Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/01/2025, 06:53
250130-hnt6ls1rb1 1030/01/2025, 06:51
250130-hmx6wa1rat 1030/01/2025, 06:45
250130-hh5p6a1pgt 10Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
30/01/2025, 06:51
Behavioral task
behavioral1
Sample
Wave.exe
Resource
win11-20241007-en
General
-
Target
Wave.exe
-
Size
9.8MB
-
MD5
708932216a4a65b3e560893a115673f2
-
SHA1
e9aeef34258854948f50f1c6bbd8eb69772d0e59
-
SHA256
a3d7cd217684a58df277f072e1b7e1a4e00448f1b7530fdae13af3903d1327a5
-
SHA512
78ce6826fa7d3d561ce69d395b62e5178ab7333a510652b614fa7864ac61bf3901a07d49b39bd43968f5f54ef6f04fd9c6aa7af7a435d05c1a3833bf61272992
-
SSDEEP
196608:QNnP/g2ys0VxNQMiLP8qJEdHvHMeNxHFJMIDJ+gsAGKkRWyHEWzsT:/JBukqJEdPHTlFqy+gs1WYzs
Malware Config
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1608 netsh.exe 5084 netsh.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4420 cmd.exe 4512 powershell.exe -
Loads dropped DLL 36 IoCs
pid Process 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe 460 Wave.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 43 discord.com 1 discord.com 8 discord.com 9 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
pid Process 4888 cmd.exe 4876 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 4684 tasklist.exe 2264 tasklist.exe 4720 tasklist.exe 1980 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 4820 cmd.exe -
resource yara_rule behavioral1/files/0x001900000002ac32-47.dat upx behavioral1/memory/460-51-0x00007FFC3AB90000-0x00007FFC3AFFE000-memory.dmp upx behavioral1/files/0x001900000002abf3-53.dat upx behavioral1/files/0x001900000002ac28-58.dat upx behavioral1/memory/460-61-0x00007FFC55D90000-0x00007FFC55D9F000-memory.dmp upx behavioral1/files/0x001900000002ac02-83.dat upx behavioral1/files/0x001900000002ac01-82.dat upx behavioral1/files/0x001900000002ac00-81.dat upx behavioral1/files/0x001900000002abff-80.dat upx behavioral1/files/0x001900000002abfe-79.dat upx behavioral1/files/0x001900000002abfd-78.dat upx behavioral1/files/0x001900000002abfc-77.dat upx behavioral1/files/0x001900000002abfb-76.dat upx behavioral1/files/0x001900000002abfa-75.dat upx behavioral1/files/0x001900000002abf9-74.dat upx behavioral1/files/0x001900000002abf2-73.dat upx behavioral1/files/0x001900000002abf1-72.dat upx behavioral1/files/0x001900000002abf0-71.dat upx behavioral1/files/0x001a00000002abeb-70.dat upx behavioral1/files/0x001900000002ac35-68.dat upx behavioral1/files/0x001900000002ac34-67.dat upx behavioral1/files/0x001c00000002ac33-66.dat upx behavioral1/files/0x001900000002ac2e-65.dat upx behavioral1/files/0x001900000002ac29-63.dat upx behavioral1/files/0x001c00000002ac27-62.dat upx behavioral1/memory/460-59-0x00007FFC4FAC0000-0x00007FFC4FAE4000-memory.dmp upx behavioral1/memory/460-87-0x00007FFC51AD0000-0x00007FFC51ADD000-memory.dmp upx behavioral1/memory/460-85-0x00007FFC52520000-0x00007FFC52539000-memory.dmp upx behavioral1/memory/460-89-0x00007FFC4FAA0000-0x00007FFC4FAB9000-memory.dmp upx behavioral1/memory/460-91-0x00007FFC4F5E0000-0x00007FFC4F60D000-memory.dmp upx behavioral1/memory/460-93-0x00007FFC4F5C0000-0x00007FFC4F5DF000-memory.dmp upx behavioral1/memory/460-95-0x00007FFC4C140000-0x00007FFC4C2B1000-memory.dmp upx behavioral1/memory/460-97-0x00007FFC4F590000-0x00007FFC4F5BE000-memory.dmp upx behavioral1/memory/460-105-0x00007FFC4FAC0000-0x00007FFC4FAE4000-memory.dmp upx behavioral1/memory/460-104-0x00007FFC4B6D0000-0x00007FFC4BA45000-memory.dmp upx behavioral1/memory/460-102-0x00007FFC4C3C0000-0x00007FFC4C478000-memory.dmp upx behavioral1/memory/460-101-0x00007FFC3AB90000-0x00007FFC3AFFE000-memory.dmp upx behavioral1/memory/460-116-0x00007FFC4C660000-0x00007FFC4C674000-memory.dmp upx behavioral1/memory/460-115-0x00007FFC4FAA0000-0x00007FFC4FAB9000-memory.dmp upx behavioral1/memory/460-113-0x00007FFC4C920000-0x00007FFC4C934000-memory.dmp upx