12585d4f6c32ec57d0d1326314371780faf57619aa098f46a46e2795730c002f

Analysis

max time kernel
14s
max time network
19s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/08/2024, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abys2.exe
Size

33.3MB
MD5

2b528ff337394c1fe09fb74ecb7ddeaa
SHA1

ded31d706f0ac01f3fca5bbe70a75975da8f9186
SHA256

12585d4f6c32ec57d0d1326314371780faf57619aa098f46a46e2795730c002f
SHA512

b42f41fe9564242414916ed724c7c95187636cdeb2da30dd65e676c716387fcd77c771a47bb782a20380f9ca87296a1d42013f9058127e5465f7789073c5ecaf
SSDEEP

786432:H9/QsGdbmKvIjjk3ESWqE5o13b5o+Say9:d/Q5dVvIswq5pHy9

Score

9^/10

credential_access defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
632	powershell.exe
3404	powershell.exe
4060	powershell.exe
4168	powershell.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‎ ‏ .scr	abys2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‎ ‏ .scr	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‎ ‏ .scr	abys2.exe

Loads dropped DLL 51 IoCs

pid	Process
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002aeef-714.dat	upx
behavioral1/memory/1476-718-0x00007FF9CF970000-0x00007FF9CFF60000-memory.dmp	upx
behavioral1/files/0x000100000002ab0f-720.dat	upx
behavioral1/files/0x000100000002ab30-725.dat	upx
behavioral1/memory/1476-726-0x00007FF9E52F0000-0x00007FF9E5314000-memory.dmp	upx
behavioral1/files/0x000100000002ab0d-728.dat	upx
behavioral1/memory/1476-729-0x00007FF9EB3A0000-0x00007FF9EB3AF000-memory.dmp	upx
behavioral1/files/0x000100000002ab12-732.dat	upx
behavioral1/memory/1476-753-0x00007FF9E1EA0000-0x00007FF9E1ECD000-memory.dmp	upx
behavioral1/memory/1476-752-0x00007FF9E6EC0000-0x00007FF9E6ED9000-memory.dmp	upx
behavioral1/files/0x000100000002ab18-750.dat	upx
behavioral1/files/0x000100000002ab17-749.dat	upx
behavioral1/files/0x000100000002ab16-748.dat	upx
behavioral1/files/0x000100000002ab15-747.dat	upx
behavioral1/files/0x000100000002ab14-746.dat	upx
behavioral1/files/0x000100000002ab13-745.dat	upx
behavioral1/files/0x000100000002ab11-744.dat	upx
behavioral1/files/0x000100000002ab10-743.dat	upx
behavioral1/files/0x000100000002ab0e-742.dat	upx
behavioral1/files/0x000100000002ab0c-741.dat	upx
behavioral1/files/0x000100000002aefe-739.dat	upx
behavioral1/files/0x000100000002aefd-738.dat	upx
behavioral1/files/0x000100000002aef3-737.dat	upx
behavioral1/files/0x000100000002aeed-736.dat	upx
behavioral1/files/0x000100000002ab31-734.dat	upx
behavioral1/files/0x000100000002ab2f-733.dat	upx
behavioral1/memory/1476-755-0x00007FF9E18E0000-0x00007FF9E1916000-memory.dmp	upx
behavioral1/memory/1476-757-0x00007FF9E5B80000-0x00007FF9E5B99000-memory.dmp	upx
behavioral1/memory/1476-761-0x00007FF9E5890000-0x00007FF9E589D000-memory.dmp	upx
behavioral1/memory/1476-760-0x00007FF9E5DE0000-0x00007FF9E5DED000-memory.dmp	upx
behavioral1/files/0x000100000002aef2-762.dat	upx
behavioral1/files/0x000100000002aef1-765.dat	upx
behavioral1/memory/1476-768-0x00007FF9E1090000-0x00007FF9E114C000-memory.dmp	upx
behavioral1/memory/1476-767-0x00007FF9E1C80000-0x00007FF9E1CAE000-memory.dmp	upx
behavioral1/files/0x000100000002af01-769.dat	upx
behavioral1/memory/1476-771-0x00007FF9E18B0000-0x00007FF9E18DB000-memory.dmp	upx
behavioral1/memory/1476-773-0x00007FF9E1870000-0x00007FF9E18A3000-memory.dmp	upx
behavioral1/memory/1476-776-0x00007FF9CF970000-0x00007FF9CFF60000-memory.dmp	upx
behavioral1/memory/1476-778-0x00007FF9D62B0000-0x00007FF9D637D000-memory.dmp	upx
behavioral1/memory/1476-777-0x00007FF9CF120000-0x00007FF9CF649000-memory.dmp	upx
