Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 02:09
Static task
static1
Behavioral task
behavioral1
Sample
17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe
Resource
win10v2004-20241007-en
General
-
Target
17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe
-
Size
1.8MB
-
MD5
4cf346373d331ff441b71ae12c4420ff
-
SHA1
e4d53520a0b925b9122cba1f9f7cac6661ac014c
-
SHA256
17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa
-
SHA512
d82d681438a1df724b3b698d12049f0b4b11c829ec94de15bbf7c68a1b456675b4a5e2fa0f25a67d8daf6da28310df508f88b3cc0906fe02eb43a0c36dcb7a09
-
SSDEEP
49152:9fRIz2Mkd2gce9Umg7kce1AmWp6/9V/eIxe2Lj4zVUw5xJS:1R6vkd2synNbm4k9V/eMeIwP5xJ
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Gcleaner family
-
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 4228 created 3436 4228 Qtdedcpuf.exe 56 PID 2024 created 3436 2024 Ixpla.exe 56 PID 1452 created 3436 1452 Gxtuum.exe 56 PID 5192 created 3436 5192 Gxtuum.exe 56 PID 5320 created 3436 5320 Gxtuum.exe 56 -
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c27866c1e3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1cff13976b.exe -
Blocklisted process makes network request 2 IoCs
flow pid Process 73 5824 rundll32.exe 74 5824 rundll32.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4056 netsh.exe 3876 netsh.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c27866c1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1cff13976b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1cff13976b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c27866c1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Qtdedcpuf.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Ixpla.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Gxtuum.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 5396 cmd.exe 5508 powershell.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lbroker.vbs Ixpla.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lbroker.vbs Gxtuum.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe l4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe l4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lbroker.vbs Qtdedcpuf.exe -
Executes dropped EXE 22 IoCs
pid Process 4524 axplong.exe 768 l4.exe 2860 l4.exe 4228 Qtdedcpuf.exe 2024 Ixpla.exe 3896 axplong.exe 5912 networkmanager.exe 840 roblox.exe 2504 stub.exe 5536 1cff13976b.exe 5296 c27866c1e3.exe 1976 Qtdedcpuf.exe 1452 Gxtuum.exe 5992 Ixpla.exe 5192 Gxtuum.exe 5604 Gxtuum.exe 2664 Gxtuum.exe 1840 axplong.exe 5320 Gxtuum.exe 5316 Gxtuum.exe 5700 axplong.exe 1976 Gxtuum.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine 1cff13976b.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine c27866c1e3.exe -
Loads dropped DLL 39 IoCs
pid Process 2860 l4.exe 2860 l4.exe 2860 l4.exe 2860 l4.exe 2860 l4.exe 2860 l4.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 2504 stub.exe 5824 rundll32.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWorkManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006141001\\networkmanager.exe" networkmanager.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1cff13976b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006272001\\1cff13976b.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c27866c1e3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006273001\\c27866c1e3.exe" axplong.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 ip-api.com -