behavioral1/memory/460-112-0x00007FFC51AC0000-0x00007FFC51AD0000-memory.dmp upx behavioral1/files/0x001c00000002ac2d-111.dat upx behavioral1/memory/460-110-0x00007FFC52520000-0x00007FFC52539000-memory.dmp upx behavioral1/memory/460-107-0x00007FFC4F570000-0x00007FFC4F585000-memory.dmp upx behavioral1/memory/460-118-0x00007FFC4F5E0000-0x00007FFC4F60D000-memory.dmp upx behavioral1/memory/460-119-0x00007FFC3AA70000-0x00007FFC3AB88000-memory.dmp upx behavioral1/files/0x001c00000002ac39-120.dat upx behavioral1/memory/460-123-0x00007FFC4C580000-0x00007FFC4C59B000-memory.dmp upx behavioral1/memory/460-122-0x00007FFC4F5C0000-0x00007FFC4F5DF000-memory.dmp upx behavioral1/files/0x001900000002ac04-124.dat upx behavioral1/files/0x001900000002ac06-126.dat upx behavioral1/memory/460-135-0x00007FFC3A620000-0x00007FFC3A6FF000-memory.dmp upx behavioral1/memory/460-134-0x00007FFC4F590000-0x00007FFC4F5BE000-memory.dmp upx behavioral1/files/0x001900000002ac05-136.dat upx behavioral1/memory/460-141-0x00007FFC4C3C0000-0x00007FFC4C478000-memory.dmp upx behavioral1/files/0x001900000002ac07-139.dat upx behavioral1/memory/460-145-0x00007FFC4F3F0000-0x00007FFC4F3FA000-memory.dmp upx behavioral1/memory/460-144-0x00007FFC4FA90000-0x00007FFC4FA9E000-memory.dmp upx behavioral1/memory/460-149-0x00007FFC3B100000-0x00007FFC3B153000-memory.dmp upx behavioral1/memory/460-148-0x00007FFC4C490000-0x00007FFC4C4A6000-memory.dmp upx behavioral1/memory/460-151-0x00007FFC3A0A0000-0x00007FFC3A477000-memory.dmp upx behavioral1/memory/460-150-0x00007FFC4F570000-0x00007FFC4F585000-memory.dmp upx behavioral1/memory/460-147-0x00007FFC4B6D0000-0x00007FFC4BA45000-memory.dmp upx behavioral1/memory/460-146-0x00007FFC3A480000-0x00007FFC3A613000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1364 sc.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4580 cmd.exe 3748 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 5096 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 3520 WMIC.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2248 ipconfig.exe 5096 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1440 systeminfo.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4512 powershell.exe 4512 powershell.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 1888 msedge.exe 1888 msedge.exe 5096 msedge.exe 5096 msedge.exe 1480 identity_helper.exe 1480 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4684 tasklist.exe Token: SeIncreaseQuotaPrivilege 1016 WMIC.exe Token: SeSecurityPrivilege 1016 WMIC.exe Token: SeTakeOwnershipPrivilege 1016 WMIC.exe Token: SeLoadDriverPrivilege 1016 WMIC.exe Token: SeSystemProfilePrivilege 1016 WMIC.exe Token: SeSystemtimePrivilege 1016 WMIC.exe Token: SeProfSingleProcessPrivilege 1016 WMIC.exe Token: SeIncBasePriorityPrivilege 1016 WMIC.exe Token: SeCreatePagefilePrivilege 1016 WMIC.exe Token: SeBackupPrivilege 1016 WMIC.exe Token: SeRestorePrivilege 1016 WMIC.exe Token: SeShutdownPrivilege 1016 WMIC.exe Token: SeDebugPrivilege 1016 WMIC.exe Token: SeSystemEnvironmentPrivilege 1016 WMIC.exe Token: SeRemoteShutdownPrivilege 1016 WMIC.exe Token: SeUndockPrivilege 1016 WMIC.exe Token: SeManageVolumePrivilege 1016 WMIC.exe Token: 33 1016 WMIC.exe Token: 34 1016 WMIC.exe Token: 35 1016 WMIC.exe Token: 36 1016 WMIC.exe Token: SeIncreaseQuotaPrivilege 1016 WMIC.exe Token: SeSecurityPrivilege 1016 WMIC.exe Token: SeTakeOwnershipPrivilege 1016 WMIC.exe Token: SeLoadDriverPrivilege 1016 WMIC.exe Token: SeSystemProfilePrivilege 1016 WMIC.exe Token: SeSystemtimePrivilege 1016 WMIC.exe Token: SeProfSingleProcessPrivilege 1016 WMIC.exe Token: SeIncBasePriorityPrivilege 1016 WMIC.exe Token: SeCreatePagefilePrivilege 1016 WMIC.exe Token: SeBackupPrivilege 1016 WMIC.exe Token: SeRestorePrivilege 1016 WMIC.exe Token: SeShutdownPrivilege 1016 WMIC.exe Token: SeDebugPrivilege 1016 WMIC.exe Token: SeSystemEnvironmentPrivilege 1016 WMIC.exe Token: SeRemoteShutdownPrivilege 1016 WMIC.exe Token: SeUndockPrivilege 1016 WMIC.exe Token: SeManageVolumePrivilege 1016 WMIC.exe Token: 33 1016 WMIC.exe Token: 34 1016 WMIC.exe Token: 35 1016 WMIC.exe Token: 36 1016 WMIC.exe Token: SeDebugPrivilege 2264 tasklist.exe Token: SeDebugPrivilege 4720 tasklist.