asyncrat | 773b0a591df8389ee2e256d22da04860e454e8323c1537818237030b9c9f535c

Resubmissions

14-01-2025 20:39

250114-zfsfgs1ncp 1

14-01-2025 20:27

250114-y8d8ws1lbj 10

14-01-2025 20:19

250114-y3s5vsylcw 1

Analysis

max time kernel
107s
max time network
124s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
14-01-2025 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NeverLose Crack By SunTube.rar
Size

18.3MB
MD5

75c0279e5a8a67dd1ffb8acfe582d548
SHA1

222a6440dd33acec8d8d9b6af73bab75dc36114b
SHA256

773b0a591df8389ee2e256d22da04860e454e8323c1537818237030b9c9f535c
SHA512

3c2756faff307a0b27ba90fa48a80c157ff691eef3f24339f1af1306b62cc34b0f2fe3c13d116dcb26daf2622fe1dd1ce7def8e614bcc02608033094aaa6783e
SSDEEP

393216:JHouKBeIU8Ey2frK3xDibRvLzU3fRM+zQInU64wb4VVo1VtvT:JJKFCy2frKdibJLgpVcIUm4cVtL

Score

10^/10

asyncrat stormkitty default defense_evasion discovery evasion execution persistence privilege_escalation pyinstaller rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6329762543:AAHEPfUNypbY9iSCcDWo6BRtHmGEdJrBGvE/sendMessage?chat_id=927516584

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00280000000461a7-33.dat	family_stormkitty
behavioral1/memory/2884-114-0x0000000000980000-0x00000000009C0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x00280000000461a7-33.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4656	powershell.exe
2144	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1898866115-3160784972-1217720036-1000\Control Panel\International\Geo\Nation	NeverLose Crack By SunTube.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1898866115-3160784972-1217720036-1000\Control Panel\International\Geo\Nation	system_cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
4840	NeverLose Crack By SunTube.exe
1260	system.exe
2884	system_cmd.exe
3284	NeverLoose.exe
4552	NeverLoose.exe
2708	vltssllxqwur.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe

Loads dropped DLL 10 IoCs

pid	Process
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe
4552	NeverLoose.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\40346d760f2d2d77bf1a49d8d3094e6e\Admin@HTHETBUC_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	system_cmd.exe
File created	C:\Users\Admin\AppData\Local\40346d760f2d2d77bf1a49d8d3094e6e\Admin@HTHETBUC_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	system_cmd.exe
File created	C:\Users\Admin\AppData\Local\40346d760f2d2d77bf1a49d8d3094e6e\Admin@HTHETBUC_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	system_cmd.exe
File created	C:\Users\Admin\AppData\Local\40346d760f2d2d77bf1a49d8d3094e6e\Admin@HTHETBUC_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	system_cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4808	powercfg.exe
1152	powercfg.exe
2996	powercfg.exe
2156	powercfg.exe
1480	powercfg.exe
5092	powercfg.exe
3176	powercfg.exe
4948	powercfg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	system.exe
File opened for modification	C:\Windows\System32\Tasks\Chrome Update	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 2568	1260	system.exe	128

