c09931d2b1c4c85a9619268881d586e015e17f7af70c3a51d5ce4a83eb2711be

Analysis

max time kernel
67s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ModsInstaller.exe
Size

103.2MB
MD5

4b5de2a76cc4726cd5da7d5ab5be8268
SHA1

440da127ba16bfd34396f5c2c40713a15aeadc17
SHA256

c09931d2b1c4c85a9619268881d586e015e17f7af70c3a51d5ce4a83eb2711be
SHA512

24936712a9676d1ab4e6904e2ebdc9689dc3a079c5f93799a130442b0d5e92f6a7a4d0ec44aaad440df0db8b0dbe4c34978c1267f0d106fcf54294755bb8fcd1
SSDEEP

3145728:is3nztCRrS6xjKcBanL2qHO5iVXfnGQbRe0zJcB8Z2:iizQZSWNaBHCid1XcBz

Score

9^/10

evasion execution persistence

Malware Config

Signatures

Enumerates VirtualBox DLL files 2 TTPs 2 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\windows\system32\vboxhook.dll	ModsInstaller.exe
File opened (read-only)	C:\windows\system32\vboxmrxnp.dll	ModsInstaller.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1796	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4164	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2172	ModsInstaller.exe

Loads dropped DLL 64 IoCs

pid	Process
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\System\\ModsInstaller.exe"	ModsInstaller.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
6696	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1956	ModsInstaller.exe
1796	powershell.exe
1796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	ModsInstaller.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	6696	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1956	3760	ModsInstaller.exe	84
PID 3760 wrote to memory of 1956	3760	ModsInstaller.exe	84
PID 1956 wrote to memory of 1796	1956	ModsInstaller.exe	88
PID 1956 wrote to memory of 1796	1956	ModsInstaller.exe	88
PID 1956 wrote to memory of 3888	1956	ModsInstaller.exe	90
PID 1956 wrote to memory of 3888	1956	ModsInstaller.exe	90
PID 3888 wrote to memory of 4164	3888	cmd.exe	92
PID 3888 wrote to memory of 4164	3888	cmd.exe	92
PID 3888 wrote to memory of 2172	3888	cmd.exe	93
PID 3888 wrote to memory of 2172	3888	cmd.exe	93
PID 3888 wrote to memory of 6696	3888	cmd.exe	94
PID 3888 wrote to memory of 6696	3888	cmd.exe	94

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4164	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ModsInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ModsInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\ModsInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\ModsInstaller.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\System\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\System\activate.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\system32\attrib.exe
      attrib +s +h .
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4164
  - - C:\Users\Admin\System\ModsInstaller.exe
      "ModsInstaller.exe"
      4⤵
      Executes dropped EXE
      PID:2172
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "ModsInstaller.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x428
1⤵
PID:2816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI37602\SDL2.dll

Filesize
2.4MB

MD5
83c5ff24eae3b9038d74ad91dc884e32

SHA1
81bf9f8109d73604768bf5310f1f70af62b72e43

SHA256
520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279

SHA512
38ff01891ad5093d0e4f222c5ab703a540514271bf3b94fb65f910193262af722adb9d4f4d2bd6a54c090a7d631d8c98497b7d78bd21359fdea756ff3ac63689

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\SDL2_image.dll

Filesize
122KB

MD5
b8d249a5e394b4e6a954c557af1b80e6

SHA1
b03bb9d09447114a018110bfb91d56ef8d5ec3bb

SHA256
1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194

SHA512
2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\SDL2_mixer.dll

Filesize
285KB

MD5
201aa86dc9349396b83eed4c15abe764

SHA1
1a239c479e275aa7be93c5372b2d35e98d8d8cec

SHA256
2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8

SHA512
bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\SDL2_ttf.dll

Filesize
1.5MB

MD5
f187dfdccc102436e27704dc572a2c16

SHA1
be4d499e66b8c4eb92480e4f520ccd8eaaa39b04

SHA256
fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63

SHA512
75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\VCRUNTIME140_1.dll