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeIncreaseQuotaPrivilege 3520 WMIC.exe Token: SeSecurityPrivilege 3520 WMIC.exe Token: SeTakeOwnershipPrivilege 3520 WMIC.exe Token: SeLoadDriverPrivilege 3520 WMIC.exe Token: SeSystemProfilePrivilege 3520 WMIC.exe Token: SeSystemtimePrivilege 3520 WMIC.exe Token: SeProfSingleProcessPrivilege 3520 WMIC.exe Token: SeIncBasePriorityPrivilege 3520 WMIC.exe Token: SeCreatePagefilePrivilege 3520 WMIC.exe Token: SeBackupPrivilege 3520 WMIC.exe Token: SeRestorePrivilege 3520 WMIC.exe Token: SeShutdownPrivilege 3520 WMIC.exe Token: SeDebugPrivilege 3520 WMIC.exe Token: SeSystemEnvironmentPrivilege 3520 WMIC.exe Token: SeRemoteShutdownPrivilege 3520 WMIC.exe Token: SeUndockPrivilege 3520 WMIC.exe Token: SeManageVolumePrivilege 3520 WMIC.exe Token: 33 3520 WMIC.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 460 1744 Wave.exe 78 PID 1744 wrote to memory of 460 1744 Wave.exe 78 PID 460 wrote to memory of 1692 460 Wave.exe 79 PID 460 wrote to memory of 1692 460 Wave.exe 79 PID 460 wrote to memory of 5072 460 Wave.exe 81 PID 460 wrote to memory of 5072 460 Wave.exe 81 PID 460 wrote to memory of 3524 460 Wave.exe 82 PID 460 wrote to memory of 3524 460 Wave.exe 82 PID 3524 wrote to memory of 4684 3524 cmd.exe 85 PID 3524 wrote to memory of 4684 3524 cmd.exe 85 PID 5072 wrote to memory of 1016 5072 cmd.exe 86 PID 5072 wrote to memory of 1016 5072 cmd.exe 86 PID 460 wrote to memory of 4820 460 Wave.exe 88 PID 460 wrote to memory of 4820 460 Wave.exe 88 PID 4820 wrote to memory of 3960 4820 cmd.exe 90 PID 4820 wrote to memory of 3960 4820 cmd.exe 90 PID 460 wrote to memory of 968 460 Wave.exe 91 PID 460 wrote to memory of 968 460 Wave.exe 91 PID 460 wrote to memory of 1984 460 Wave.exe 93 PID 460 wrote to memory of 1984 460 Wave.exe 93 PID 1984 wrote to memory of 2264 1984 cmd.exe 95 PID 1984 wrote to memory of 2264 1984 cmd.exe 95 PID 968 wrote to memory of 2188 968 cmd.exe 96 PID 968 wrote to memory of 2188 968 cmd.exe 96 PID 460 wrote to memory of 2148 460 Wave.exe 97 PID 460 wrote to memory of 2148 460 Wave.exe 97 PID 460 wrote to memory of 3080 460 Wave.exe 98 PID 460 wrote to memory of 3080 460 Wave.exe 98 PID 460 wrote to memory of 4104 460 Wave.exe 99 PID 460 wrote to memory of 4104 460 Wave.exe 99 PID 460 wrote to memory of 4420 460 Wave.exe 101 PID 460 wrote to memory of 4420 460 Wave.exe 101 PID 2148 wrote to memory of 3384 2148 cmd.exe 105 PID 2148 wrote to memory of 3384 2148 cmd.exe 105 PID 3384 wrote to memory of 2308 3384 cmd.exe 106 PID 3384 wrote to memory of 2308 3384 cmd.exe 106 PID 3080 wrote to memory of 3192 3080 cmd.exe 107 PID 3080 wrote to memory of 3192 3080 cmd.exe 107 PID 4104 wrote to memory of 4720 4104 cmd.exe 108 PID 4104 wrote to memory of 4720 4104 cmd.exe 108 PID 4420 wrote to memory of 4512 4420 cmd.exe 109 PID 4420 wrote to memory of 4512 4420 cmd.exe 109 PID 3192 wrote to memory of 1232 3192 cmd.exe 110 PID 3192 wrote to memory of 1232 3192 cmd.exe 110 PID 460 wrote to memory of 4888 460 Wave.exe 111 PID 460 wrote to memory of 4888 460 Wave.exe 111 PID 460 wrote to memory of 4580 460 Wave.exe 113 PID 460 wrote to memory of 4580 460 Wave.exe 113 PID 4888 wrote to memory of 1440 4888 cmd.exe 115 PID 4888 wrote to memory of 1440 4888 cmd.exe 115 PID 4580 wrote to memory of 3748 4580 cmd.exe 116 PID 4580 wrote to memory of 3748 4580 cmd.exe 116 PID 4888 wrote to memory of 4560 4888 cmd.exe 118 PID 4888 wrote to memory of 4560 4888 cmd.exe 118 PID 4888 wrote to memory of 3520 4888 cmd.exe 119 PID 4888 wrote to memory of 3520 4888 cmd.exe 119 PID 4888 wrote to memory of 4972 4888 cmd.exe 120 PID 4888 wrote to memory of 4972 4888 cmd.exe 120 PID 4972 wrote to memory of 4016 4972 net.exe 121 PID 4972 wrote to memory of 4016 4972 net.exe 121 PID 4888 wrote to memory of 4616 4888 cmd.exe 122 PID 4888 wrote to memory of 4616 4888 cmd.exe 122 PID 4616 wrote to memory of 3600 4616 query.exe 123 PID 4616 wrote to memory of 3600 4616 query.exe 123 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3960 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:1692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"4⤵