behavioral1/memory/1476-783-0x00007FF9E0480000-0x00007FF9E0492000-memory.dmp	upx
behavioral1/memory/1476-782-0x00007FF9E52D0000-0x00007FF9E52E5000-memory.dmp	upx
behavioral1/memory/1476-781-0x00007FF9E52F0000-0x00007FF9E5314000-memory.dmp	upx
behavioral1/files/0x000100000002af0a-785.dat	upx
behavioral1/memory/1476-788-0x00007FF9DD880000-0x00007FF9DD894000-memory.dmp	upx
behavioral1/files/0x000100000002ab20-792.dat	upx
behavioral1/memory/1476-794-0x00007FF9D6410000-0x00007FF9D6436000-memory.dmp	upx
behavioral1/memory/1476-797-0x00007FF9CF000000-0x00007FF9CF11C000-memory.dmp	upx
behavioral1/memory/1476-796-0x00007FF9E5B80000-0x00007FF9E5B99000-memory.dmp	upx
behavioral1/memory/1476-793-0x00007FF9E2170000-0x00007FF9E217B000-memory.dmp	upx
behavioral1/files/0x000100000002ab1f-790.dat	upx
behavioral1/memory/1476-787-0x00007FF9DC9F0000-0x00007FF9DCA77000-memory.dmp	upx
behavioral1/files/0x000100000002ab49-800.dat	upx
behavioral1/memory/1476-802-0x00007FF9E5890000-0x00007FF9E589D000-memory.dmp	upx
behavioral1/memory/1476-803-0x00007FF9DD860000-0x00007FF9DD878000-memory.dmp	upx
behavioral1/memory/1476-807-0x00007FF9CEE80000-0x00007FF9CEFF6000-memory.dmp	upx
behavioral1/memory/1476-806-0x00007FF9D08A0000-0x00007FF9D08C3000-memory.dmp	upx
behavioral1/memory/1476-805-0x00007FF9E1090000-0x00007FF9E114C000-memory.dmp	upx
behavioral1/memory/1476-825-0x00007FF9D0190000-0x00007FF9D01A2000-memory.dmp	upx
behavioral1/memory/1476-824-0x00007FF9D01B0000-0x00007FF9D01BD000-memory.dmp	upx
behavioral1/memory/1476-823-0x00007FF9D01C0000-0x00007FF9D01CC000-memory.dmp	upx
behavioral1/memory/1476-822-0x00007FF9D01D0000-0x00007FF9D01DC000-memory.dmp	upx
behavioral1/memory/1476-821-0x00007FF9D0890000-0x00007FF9D089B000-memory.dmp	upx
behavioral1/memory/1476-820-0x00007FF9D6200000-0x00007FF9D620B000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
23	discord.com
25	discord.com
26	discord.com
2	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4748	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1688	WMIC.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
1476	abys2.exe
4168	powershell.exe
4168	powershell.exe
632	powershell.exe
632	powershell.exe
3404	powershell.exe
3404	powershell.exe
4060	powershell.exe
4060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	abys2.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeIncreaseQuotaPrivilege	1984	WMIC.exe
Token: SeSecurityPrivilege	1984	WMIC.exe
Token: SeTakeOwnershipPrivilege	1984	WMIC.exe
Token: SeLoadDriverPrivilege	1984	WMIC.exe
Token: SeSystemProfilePrivilege	1984	WMIC.exe
Token: SeSystemtimePrivilege	1984	WMIC.exe
Token: SeProfSingleProcessPrivilege	1984	WMIC.exe
Token: SeIncBasePriorityPrivilege	1984	WMIC.exe
Token: SeCreatePagefilePrivilege	1984	WMIC.exe
Token: SeBackupPrivilege	1984	WMIC.exe
Token: SeRestorePrivilege	1984	WMIC.exe
Token: SeShutdownPrivilege	1984	WMIC.exe
Token: SeDebugPrivilege	1984	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1984	WMIC.exe
Token: SeRemoteShutdownPrivilege	1984	WMIC.exe
Token: SeUndockPrivilege	1984	WMIC.exe
Token: SeManageVolumePrivilege	1984	WMIC.exe
Token: 33	1984	WMIC.exe
Token: 34	1984	WMIC.exe
Token: 35	1984	WMIC.exe
Token: 36	1984	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1984	WMIC.exe
Token: SeSecurityPrivilege	1984	WMIC.exe
Token: SeTakeOwnershipPrivilege	1984	WMIC.exe
Token: SeLoadDriverPrivilege	1984	WMIC.exe
Token: SeSystemProfilePrivilege	1984	WMIC.exe
Token: SeSystemtimePrivilege	1984	WMIC.exe
Token: SeProfSingleProcessPrivilege	1984	WMIC.exe
Token: SeIncBasePriorityPrivilege	1984	WMIC.exe
Token: SeCreatePagefilePrivilege	1984	WMIC.exe
