Analysis Overview
SHA256
dcc00d4fd546010acfab5d484e25a13eb8b51e6a55623d0dd59ab13573e4c594
Threat Level: Known bad
The file Built.exe was found to be: Known bad.
Malicious Activity Summary
Blankgrabber family
Deletes Windows Defender Definitions
A stealer written in Python and packaged with Pyinstaller
Command and Scripting Interpreter: PowerShell
Loads dropped DLL
UPX packed file
Unsigned PE
Enumerates processes with tasklist
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-26 13:03
Signatures
A stealer written in Python and packaged with Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blankgrabber family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-26 13:03
Reported
2024-06-26 13:40
Platform
win10-20240404-fr
Max time kernel
315s
Max time network
1608s
Command Line
Signatures
Deletes Windows Defender Definitions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Windows Defender\MpCmdRun.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | blank-cl1tw.in | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI47682\python312.dll
| MD5 | cbd02b4c0cf69e5609c77dfd13fba7c4 |
| SHA1 | a3c8f6bfd7ffe0783157e41538b3955519f1e695 |
| SHA256 | ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5 |
| SHA512 | a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
memory/1332-29-0x00007FF866FA0000-0x00007FF867679000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI47682\base_library.zip
| MD5 | 630153ac2b37b16b8c5b0dbb69a3b9d6 |
| SHA1 | f901cd701fe081489b45d18157b4a15c83943d9d |
| SHA256 | ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2 |
| SHA512 | 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_ctypes.pyd
| MD5 | e7629e12d646da3be8d60464ad457cef |
| SHA1 | 17cf7dacb460183c19198d9bb165af620291bf08 |
| SHA256 | eb8affa4e7a4da15c9cda37c68ac8232d885a9d367b28973473949b205384789 |
| SHA512 | 974ae1607093161a5f33eda9e0a0ade214700d05eb728c8157e7b7589c587cc1cdefe0132d16d31c2941ed4eec4668428564609a0a2ced983c8b13f98a84801b |
memory/1332-34-0x00007FF879830000-0x00007FF879855000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI47682\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\libcrypto-3.dll
| MD5 | 7f1b899d2015164ab951d04ebb91e9ac |
| SHA1 | 1223986c8a1cbb57ef1725175986e15018cc9eab |
| SHA256 | 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986 |
| SHA512 | ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d |
memory/1332-52-0x00007FF87A0E0000-0x00007FF87A0EF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_ssl.pyd
| MD5 | a9f1bda7447ab9d69df7391d10290240 |
| SHA1 | 62a3beb8afc6426f84e737162b3ec3814648fe9f |
| SHA256 | 2bb05f7dbd21e67d2a6671411f8ae503dd7538a6767b2169b3033b695557ac13 |
| SHA512 | 539e94b59093dcf62d6f1a312d9b6aac27873f6416cde050e756e367b9907a8c0e7a31109a433b206bf023436d823d3d945f695cc7291604c0a24bcd27dc1451 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_sqlite3.pyd
| MD5 | b8aa2de7df9ba5eab6609dcf07829aa6 |
| SHA1 | 4b8420c44784745b1e2d2a25bd4174fc3da4c881 |
| SHA256 | 644669d0875b33aa7e9d3f1856bc8b696f796ad61c7edb9219f8f0ff1a69531a |
| SHA512 | 5587efef4c349a137d785594bb7cbffef19fd418bf7d6fb2a4a3e2107354f5f874eeb7e18799031bde335bc65e4ca53f73793a60c67a5482c7e6d1564894ba17 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_socket.pyd
| MD5 | 4ee9483c490fa48ee9a09debe0dd7649 |
| SHA1 | f9ba6501c7b635f998949cf3568faf4591f21edd |
| SHA256 | 9c644a6db56052cf2680476648391b47b603957ffb353ad44a68dac761805ef1 |
| SHA512 | c55ddd782cc52d1aba6fd4466ed72387aad4debd3c48315db16aa35d3a5265478d8b197a3a0e0bcf9277004c10b4ccfe8706ab9d0e886d19c0cc4cb406fab4a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_queue.pyd
| MD5 | 048e8e18d1ae823e666c501c8a8ad1dd |
| SHA1 | 63b1513a9f4dfd5b23ec8466d85ef44bfb4a7157 |
| SHA256 | 7285eef53fd485d6093a9aecbe8fc87c6d70ae4e91d41f382a2a3edff7ebc6c8 |