- Views/modifies file attributes
PID:3960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"4⤵PID:2188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\system32\chcp.comchcp5⤵PID:2308
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\chcp.comchcp5⤵PID:1232
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"3⤵
- Network Service Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1440
-
-
C:\Windows\system32\HOSTNAME.EXEhostname4⤵PID:4560
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername4⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\system32\net.exenet user4⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user5⤵PID:4016
-
-
-
C:\Windows\system32\query.exequery user4⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"5⤵PID:3600
-
-
-
C:\Windows\system32\net.exenet localgroup4⤵PID:4660
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup5⤵PID:1812
-
-
-
C:\Windows\system32\net.exenet localgroup administrators4⤵PID:1164
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:3920
-
-
-
C:\Windows\system32\net.exenet user guest4⤵PID:1788
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest5⤵PID:2788
-
-
-
C:\Windows\system32\net.exenet user administrator4⤵PID:1604
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator5⤵PID:4220
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command4⤵PID:2352
-
-
C:\Windows\system32\tasklist.exetasklist /svc4⤵
- Enumerates processes with tasklist
PID:1980
-
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:2248
-
-
C:\Windows\system32\ROUTE.EXEroute print4⤵PID:3492
-
-
C:\Windows\system32\ARP.EXEarp -a4⤵
- Network Service Discovery
PID:4876
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano4⤵
- System Network Connections Discovery
- Gathers network information
PID:5096
-
-
C:\Windows\system32\sc.exesc query type= service state= all4⤵
- Launches sc.exe
PID:1364
-
-
C:\Windows\system32\netsh.exenetsh firewall show state4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1608
-
-
C:\Windows\system32\netsh.exenetsh firewall show config4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:1480
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:3400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:2756
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:2732
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc39b53cb8,0x7ffc39b53cc8,0x7ffc39b53cd82⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:12⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,13016311344690593080,9011940914712923542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3728
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1System Information Discovery
3System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f1d2c7fd2ca29bb77a5da2d1847fbb92
SHA1840de2cf36c22ba10ac96f90890b6a12a56526c6
SHA25658d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5
SHA512ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14
-
Filesize
152B
MD54c1a24fa898d2a98b540b20272c8e47b
SHA13218bff9ce95b52842fa1b8bd00be073177141ef
SHA256bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95
SHA512e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e
-
Filesize
5KB
MD5c5f912d5835f2448acb54c4d7a0f9fd5
SHA1f681802aaf46d3f1c71413946437c543fa13baf9
SHA256055a0b59d6d64f877be37df29cf922f2148d061b31be392d18ee14a56d4b4447