Filesize
48KB

MD5
68156f41ae9a04d89bb6625a5cd222d4

SHA1
3be29d5c53808186eba3a024be377ee6f267c983

SHA256
82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd

SHA512
f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_asyncio.pyd

Filesize
72KB

MD5
ad364098aa105e804c8c98d343ec3527

SHA1
4ebe5696875c94bdbbd6cd031c0593ae89d176af

SHA256
bac2870d61a72be50cabc968be924147132036185b3b538aa3b1b43d8c828a2e

SHA512
beb0a44a44969abf7290fc560deceac5bd8cee96d560041f783dd439a5f73b340634e451797ac1b67405f655299fce5a20627cbacba4943f7723778fde61497f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_bz2.pyd

Filesize
84KB

MD5
03bad8289d9aa18e859ed7270a719e92

SHA1
ee371b1afc7d5be754553d54bd0db8968568c703

SHA256
178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd

SHA512
5267906b6daf79e898f87d24b6c0467f75df4c53fe0f44c5dcb02eeffef3b9b7078b2b1af3417ba92ab7586a7968a6b4fdb44b398287cdc1cb0c1dff2e4e9aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_cffi_backend.cp312-win_amd64.pyd

Filesize
175KB

MD5
fcb71ce882f99ec085d5875e1228bdc1

SHA1
763d9afa909c15fea8e016d321f32856ec722094

SHA256
86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b

SHA512
4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_ctypes.pyd

Filesize
124KB

MD5
f8d2950d5496d3940aef6758c9e9e576

SHA1
ed68c88c14e44871a085e93bf8cf6aabc816ce28

SHA256
9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0

SHA512
ab25ff65abd64f39b156f7aa91c35a327c930f31d3a5d128e67e00c6307e0a0637595ab812931dc2ffec7102e33a2afc746de6267f6130d4f5a8d3445bcded79

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_decimal.pyd

Filesize
251KB

MD5
c68fc0d5c1878d02069503280234e969

SHA1
98c8e90bf27067a4ff0764c23b95a8b845869736

SHA256
847e2b2c69ca623e0f96bbda0f421ca978fbb5925beec4cc5e4c5d9c966c4bbc

SHA512
ff745d92beb4c850371b1251c0d81c301a6ce5f6d7d5cb785a5d50dbe17817455eafc32bb6624b24dd074270892fb3fd52a864fcca6e6ea6d46723d3a1c2b6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_elementtree.pyd

Filesize
132KB

MD5
cc59a1ca9cf077f345a6872be765d63a

SHA1
994f6a8fa1fecce64bec7222d5437df0b99f5f76

SHA256
9dead134ccd6c3c2e2bdbed8a02b5853200deb11aa2a22b926f9f2955d3f5143

SHA512
b005d2ab4072ae438551897b359f65b4a438404303ef752768b25bf754fd6a4c29fe26392cff47daca8255b83e095d674a768f294e4290d0f6861cfd1adfd1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_hashlib.pyd

Filesize
65KB

MD5
5b08c2dcbe1b1dea46abbd6c9425878e

SHA1
8fe7d98d8f3ccab36d92da7e84cdc0f7d10dbadd

SHA256
823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e

SHA512
3843966697558800c639037a34da13f6bd6a0c3816bc0bbd292f04db13acc03f0b79a8fab4c58ad25fe18dd11471bc9dc20cc0d9c97c4c63fbe025ea6242b4d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_lzma.pyd

Filesize
156KB

MD5
02b16654f73129b1a1220c00d757112d

SHA1
7ce602e4c2854be7c6b439bc64162d58b1467750

SHA256
f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a

SHA512
8daf5d68230d0340e5d940067afca39922078ce94b6753f2be7ae208d7982e87f5273aca768465b110477f83735f4c8e14f7bf95c2a48e2e5457bc723398e541

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_multiprocessing.pyd

Filesize
35KB

MD5
3966d8fd4d83fa54db28338ff6087e08

SHA1
61309a8044bef8b0aa0a7447d3afdfd7502ffebb

SHA256
b66a5a1a4aa1f187cc349e7548c3cf6d815552937a6a1d33ecc87b76794a1939

SHA512
2203f5e547c74dc0aa177f2708aa09950825f16cfacadf84de005296baf305f08d732ee1e38dafbb80eeec72bf090b56359f5e2df8c28c87ded8ea5552fecf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_overlapped.pyd