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system.exe	NeverLose Crack By SunTube.exe
File created	C:\Windows\system_cmd.exe	NeverLose Crack By SunTube.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe
4836	sc.exe
2736	sc.exe
4740	sc.exe
2040	sc.exe
1500	sc.exe
2752	sc.exe
4676	sc.exe
4924	sc.exe
976	sc.exe
5040	sc.exe
1004	sc.exe
1912	sc.exe
2560	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00290000000461a8-57.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system_cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3396	cmd.exe
1992	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	system_cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	system_cmd.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2944	powershell.exe
2944	powershell.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
2884	system_cmd.exe
1260	system.exe
4656	powershell.exe
4656	powershell.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
1260	system.exe
2568	dialer.exe
2568	dialer.exe
1260	system.exe
1260	system.exe
1260	system.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe
2708	vltssllxqwur.exe
2144	powershell.exe
2144	powershell.exe
2568	dialer.exe
2568	dialer.exe
2568	dialer.exe
2568	dialer.exe
2568	dialer.exe
2568	dialer.exe
2568	dialer.exe
2568	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4852	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4852	7zFM.exe
Token: 35	4852	7zFM.exe
Token: SeSecurityPrivilege	4852	7zFM.exe
Token: SeSecurityPrivilege	4852	7zFM.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeIncreaseQuotaPrivilege	2944	powershell.exe
Token: SeSecurityPrivilege	2944	powershell.exe
Token: SeTakeOwnershipPrivilege	2944	powershell.exe
Token: SeLoadDriverPrivilege	2944	powershell.exe
Token: SeSystemProfilePrivilege	2944	powershell.exe
Token: SeSystemtimePrivilege	2944	powershell.exe
Token: SeProfSingleProcessPrivilege	2944	powershell.exe
Token: SeIncBasePriorityPrivilege	2944	powershell.exe
Token: SeCreatePagefilePrivilege	2944	powershell.exe
Token: SeBackupPrivilege	2944	powershell.exe
Token: SeRestorePrivilege	2944	powershell.exe
Token: SeShutdownPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeSystemEnvironmentPrivilege	2944	powershell.exe
Token: SeRemoteShutdownPrivilege	2944	powershell.exe
Token: SeUndockPrivilege	2944	powershell.exe
Token: SeManageVolumePrivilege	2944	powershell.exe
Token: 33	2944	powershell.exe
Token: 34	2944	powershell.exe
Token: 35	2944	powershell.exe
Token: 36	2944	powershell.exe
Token: SeDebugPrivilege	2884	system_cmd.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe
Token: 35	4656	powershell.exe
Token: 36	4656	powershell.exe
Token: SeDebugPrivilege	1260	system.exe
Token: SeDebugPrivilege	2568	dialer.exe
Token: SeShutdownPrivilege	2156	powercfg.exe
Token: SeCreatePagefilePrivilege	2156	powercfg.exe
Token: SeShutdownPrivilege	1480	powercfg.exe
Token: SeCreatePagefilePrivilege	1480	powercfg.exe
Token: SeShutdownPrivilege	5092	powercfg.exe
Token: SeCreatePagefilePrivilege	5092	powercfg.exe
Token: SeShutdownPrivilege	2996	powercfg.exe
Token: SeCreatePagefilePrivilege	2996	powercfg.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2144	powershell.exe
Token: SeIncreaseQuotaPrivilege	2144	powershell.exe
Token: SeSecurityPrivilege	2144	powershell.exe
Token: SeTakeOwnershipPrivilege	2144	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4852	7zFM.exe
4852	7zFM.exe
4852	7zFM.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3284	NeverLoose.exe
4552	NeverLoose.exe
1320	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4840	4852	7zFM.exe	86
PID 4852 wrote to memory of 4840	4852	7zFM.exe	86
PID 4840 wrote to memory of 2944	4840	NeverLose Crack By SunTube.exe	88
PID 4840 wrote to memory of 2944	4840	NeverLose Crack By SunTube.exe	88
PID 4840 wrote to memory of 1260	4840	NeverLose Crack By SunTube.exe	90
PID 4840 wrote to memory of 1260	4840	NeverLose Crack By SunTube.exe	90
PID 4840 wrote to memory of 2884	4840	NeverLose Crack By SunTube.exe	91
PID 4840 wrote to memory of 2884	4840	NeverLose Crack By SunTube.exe	91
PID 4840 wrote to memory of 2884	4840	NeverLose Crack By SunTube.exe	91
PID 4840 wrote to memory of 3284	4840	NeverLose Crack By SunTube.exe	92
PID 4840 wrote to memory of 3284	4840	NeverLose Crack By SunTube.exe	92
PID 3284 wrote to memory of 4552	3284	NeverLoose.exe	95
PID 3284 wrote to memory of 4552	3284	NeverLoose.exe	95
PID 4552 wrote to memory of 1004	4552	NeverLoose.exe	96
PID 4552 wrote to memory of 1004	4552	NeverLoose.exe	96
PID 2884 wrote to memory of 3396	2884	system_cmd.exe	97
PID 2884 wrote to memory of 3396	2884	system_cmd.exe	97
PID 2884 wrote to memory of 3396	2884	system_cmd.exe	97
PID 3396 wrote to memory of 1620	3396	cmd.exe	99
PID 3396 wrote to memory of 1620	3396	cmd.exe	99
PID 3396 wrote to memory of 1620	3396	cmd.exe	99
PID 3396 wrote to memory of 1992	3396	cmd.exe	100
PID 3396 wrote to memory of 1992	3396	cmd.exe	100
PID 3396 wrote to memory of 1992	3396	cmd.exe	100
PID 3396 wrote to memory of 2676	3396	cmd.exe	101
PID 3396 wrote to memory of 2676	3396	cmd.exe	101
PID 3396 wrote to memory of 2676	3396	cmd.exe	101
PID 2884 wrote to memory of 3452	2884	system_cmd.exe	102
PID 2884 wrote to memory of 3452	2884	system_cmd.exe	102
PID 2884 wrote to memory of 3452	2884	system_cmd.exe	102
PID 3452 wrote to memory of 3808	3452	cmd.exe	104
PID 3452 wrote to memory of 3808	3452	cmd.exe	104
PID 3452 wrote to memory of 3808	3452	cmd.exe	104
PID 3452 wrote to memory of 3868	3452	cmd.exe	105
PID 3452 wrote to memory of 3868	3452	cmd.exe	105
PID 3452 wrote to memory of 3868	3452	cmd.exe	105
PID 4552 wrote to memory of 2488	4552	NeverLoose.exe	108
PID 4552 wrote to memory of 2488	4552	NeverLoose.exe	108
PID 4288 wrote to memory of 1164	4288	cmd.exe	113
PID 4288 wrote to memory of 1164	4288	cmd.exe	113
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 1260 wrote to memory of 2568	1260	system.exe	128
PID 2568 wrote to memory of 628	2568	dialer.exe	5
PID 2568 wrote to memory of 680	2568	dialer.exe	7
PID 2568 wrote to memory of 964	2568	dialer.exe	12
PID 2568 wrote to memory of 412	2568	dialer.exe	13
PID 2568 wrote to memory of 732	2568	dialer.exe	14
PID 2568 wrote to memory of 712	2568	dialer.exe	15
PID 2568 wrote to memory of 1060	2568	dialer.exe	16
PID 2568 wrote to memory of 1068	2568	dialer.exe	17
PID 2568 wrote to memory of 1132	2568	dialer.exe	18
PID 2568 wrote to memory of 1216	2568	dialer.exe	19
PID 2568 wrote to memory of 1288	2568	dialer.exe	21
PID 2568 wrote to memory of 1304	2568	dialer.exe	22
PID 2568 wrote to memory of 1328	2568	dialer.exe	23
PID 2568 wrote to memory of 1352	2568	dialer.exe	24
PID 2568 wrote to memory of 1412	2568	dialer.exe	25
PID 2568 wrote to memory of 1532	2568	dialer.exe	26
PID 2568 wrote to memory of 1576	2568	dialer.exe	27