SHA51257e57a980c8eb522a5c05700ecd23c02757de3e187f98796d025240a6e74e13552c0defd18bc77e682e57f16ea0a523738148d3009171a6ff1ca05ab27c5d0f5
-
Filesize
6KB
MD560783a55d4d707cfb2fc16407efd1b2c
SHA185011c32dbf7d99dd7a72a57c829645a235e9e11
SHA2563a114704c116ef346e0dcf78c2c5c125ce32f05908f635c2250050562b3e29a2
SHA51255af79fad78ff04622b48e5fa1c35dca0491118a41756a9309f3d0e592164920d739459f3bdde4ddc072e81abf142a780ce1e06768aa930b92e7ac810f379a6d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5de56111322f521694c67391aa91c968f
SHA1cc6272b5cd1a95e7aca43e4ca5f9d8a0f297304e
SHA2567ca788fbeff02de4e833ea58be34a3941b0165b5b8eaaac1392570aac903db32
SHA5124770de010b92a9a10f8fd6cb1dbf32a5f497d3c013dfea69adfe0d4638dde2baa582a19540909e839208bec9d424f00d68ca5c8f6718c5df589bce132698e311
-
Filesize
10KB
MD53a977613edccf804b920f8cd6f28715f
SHA1523b20dc0ca77ed758d25f765d3eb2d92251e926
SHA25637233ee76bc77f5147caa588489b39eb3836221a84bf4d91b4a09e51343ba19d
SHA5125c45f44c5ef5cb4d3522c949178506c2c20cb5de831a2a203d156cf0fe166191dc3af4aee44a1034f2b788bcd5a88076e7bfc82f94858ddb0ea36a595998b896
-
Filesize
18KB
MD5518674fb35e45d773591cbb594037829
SHA1c36a261c91a614ddcea22ef7400c4ff05499bd0f
SHA25676eca57c56869e5dd5872199177a1f5a487f4c20e8986bcdca485c7d9c83891f
SHA512fca849599685d8bbdea657ec6fa65780912c9905b949d262e64f0d2f9aad8a4c8ccd468dcdaf5cc7904e5c641be8c2bcb1fe3943407f95ac437a37fadf732f9e
-
Filesize
1.7MB
MD524eeeb162e41eded77905640104e62f0
SHA1867fc098f93b9f5ae6f16808d18e751bdd08a0c0
SHA2560e3dd7f785c82f87ea9ca485c9c6727b19d0b02e013b3781629fa28e3b453d70
SHA512c718e7032088bc962a7de9509b2b9d856a2d9e52ae50a04a6f5320930dcc58786d9ff766677e5e14f97a70c72e2b954ee0b423d8ab71eef146f5ddf4e8901440
-
Filesize
16KB
MD5b197b7b3d291ec9f5889f99d3359129b
SHA1b8412e858b490966161cecf0ace437acd016220d
SHA256a26cb32795faaae747a84f62d2f34a60a06f370c6f09cc5ee2388c5895b02099
SHA51253ad54e25047b8bc801eba062412f2e2626df16cf50b90c9a7e502e715b9dbfa42b51822b99531b73b87c680ceea51fa2f6d18ac6566107f289071c7e079fda2
-
Filesize
10KB
MD50618afc91a702c2ba391c15909599182
SHA1f2bf235d3fa0ecf6f783adaed572da9bd90569dd
SHA25691e09fb8b038d77080f6d88086c42603511ec77dac4c052abaa8d6037479f969
SHA51298a76d300c4be062184ff2deabd44fb589570b9d256b453b9e124f9c49a2889f94dfa1f8d1c1af95cbfc16eedbb5439d9ccaed6c6ba8d04b8a83b6d091755334
-
Filesize
11KB
MD5647ec085f57e7d6ea49f5167314b34ff
SHA1f9d70093b5162977850f314d3027a1809e0ec817
SHA2569f7f01c9340fc4168d9167814884c400cfe4cfb27c50e1d49ad8d701938e891b
SHA512762a0718bf21b54cb31b8ef3887c7d50cbca71291ed05193157578d9e39c90b396e88e238929f1a34d875875fdced3ef6a05cb6782105f35c0a81203cd200d9f
-
Filesize
17KB
MD5f4c11db86de8b8dc47c2bb1893adb6c2
SHA1b959512e537ad58af711f250b47921caf9613cc4
SHA256abee95409b9e05cf60e497c39aecf2b507dc5ddb2f92d0dbcfa9a7f1af747b36
SHA5128652539520b333d59a32a9aaac451d3ce1d04076a11a6f67c4a8a7080c810340740b805808c45a235d17f628653c3e81e78dcbb0143829cea9d47d0a37e0f039
-
Filesize
773KB
MD5b37f8e68a7feb3f3fd3cbb2a022abdc2
SHA180f40e7d4221a42658c0c3391b33768d55b03088
SHA256bf4e71de010293e78332c1b84af69a6142ac1cb298928181de065e5121103eed
SHA512226f6746b560b9fe15ce19a22c183e139aec68973523cc1eb7018cea1d85a1f72ca4b2bf4e1f7f948b74fa6b10324616e924744811f4b02fbcd3566dd0bcac8e
-
Filesize
9KB
MD52c4d9c44aa19a2bfe5d97056598479f3
SHA1b098c8575974ed0f9d54d2b01a689722166ba637
SHA2569a83c2c38b983740ae8f253ac958662d08161a05f11a83b30e86946b5c5efd95
SHA512f50e40a5f49b81a4205fd8c1c0a4ffc36eb2eb92639b91301b0f1f2bc3dff686ec271a22fc1142c69cc9fbb41dfbb5694e0c7130cb0da3caa2923417d728de87
-
Filesize
14KB
MD57c5b2b3866c6928f40661048d24ddf7c
SHA1a6858e793535ddef2d3a16bb686619e83b0b86b0
SHA2565cd3cd839b16e599a62f942797a434d0979961b79703353a82b556c11a46c1f2
SHA51223dd14da8a8276f918d6a752f93dddd6b12d02dbbb65fc5995052a33c0d358e189031a0413163f6415cdbbcb5f0058cf9987f2562b0aa7fee4ee12d0cfbaad98
-
Filesize
733KB
MD595df60122d8ce192576ef0f578455b5f
SHA1badf9bfb505704ec66e484831986396ed040b9cc
SHA256214a2ed54ef679d61d0b122e3c4c112807c426f771f0479a6b18aff6e34a87b0