Token: SeBackupPrivilege	1984	WMIC.exe
Token: SeRestorePrivilege	1984	WMIC.exe
Token: SeShutdownPrivilege	1984	WMIC.exe
Token: SeDebugPrivilege	1984	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1984	WMIC.exe
Token: SeRemoteShutdownPrivilege	1984	WMIC.exe
Token: SeUndockPrivilege	1984	WMIC.exe
Token: SeManageVolumePrivilege	1984	WMIC.exe
Token: 33	1984	WMIC.exe
Token: 34	1984	WMIC.exe
Token: 35	1984	WMIC.exe
Token: 36	1984	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2660	wmic.exe
Token: SeSecurityPrivilege	2660	wmic.exe
Token: SeTakeOwnershipPrivilege	2660	wmic.exe
Token: SeLoadDriverPrivilege	2660	wmic.exe
Token: SeSystemProfilePrivilege	2660	wmic.exe
Token: SeSystemtimePrivilege	2660	wmic.exe
Token: SeProfSingleProcessPrivilege	2660	wmic.exe
Token: SeIncBasePriorityPrivilege	2660	wmic.exe
Token: SeCreatePagefilePrivilege	2660	wmic.exe
Token: SeBackupPrivilege	2660	wmic.exe
Token: SeRestorePrivilege	2660	wmic.exe
Token: SeShutdownPrivilege	2660	wmic.exe
Token: SeDebugPrivilege	2660	wmic.exe
Token: SeSystemEnvironmentPrivilege	2660	wmic.exe
Token: SeRemoteShutdownPrivilege	2660	wmic.exe
Token: SeUndockPrivilege	2660	wmic.exe
Token: SeManageVolumePrivilege	2660	wmic.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1476	3468	abys2.exe	81
PID 3468 wrote to memory of 1476	3468	abys2.exe	81
PID 1476 wrote to memory of 3176	1476	abys2.exe	82
PID 1476 wrote to memory of 3176	1476	abys2.exe	82
PID 1476 wrote to memory of 4748	1476	abys2.exe	86
PID 1476 wrote to memory of 4748	1476	abys2.exe	86
PID 4748 wrote to memory of 5056	4748	cmd.exe	88
PID 4748 wrote to memory of 5056	4748	cmd.exe	88
PID 1476 wrote to memory of 2656	1476	abys2.exe	89
PID 1476 wrote to memory of 2656	1476	abys2.exe	89
PID 2656 wrote to memory of 4168	2656	cmd.exe	91
PID 2656 wrote to memory of 4168	2656	cmd.exe	91
PID 1476 wrote to memory of 3380	1476	abys2.exe	92
PID 1476 wrote to memory of 3380	1476	abys2.exe	92
PID 3380 wrote to memory of 632	3380	cmd.exe	94
PID 3380 wrote to memory of 632	3380	cmd.exe	94
PID 3380 wrote to memory of 3404	3380	cmd.exe	95
PID 3380 wrote to memory of 3404	3380	cmd.exe	95
PID 3380 wrote to memory of 4060	3380	cmd.exe	96
PID 3380 wrote to memory of 4060	3380	cmd.exe	96
PID 1476 wrote to memory of 4788	1476	abys2.exe	100
PID 1476 wrote to memory of 4788	1476	abys2.exe	100
PID 4788 wrote to memory of 1984	4788	cmd.exe	102
PID 4788 wrote to memory of 1984	4788	cmd.exe	102
PID 1476 wrote to memory of 2660	1476	abys2.exe	104
PID 1476 wrote to memory of 2660	1476	abys2.exe	104
PID 1476 wrote to memory of 464	1476	abys2.exe	106
PID 1476 wrote to memory of 464	1476	abys2.exe	106
PID 464 wrote to memory of 1688	464	cmd.exe	108
PID 464 wrote to memory of 1688	464	cmd.exe	108
PID 1476 wrote to memory of 3424	1476	abys2.exe	109
PID 1476 wrote to memory of 3424	1476	abys2.exe	109
PID 3424 wrote to memory of 5012	3424	cmd.exe	111
PID 3424 wrote to memory of 5012	3424	cmd.exe	111
PID 1476 wrote to memory of 4036	1476	abys2.exe	112
PID 1476 wrote to memory of 4036	1476	abys2.exe	112
PID 4036 wrote to memory of 1248	4036	cmd.exe	114
PID 4036 wrote to memory of 1248	4036	cmd.exe	114
PID 1476 wrote to memory of 404	1476	abys2.exe	115
PID 1476 wrote to memory of 404	1476	abys2.exe	115
PID 404 wrote to memory of 792	404	cmd.exe	117
PID 404 wrote to memory of 792	404	cmd.exe	117
PID 1476 wrote to memory of 1756	1476	abys2.exe	118
PID 1476 wrote to memory of 1756	1476	abys2.exe	118
PID 1756 wrote to memory of 4176	1756	cmd.exe	120
PID 1756 wrote to memory of 4176	1756	cmd.exe	120