pid Process 4864 cmd.exe 660 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 5996 tasklist.exe 2676 tasklist.exe 3948 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 4552 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe 4524 axplong.exe 3896 axplong.exe 5536 1cff13976b.exe 5296 c27866c1e3.exe 1840 axplong.exe 5700 axplong.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4228 set thread context of 1976 4228 Qtdedcpuf.exe 156 PID 2024 set thread context of 5992 2024 Ixpla.exe 158 PID 1452 set thread context of 5604 1452 Gxtuum.exe 161 PID 5192 set thread context of 2664 5192 Gxtuum.exe 164 PID 5320 set thread context of 5316 5320 Gxtuum.exe 170 -
resource yara_rule behavioral2/files/0x0007000000023cc0-2005.dat upx behavioral2/memory/5912-2490-0x0000000000750000-0x0000000000ECB000-memory.dmp upx behavioral2/memory/5912-2496-0x0000000000750000-0x0000000000ECB000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\Gxtuum.job Qtdedcpuf.exe File created C:\Windows\Tasks\Gxtuum.job Ixpla.exe File created C:\Windows\Tasks\axplong.job 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2404 sc.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x0007000000023cf9-2565.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2908 5296 WerFault.exe 128 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qtdedcpuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ixpla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1cff13976b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qtdedcpuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ixpla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c27866c1e3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2808 cmd.exe 1820 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 4576 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 5452 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6040 ipconfig.exe 4576 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5072 systeminfo.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 25 Go-http-client/1.1 -
Kills process with taskkill 1 IoCs
pid Process 2448 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe 4524 axplong.exe 4524 axplong.exe 3896 axplong.exe 3896 axplong.exe 5536 1cff13976b.exe 5536 1cff13976b.exe 5508 powershell.exe 5508 powershell.exe 5508 powershell.exe 5296 c27866c1e3.exe 5296 c27866c1e3.exe 4228 Qtdedcpuf.exe 4228 Qtdedcpuf.exe 2024 Ixpla.exe 2024 Ixpla.exe 1452 Gxtuum.exe 5192 Gxtuum.exe 1840 axplong.exe 1840 axplong.exe 5320 Gxtuum.exe 5700 axplong.exe 5700 axplong.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4228 Qtdedcpuf.exe Token: SeDebugPrivilege 2024 Ixpla.exe Token: SeIncreaseQuotaPrivilege 4784 WMIC.exe Token: SeSecurityPrivilege 4784 WMIC.exe Token: SeTakeOwnershipPrivilege 4784 WMIC.exe Token: SeLoadDriverPrivilege 4784 WMIC.exe Token: SeSystemProfilePrivilege 4784 WMIC.exe Token: SeSystemtimePrivilege 4784 WMIC.exe Token: SeProfSingleProcessPrivilege 4784 WMIC.exe Token: SeIncBasePriorityPrivilege 4784 WMIC.exe Token: SeCreatePagefilePrivilege 4784 WMIC.exe Token: SeBackupPrivilege 4784 WMIC.exe Token: SeRestorePrivilege 4784 WMIC.exe Token: SeShutdownPrivilege 4784 WMIC.exe Token: SeDebugPrivilege 4784 WMIC.exe Token: SeSystemEnvironmentPrivilege 4784 WMIC.exe Token: SeRemoteShutdownPrivilege 4784 WMIC.exe Token: SeUndockPrivilege 4784 WMIC.exe Token: SeManageVolumePrivilege 4784 WMIC.exe Token: 33 4784 WMIC.exe Token: 34 4784 WMIC.exe Token: 35 4784 WMIC.exe Token: 36 4784 WMIC.exe Token: SeDebugPrivilege 5996 tasklist.exe Token: SeIncreaseQuotaPrivilege 4784 WMIC.exe Token: SeSecurityPrivilege 4784 WMIC.exe Token: SeTakeOwnershipPrivilege 4784 WMIC.exe Token: SeLoadDriverPrivilege 4784 WMIC.exe Token: SeSystemProfilePrivilege 4784 WMIC.exe Token: SeSystemtimePrivilege 4784 WMIC.exe Token: SeProfSingleProcessPrivilege 4784 WMIC.exe Token: SeIncBasePriorityPrivilege 4784 WMIC.exe Token: SeCreatePagefilePrivilege 4784 WMIC.exe Token: SeBackupPrivilege 4784 