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1060

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1288
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1576
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2136

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3008

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2848

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3564

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3652
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NeverLose Crack By SunTube.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\7zO4F26A198\NeverLose Crack By SunTube.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO4F26A198\NeverLose Crack By SunTube.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbgBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAYwBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AawBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAbQB2ACMAPgA="
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Windows\system.exe
      "C:\Windows\system.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4288
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:1164
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:4676
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4740
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:1004
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:4948
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4836
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2568
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "ZJSAAMGD"
        5⤵
        Launches sc.exe
        
        PID:2736
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "ZJSAAMGD" binpath= "C:\ProgramData\qjeczfkghagn\vltssllxqwur.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:1912
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:4924
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "ZJSAAMGD"
        5⤵
        Launches sc.exe
        
        PID:2040
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4156
  - - C:\Windows\system_cmd.exe
      "C:\Windows\system_cmd.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3396
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1992
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3452
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3868
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Windows\system_cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1620
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\NeverLoose.exe
      "C:\Users\Admin\AppData\Local\Temp\NeverLoose.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\NeverLoose.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NeverLoose.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:1004
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4136

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4372

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1740

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3888

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2844

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3108

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:3500

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4068

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4348

C:\ProgramData\qjeczfkghagn\vltssllxqwur.exe
C:\ProgramData\qjeczfkghagn\vltssllxqwur.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2708
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3836
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2588
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:976
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1500
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5040
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:3176
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4948
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4808
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1152
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:2632
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:548
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\40346d760f2d2d77bf1a49d8d3094e6e\Admin@HTHETBUC_en-US\System\Process.txt

Filesize
4KB

MD5
c96b6953a422157e399e784585aaeeca

SHA1
58290e5c31e126ce0583c5c3730aae4339ed5311

SHA256
ecb5e8e593537308bd0235e103851519fa8ba971c0354d9805ce13e3d591a4f8

SHA512
70d607bd637e8eecebeb580a9d2efcd41adc12e858171dad8fd4ac643b272cd50e2efa87fb76c5fe06ab7de34f36df5263302549b3dbb8f34bdfcb3ae6f617b8

Download Submit
C:\Users\Admin\AppData\Local\9539c5559d0705a3dc8f7d7e68d13852\msgid.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4F26A198\NeverLose Crack By SunTube.exe

Filesize
10.5MB

MD5
009013843d334e4560844997666ba298

SHA1
3f4f5b6e6d5845621db774c2d80a043595ad9208

SHA256
af6fe8996df0b68e06bc5f0d6cee39e045a4115e33f38f26bab4fb5874545ec3

SHA512
75663112641208fceec7badebe89ff682a381027b71d5ad472e4eff0b2392a223cbb9af60b87b430eabb4afd0cb03d6246e6d101f8345db83fcc3367102d978c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NeverLoose.exe

Filesize
7.2MB

MD5
94d9898031e3901bf378da83af447f28

SHA1
60e81c6beb55b04817e6a7f16dbf8dc5b8df43d5

SHA256
aaa3f08706c9eed3ab28a9dbb5bf76d75a4fd48eb4d8caa7e9699f5f6277a3a6

SHA512
d1c0a7793d5e2da760b7a800412658d88285888406f1171cef0a9f7dfb6fe8ea14b1b440866329735f394d8aaa2bf9b433112ec595e367724422144061f891e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\_bz2.pyd

Filesize
81KB

MD5
86d1b2a9070cd7d52124126a357ff067

SHA1
18e30446fe51ced706f62c3544a8c8fdc08de503

SHA256
62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

SHA512
7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\_ctypes.pyd

Filesize
120KB

MD5
1635a0c5a72df5ae64072cbb0065aebe

SHA1
c975865208b3369e71e3464bbcc87b65718b2b1f

SHA256
1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

SHA512
6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\_lzma.pyd

Filesize
154KB

MD5
7447efd8d71e8a1929be0fac722b42dc

SHA1
6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

SHA256
60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

SHA512
c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-console-l1-1-0.dll

Filesize
13KB

MD5
7235a669254fd5be893b15338f2d7fc3

SHA1
f972845f66eb407b08eb1b998cf08aed3388556d

SHA256
6cbc74dae3b82931c0835dfea8f3d7319e3e5c0aa40ffa5f9c88b7eba5e6953f

SHA512
a45c64c61344d1bb548e7e54be076dba913546df9728e8e5987cf0f711686fc91667792a018a9f77e501602908271b96bede0436cf5d9d3c7d3bbffb0192d1df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-datetime-l1-1-0.dll