Filesize
55KB

MD5
1e467f86ce9bb4dbe682bc0bf41b018a

SHA1
3a9d3ad208fb41a843d9d4d10f245d6a21266ffc

SHA256
0e6081da5bbf8fcd756b02153ab7fca12bd0bc04842abe5765f7409af4987b17

SHA512
22271f1c2f709e764d88dbf6fd0ede850f1d2d80992049b88b11f6620e6b055f18f1c55df43d6281ccf8ca84224ac88f72cb03beedd9173888a71a5549b3ac59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_queue.pyd

Filesize
32KB

MD5
6f8624f0746fa31cf72ef568d6a121f1

SHA1
1054fb373ea2aa51cb04fe98e6efd130be34fc43

SHA256
37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3

SHA512
e52199265a0360027d21034060984dd2100b79faeb03b86cb7a6545da10c00d860117598f659ca38c5bddf368d2f525e4a337011cc78bbce5307baa52588fb9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_socket.pyd

Filesize
83KB

MD5
dc5a5ab89e6e2b48cb50b463b214fd89

SHA1
f7740ff9d75767ccdac7aa0dde8659d3133249a2

SHA256
0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c

SHA512
98a886daa82848bc4ca352ec7e7f663822cbad5cd40c5ea7915821097964167d0628af47b8f19f22a825f9696f3199ffbaa94d699ae773a7eb57ae6dc1c3814f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_sqlite3.pyd

Filesize
124KB

MD5
97c255c1a9db767941d8dad861be443f

SHA1
a6d2bbce1c9e882dc1c4a08cfc8425ade036eb3c

SHA256
c135f756acf749cb5bac4c4eb48adc06a22a6c5318399ea26763530bd73df5f6

SHA512
380325bc4a912a86d83a4783ac42cd7bd0ff0b5cea73652380afb566db3271a94e11fedd19e0c347634a249e0a7e52ee8099ef602bcfa7f39cf0ae41cdf62c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_ssl.pyd

Filesize
175KB

MD5
25d4b1c6ca053c573a55d68ae3db5ce2

SHA1
ed6bc021e3d5e5ca8083e22b718bc89d55d3ab7f

SHA256
81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128

SHA512
396a5432461408059ccda92cc9ca641e68150aad02efcb635dcd3f7d68d9dd09ccec0619705abf3f43a959997b4f8821b726822b89c217c4054f8e8a67eb7fc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_tkinter.pyd

Filesize
66KB

MD5
324416d395eacb57f680b6c2ae033afe

SHA1
9a52006193e31ab23312054af665d1e15128ad7c

SHA256
96d318146ce3f329209799e4d547c28c0d4b5ab5040da19221ef815540b5f78e

SHA512
77799b933a7e7f50a21d2e0a92964397b072aba1ead33ddb60ddfe144c570b40c705780f088a59cb78a0b1c54b15f9b33aab220e7bc3eecf74d2ef479462d616

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_uuid.pyd

Filesize
27KB

MD5
7f64ee67cbe4066246e3b98844a781f9

SHA1
dab90bf194c51855fff39a8da81da39d47389a36

SHA256
20557961ac93ae00829b0865018bcc565e41b52b103d2aa58405a0208ada148f

SHA512
a19546f5444c68ef3227dd3ba643d09fa005a9c3e65afffdb5346dc142395e8fb61163764ff255544dae81d305d410cec6620b97030f82f2970f33be763af551

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\_wmi.pyd

Filesize
39KB

MD5
e203a46e89f443646cec65d96aceadba

SHA1
6ec891960ac4b9d501e593157f5e89bcddeb0cb4

SHA256
af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a

SHA512
5678c0cff56e41b59577c13fd206af279831bfca6fa9e56b4fd6f960f3c11834775498ed2d9008a21b6ef65cb2dfffa0152a4e2ad1da4cf198ecceedcb599e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\base_library.zip

Filesize
1.3MB

MD5
0cb8186855e5a17427aa0f2d16e491a9

SHA1
8e370a2a864079366d329377bec1a9bbc54b185c

SHA256
13e24b36c20b3da9914c67b61614b262f3fc1ca7b2ee205ded41acc57865bfef

SHA512
855ff87e74e4bd4719db5b17e577e5ae6ca5eedd539b379625b28bccdf417f15651a3bacf06d6188c3fcaac5814dee753bf058f59f73c7050a0716aa7e718168

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\charset_normalizer\md.cp312-win_amd64.pyd