SHA512690d49940f2ed96a743ff58af5d39c8146f89d2e5bb5c5e7892a9c826a7cd579a48061d640abdf215393dd94946ad8ae42f9023d76dc95799cbd3f6b05552ede
-
Filesize
452KB
MD5c4b98f92bd7a79cb66da7e9f1330e25f
SHA1e911fa096b0bfc436c083e67216ca5c317957fd9
SHA256186822ed15a7e8336f27536b803a495d9b70fedb3048cc6614d7814b6026e3a8
SHA512b0d783a8dd6e3cc2c749bbfc65a4fc912dd8c08a44c9c8ca98fc93bd9260f98089e457fa0a38db0d8b7185e64da2924a7f6e912cfc4a1919038f08ee4b401387
-
Filesize
19KB
MD51f961c75139b1ad96c9c621f7d643f3a
SHA1962da7d9a805f4c9031c8fcb9e528bc693c343cc
SHA256ddbbb6ef0863567cfe182f3997b3f2381a1f7055917ca968f50ef8937537c1af
SHA512aa5dd5deb500038e5658b47ed385711720346035c89c03c663301f60cb637ce3c871255c29773cc256dfec55beda870531367773d4c4c37b09dc3ce7b52ec92d
-
Filesize
842KB
MD5ecc72f79bcb8b405609187840a8c23fe
SHA14ab0e9d7d1e424cf755772c254f7f283eb9073fb
SHA25636b9deccf1e4bc64be9848a7319f4728ff8f6f7f4d2e87e18fbc0780b411f5cd
SHA51268f0935ded6f3e2e4b14dffc18a4035b6e60395c39fc14059c5a65e1bc34bb067181539b715fd61ca6e45d29ce448ed310161d5bb14ec9ef9711edf09c06473c
-
Filesize
374KB
MD5439f636d218f637993c32cd280e4c057
SHA11acc019dafe14b4916e4985546f4122c0d39335a
SHA256ed167592441348a888a02c6131e491ab95f2fc2709fb75c1f710b8c94d3728c5
SHA5120d98dba63efe810a4056450631894e42b3e1dbc56337626c8fd394624509e692d1d7536bfb3480f0453060c38b30aaff01ddc5a693e73641421f619b1a8dea81
-
Filesize
292KB
MD525f57d4ddbc4e5ec11f63b8b91a6b11f
SHA1ac9b0da871e0a4fd0baa9378c715dc0fbb26edef
SHA25696c21e9a1a34aa38b8a2c487521fb31945af641e20d230b3f3adf990cab38fbb
SHA512680c5ac33720c01f25e1f3f84dd7784aa0a99281c7d8841d0a5925cc7ad5d8389aab2c179fcd9a93c598657ba6fbb2b288e593e8b44f16adcf0edc2d55778e33
-
Filesize
209KB
MD5077fb5af33afcd6970971c76c4b19863
SHA1e5826b1bf1f1747916839a702a83048008cbfaf2
SHA25671788c754361f713a0f2e3d30dc2da3cdc4171a2cdadb472d91946ca9eca50ab
SHA5124714fd3251a50fbe11c222b95a30d29599cab58e310807ee2d67cfcfa1aafe3df15548e6c9f30b5da668f425472803407193829e1fd8fc364f9f4a0e2ecbab7b
-
Filesize
188KB
MD52ebd03d48c12a1e3a31298bba28cb843
SHA122062f3e8d6f42b263d72cfbb1722e4d4da069d1
SHA256d548896f8767b43a883900594fece64c34c574addfd39693b3d1b1d4b33e5c2a
SHA512fe5ef5d0acf4002bc428b6dea50753df4753014c49df52f81e8b7f7a5bbbdf21869d710dcf89682b54e7181719ca78d5b6a609a6e77ceebe9808bd940c609123
-
Filesize
69KB
MD5302d883d5ae077617fa06da5926c1cee
SHA1d5a7c7cabb6d7fed7c75452888575087906b112a
SHA256ac7ceaeebcfd4adbfb0f0022395cfd6cd5ade5bd80443a7fa2d82986c3389823
SHA512684b6126932fb2581fce89ef54d5be6af6f5e7d363f601c99d089190c64ccd8cf73c68548287963f510aa7a74881825c96e974b8a849a2b8073c7fc1748cd53a
-
Filesize
860KB
MD584979ce4bee980437ee943c8d1dc5a37
SHA110a11beda32349813ffecbbf406c49b3eb08c936
SHA256e621e58baade17bcd6aeec7828375530204e42127a914aba361bbb2bf9d2fd19
SHA512265c4cb552cbe64d2759e54b16d3ddc31ebcda3373ee4e7566809ec992fb16a42cea964785753d5b52d8c0678d1e4ac7eb06e4644c8b68965ef4178450d5de32
-
Filesize
24KB
MD5a51464e41d75b2aa2b00ca31ea2ce7eb
SHA15b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA25616d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
-
Filesize
704KB
MD52b3c5d50abdfb34cb35f94e257ab6b58
SHA18ef3b712dcef59daa294bc4908abb956b6a79afc
SHA256f1302340e5d25e653a98ad0d9cd54c1e507625651960abf820e9d8af03006ce3
SHA512d7de7911dafca09af7942024faa7e92e369af23a6f694b339442c0b5722c66249db3902a3f8ca6e64e410d84a4931b7c961a826635330a54f239ea9de68292fd
-
Filesize
1.2MB
MD5973caf7ba33dcf2b37fd5d5f2e41b7f9
SHA1135fc4c9b3d9ddbfde0d2e6cc8ec686ba2041300
SHA256ef2fd2ea62c433802ddbbe713aac15a0bd06753da8b79f480524b31cc638cb2e
SHA5125e1ed76aad7ad575828bba99582c0c8c5838d8edf30c141284e62a273d4dba1cb525088ed1868a6d4a5f25c0360af3af3a8bb36ed304e65787152f4fac9cfe1e
-
Filesize
552KB
MD5cd0c37f1875b704f8eb08e397381ac16
SHA1249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b
SHA256d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a
SHA512d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