Filesize
13KB

MD5
f01d69d7a6e17fed29364349bc140b0e

SHA1
b5e943efe44329e603ca8eccd76048ca9f421ee9

SHA256
3478a04d9d101250389152f5c9b54db6047ae4af230dcccc41f074fa09571fec

SHA512
265d0a7c6e57aec633fc50f849b5faff9fcb630784d5cc972eab97fa1f1457e8af8991e816fbfe3c36b75f6b66c182417ed0add0ad87c8e94f99e45df7d3625d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-debug-l1-1-0.dll

Filesize
13KB

MD5
ff461bd0830bc2f35bffb3faba52880d

SHA1
2a30bfd7eb62674bdb9aef1f080a4b98819d0b2b

SHA256
74d7e2cebae440d2c53ea4863c47d02775ded3603d44cfc66418c492b3f89612

SHA512
365f206606200496b204af5277c47e1af537fc6087b11ddc36854122170c8e92b19f8cfc9a015c59e75c516f9007606c35ee16d7606a8c1c203d96d7243b617d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
13KB

MD5
e03ab9169f9047cb77bed0730f155456

SHA1
ffec9c08500be50c11403e21107b0ac23d9b9632

SHA256
e18da5e27b4cba781d3eb4bfcd095e0635212fe821eb184e039a518aa4a0ff03

SHA512
fb76942cce49bb77dc5890e74d09ade7991ee4a15c8da4e6106f2cec35495416c760a935c4cf9ed0011396ade1f7fe3c5682938ec70e365e5a47418345145e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-file-l1-1-0.dll

Filesize
16KB

MD5
9a24eaa876e24e870c006e38a9272aaf

SHA1
327a34f9bb49acd93bbb8051e8ebe21a6752890a

SHA256
9a06f78070efd6a8b19daf6c66050e6c5ccea4b26f8af43b669d1ae86bb059da

SHA512
cbb96bc611edeece1d1183c921495ccb32281d7cc0b039621f0ed5f2bfc9a34dd7967a2229afc446939e0f84e81105728f004f5fa8e6b68f8c53f89d93d4eabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-file-l1-2-0.dll

Filesize
13KB

MD5
8d20c95352af844791fe145fe76c3d46

SHA1
71859ebbcb35614aa45332592e8c0d187a64ad41

SHA256
e0b4a8e23bc1eac15e3f87ad6525ce94723cadf0c39da206a289233d1d8d0029

SHA512
64b43d52485d3ff7cf9c3db41a6345a4f68dd1275d0c6b50a8aca891710b6c3fea0c9ce92682f36510963ed641318aea08e7644d7f5665594a28d6a5fe50aed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-file-l2-1-0.dll

Filesize
13KB

MD5
4f4de51033972d6c2ad7fcc6e030263d

SHA1
bb79c8e3dc3550d3da7bedb09b42e9f6e71456a2

SHA256
417285f8881875cb9cf78b8b5cc7e6ea4bfa7c230f55a191d104f02e46e05b02

SHA512
1bedaa10b31fa08af830a022a57b2ad8bc581c87b2ecd57108dd3a0e3bd385f37152d2c813012dff0f37efa26e594c2e72e4d0099e7c22e91e3f6ab1f16637f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-handle-l1-1-0.dll

Filesize
13KB

MD5
5c6bf4c69c7f97375540c6bec6d23025

SHA1
795b803f6459a81449e0af78f5fe4ccfb7dada86

SHA256
50b47b18fba08f50df33488a64f1e8fff66fb0c2f15ae0832b87add66d85622b

SHA512
f0bc45e35a5eada742987d6c83ada003ca908f7da838481c3251156cc4648fd185f4bd26d7afd2813003c14c2e6b2b015227c14b9e8ba665eed70719251e7485

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-heap-l1-1-0.dll

Filesize
13KB

MD5
c71eec6d63bc0ee17b83638c1c15d508

SHA1
30447d16ac60ac00165ffb821c4ea3e13f910412

SHA256
2a69626533faf7d61719c8fcd9b60013970e772c94108f879a11b207fe70407a

SHA512
446742b13770474067f4a74dec6c305cc586863778a74e20573c4484aa1ecf26a3cc5336df9e248c72ae6fc5da1c34829a002f8aee5b393f186deed57b53a9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
13KB

MD5
6a2c0b783d760b433ff8468f77dbbf84

SHA1
203a5faaa12af8a2f3266356ab6be11d69b76aad

SHA256
9d76c51ed5f676e9436984a7908e0280fb9c7ae4bb2e4d9f1fbbd551884ad096

SHA512
45d3452013151ad87f31b8196f72a0c0d997185c5928c4c868b1bde2af2f018f3b6d1f9d6f0e00082e267ad46d044360a3ef29cd79e10690b5b48f3c72875aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
14KB

MD5
5272317b3fe7cd2ff89f6b59428c06b4

SHA1
5c119f3a33ded708daa5b415b51f95cc91e60c7c

SHA256
508f9f7fd22560df4a3aab17ee05698faa61a04bba68962c5c2a686a6c47456f

SHA512
a2cac161a1c61aae2a12ba9180d99e61ad381961b8c6002fa11abd540765af32f583dcbe3366d083fc8149a1076b4af0191e21ed87f6556e3a2a73c3501fee5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-localization-l1-2-0.dll