Filesize
10KB

MD5
176f574e666f01984288db5e08f72229

SHA1
336e1da5fcd6acb30fcd6f36563685bc93a194f7

SHA256
5c11b2fbe20a75aedcde205fbf0fdda2fa1ca9bd914ae72656dc6fb651bfded0

SHA512
a4633c5e994630ebe6188d68e387a63d61d53153a0ca940314256e787b7b4939b47cf26d2a949e91b8bfd5db20d105cc01fed5dfe7515d84cd70cbd9df7f2fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\freetype.dll

Filesize
639KB

MD5
236f879a5dd26dc7c118d43396444b1c

SHA1
5ed3e4e084471cf8600fb5e8c54e11a254914278

SHA256
1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f

SHA512
cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libcrypto-3.dll

Filesize
5.0MB

MD5
123ad0908c76ccba4789c084f7a6b8d0

SHA1
86de58289c8200ed8c1fc51d5f00e38e32c1aad5

SHA256
4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43

SHA512
80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libjpeg-9.dll

Filesize
238KB

MD5
c540308d4a8e6289c40753fdd3e1c960

SHA1
1b84170212ca51970f794c967465ca7e84000d0e

SHA256
3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69

SHA512
1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libmodplug-1.dll

Filesize
259KB

MD5
ead020db018b03e63a64ebff14c77909

SHA1
89bb59ae2b3b8ec56416440642076ae7b977080e

SHA256
0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e

SHA512
c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libogg-0.dll

Filesize
25KB

MD5
307ef797fc1af567101afba8f6ce6a8c

SHA1
0023f520f874a0c3eb3dc1fe8df73e71bde5f228

SHA256
57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe

SHA512
5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libopus-0.dll

Filesize
359KB

MD5
e1adac219ec78b7b2ac9999d8c2e1c94

SHA1
6910ec9351bee5c355587e42bbb2d75a65ffc0cf

SHA256
771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806

SHA512
da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libopus-0.x64.dll

Filesize
431KB

MD5
0e078e75ab375a38f99245b3fefa384a

SHA1
b4c2fda3d4d72c3e3294beb8aa164887637ca22a

SHA256
c84da836e8d92421ac305842cfe5a724898ed09d340d46b129e210bdc9448131

SHA512
fa838dab0a8a07ee7c370dd617073a5f795838c3518a6f79ee17d5ebc48b78cebd680e9c8cbe54f912ceb0ae6112147fb40182bcfdcc194b73aa6bab21427bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libopusfile-0.dll

Filesize
45KB

MD5
245498839af5a75cd034190fe805d478

SHA1
d164c38fd9690b8649afaef7c048f4aabb51dba8

SHA256
ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4

SHA512
4181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libpng16-16.dll

Filesize
206KB

MD5
3a26cd3f92436747d2285dcef1fae67f

SHA1
e3d1403be06beb32fc8dc7e8a58c31e18b586a70

SHA256
e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5

SHA512
73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libssl-3.dll

Filesize
774KB

MD5
4ff168aaa6a1d68e7957175c8513f3a2

SHA1
782f886709febc8c7cebcec4d92c66c4d5dbcf57

SHA256
2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950

SHA512
c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libtiff-5.dll

Filesize
422KB

MD5
7d40a697ca6f21a8f09468b9fce565ad

SHA1
dc3b7f7fc0d9056af370e06f1451a65e77ff07f7

SHA256
ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95

SHA512
5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\libwebp-7.dll

Filesize
437KB

MD5
2c5aca898ff88eb2c9028bbeefebbd1e

SHA1
7a0048674ef614bebe6cc83b1228d670372076c9

SHA256
9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50

SHA512
46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\portmidi.dll

Filesize
41KB

MD5
df538704b8cd0b40096f009fd5d1b767

SHA1
d2399fbb69d237d43624e987445694ec7e0b8615

SHA256
c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013

SHA512
408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\pyexpat.pyd

Filesize
198KB

MD5
ab15ffb93ea7d8abd0a01060eefc39f0

SHA1
f90a7fad0c9970cd0d3e94f7b7b7959dfd6fcbc2

SHA256
fb0be386ab5bc1695e47e49220f52beee99239bbe85c1749694a8a696054865f

SHA512
5df2497c6e76c4bee30bef634d52a815a9112d11dbc737dfe16002d08b5ba885a56dbb56ce1deeeaa46a99fb37d5e350a28937382de443c553e5027be7bec01a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\python3.DLL