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\abys2.exe
"C:\Users\Admin\AppData\Local\Temp\abys2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\abys2.exe
  "C:\Users\Admin\AppData\Local\Temp\abys2.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‎ ‏ .scr"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‎ ‏ .scr"
      4⤵
      Drops startup file
      Views/modifies file attributes
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:1248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Browser\cc's.txt

Filesize
91B

MD5
5aa796b6950a92a226cc5c98ed1c47e8

SHA1
6706a4082fc2c141272122f1ca424a446506c44d

SHA256
c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

SHA512
976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Browser\history.txt

Filesize
23B

MD5
5638715e9aaa8d3f45999ec395e18e77

SHA1
4e3dc4a1123edddf06d92575a033b42a662fe4ad

SHA256
4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6

SHA512
78c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\ConvertFromOptimize.txt

Filesize
329KB

MD5
0c77907738b657b96af4e7b90695b4b2

SHA1
79994dac72ab383e7f9c16a2035c584c36c2b442

SHA256
1469437a567df8eea193b152ea085a501805ba3c6e45d2f2463d756c248e338f

SHA512
40881c7bff3f1e16f7b99ec6d3d4079072ee0a700e7a34f80deb595563d620d5a424b09bbf633edfa59c32878a029cf3dadddff142783a13269b16f8e96a9bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\ConvertFromUninstall.docx

Filesize
784KB

MD5
1fc613ed97fb136ce4618b8bf2cbde93

SHA1
3cfd89198e14387e797aa1baaf45e9b157d60c93

SHA256
44b3a6022530f49a32ada2227dfdb5e4933e4851a8ce0375330e9a2bcefc5e0e

SHA512
61e1cd365213e33c220e01a286fe756f6c05bfd0cdf4656c4a9b021b122ef7433afec7a9b535a86c926dfc466d903ca897d80d41bf7efe783829a21b090a65be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\CopyUndo.docx

Filesize
15KB

MD5
a84422cd7c4aac42f03d67a8f45a10b4

SHA1
5e7c171d2b78db1d230c6ea3dd8e18d05c16cc22

SHA256
571370f7d68f29841fca0d3337b689bd925dfa102374d13dc158f2ed9bb7dc3a

SHA512
a1b145e5ce7f797751af47ed04fc01110d5ec81c6f332fff36b7ac3ad58cab464a0007be3d7f3a7070f9ab94461ead6298fd11ba88791aec2aa5a70e4fc03021

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\ExitStop.docx

Filesize
16KB

MD5
7694865b34f08b6be6780f923d1be6fa

SHA1
b450600dbc1389f4a5f772d76f265195610014b0

SHA256
a1a61f3ccf0d5ea72a1c389fbff2cba003eab30a14600a3fcd0d10004a814467

SHA512
c1d903a66c65379748cfbb105f3919a7a082bcf670e5f58397b8b6ff1301b9a0f4a1b97e617b229d27fbe2c671e619b5e653033a371c57371ef2742def1cd5c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\LimitSync.odt

Filesize
399KB

MD5
731fb7e6de7e6d8ae947bc74458f6702

SHA1
5bb341759df0124c1b028a211219e6f612ee80bc

SHA256
2e7e0ddeb02f7ba4f01f4b41376f7e091a516cb63c153aa918b0049ccf6c358f

SHA512
0be239312d323d7efbc6f6f7e3be75a740ecb50c8e5a646e6c88043caca36e61e5b3542e694cef7a04a99d533f436bf2ca6612597a330dc97a6a4b360b6adea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\PopBackup.txt

Filesize
540KB

MD5
6421411a29b9f4d7d34f9987f7ca7f4a

SHA1
ec2071a3ff4a642e245cd7b6d1ddccd7586e136b

SHA256
3ffa756e98547f84a831b666e30d7c3566e062be4166d5f387a2164f152aebc1

SHA512
60e09c728822e4dfe0ba6bc67344d8f2fb5b48a6b554c445b5547fb39e5ab51afc27c7a7bbdbd7ddf4c7483e1d0bd34f03e2ce0130b292fff8e28b5f2bf2d52c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vq6QJTHSOu\Common Files\RestoreShow.docx

Filesize
12KB

MD5
1c06dfbe9a29c2b590955f6a8a3a1897

SHA1
61312c1307cb831683d09b422cee3ecee67ae797

SHA256
5eab740ed76b38e1f29a2218146fcd20feabe25aad9304cbd72c2369a81ffe1a

SHA512
784bd1079ea47135087485b3623fbdf1ab57c5e5d71d6f272c6ec1c1242af41a1501279cecaa28d0d317a4eab54793fe7bce19d54ddae6ed208c560152667ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_asyncio.pyd

Filesize
36KB

MD5
5a1206bd99650e3293b3f9683a5cbb4b

SHA1
4910bd26ae8898ba3d63bb3fa412584ef1a2d933

SHA256
8057e3f1829fa567a33eac2194c7c2f0b60f85a638ebbd21de58a3be1b3e9465

SHA512
a0cb73a038c3b3083c91a894e516d773afbc13c938022f6666cbd258a0ac3aba3ed723c87ea6c89d5503c31cb0c03f412e56d85298719b0ddac87205c335faa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_bz2.pyd

Filesize
48KB

MD5
40294c408837f9290de29f605027e0a9

SHA1
25e1fb3de26e2c53abfdd1ced972438e2e151bd0

SHA256
764fb664a03bdae19903ee5fecfcac8aee979ad2b5fc0bf1f4515686a33e18d1

SHA512
b21fe98e05f7a871c5af9c34e23df9693b29303592e473c84bceda3e69e4afb3659b14c186f742267625f24299ea00eb97f066288e92db1f5cb7e995d31d9e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
55ee36964cfb1cb5c4a13762722e6b8e

SHA1
b7337e1aeac9bec9daffac43bcb881011f9eded9

SHA256
b346624f456f5297696e9708fa44a5473c1dc53443d14e6b5330cf191ca2d766

SHA512
337462452c576fa1001c750df5af943a9efebf0409246849d700b6c2e2766ed2c4bf46ca7027d2e37bf1f949525fca682ee322ac7867e0b5525be9054c10c24a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_ctypes.pyd