Filesize
15KB

MD5
ad54ab7a338bf0bb0b2bb11f0b16e1af

SHA1
b771a5250d6f2b035796f2050a67cd6f84f625ce

SHA256
044a978132ec0c4b72eca55994cffe2047371c6e74a68e8228e3387f0332b40f

SHA512
6e5ae7d185c2e006b6d25e0deef8c41b3de334a8ea55423ae3a26c271daa282ebb8df17014685824698edf1222bcb999f061cfe8be76850b4685bf9b2b2f634d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-memory-l1-1-0.dll

Filesize
13KB

MD5
58013d04c222cc8dcbd32268c03abcbf

SHA1
37c91f953ca13169c4b04513937b62a1b34540d7

SHA256
7c73634ea7fcca77c2fe20e03a3328bb257c49d70af8bb428da797ba03b8cf57

SHA512
7bc8fe152863b94a3e2f1933fe2c3ae963f6f3cc0a5149e80eaae811294cf0f5f54b226073e9607e95574a57f1e9e7ea8f64de597b1d17d185deb61ffb97d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
13KB

MD5
c1e4a6db32e336056dec55c8ea05a849

SHA1
baa6b8253c8c7f66672752c15f9052f77a963035

SHA256
df17a553a57b4942e78a3b6f1472b455b0bd215691b37ed4dfa4cc532ea055fb

SHA512
ef318bcda1a666e371c8355202065cf2676a0140a68207579326a2492983a909d43c61b83ce825ca9805f37a8efdb84ddd8336a2c438b9c42f5231e30c86abac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
14KB

MD5
8e66e34a0f05145da500c6a11a48e704

SHA1
d32ad7d6701c41e6bce0c83da3da62a93394ae06

SHA256
d6712f71faa5fea89f51d960aa43ceb762f5915aa0515e92af70ce9c99ecc061

SHA512
d7cd4848d6a3cdd171819a88bb8f5c9a6188bcc34ee2b4a44c56605cb6958d728965ab03b661aa1ad84b9b5396f1fe3763ec640265198d6cc892e203e404becf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
15KB

MD5
89fdf9b863765b323954a007ad9ca2ff

SHA1
35ccf203dd1484ed0e91590b446fbaa65be2294b

SHA256
ac63c9a03f4518c2081fc06b26ca7bb865c8afe180cad84cfa46abd899a8ea6d

SHA512
3155f9ef5e3bc20b7bfdf21a5a3ac43aa69cf98c4afa4a7238b57ab95a6bb1089806de8d677f75338097a626db27b94e0230531e9312c97d2583f109f369267f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
13KB

MD5
e636eb68e4d0764ac516eb90c015c5a9

SHA1
e218ae03a11d1bc146de124562929b6194ad39dc

SHA256
db275cd6f925431d8131bf9af742084aedf5ecf76d1854bef1e67f430a90caf5

SHA512
fb29172f5d41afefea4070f757212c9d6a5747c12116162b9f2987c8587766e8ff6e64664a7d7d287eac1734c6a61f0a5d70a55e28232fb76532826bbf290b3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-profile-l1-1-0.dll

Filesize
12KB

MD5
453f57ec6434ee859fbceb976b3e9942

SHA1
05ae6d53b8ad3c6c6cb80011919ac7ba04b10bc0

SHA256
e027d7bc88cf4ecf0f832fedf26cb97f1dc0499c0ac11dc088d2e4888a885122

SHA512
b22cb1f6d7388a6f81dc53d9a506b18a17875ef1cc6ea5c3da930dd62a1e23dfdf384b6babeb7e1cd929bf08ce4ac51a38dddba46b4edcfe5a5f41f272fd3912

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
13KB

MD5
f73fd3421da637af068f79cdd9b31fcc

SHA1
d1c6b827371cb67b2542367d5fcdd962d729d55e

SHA256
f7073f13dd4f8e66753da48ea685de5327336e45abb55d35c320b40b3612a21e

SHA512
ee9078b7903416f3c41fb0756005a0cdd051bd187536223b81029e71497ad0fbc0e31bc4b89d1d8e295282f8f26095f0260fa721d67d3928933d14cecbe013d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-string-l1-1-0.dll

Filesize
13KB

MD5
d7ee943a5337f11e40ec6dbca4e78843

SHA1
e0a26ca120db56169681ff2c68b609bfa2c9b929

SHA256
7be6aec7b294b34ad294d5a6058b97a1f0487cfd1947f45d47aedcc11e47d420

SHA512
5e9914e071947dc9fb2936f3682760d10e941608e1fc594a65304cb0fe36883a49b40eef752aee50e32987cdb9e2d54706031a8dd12d267bd849c7b519e5a205