WMIC.exe Token: SeRestorePrivilege 4784 WMIC.exe Token: SeShutdownPrivilege 4784 WMIC.exe Token: SeDebugPrivilege 4784 WMIC.exe Token: SeSystemEnvironmentPrivilege 4784 WMIC.exe Token: SeRemoteShutdownPrivilege 4784 WMIC.exe Token: SeUndockPrivilege 4784 WMIC.exe Token: SeManageVolumePrivilege 4784 WMIC.exe Token: 33 4784 WMIC.exe Token: 34 4784 WMIC.exe Token: 35 4784 WMIC.exe Token: 36 4784 WMIC.exe Token: SeDebugPrivilege 2448 taskkill.exe Token: SeDebugPrivilege 2676 tasklist.exe Token: SeDebugPrivilege 5508 powershell.exe Token: SeIncreaseQuotaPrivilege 5452 WMIC.exe Token: SeSecurityPrivilege 5452 WMIC.exe Token: SeTakeOwnershipPrivilege 5452 WMIC.exe Token: SeLoadDriverPrivilege 5452 WMIC.exe Token: SeSystemProfilePrivilege 5452 WMIC.exe Token: SeSystemtimePrivilege 5452 WMIC.exe Token: SeProfSingleProcessPrivilege 5452 WMIC.exe Token: SeIncBasePriorityPrivilege 5452 WMIC.exe Token: SeCreatePagefilePrivilege 5452 WMIC.exe Token: SeBackupPrivilege 5452 WMIC.exe Token: SeRestorePrivilege 5452 WMIC.exe Token: SeShutdownPrivilege 5452 WMIC.exe Token: SeDebugPrivilege 5452 WMIC.exe Token: SeSystemEnvironmentPrivilege 5452 WMIC.exe Token: SeRemoteShutdownPrivilege 5452 WMIC.exe Token: SeUndockPrivilege 5452 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 4524 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe 83 PID 2216 wrote to memory of 4524 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe 83 PID 2216 wrote to memory of 4524 2216 17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe 83 PID 4524 wrote to memory of 768 4524 axplong.exe 89 PID 4524 wrote to memory of 768 4524 axplong.exe 89 PID 768 wrote to memory of 2860 768 l4.exe 91 PID 768 wrote to memory of 2860 768 l4.exe 91 PID 4524 wrote to memory of 4228 4524 axplong.exe 92 PID 4524 wrote to memory of 4228 4524 axplong.exe 92 PID 4524 wrote to memory of 4228 4524 axplong.exe 92 PID 4524 wrote to memory of 2024 4524 axplong.exe 95 PID 4524 wrote to memory of 2024 4524 axplong.exe 95 PID 4524 wrote to memory of 2024 4524 axplong.exe 95 PID 4524 wrote to memory of 5912 4524 axplong.exe 97 PID 4524 wrote to memory of 5912 4524 axplong.exe 97 PID 4524 wrote to memory of 840 4524 axplong.exe 98 PID 4524 wrote to memory of 840 4524 axplong.exe 98 PID 840 wrote to memory of 2504 840 roblox.exe 101 PID 840 wrote to memory of 2504 840 roblox.exe 101 PID 2504 wrote to memory of 3816 2504 stub.exe 102 PID 2504 wrote to memory of 3816 2504 stub.exe 102 PID 2504 wrote to memory of 4936 2504 stub.exe 103 PID 2504 wrote to memory of 4936 2504 stub.exe 103 PID 2504 wrote to memory of 4168 2504 stub.exe 104 PID 2504 wrote to memory of 4168 2504 stub.exe 104 PID 4936 wrote to memory of 4784 4936 cmd.exe 105 PID 4936 wrote to memory of 4784 4936 cmd.exe 105 PID 4168 wrote to memory of 5996 4168 cmd.exe 106 PID 4168 wrote to memory of 5996 4168 cmd.exe 106 PID 4524 wrote to memory of 5536 4524 axplong.exe 107 PID 4524 wrote to memory of 5536 4524 axplong.exe 107 PID 4524 wrote to memory of 5536 4524 axplong.exe 107 PID 2504 wrote to memory of 4552 2504 stub.exe 108 PID 2504 wrote to memory of 4552 2504 stub.exe 108 PID 4552 wrote to memory of 5740 4552 cmd.exe 110 PID 4552 wrote to memory of 5740 4552 cmd.exe 110 PID 2504 wrote to memory of 5340 2504 stub.exe 111 PID 2504 wrote to memory of 5340 2504 stub.exe 111 PID 2504 wrote to memory of 4984 2504 stub.exe 112 PID 2504 wrote to memory of 4984 2504 stub.exe 112 PID 5340 wrote to memory of 5752 5340 cmd.exe 113 PID 5340 wrote to memory of 5752 5340 cmd.exe 113 PID 4984 wrote to memory of 2448 4984 cmd.exe 114 PID 4984 wrote to memory of 2448 4984 cmd.exe 114 PID 2504 wrote to memory of 5464 2504 stub.exe 115 PID 2504 wrote