Filesize
58KB

MD5
ee9b21f64fdfe722f18a8336be3123db

SHA1
3083b97eefecda77894302e33abbcce4b9257c50

SHA256
6b2850bbea529f011ab57e74718bfdda7210a6b7334b2db5bf6dd66db469b9d4

SHA512
462722a8b8a05f4a4a371b5c41361de239bdaadfb97d1cbcdc66b608a09dcc86cbb4978dcd0d81f68df4f51aab332efe6de361a61110f9cae719e61c9a1475a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_decimal.pyd

Filesize
106KB

MD5
5aa903771f8966355d65443bbb94db7e

SHA1
30a28066be618095d2a33a381e4b85d09d099bdf

SHA256
8e0104a9cd3dc02b1e8ec1be3ad0fbbb5485303a7792fee945d101fa44fce2ae

SHA512
baf8a240bf2d17badd4bcc8ede51ca14cf2fd12e91276266d6afa26027d8801853e2e6789a4503440564bdb21d5fab516dedff7cfa95e3118de23e8618d2306b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_hashlib.pyd

Filesize
35KB

MD5
6b32fb877f10506e5c7bb0d43c63dc38

SHA1
ec903f101312dfa465b934586754e0d84cb469b4

SHA256
16a603ac6ff421c8ce55c27ab63a2400730ef072eb5bbc3ab973aa96df363c03

SHA512
1b5b0711341aa4fa27ab688739076079209557c8a94415cb0dafd05d7f91ef7a05a54d62e252ccbc312617aac1597770cfc0579156d084296cfef40ddd2502ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_lzma.pyd

Filesize
86KB

MD5
abb9bff2d88287b0bbb9fdbc3ceef73e

SHA1
ca36db134a53cba0fb53915c9685df51304a4c4e

SHA256
2e47ef901b5daf77b85f60eed4cc69a585b41ebf784db877cdc94e5b9cbba3a4

SHA512
8b0338471a4067d4902ee34d95e08057fb00e52a7943b80b79d0f51e151d884db3b8013b8fbb63ffb474ea7f24b7f5be325d44bd7dad459910975373ea8a64db

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_multiprocessing.pyd

Filesize
26KB

MD5
d30c2fa7118a6e6baeef6fb8236a0bf7

SHA1
1d57ef4b5c52648f153bf2b207612e6b6a415b35

SHA256
6e3bb8e606620c7a27429a981d2202a710286f9c9fe2d66c255afbeeb1264ee3

SHA512
a4ea3d2036d38046a3d408fb6a8a55efbe4791b83a7dce47e40a0cf729542ac01030a5acea1cd478d856133f40f4735ac211b139f37fa53a93c63b78d4717d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_overlapped.pyd

Filesize
32KB

MD5
6caed89de355a121dc70bb92c6e23d33

SHA1
ed8e4fd3aa49134ea1fd624a233c6613c8b7bf65

SHA256
38bf600b1d838d7597648ed7a1adfd74ba53357b8f3f107311a92f4b15388d33

SHA512
932c2b132d0086ed59e2d741bd15eb31c2ed6d86f90e6224e3e02111aa260f9dd9de51f8769d9b128d5e323799c80ce98dd9b3e377499efefede012f514f2598

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_queue.pyd

Filesize
25KB

MD5
7d9b2b53475872431fb4da860cb539f2

SHA1
d1421daf86308431ba173e41987f2f79d22e12d0

SHA256
19f7ad282e75a355dd7385dee2864fc3add24415d3e9682a11a6c52859c548ba

SHA512
050d065a2fd039bcfc8472e6a3c22a034e1ab774bcc08e8196f061aba5e318de9006aa9afb9825071b3b0b7819e29ad7820663c78a85de966c6aa28ac5dbbe2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_socket.pyd

Filesize
43KB

MD5
bad2e960b0a9554b91ef60615ea55dd5

SHA1
672e0a09193688cd4d5a611d8142637bc1a52d08

SHA256
438c7c1059314f93df571583683ca8d36c4600022ee55bd37c9071a41fcb8998

SHA512
18cfecc6fb38c09c483c131e685abed365d271c8e6707b294863cb25a74b9b6c720be70f97d0d7903ef6a55cd45da9898a3d88906f6f599b2b2fe67958935724

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_sqlite3.pyd

Filesize
56KB

MD5
5d5670c57a88c0835e72da8c8e19cfb1

SHA1
7b0a3580118d71514c38cb3200b5f140e33b0f5e

SHA256
39f38fcf1839b3a7dae68175275786c99650ee150ec6bb0df071a3df8bfd629e

SHA512
acc7b9577082c6d96aa9632ba7835dc0046aff2964123b6a8be1e03c56400a0177cd20b9897f94bb517d0bcd7cd570a44b5ca9509e6f6895e8552e82a2985d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_ssl.pyd