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-synch-l1-1-0.dll

Filesize
15KB

MD5
59066ffbfa13361fcbd94bc6ba18b05f

SHA1
60d2ad60cb46e44508a8c9d97276dc966b5f4b88

SHA256
1abae1dcb260e78e2bcdaa7cd67d07eafc75cea4aeae5863f03fb0035905aaaf

SHA512
7116b74c95bf6098a0cd916826d217b95b71ed31772c0b4aaa04c1664733b6be2d7efc841fa1202971e776dd4ae6b31ce4d925d60fc3822ced79da388bf4e50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-synch-l1-2-0.dll

Filesize
13KB

MD5
02aace0e9c0ff73b2d20c1d8236d98fd

SHA1
03fb3fe4cc41fe66b384e1424d1d6fedd6c9c9aa

SHA256
c6c40e9fd60672fdd890c4701e080eccc3bcd69eb83445a4a2254c5ef18e86d8

SHA512
b06900073f24fdff8235c13131adb3872d85f65c7b95b3b0938175002bf4f4482e1d79c1dd1560e5d9423e1ea1ed1023824584b43f88947008a1e8e1d841c454

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
14KB

MD5
de669b7280308b603319c8e146e3619f

SHA1
16dbbd02517e297ad705e8a83dc2014ddd354869

SHA256
e7ffde0e77d2dc041573df00219fced1b83873b30659b045af237a329cd76456

SHA512
218291aa877cb16eefc33b02664111171ccc0ce5be3541f1cd44ce6dc6bbf82554bc307624ea37cee5d1b2d85cc4833eefb2b8daeba9635d414f088696c4e027

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-timezone-l1-1-0.dll

Filesize
13KB

MD5
0bc29b6ea06e6aa4ccde719cf905be57

SHA1
d4506b799c5a9486ecf6f23f24578347ae30e80f

SHA256
977a842cc27890b44f2869ed5cc1f63b2327f4cd0b2d15d9df281c36eb8b7bd9

SHA512
02bb1d61e2304548becdec5b442f445143789eb5885dec28fed10edb67ce20be56c22838b2e740f7f72ac6eeff717d0056d552c406770e2e93a4beeedb48258e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-util-l1-1-0.dll

Filesize
13KB

MD5
ba3479272eb5d88aa92c4488fab50696

SHA1
1c8db713c2b80b9063a9beb7b437feb5600f962e

SHA256
713b891eea8729abacb72d1cf3c0564a5cccf4e8e88840bbf223c3abd45155e9

SHA512
845d22a7cc053764350f8eb4699d6c4cd199f03bad86b5249245b0bd7bc92bab39b5d5059d4d8502f3b3093180f9bc7468190964f49de22ea5531210b553818d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-conio-l1-1-0.dll

Filesize
14KB

MD5
2c0fa7f923e9e00922c56ac7cf99eeab

SHA1
dfe4ffb4a920a6a26c3d2dd47eb6380dfdbb1a3a

SHA256
87cb51e83a8dac859ec737a227a569080f0b79ca6ccaa05f72b4ccdec7f3f6ef

SHA512
01495dfc8dbd69fb0969654f88bb72be6b540ca2a414d91b4d64df962290c4db0b911982701d41ac30e941b8c1d16ec8385f767d737f6dc10fd0d30b0104c23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-convert-l1-1-0.dll

Filesize
17KB

MD5
cc688afa6d30809879eb0e8218fbd177

SHA1
ea85e2c54ec189069a7d49d782ce104dc73bec8f

SHA256
2456e4093b455d9411b706d5136d23363b8c19f6652144430053316991656bd6

SHA512
2bc6d36b0a5ffdae655e6d08b1129040e5f34f138910b2c0083d31056b041e7698ea16a26f911caa29bfd2e0536126f2e3899b19035e09bf427942ba71b4b07a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-environment-l1-1-0.dll

Filesize
13KB

MD5
213e33edf5171b70537fc822d2ba346b

SHA1
979a4f6225bd93dddc795c8b68c8108fe7d24080

SHA256
d574159915a665979d651157876706d7ebcc652e3bfa4f42e0ec58743b40308c

SHA512
0beeec420d578ab3d780b6db0aec26b6fbb817132ade84eda1d1ec64977d4625e9b97b099e1cbd32d708a2416b364c2164a654fd5a10ac8ab2e0b96d09b74508

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
15KB

MD5
ed545df4bc2b692e10045a9dfe5ff838

SHA1
0693d59d98fce42ece8c18bdbb9f1fbf74151eb3

SHA256
f5e8c5e92204fbfc62bf2da93a8bd2d1f9ed25a1ee589149a44425eac93b4b48

SHA512
53f1dd446c842ad1d3f31e32c74b7780aa84abaa474fb2dda8b50a4246692f15dd18bee3e2914890dc501a9512d612e02aa2e05b56978cb9bfcc0f4cb08bfccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-heap-l1-1-0.dll

Filesize
14KB

MD5
7971654560666eb0c0b8a57a9c3989d8

SHA1
fefa9eafa98758323fd7879e41e17db5fd194cef

SHA256
412a9b06373eddc750f6dc847175b0df4daf68536bbbefd03e750aeac17d0297

SHA512
6d3eac9b836cdbe149357bff7de318d59ee5992de2003d8e5ff8909099deabfe71d8204690e612520aa06eb4bebd223b333ee2fa29ae2077fc4d77e091bb7dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-locale-l1-1-0.dll