48KB
MD5bba9680bc310d8d25e97b12463196c92
SHA19a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA5121575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
-
Filesize
34KB
MD57d4f9a2b793e021f7e37b8448751ed4e
SHA10ea07b5024501aad5008655cfeae6d96b5da957a
SHA2562293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
SHA512af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26
-
Filesize
291KB
MD5277ad3ef0a1323a7e29d32f1fb4f0782
SHA13cbac1c280afb586fc79abcc24732b71700c4c16
SHA256e4b450838c9408ed80f8bb8d4e165e8de204c73108af50c20c8b2b0c797cf219
SHA51226a4446fccd2aa2b6c151ade640c154ac85be975dde0a1e5a6a857f1c505c7ac763e420fdce68892bcd70fb1bb5a24dff39f6751eefb7d01ba34de905e1db508
-
Filesize
46KB
MD56250a28b9d0bfefc1254bd78ece7ae9f
SHA14b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA2567d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
SHA5126d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7
-
Filesize
72KB
MD5569d276da5bcb89d9e93b639d27d4c7c
SHA146ef90c9dbac45a89c384d26af1971fb780073bf
SHA256e016f14f54a7907f0afe9970b5bfe9fb0ad043109d4446dd5e2910600e0b5a82
SHA5121b883a41ecd35fe4a62d996f4a8c96e2ed9c7d16fd5a1515792f39524cacb9bdb314b5435644e52af0f1874b1a4ee1865492722649f59b51eb70085c0679d7b5
-
Filesize
56KB
MD54b90108fabdd64577a84313c765a2946
SHA1245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA256e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
SHA51291fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc
-
Filesize
103KB
MD520985dc78dbd1992382354af5ca28988
SHA1385a3e7a7654e5e4c686399f3a72b235e941e311
SHA256f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
SHA51261b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8
-
Filesize
33KB
MD53b5530f497ff7c127383d0029e680c35
SHA1fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA2565971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
SHA51212ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a
-
Filesize
84KB
MD58edbeeccb6f3dbb09389d99d45db5542
SHA1f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA25690701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
SHA5122a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501
-
Filesize
25KB
MD54fbc5fd5da9da74c04fe0374387b34d3
SHA11e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA256b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
SHA512ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a
-
Filesize
30KB
MD55c1441f6ee11632183a83dac2d22853b
SHA1eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA256104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
SHA512e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595
-
Filesize
24KB
MD55c4c43763fb1a796134aa5734905c891
SHA144a5e1ae4806406a239129d77888bd87d291a410
SHA2564edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
SHA51207bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e
-
Filesize
41KB
MD553e72716073038c1dd1db65bfdb1254c
SHA17bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA256e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
SHA512c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941
-
Filesize
48KB
MD5e7d68df8f65fbb0298a45519e2336f32
SHA1ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA2562473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
SHA512626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e
-
Filesize
60KB
MD57e9d95ac47a2284706318656b4f711d3
SHA1f085104709201c6e64635aeacf1da51599054e55
SHA25638dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
SHA512294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118
-
Filesize
21KB
MD559cfd9669367517b384922b2485cb6a7
SHA11bd44298543204d61d4efd2cd3980ad01071360d
SHA256e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
SHA512d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665
-
Filesize
21KB
MD54ee50be5f99d4f5ab298bb3a4a49b074
SHA1999e12e6feb57a8b7353523169a0e989e11f41f6