Filesize
65KB

MD5
7ada89e02b3eafeb1a7f81c26554242f

SHA1
0101e60ae2f6a6be01310ef15809b3265aef3694

SHA256
e179200fa41ac62133e54a30c96dd30aa9269c76e61c4fd14a9745e6d94105e7

SHA512
84ec7c52b3851d28ee1c7f66b5ff57dbfc0bc9a9b877f55df57d84430dc7f770820135845c4d1d3393893e86df3ccb0a4d7d01421fb1cdfd68512b8df8251495

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\_uuid.pyd

Filesize
24KB

MD5
b21b864e357ccd72f35f2814bd1e6012

SHA1
2ff0740c26137c6a81b96099c1f5209db33ac56a

SHA256
ce9e2a30c20e6b83446d9ba83bb83c5570e1b1da0e87ff467d1b4fc090da6c53

SHA512
29667eb0e070063ef28b7f8cc39225136065340ae358ad0136802770b2f48ac4bda5e60f2e2083f588859b7429b9ea3bad1596a380601e3b2b4bb74791df92a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\base_library.zip

Filesize
1.4MB

MD5
6e706e4fa21d90109df6fce1b2595155

SHA1
5328dd26b361d36239facff79baca1bab426de68

SHA256
ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998

SHA512
c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\certifi\cacert.pem

Filesize
287KB

MD5
2a6bef11d1f4672f86d3321b38f81220

SHA1
b4146c66e7e24312882d33b16b2ee140cb764b0e

SHA256
1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c

SHA512
500dfff929d803b0121796e8c1a30bdfcb149318a4a4de460451e093e4cbd568cd12ab20d0294e0bfa7efbd001de968cca4c61072218441d4fa7fd9edf7236d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
9KB

MD5
542c223312c5dbe5d21fc216dfb8cb7e

SHA1
c2922363caf50c40ac079786af12141f69248d5d

SHA256
6864ce58854fc54853f557c218bddbb73fe457b704bee24da84579d82aee6509

SHA512
2eab599c5ca6eeb8b80bccce839b37ca42c949d45d12981a1efe43df980736ede7b4fd1a23d2dbba7895948a8dfa79136549dffb9fdbf7110430f53fea557c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
39KB

MD5
d28bf4b47504d9fa10214d284bf47bca

SHA1
8ab2d660f00d4b0db47da1d691cb27c044240940

SHA256
4609d4065b796165f71f15a17dc43307219acaac2248e48c15e8e0b3ae5685be

SHA512
e6dc5e31047ae7fbe81e80d86d42c6d34faa36c4812d6c640610fb5a679acd0890e10eae3d142dfed0b2b9474b83daf162b2bceb2cadc06a70a7115dd831e074

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\libcrypto-3.dll

Filesize
1.6MB

MD5
63eb76eccfe70cff3a3935c0f7e8ba0f

SHA1
a8dd05dce28b79047e18633aee5f7e68b2f89a36

SHA256
785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e

SHA512
8da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\libffi-8.dll

Filesize
29KB

MD5
be8ceb4f7cb0782322f0eb52bc217797

SHA1
280a7cc8d297697f7f818e4274a7edd3b53f1e4d

SHA256
7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676

SHA512
07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\libssl-3.dll

Filesize
222KB

MD5
7e87c34b39f3a8c332df6e15fd83160b

SHA1
db712b55f23d8e946c2d91cbbeb7c9a78a92b484

SHA256
41448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601

SHA512
eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\luna.aes

Filesize
68KB

MD5
f4cc0cba647f467de7f08b13a5e1b087

SHA1
918b0a0dd45a7c95533de9c9ee95963ed790f87c

SHA256
9ed965cadfcf3bc0842642f6ea540c9f8b17a637bedd43495cbd517da8256f37

SHA512
e97ac3626187631d905b522b1b8436fd9682dfa39456354ef6f440a72bfd8f8af8e19f183d47e1d871bca2cf45ea3989daaea63cbc3636eba93bd92521e2ea4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\psutil\_psutil_windows.pyd

Filesize
31KB

MD5
3adca2ff39adeb3567b73a4ca6d0253c

SHA1
ae35dde2348c8490f484d1afd0648380090e74fc

SHA256
92202b877579b74a87be769d58f9d1e8aced8a97336ad70e97d09685a10afeb3

SHA512
358d109b23cf99eb7396c450660f193e9e16f85f13737ecf29f4369b44f8356041a08443d157b325ccb5125a5f10410659761eda55f24fcc03a082ac8acdd345

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\pyexpat.pyd

Filesize
87KB

MD5
2e5f673d0c99742cc5a59780f91185d3

SHA1
509f1d0c69ffec3d01cd5fcca82c8c9b1bdf8fd3

SHA256
14a09010751a844c23e5a9251fe0e79346449c68b3bbfffbc051244ba5a41cf3

SHA512
2b94e3bcd3f795fbba47488da43db32bfc373d09a6283b43a4be2816a80cc554829e0787a4eff68e874feb73084cc0428774114e56893428749e44b0c6fddb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\python3.DLL