to memory of 5464 2504 stub.exe 115 PID 2504 wrote to memory of 5396 2504 stub.exe 116 PID 2504 wrote to memory of 5396 2504 stub.exe 116 PID 2504 wrote to memory of 5292 2504 stub.exe 117 PID 2504 wrote to memory of 5292 2504 stub.exe 117 PID 2504 wrote to memory of 1752 2504 stub.exe 118 PID 2504 wrote to memory of 1752 2504 stub.exe 118 PID 5396 wrote to memory of 5508 5396 cmd.exe 119 PID 5396 wrote to memory of 5508 5396 cmd.exe 119 PID 5292 wrote to memory of 5580 5292 cmd.exe 120 PID 5292 wrote to memory of 5580 5292 cmd.exe 120 PID 5464 wrote to memory of 2676 5464 cmd.exe 121 PID 5464 wrote to memory of 2676 5464 cmd.exe 121 PID 1752 wrote to memory of 2304 1752 cmd.exe 122 PID 1752 wrote to memory of 2304 1752 cmd.exe 122 PID 2504 wrote to memory of 4864 2504 stub.exe 123 PID 2504 wrote to memory of 4864 2504 stub.exe 123 PID 4864 wrote to memory of 5072 4864 cmd.exe 124 PID 4864 wrote to memory of 5072 4864 cmd.exe 124 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5740 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe"C:\Users\Admin\AppData\Local\Temp\17f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe"C:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\onefile_768_133785293923445238\l4.exeC:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe5⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
PID:2860
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe"C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe"C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\1006141001\networkmanager.exe"C:\Users\Admin\AppData\Local\Temp\1006141001\networkmanager.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5912
-
-
C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\onefile_840_133785294125378324\stub.exeC:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵PID:3816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""6⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"7⤵
- Views/modifies file attributes
PID:5740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""6⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"7⤵PID:5752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"6⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard7⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"6⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\system32\chcp.comchcp7⤵PID:5580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"6⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\chcp.comchcp7⤵PID:2304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"6⤵
- Network Service Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\system32\systeminfo.exesysteminfo7⤵
- Gathers system information
PID:5072
-
-
C:\Windows\system32\HOSTNAME.EXEhostname7⤵PID:5504
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername7⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:5452
-
-
C:\Windows\system32\net.exenet user7⤵PID:4472
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user8⤵PID:5656
-
-
-
C:\Windows\system32\query.exequery user7⤵PID:6044
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"8⤵PID:4520
-
-
-
C:\Windows\system32\net.exenet localgroup7⤵PID:2224
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup8⤵PID:2944
-
-
-
C:\Windows\system32\net.exenet localgroup administrators7⤵PID:4692
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators8⤵PID:3264
-
-
-
C:\Windows\system32\net.exenet user guest7⤵PID:4200
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest8⤵PID:384
-
-
-
C:\Windows\system32\net.exenet user administrator7⤵PID:2724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator8⤵PID:2760
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command7⤵PID:1516