Filesize
68KB

MD5
acd6bad0ea9a91ce06189bb63d594b41

SHA1
46ee5089000b5c312739a909662142104d4d8be9

SHA256
7c3e2956271eff4949145d14635c0ca659db5ed19215201d2d8b3a4a3d3006f9

SHA512
79b888bda9804a9091f5fe8d411f2a81439d3d9618e6bd73a3f729bc977cd8e15914f3fd9f90462331aee431713c8ed7ffe864c975faa6083d7925d17d43b315

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\python312.dll

Filesize
6.6MB

MD5
f9a43765b486c561bf0895eb9390ed1f

SHA1
b398fbd02bd7fdb32dcb88f11758a0a9826b75a4

SHA256
3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d

SHA512
f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\select.pyd

Filesize
32KB

MD5
208cef2d2c60a3457b13aa428dceb347

SHA1
f78ddbe4be3ff0b21f06aea5f2266625d489470b

SHA256
fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376

SHA512
8b0d14d1c93089368d34bdf49602f4c8e1daa1711c2760eeb2c59a10dbf7611fce098af0f11d7d5aa53d7d07dde39b1f31ecf5f62f7f91f31d7abeed5d828b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\sqlite3.dll

Filesize
1.5MB

MD5
e082f3eb41fda914810a1ab45c4054bd

SHA1
410b72b64c6ab4280483ae99253d2fe71135a586

SHA256
272c41fb992490d32a1b4904b28ef3fad7fbbd07bbdcee625d849960809cf0bd

SHA512
9ae3040c9a16090f4bf3c4206a574347476282b296da3f1635a6015812703f80fe7716ff53fdf1d683c7dd706e3657acacc156727ea062cf97697fed63d354b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\tcl86t.dll

Filesize
1.8MB

MD5
06f919d58dfff12b0ee3ab026ea4b627

SHA1
15473868d33fdfc290470430f649ebd3d9d891c4

SHA256
808960f1810e03cfd153be3d9ee9bf01717904c8a23bdcf22d98ff766e33ab96

SHA512
98cba91abdac3b074cfcf34bf1db58499f97d3f926ce2e1239973f08f5ef263a9ca8b4a172a5857346f424e7f928c1a546a738287270bee0695aec7e214125e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\tk86t.dll

Filesize
1.5MB

MD5
74c8892fb92f1cd0002f3114e7559909

SHA1
abfb158ff82e822ecef1cb2dae65ac0ec1701974

SHA256
aaa0f414484211caf42a0807a3afd70c53b172f59d05dfd9f1fc55244c26dc3b

SHA512
78aca417a634d4dd8f3d6fa5f8efa50518f79cb4ebfde18d6b2511e26d7678d8dbfd3aab11bfaf2f39ac5a987e00f580b3949386a3760b6ff719f07494755c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\unicodedata.pyd

Filesize
1.1MB

MD5
5e432cca03cd6c18cf4043ed1f3af40a

SHA1
f418bc194c3d35298028bb43dc8cff720360eb2b

SHA256
e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753

SHA512
02076ef322d23becfe3e24cca5e868a3acb28086dfe83188d82a1a138ad24b9ea097df667bcf8b5486b3306abff0138462e757171a92cd2b58a98a2ac152ec91

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37602\zlib1.dll

Filesize
106KB

MD5
5eac41b641e813f2a887c25e7c87a02e

SHA1
ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5

SHA256
b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08

SHA512
cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2x3oyoww.fvy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1796-1334-0x00007FFAB7053000-0x00007FFAB7055000-memory.dmp

Filesize
8KB

Download
memory/1796-1340-0x0000023E2FAC0000-0x0000023E2FAE2000-memory.dmp

Filesize
136KB

Download
memory/1796-1345-0x00007FFAB7050000-0x00007FFAB7B11000-memory.dmp

Filesize
10.8MB

Download
memory/1796-1346-0x00007FFAB7050000-0x00007FFAB7B11000-memory.dmp

Filesize
10.8MB

Download
memory/1796-1349-0x00007FFAB7050000-0x00007FFAB7B11000-memory.dmp

Filesize
10.8MB

Download