Filesize
13KB

MD5
2b325d26931c3f4ff72c074f36ea27d6

SHA1
6b809fe5085ebb07418eaee6e37a221b4cc7251f

SHA256
b399e86af799dbf635e364258f3345575e915b1f1919bb79cfb6c0a9b52874c4

SHA512
1c55edd81b67381b6142c905f560ff78d2110b184222205b00abfb611b1ca261ca07b90afc44ca8c34548a2df91b5a72bfdc6a9cc35b772d29a942e77308e5ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-math-l1-1-0.dll

Filesize
22KB

MD5
df47d580db43391477ec986413995ca0

SHA1
5aee2d5bf3f4fd2bfee55ae08dda26b0ebbb2044

SHA256
91958af51f0d7f01479684d7a2fb9bdaf84c18d08c21429d8fc63851fd812ebf

SHA512
d48ace08bb78a6767fef3fcb0041089516b1cbdc7ff78ee25c1f87c44fd410dbad16e9353340047a5dc2aecbd95e9f84e15114921ddb01c1d155136079afa4d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-process-l1-1-0.dll

Filesize
14KB

MD5
45fddf7be0c07e99cbdb6a9344f8b5fc

SHA1
ba020d5ffa0706b97f23fae46d65fd1482035d1c

SHA256
d14990fa62fb685b6d2e8621581fb80ac90fe0e19ff406d0d8585e87d4a5cf0c

SHA512
28a7398ee8b5586974b0226af48f61330a4c44996b888173d5f6909d0070af8a40d060113c621e26dcaf763193cfabc8f928ce7e95682d9241f20eaf45b8f93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
17KB

MD5
144a33a7874cd4d5aa4edb9511b84389

SHA1
01b8c736527b24ca37a5390afa9a16d7609a3be5

SHA256
c2d969aa0f0c56d9a1b24cd0c17b6152017ae7dbd5bb2eb273fdd4f533d9b912

SHA512
42a74cfeb8973b44571936ecdbba11461d7a0e0cb21b0be6aec28a05e59d5abce54434b0cd048cf11b324afae545e505410f54b538c3891525a31b56e9b0f2ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
19KB

MD5
d18f660fcadc19c7cfc66c9205d6ce95

SHA1
2d69859cbc4203b869dfd1ff9d7bb44e85cd71fa

SHA256
984d07bc9513066f58d417389e844a60ac0fbdb3f5c5cf857dd39e67db2ca4ec

SHA512
6716bf5f4faf141dcaada28681aca8beff00ddc43ee1228229ba8d83fb2a6f777a311ed974c8488006e63ea5c0e35ce417eab586a71fbe20ca65a7595d76d91a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-string-l1-1-0.dll

Filesize
19KB

MD5
8d61ebd7a1ead88bd58afd3e450485f8

SHA1
1e646c0785aa3826d86614e4e11b2f95b05eb8b9

SHA256
36e7c1391561ac7774d26e390ee6d977d584cc1455c8a6c1bf980296a8faea3e

SHA512
94a4a522d29d042561e8c4c2124cf6dfcb6d98fc7253ec71ac80dcdcefa4e4abe22f6e3b3c99b49d38a09d3a6abe437dc097d5b3549370b9cdcff9f53bdcd011

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-time-l1-1-0.dll

Filesize
15KB

MD5
ce666d7cb8b5330a10eaaf3de02cbe4a

SHA1
c7279be4735a6e9796a7c7296787ac090236870f

SHA256
a63ebea251528583444e5e26004a914db835123f72ae86d0ae33b1b975e268d6

SHA512
061ad1a44433c8e235ba027a8fcf41235f614d4cf4597d646e5d729c07ec18be120f3cb259b670d042a2380f4d0876011edac8865c7a1f4bc0f3ddcb1f4c4e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-crt-utility-l1-1-0.dll

Filesize
13KB

MD5
b6e80404aad88700cd64ecc63a83e5e5

SHA1
5f8c54af45bf503df34b9b72ece55b074b43e95c

SHA256
ed80d09f1f15af97880e893d3dc71cb7b666637f8efe9d01d727eb432e2ace9a

SHA512
d08ae570ef48fcfbae2add5f37614e42583f5b80cd1e8795adfeda9e10c8be2fced25354f9c706b123b123d1e3d9fd6df277fec3979cf356ba1e4ba587d0e0b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\base_library.zip

Filesize
859KB

MD5
c4989bceb9e7e83078812c9532baeea7

SHA1
aafb66ebdb5edc327d7cb6632eb80742be1ad2eb

SHA256
a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd

SHA512
fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\select.pyd

Filesize
29KB

MD5
a653f35d05d2f6debc5d34daddd3dfa1

SHA1
1a2ceec28ea44388f412420425665c3781af2435

SHA256
db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

SHA512
5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32842\ucrtbase.dll

Filesize
987KB

MD5
ed64a1170ed7ff5a2b92639c94eaab1f

SHA1
b883b72ef01c920338f5d67a333f41ea59b52181

SHA256
427717ae33c2185e01c6360bc58b1823d3f8217b66703c47db8ddd06cdd2e4b4

SHA512
2d14d2398c002869e9cf37c54c5bd32611904b9b57ed67fdf5edbe67995a67917152cf3805a0fe745cc9743764bd51fbe308c620321a09121681ac984357c2d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fuogwv4l.aww.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system.exe