-
-
C:\Windows\system32\tasklist.exetasklist /svc7⤵
- Enumerates processes with tasklist
PID:3948
-
-
C:\Windows\system32\ipconfig.exeipconfig /all7⤵
- Gathers network information
PID:6040
-
-
C:\Windows\system32\ROUTE.EXEroute print7⤵PID:6100
-
-
C:\Windows\system32\ARP.EXEarp -a7⤵
- Network Service Discovery
PID:660
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano7⤵
- System Network Connections Discovery
- Gathers network information
PID:4576
-
-
C:\Windows\system32\sc.exesc query type= service state= all7⤵
- Launches sc.exe
PID:2404
-
-
C:\Windows\system32\netsh.exenetsh firewall show state7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4056
-
-
C:\Windows\system32\netsh.exenetsh firewall show config7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2808 -
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵PID:5244
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵PID:4844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵PID:2744
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵PID:2816
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006272001\1cff13976b.exe"C:\Users\Admin\AppData\Local\Temp\1006272001\1cff13976b.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5536
-
-
C:\Users\Admin\AppData\Local\Temp\1006273001\c27866c1e3.exe"C:\Users\Admin\AppData\Local\Temp\1006273001\c27866c1e3.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 14685⤵
- Program crash
PID:2908
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe"C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe"C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5192
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5604 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\10000580111\eula.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5824
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Executes dropped EXE
PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Executes dropped EXE
PID:5316
-
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5296 -ip 52961⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1840
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5320
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5700
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
13KB
MD544163d81bb5710839fb9ba265de2c942
SHA1a7497d6085ed8ce25e9728a0af7e989e026eaf04
SHA256de4e3ff7f7da5d5561e384585a9d0cb66f2c51ea324c184848d125d8792bf666
SHA51297ef4974f41affd04eb960fa873cd9754f31007c3d7239a7fb5b17cc152c01f2050c3b25d107e36ab5c65010610624e773f726de7d39255bb2c0ad5d8b9929a4
-
Filesize
5.9MB
MD5d68f79c459ee4ae03b76fa5ba151a41f
SHA1bfa641085d59d58993ba98ac9ee376f898ee5f7b
SHA256aa50c900e210abb6be7d2420d9d5ae34c66818e0491aabd141421d175211fed6
SHA512bd4ef3e3708df81d53b2e9050447032e8dcdcc776cf0353077310f208a30dab8f31d6ec6769d47fb6c05c642bdd7a58fb4f93d9d28e2de0efc01312fbc5e391e
-
Filesize
1.2MB
MD5f880c05fa8059b3f68e29922d370ec0c
SHA119e3afc0856bad554ccb248085355ada23cc37ab
SHA256f93f39819b5443b4e83783445eefd4e1c075d69a7f6c2379ccca08b17a4f70b6
SHA5127c3a8b887a83735e33290d49b58d1b5c55177c2455a546b1ad8c31b0b0cb3d14d06e1bc2101a3f93361080390760a1871c098b7f3825ed973ab8f3268e0a45b7
-
Filesize
1.4MB
MD56e7ffd057086e44e4fcc01846cd2b152
SHA105712e7e7b8429b2dd201ea504dc32fefe5795da
SHA256fbc587e990949e428e8ce7a2c74dbf85cd63ffa07370756ad854595fea0033d7
SHA5128cab1824b32c54273658d28738109c8a1ef3170c1fbe02deeee40d40990acb6d45431bfb65a3facebee9a919bd972734012b1e8de035b9c1329f1bd0e709ecd2
-
Filesize
2.1MB
MD5f8d528a37993ed91d2496bab9fc734d3
SHA14b66b225298f776e21f566b758f3897d20b23cad
SHA256bc8458a8d78cf91129c84b153aafe8319410aacb8e14aec506897c8e0793ba02
SHA51275dc1bbb1388f68d121bab26fc7f6bf9dc1226417ad7ed4a7b9718999aa0f9c891fed0db3c9ea6d6ccb34288cc848dc44b20ea83a30afd4ea2e99cff51f30f5a
