e0b865c06e6f9907017bbed0121771712b007a18771099131f24da134f3cbff0a7af30ca4e1c262b117e8bacf055cd54002
-
Filesize
21KB
MD5e3ede68927c68aa73ac95722d24334ce
SHA1dbe71e1a56f9b7569b4a568bb67e37c38011b879
SHA2565dd42e524920f4cb467031eb9e0e440bbe73de0fb39f71e65736a2ab2f6fcfe8
SHA512d935058d8409b518d82336dc0b1521bf411ef77ef49485ede15baf5d1ac527f46ad813ebdb889c0f9999d553a879150d5ba41ce3a0b11d5ca08907e378fc9b8d
-
Filesize
21KB
MD53cca955cde8362605fc268e4b12accaa
SHA16f3c214ef223f35495c0cb0ee359b9d975c14e72
SHA25634c6e58abcce5bccace50df3bd6c3e2d3f4e8413b14aae8e707ddfddccdeba6d
SHA5125b7fe7deb6066c53bd41479172eac2736301f5cf32921f13d2ce6ad2811925e7bc1c436627698050be86ddf18852eeac927be4efc2182d857b31f637adc6c206
-
Filesize
29KB
MD5e6184d65799033dbee51667790130016
SHA1b00461d14ffa2beab0887bcb716f331090cce8c9
SHA256eecac10f830ad0dcbdf0f0dc1422ef5cfed490a877429a4674aecc560869a5e5
SHA512987c14f8c22ae0d6c1005cc7b0d9a240283c2120e8ded030a407f25fb7786f7283980850ca243859f0148dbeb7bfaec01c8208865b81046999252d07e5f42d53
-
Filesize
21KB
MD5fa9b5cec8eed4fef73ec60d7f4c1eb1e
SHA103f19b2886688de1fb2016d614fe514f8b508250
SHA25609f19b41a8d71cd5174efdae2a7649022780434d7c4416d6121153359aa85918
SHA512744288d8903fdceed87cc5b7e0e286fab59584b57acdd943b04c5f6a39391a1662961a686344c1fdce36aea039adf8b1fcfc883e06011dd592077931716cdff7
-
Filesize
25KB
MD5be6d51793bc63716fb45cb49958b0f6a
SHA1e2563b2c324b58bad602c46bc4d6148ce5319c10
SHA256edd8206ef8caf25e955e9fba2c9c8ebf73d8ec3fd0f562372f7ed8b8f7004c2f
SHA51231fa876b8dc54d882db0d8a3c7e6784b893b6c8b4a04688261720d75402cb4229f07c70df4dabb032b63940d8e3ba95978d439b5f0f9a21c62a8adbcc92bcabe
-
Filesize
25KB
MD5ce04551e4a578993207eed8f49e045dc
SHA1f2ea2b8901458263879e76f67c4154559252aa5b
SHA256f6ba90e21a1e31ff2be7292c2a03d20570788fd829e075ab4a6d37a9ca2ba194
SHA512872af73065241877679e96dd6c5e8458417436241262829a378768aa47cb290f45aab67ddf205bccd6846a2189a0bd26a31fb01f1d7886fe93067687055f4fe5
-
Filesize
25KB
MD503f1e99c4258416b4c6800081b3701e2
SHA1502d6654cc0a331b8c45eb760db39edbc3ee93c9
SHA256abf8a6ad52f6c71458dc2c159eb8ce7a297494177f8e05fd52a1e7bceb493426
SHA5127a1fc6488c4eee4a32963b1e78b76ac1c4d4c196c8b2743ae4cc89805fa02f554210d0fe5a87afa258abe3c24c710315facdea997e7aa2effcf8664b8531c459
-
Filesize
21KB
MD5c4af0dc7d97105deac352f569beb603d
SHA1f52d7ee9ae432dbf5b42d5fb2a816411138d7e03
SHA256b66ae7e1d0da45a758b2ec9d2727f8f59a2d0a59bf43be347369381338c6afb3
SHA5128961b1acab372511d45b4cb08f6672bebc436f19c854f73058bb28e56ddd57dfd18aab785b39e0b1254ce9e2989e6db744e1de503429932fce2b0f53f000d91f
-
Filesize
21KB
MD5b5c0e86861a795b607b3dddf29ceab01
SHA14ece72b0a9d8f42da935f9affe3280b48805d9c1
SHA256837167faa319cab764615fcfdb375008aed60c399b139dc0b3b0338a106f3b18
SHA5126ec88fbbbdd3377650bc575da6f1d1a8f94b445bceb6d96894a511b690cd3af63be5df448bc6bcac0e3200086f90cd1707c5b281bacfbbdf7a02f984f3ddf32b
-
Filesize
1.4MB
MD53b3654276bbb89fcba4df6a0a0fad8d6
SHA1668cd7e62cb6449e820ce1c24484e7ab9c4ca9a4
SHA256de67ef0597974ce98ac33c99d230f370284031ef62249d55c5d6210066874938
SHA512ecade71b589213ba9bcf8f997e4ab1d1c7c2c78fb88d5f2d562f376986c005e9b98ffdbbd0988f6b5f50adff4cc46be1c076b377a6e6152014d5552effec4973
-
Filesize
1.1MB
MD586cfc84f8407ab1be6cc64a9702882ef
SHA186f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA25611b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c
-
Filesize
24KB
MD5decbba3add4c2246928ab385fb16a21e
SHA15f019eff11de3122ffa67a06d52d446a3448b75e
SHA2564b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d
SHA512760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012
-
Filesize
203KB
MD56cd33578bc5629930329ca3303f0fae1
SHA1f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA2564150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e
-
Filesize
86KB
MD5fe0e32bfe3764ed5321454e1a01c81ec
SHA17690690df0a73bdcc54f0f04b674fc8a9a8f45fb
SHA256b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92
SHA512d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d
-
Filesize
64KB
MD534e49bb1dfddf6037f0001d9aefe7d61
SHA1a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA2564055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
-
Filesize
24KB
MD5c39459806c712b3b3242f8376218c1e1
SHA185d254fb6cc5d6ed20a04026bff1158c8fd0a530
SHA2567cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9
SHA512b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d
-
Filesize
608KB
MD5895f001ae969364432372329caf08b6a
SHA14567fc6672501648b277fe83e6b468a7a2155ddf
SHA256f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7
SHA51205b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261
-
Filesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
-
Filesize
293KB
MD506a5e52caf03426218f0c08fc02cc6b8
SHA1ae232c63620546716fbb97452d73948ebfd06b35
SHA256118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a
SHA512546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82