Filesize
65KB

MD5
35da4143951c5354262a28dee569b7b2

SHA1
b07cb6b28c08c012eecb9fd7d74040163cdf4e0e

SHA256
920350a7c24c46339754e38d0db34ab558e891da0b3a389d5230a0d379bee802

SHA512
2976667732f9ee797b7049d86fd9beeb05409adb7b89e3f5b1c875c72a4076cf65c762632b7230d7f581c052fce65bb91c1614c9e3a52a738051c3bc3d167a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\python311.dll

Filesize
1.6MB

MD5
18c6889e605169f00328dfa6894607b2

SHA1
ecd0c3ad3cca1704b8c989b0fdd214d572cba02c

SHA256
8f09d056f75b5faf696be1bff441fcc1ff39f96155296d77ce1d56ad918e3fcf

SHA512
5563aa51f66d9d740c6fda55b6fff638221e4e1811859f055f0e316dc80a377e80716f1f2711237b0cebbdab07566e827c5eb7a384ea407636f23d7ebeeea384

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\pywin32_system32\pythoncom311.dll

Filesize
193KB

MD5
471d17f08b66f1489516d271ebf831e3

SHA1
0296e3848de8e99c55bab82c7b181112fb30e840

SHA256
39f4e62d0366897e20eb849cdc78f4ea988605ba86a95c9c741f2797086a6788

SHA512
857a92588f3363ce9e139fe92222ece6d7d926fdcb2c5c1febfb6328389f3e5f8b82063aface5b61015de031e6bfda556067f49f9cc8103664749d8581da1587

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\pywin32_system32\pywintypes311.dll

Filesize
62KB

MD5
04ce7664658c9c18527594708550d59e

SHA1
1db7e6722aaea33d92fba441fca294600d904103

SHA256
e3be247830c23a1751e1bab98d02ba5da3721d2a85469eda3764fc583ca2a6ff

SHA512
e9744b2eee5fa848d5ac83622a6b1c1a1009d7ad8a944bda7a118dd75d8d24218fa2e4ef67718caabda0dd67efdd5be1497705afef8edec830f1b2402d0f0a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\select.pyd

Filesize
25KB

MD5
72e0f358a28e6f4c248c8ce76512341b

SHA1
ecc215a1fc652ef58d6f2746680d9a19a555639f

SHA256
4694c2e1b23800f1af25e303f21d5f12443dbf93d4f4806585b64bc0ee91e5fc

SHA512
019c446f1cb495810a265a55aeee7cfa8225130d330d024828b1ead1f31e0432aa11bb2f74ef27729c9bc2db00662791e57ef0ec4cefdfa1622255e47c3d6abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\sqlite3.dll

Filesize
630KB

MD5
b4090472daed7dfec8bc6bbe4b30fba8

SHA1
fc429d9ccd0276e4491bab542ae0af1eafd95140

SHA256
ba12d87ebe1fa1ca94513db8f5209d79cddd1fc3e8f436f48707129a32c38142

SHA512
0e37857b9195cf72317ba0c6ac84f811b457e12be0f96323e678b1316a8669732aa3a85040b02a18dc791170d86b901f224fca34743b64616d2ecae2114e64ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\unicodedata.pyd

Filesize
295KB

MD5
89bf177f2d232032496b1d896ac50a3d

SHA1
303d0b5bca3beaaf28ede93dcf5aca654f5ad7bf

SHA256
286714c9193343f218dcadb47f6356f1232b02b59ecacd785ac42df04636e3ca

SHA512
a9d0446155abd67e067372a29b62fad1311b186dd0d1f259c03f240967ac4619142437bcbd2b4c3cb1386e1d377f1c46d12dd53ac320e360e5b3e60a5e1455c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\win32\win32api.pyd

Filesize
48KB

MD5
d2668458d3a33de3fbe931eb029a3628

SHA1
258351db3b6ce6ae80a428c2b5dc0a3f7cfa112a

SHA256
2c37610d165a3c3c0350b08a5d803928267aa69878f753d2e2b048de4f3a7413

SHA512
440b760300043938c1a3130baf667426d1dabdb6dab24581054c9d5ef213997183b0a317b4f846f277eabb07f7bd4d2cc42d90158511c904b7a78672869c641d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34682\zstandard\backend_c.cp311-win_amd64.pyd

Filesize
174KB

MD5
27b39c3d5734c38a73cd128985961d99

SHA1
db1bae0179194f9e1f101da9b85c9963cead31c9

SHA256
bb210e80a9d2957a4bbdbd809d4e98bb78d8b6d99ceb5a965dfc1afe6c5e52f8

SHA512
249a84f43592e5ab63e340c4e45a4306dcaa8c6d287627ac87b852d9503c81754a6fd8373afbbc50cb4d3eeac47b1e276b38e65274d6fa71f09d4792685d7bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0qvfh4bh.vj2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\tmp\9CoXwqWl3xM0z

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
memory/1476-822-0x00007FF9D01D0000-0x00007FF9D01DC000-memory.dmp