-
Filesize
10.7MB
MD56898eace70e2da82f257bc78cb081b2f
SHA15ac5ed21436d8b4c59c0b62836d531844c571d6d
SHA256bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23
SHA512ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2
-
Filesize
1.7MB
MD591c87d6521355c02422acb98aea28b43
SHA171f5a66b2d645b355e675ce458f302b192da214b
SHA256f7df3bbf114ddb67167ed7b1bbea2ce1a575b0cba8d5b54a21a59b662dfd5139
SHA512dea14418513777047d89268e316fa71a2f17f3cdd7d912688302ee332b4a15343ee4a0bf515beb308b58ea742b905b5e29f57531fcf8da1d3d83708ce8cab1a5
-
Filesize
1.9MB
MD50a2e0cf36cb5586fb3ecff4872b27b9d
SHA1b8ab43272fbbad21c1985ee536ecd5ccbdc0a761
SHA256417e7e396fbadbf07bf6952dbd3c0b6b496bc18871047645879db777552552b1
SHA51254f788a088be98537649567c9c9c1c13fb148502900862832b91438a4e0ea1cfab5d8c465834059556f2799d83390ef2bc07efa6c3a63b225484528c2e85eedf
-
Filesize
1.8MB
MD54cf346373d331ff441b71ae12c4420ff
SHA1e4d53520a0b925b9122cba1f9f7cac6661ac014c
SHA25617f29ebe12b697ea77345bb9c0cf3c55c411783dc717c4bf5fa65e9af42686fa
SHA512d82d681438a1df724b3b698d12049f0b4b11c829ec94de15bbf7c68a1b456675b4a5e2fa0f25a67d8daf6da28310df508f88b3cc0906fe02eb43a0c36dcb7a09
-
Filesize
83KB
MD530f396f8411274f15ac85b14b7b3cd3d
SHA1d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA256cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
SHA5127d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
-
Filesize
156KB
MD59e94fac072a14ca9ed3f20292169e5b2
SHA11eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA256a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
SHA512b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
-
Filesize
30KB
MD57c14c7bc02e47d5c8158383cb7e14124
SHA15ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA25600bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
SHA512af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
174KB
MD52baaa98b744915339ae6c016b17c3763
SHA1483c11673b73698f20ca2ff0748628c789b4dc68
SHA2564f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
SHA5122ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
7.5MB
MD581ad4f91bb10900e3e2e8eaf917f42c9
SHA1840f7aef02cda6672f0e3fc7a8d57f213ddd1dc6
SHA2565f20d6cec04685075781996a9f54a78dc44ab8e39eb5a2bcf3234e36bef4b190
SHA51211cd299d6812cdf6f0a74ba86eb44e9904ce4106167ebd6e0b81f60a5fcd04236cef5cff81e51ed391f5156430663056393dc07353c4a70a88024194768ffe9d
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
81KB
MD569801d1a0809c52db984602ca2653541
SHA10f6e77086f049a7c12880829de051dcbe3d66764
SHA25667aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
SHA5125fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb
-
Filesize
5.9MB
MD563c4e3f9c7383d039ab4af449372c17f
SHA1f52ff760a098a006c41269ff73abb633b811f18e
SHA256151524f6c1d1aeac530cfd69de15c3336043dc8eb3f5aeaa31513e24bfd7acdd
SHA512dcfb4804c5569ad13e752270d13320f8769601b7092544741e35bc62a22af363b7a5ea7c5a65132c9575540a3e689a6946110502bd0f046385b8739e81761fbf
-
Filesize
6.6MB
MD5166cc2f997cba5fc011820e6b46e8ea7
SHA1d6179213afea084f02566ea190202c752286ca1f
SHA256c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
SHA51249d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
62KB
MD56eb3c9fc8c216cea8981b12fd41fbdcd
SHA15f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA2563b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA5122027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
16.1MB
MD5d09a400f60c7a298e884f90539e9c72f
SHA141582ba130bef907e24f87534e7a0fdd37025101
SHA256700962aa295e2fa207ff522e2f5ca051a2929eb6f252d42c9cb0a56a4f084bfe
SHA512d8ba2859bb2ea109c1ca33cb924e40bf61db79aefb59324101d9f47a08835d86834790d3bc6bad4151a561ef82265b32d5111bc80f95dce769c5eb4da5116cc9