| SHA512 | e57e162d1099b696d11bad172d36824a41fde3dd1d3be0dbd239746f8c87f17e78f889c8ad75ffdac89032b258e6f55f0dab82aae21b9d7ad166ceedfe131b61 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_lzma.pyd
| MD5 | ed348285c1ad1db0effd915c0cb087c3 |
| SHA1 | b5b8446d2e079d451c2de793c0f437d23f584f7b |
| SHA256 | fa84770ccf4394d046ed69edaea71957306a25def4986ee6650daf0a2c2d3e43 |
| SHA512 | 28a4c21bdb0bd697e93b276c184bfc5e317d930c4462e655d9d9ef7487168809ee952e32a856304cdd67a76d6b2286bf94fe9b9de6706c8d36a810aa916ce8e1 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_hashlib.pyd
| MD5 | 3c1056edef1c509136160d69d94c4b28 |
| SHA1 | e944653161631647a301b3bddc08f8a13a4bf23e |
| SHA256 | 41e4bb3c6064cb9e8a62e17056aea19e3d7e6ff1efc17c18d76118ac4e3b7243 |
| SHA512 | a03fcf2af6df72923714f66d26774a39e709fa8ad879d72b838d531692231f68480b5ff65b83358ad6b7b411f4ece7028a8613c3b1177acf1d3c933a843ca19a |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_decimal.pyd
| MD5 | 94fbb133e2b93ea55205ecbd83fcae39 |
| SHA1 | 788a71fa29e10fc9ea771c319f62f9f0429d8550 |
| SHA256 | f8e8fbeee7c8454fa42fe47f1da9c63f6b6e631b0dff22c80631f426efcba78b |
| SHA512 | b488f06be28fc8ffd3d8be6b986c7a35ab868198b10943bfa59b9130ebd50354adb9e1818b73ed1f2c92d33d869091e9167346b4430668ca31dd46a845276dea |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\_bz2.pyd
| MD5 | ba8871f10f67817358fe84f44b986801 |
| SHA1 | d57a3a841415969051826e8dcd077754fd7caea0 |
| SHA256 | 9d30387ee07585516f8ce479fcd4e052597835d4149568c1d8382a4a3a0ae7e1 |
| SHA512 | 8e23b032b785f37b920206fa3064c5fa0e28949f23b2e985fae26c9a355a6bc33dcd380925091f627d4d7936f0958e90fa7c022d89c73db8a1ea6ad267a1a341 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\unicodedata.pyd
| MD5 | 9a03b477b937d8258ef335c9d0b3d4fa |
| SHA1 | 5f12a8a9902ea1dc9bbb36c88db27162aa4901a5 |
| SHA256 | 4d6e035a366c6f74660f74b8b816add345fa7f1c6cf0793dcf1ed9f91b6ce6a4 |
| SHA512 | d3d8bb51474f93d02837580f53aacf5ca9eaf8587e83cddb742c707a251fe86f14e8e665aa4423ac99d74c6c94d95c7df3bfd513b3d5c69661e604f22dcabebe |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\sqlite3.dll
| MD5 | ce4f27e09044ec688edeaf5cb9a3e745 |
| SHA1 | b184178e8a8af7ac1cd735b8e4b8f45e74791ac9 |
| SHA256 | f940ff66960441c76a258846d66d4a357e72ad8fbb6bde62b5e5fbe90103b92d |
| SHA512 | bab572324dcf12e71fb6a9648e9224528bd29c75e7d3b978b7068eca0d6f2cb795165756249f47e1db401267b0a1e5fd06c35b6cf5595a013240f9e3444ea083 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\select.pyd
| MD5 | a71d12c3294b13688f4c2b4d0556abb8 |
| SHA1 | 13a6b7f99495a4c8477aea5aecc183d18b78e2d4 |
| SHA256 | 0f3ae1b65102d38f6b33fcbbdadd347aa1b0c09ed8028d4412982b3bd97caf0f |
| SHA512 | ff16cb399b661c170bf79108c62010d32804ead3f6c565b0755a26b62b4f51290bcb71face6cebaa82c0f9b3863aaaa7fa57ddc1e2bbae8598b047d01d15cbe5 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\rarreg.key
| MD5 | 9795f79ddb61aa29027f4d68496b379c |
| SHA1 | 2b28db4d9ac8cffba73048444b1df25346f4ef32 |
| SHA256 | e63f3d6710097498085564dfc85add6ed4cf44238c33d20820d2426abcee4e31 |
| SHA512 | e44fbbc02da75d173c81bdfda9b14102997609af06fd50c51030430c3c80193dadb632592997361c79b0dfed50ccc0e1743c306a881401a1c78a6a7facb45d4d |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\libssl-3.dll
| MD5 | 264be59ff04e5dcd1d020f16aab3c8cb |
| SHA1 | 2d7e186c688b34fdb4c85a3fce0beff39b15d50e |
| SHA256 | 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d |
| SHA512 | 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248 |
C:\Users\Admin\AppData\Local\Temp\_MEI47682\blank.aes
| MD5 | b76283aea68b3e2533eb55d3c45912e0 |
| SHA1 | 1f4c101e1f849069c6dba4c90c7d4d1674ea1701 |
| SHA256 | d4b1845d3773e00ae1740cb0c6ec4770780eb6c8c49b4f2af4f096e01b8a19d7 |