Filesize
2.8MB

MD5
e718218fb10f827d522ee70594ade637

SHA1
709fa6eccc295efdf68287f7390912d91ef8a407

SHA256
0e66644b335d0e74c484d79f683a1cfbb6746e2187f69e20b8704e11793f8715

SHA512
adf8fda24c09bdadfebee4fb91486168f71cc1694cab104822b6aa9540a6e9b83804114cbe8071ca4f3bb820fb65fa5065845019a7548687b257dd39614a9d1a

Download Submit
C:\Windows\system_cmd.exe

Filesize
233KB

MD5
75cb05ce63adbf838ee8bdddfbe88001

SHA1
9ece3e9b88ec293be12ef87a4573e458c985ebaa

SHA256
28b9b2f88b044821d6041a915c1d514b0a1be275f519ba7156af4ed10fce061b

SHA512
8bb1575704b1ed2b510e102a2076fb8ca9f226804a5495c7f06e0e6d5b2a400d159423f942d35fc71b5b077fa8b156d8656881dde6150d05723a0a8804be80a8

Download Submit
memory/412-893-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/412-892-0x00000167DA6B0000-0x00000167DA6DB000-memory.dmp

Filesize
172KB

Download
memory/628-881-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/628-878-0x0000014AEA310000-0x0000014AEA334000-memory.dmp

Filesize
144KB

Download
memory/628-880-0x0000014AEA360000-0x0000014AEA38B000-memory.dmp

Filesize
172KB

Download
memory/680-883-0x000001D934580000-0x000001D9345AB000-memory.dmp

Filesize
172KB

Download
memory/680-884-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/712-902-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/712-901-0x000001DAD70B0000-0x000001DAD70DB000-memory.dmp

Filesize
172KB

Download
memory/732-896-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/732-895-0x000002878EA90000-0x000002878EABB000-memory.dmp

Filesize
172KB

Download
memory/964-888-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/964-887-0x0000029ED16D0000-0x0000029ED16FB000-memory.dmp

Filesize
172KB

Download
memory/1068-904-0x000002C9B4160000-0x000002C9B418B000-memory.dmp

Filesize
172KB

Download
memory/1068-905-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/1132-911-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/1132-910-0x0000029F6B540000-0x0000029F6B56B000-memory.dmp

Filesize
172KB

Download
memory/1216-914-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/1216-913-0x000001DB787B0000-0x000001DB787DB000-memory.dmp

Filesize
172KB

Download
memory/1288-917-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/1288-916-0x000002D594F90000-0x000002D594FBB000-memory.dmp

Filesize
172KB

Download
memory/1304-925-0x0000027D37190000-0x0000027D371BB000-memory.dmp

Filesize
172KB

Download
memory/1304-926-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/1328-929-0x00007FFA67370000-0x00007FFA67380000-memory.dmp

Filesize
64KB

Download
memory/1328-928-0x000002881B870000-0x000002881B89B000-memory.dmp

Filesize
172KB

Download
memory/2144-1022-0x0000014F5FEF0000-0x0000014F5FF0C000-memory.dmp

Filesize
112KB

Download
memory/2144-1044-0x0000014F62540000-0x0000014F625F5000-memory.dmp

Filesize
724KB

Download
memory/2144-1171-0x0000014F5FEE0000-0x0000014F5FEEA000-memory.dmp

Filesize
40KB

Download
memory/2568-858-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2568-860-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2568-859-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2568-857-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2568-864-0x00007FFAA58E0000-0x00007FFAA599D000-memory.dmp

Filesize
756KB

Download
memory/2568-862-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2568-863-0x00007FFAA72F0000-0x00007FFAA74E8000-memory.dmp

Filesize
2.0MB

Download
memory/2568-875-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2884-114-0x0000000000980000-0x00000000009C0000-memory.dmp

Filesize
256KB

Download
memory/2884-734-0x0000000005F50000-0x00000000064F6000-memory.dmp

Filesize
5.6MB

Download
memory/2884-221-0x0000000005300000-0x0000000005366000-memory.dmp

Filesize
408KB

Download
memory/2884-735-0x0000000005B80000-0x0000000005C12000-memory.dmp

Filesize
584KB

Download
memory/2884-841-0x0000000006A50000-0x0000000006A5A000-memory.dmp

Filesize
40KB

Download
memory/2884-1182-0x00000000074A0000-0x00000000074AA000-memory.dmp

Filesize
40KB

Download
memory/2944-34-0x0000022478410000-0x0000022478432000-memory.dmp

Filesize
136KB

Download
memory/4840-17-0x00007FFAA72F0000-0x00007FFAA74E8000-memory.dmp

Filesize
2.0MB

Download
memory/4840-64-0x00007FFAA72F0000-0x00007FFAA74E8000-memory.dmp

Filesize
2.0MB

Download
memory/4840-16-0x0000000000880000-0x00000000012FC000-memory.dmp

Filesize
10.5MB

Download
memory/4840-15-0x00007FFAA72F0000-0x00007FFAA74E8000-memory.dmp

Filesize
2.0MB

Download