SHA2569b289b01e9d45609a4e7ea9695a6971caee51543d5f5def473f2fd1be3ba476d
SHA5129d6171645cba26792829b732313da50405ccb07e0ab725775ba6cce5d4fe36ecbd736a6710734df45aaa9ff389f51e4059d8eca187df989c05bd90b4db8e9f54
-
Filesize
64KB
MD5a2e8916b3e660e9e76b16063b4b99cfe
SHA17b06ae2b1a610692ca166c50dfbc6c3a4221fd16
SHA25641dd331430b6395cc4abdd1855f84e8e341846021453e395769d712888ed77bb
SHA5126e6196863fade7f8c2ade8942c302a915aa026cbf30a293edf591b2272d1a3eb1a1de652f36e1bf09ab787946ef48a11b70b8f017f99b2d16e4e77f793b34d4c
-
Filesize
19KB
MD5b89d69ec0b65fd551996798dde5e9394
SHA1f6d89be7145c1ef93b3251de2f4f6e4d93103288
SHA256dc3cf160204e11c0ec79cf33ac4c97a1aebbb820c2e07855e5fcd29c5dd31158
SHA512d2575aa5c6e81e43c53d76659fa3b6aa66f9afbe1e343aa9004d8a533e5c37cd3ef2f062c6a440389728b18a38d2de90aab36340607bb004d23c28e681db142c
-
Filesize
14KB
MD540354ebde496e17e83b228a61718fdeb
SHA18501f20087255843fa3ebb8380c79f0bc1b81fc7
SHA2564689bae0e0660c2f9def96867e9b0f72d6b253e3bb01d50985599d89d573350f
SHA512adbce70c6804ef3626e4ba6a6639046a6dc9da359f8cb6433d0c2ee52d1bc0813be6350d02324d68094ce745d13d9848340303c1fb2622329425d4ed5d7a5628
-
Filesize
859KB
MD54253e18e2f977da6beaf3587db5b605c
SHA160eeed22b25bae022bdc5784352a49e441c6b301
SHA256281e6f042e93f9de1c44c9917c8a54c0efbbe5fd97d9f46a65c8d702e144f4dd
SHA5122f474078f48739660cf4a770544c52dcd00d2951c3ad03549f80951f57c425cda5979d56e9482dd05541de851c33a27658da8b4bccde19276ab43108d0a30163
-
Filesize
1.1MB
MD586cfc84f8407ab1be6cc64a9702882ef
SHA186f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA25611b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c
-
Filesize
23KB
MD5d50ebf567149ead9d88933561cb87d09
SHA1171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA2566aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA5127bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de
-
Filesize
203KB
MD56cd33578bc5629930329ca3303f0fae1
SHA1f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA2564150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e
-
Filesize
20KB
MD5dba01ddfe41784191780e50534b7b86b
SHA164e834d0e457252f6deba67843626804d6343a41
SHA2561fc13691e104e56fb0b742288d4aa943b907db3da6848e1b92904a1aa9b89187
SHA51213046e44a6e0df896789d17427f9c05c229cbabfb0414e3c6b78637701a316953efa507e40519c760ea762e2e2c90714fd72e14e7bd949094c08d70bf515c2ff
-
Filesize
86KB
MD546331749084f98bcfe8631d74c5e038f
SHA15e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA25621cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
SHA512edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589
-
Filesize
63KB
MD5c17b7a4b853827f538576f4c3521c653
SHA16115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA5128e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
-
Filesize
1.4MB
MD5fc7bd515b12e537a39dc93a09b3eaad6
SHA196f5d4b0967372553cb106539c5566bc184f6167
SHA256461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122
-
Filesize
24KB
MD53797a47a60b606e25348c67043874fe8
SHA163a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA256312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
SHA5123eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2
-
Filesize
608KB
MD56a3a34c9c67efd6c17d44292e8db8fad
SHA1339b1e514d60d8370eaec1e2f2b71cead999f970
SHA2567b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
SHA5126f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5
-
Filesize
287KB
MD5fed35db31377d515d198e5e446498be2
SHA162e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA256af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
SHA5120985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a
-
Filesize
31KB
MD5e38fde2d8395e72458dd08956598279e
SHA11fc9f0562d9012d3cfcf8ac8cff6854d7f35e333
SHA256248cd49446e0e0939a03ffe6cc8b83885bfc9b285dbaff90bc10ac6334d10f54
SHA512bd8428f4f67de23d65c86b8901a9351fd5fbd81bd980ad3277a1520eb21723287f2364dd13fbcf5454bad41947d37b614a245fc204d9a69c0dbfca1ad78329f2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82