| SHA512 | 2593e5d83c465e08360fc9a3efa5d4f0d0fdb8977368457fd3875ca31cb7ce2c79501f37e01ebd6e9796da2edf6b14a561d7b69879245439a8da921bb00aa589 |
memory/1332-58-0x00007FF8797D0000-0x00007FF8797FD000-memory.dmp
memory/1332-60-0x00007FF8797B0000-0x00007FF8797C9000-memory.dmp
memory/1332-64-0x00007FF876E70000-0x00007FF876FE6000-memory.dmp
memory/1332-63-0x00007FF8771E0000-0x00007FF877204000-memory.dmp
memory/1332-66-0x00007FF8771C0000-0x00007FF8771D9000-memory.dmp
memory/1332-68-0x00007FF879B50000-0x00007FF879B5D000-memory.dmp
memory/1332-75-0x000002305EA80000-0x000002305EFA9000-memory.dmp
memory/1332-74-0x00007FF876E30000-0x00007FF876E63000-memory.dmp
memory/1332-73-0x00007FF866FA0000-0x00007FF867679000-memory.dmp
memory/1332-77-0x00007FF876260000-0x00007FF876789000-memory.dmp
memory/1332-76-0x00007FF876790000-0x00007FF87685D000-memory.dmp
memory/1332-84-0x00007FF874C70000-0x00007FF874D8B000-memory.dmp
memory/1332-83-0x00007FF879820000-0x00007FF87982D000-memory.dmp
memory/1332-80-0x00007FF8771A0000-0x00007FF8771B4000-memory.dmp
memory/1332-79-0x00007FF879830000-0x00007FF879855000-memory.dmp
memory/5000-94-0x00000298F8530000-0x00000298F8552000-memory.dmp
memory/1560-95-0x0000027A4BF70000-0x0000027A4BF80000-memory.dmp
memory/5000-93-0x00000298F8430000-0x00000298F84BA000-memory.dmp
memory/1560-96-0x0000027A4C2A0000-0x0000027A4C3A2000-memory.dmp
memory/5000-101-0x00000298F8800000-0x00000298F8876000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o3n3dyn4.qlc.ps1
| MD5 | c4ca4238a0b923820dcc509a6f75849b |
| SHA1 | 356a192b7913b04c54574d18c28d46e6395428ab |
| SHA256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| SHA512 | 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a |
memory/1332-132-0x00007FF876E70000-0x00007FF876FE6000-memory.dmp
memory/1332-150-0x00007FF876E30000-0x00007FF876E63000-memory.dmp
memory/5000-151-0x00000298F8BD0000-0x00000298F8C1C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI47682\blank.aes
| MD5 | 864e0adb4a7c1857c58f03d51ff3c08a |
| SHA1 | 130f0678f6e7dfbbbe249e4b16041724590dbff6 |
| SHA256 | 3df1a5535ded014a3c6f2aaa153afc04b8b7cc355068cd863b13fdf451c092ba |
| SHA512 | 4d6375e67155095eafe275466081cf5e625a3bd68e6e4b622a69d92241c192dc2f9e01fc6febf1e52172a026bec42e39afb87687ba5f27859d7e60e96d86c938 |
memory/1332-149-0x00007FF879B50000-0x00007FF879B5D000-memory.dmp
memory/1332-148-0x00007FF8771C0000-0x00007FF8771D9000-memory.dmp
memory/1332-147-0x00007FF876260000-0x00007FF876789000-memory.dmp
memory/1332-146-0x00007FF8771E0000-0x00007FF877204000-memory.dmp
memory/1332-145-0x00007FF8797B0000-0x00007FF8797C9000-memory.dmp
memory/1332-144-0x00007FF8797D0000-0x00007FF8797FD000-memory.dmp
memory/1332-143-0x00007FF87A0E0000-0x00007FF87A0EF000-memory.dmp
memory/1332-142-0x00007FF879830000-0x00007FF879855000-memory.dmp
memory/1332-141-0x00007FF876790000-0x00007FF87685D000-memory.dmp
memory/1332-126-0x00007FF866FA0000-0x00007FF867679000-memory.dmp
memory/1332-140-0x00007FF874C70000-0x00007FF874D8B000-memory.dmp
memory/5000-193-0x00000298F8B80000-0x00000298F8BA0000-memory.dmp
memory/1332-139-0x00007FF879820000-0x00007FF87982D000-memory.dmp
memory/1332-138-0x00007FF8771A0000-0x00007FF8771B4000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 658c36925009524c74daa85f63979f37 |
| SHA1 | 294756e681ae66d8cf00ff397f4eb9d6444c10a5 |
| SHA256 | daa7b2b0478805b535083b67b14fe3789d26dd5f8e96365c5aef030a675344d7 |
| SHA512 | e2d0490ba443086e9dc600d4f558e188546d4c902cca00c7c864eb38bf52270932ecb67d11643a93b5db4e046ae8bf54975b3e8b57db187860e7775b3455223e |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 8592ba100a78835a6b94d5949e13dfc1 |
| SHA1 | 63e901200ab9a57c7dd4c078d7f75dcd3b357020 |
| SHA256 | fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c |
| SHA512 | 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3 |