Filesize
48KB

Download
memory/1476-757-0x00007FF9E5B80000-0x00007FF9E5B99000-memory.dmp

Filesize
100KB

Download
memory/1476-781-0x00007FF9E52F0000-0x00007FF9E5314000-memory.dmp

Filesize
144KB

Download
memory/1476-783-0x00007FF9E0480000-0x00007FF9E0492000-memory.dmp

Filesize
72KB

Download
memory/1476-788-0x00007FF9DD880000-0x00007FF9DD894000-memory.dmp

Filesize
80KB

Download
memory/1476-777-0x00007FF9CF120000-0x00007FF9CF649000-memory.dmp

Filesize
5.2MB

Download
memory/1476-794-0x00007FF9D6410000-0x00007FF9D6436000-memory.dmp

Filesize
152KB

Download
memory/1476-797-0x00007FF9CF000000-0x00007FF9CF11C000-memory.dmp

Filesize
1.1MB

Download
memory/1476-796-0x00007FF9E5B80000-0x00007FF9E5B99000-memory.dmp

Filesize
100KB

Download
memory/1476-778-0x00007FF9D62B0000-0x00007FF9D637D000-memory.dmp

Filesize
820KB

Download
memory/1476-793-0x00007FF9E2170000-0x00007FF9E217B000-memory.dmp

Filesize
44KB

Download
memory/1476-776-0x00007FF9CF970000-0x00007FF9CFF60000-memory.dmp

Filesize
5.9MB

Download
memory/1476-787-0x00007FF9DC9F0000-0x00007FF9DCA77000-memory.dmp

Filesize
540KB

Download
memory/1476-773-0x00007FF9E1870000-0x00007FF9E18A3000-memory.dmp

Filesize
204KB

Download
memory/1476-802-0x00007FF9E5890000-0x00007FF9E589D000-memory.dmp

Filesize
52KB

Download
memory/1476-803-0x00007FF9DD860000-0x00007FF9DD878000-memory.dmp

Filesize
96KB

Download
memory/1476-807-0x00007FF9CEE80000-0x00007FF9CEFF6000-memory.dmp

Filesize
1.5MB

Download
memory/1476-806-0x00007FF9D08A0000-0x00007FF9D08C3000-memory.dmp

Filesize
140KB

Download
memory/1476-805-0x00007FF9E1090000-0x00007FF9E114C000-memory.dmp

Filesize
752KB

Download
memory/1476-825-0x00007FF9D0190000-0x00007FF9D01A2000-memory.dmp

Filesize
72KB

Download
memory/1476-824-0x00007FF9D01B0000-0x00007FF9D01BD000-memory.dmp

Filesize
52KB

Download
memory/1476-823-0x00007FF9D01C0000-0x00007FF9D01CC000-memory.dmp

Filesize
48KB

Download
memory/1476-771-0x00007FF9E18B0000-0x00007FF9E18DB000-memory.dmp

Filesize
172KB

Download
memory/1476-821-0x00007FF9D0890000-0x00007FF9D089B000-memory.dmp

Filesize
44KB

Download
memory/1476-820-0x00007FF9D6200000-0x00007FF9D620B000-memory.dmp

Filesize
44KB

Download
memory/1476-819-0x00007FF9D6210000-0x00007FF9D621C000-memory.dmp

Filesize
48KB

Download
memory/1476-818-0x00007FF9CF120000-0x00007FF9CF649000-memory.dmp

Filesize
5.2MB

Download
memory/1476-817-0x00007FF9D6400000-0x00007FF9D640C000-memory.dmp

Filesize
48KB

Download
memory/1476-816-0x00007FF9DA7A0000-0x00007FF9DA7AC000-memory.dmp

Filesize
48KB

Download
memory/1476-815-0x00007FF9E1870000-0x00007FF9E18A3000-memory.dmp

Filesize
204KB

Download
memory/1476-814-0x00007FF9DC9D0000-0x00007FF9DC9DB000-memory.dmp

Filesize
44KB

Download
memory/1476-813-0x00007FF9DC9E0000-0x00007FF9DC9EC000-memory.dmp

Filesize
48KB

Download
memory/1476-812-0x00007FF9DE110000-0x00007FF9DE11B000-memory.dmp

Filesize
44KB

Download
memory/1476-811-0x00007FF9E0E80000-0x00007FF9E0E8C000-memory.dmp

Filesize
48KB

Download
memory/1476-810-0x00007FF9E1860000-0x00007FF9E186B000-memory.dmp

Filesize
44KB

Download
memory/1476-809-0x00007FF9E1D60000-0x00007FF9E1D6B000-memory.dmp

Filesize
44KB

Download
memory/1476-808-0x00007FF9D07B0000-0x00007FF9D07E8000-memory.dmp

Filesize
224KB

Download
memory/1476-829-0x00007FF9D0150000-0x00007FF9D0179000-memory.dmp

Filesize
164KB

Download
memory/1476-830-0x00007FF9CEC30000-0x00007FF9CEE75000-memory.dmp

Filesize
2.3MB

Download
memory/1476-828-0x00007FF9D0180000-0x00007FF9D018C000-memory.dmp

Filesize
48KB

Download
memory/1476-827-0x00007FF9D62A0000-0x00007FF9D62AE000-memory.dmp

Filesize
56KB

Download
memory/1476-826-0x00007FF9D62B0000-0x00007FF9D637D000-memory.dmp

Filesize
820KB

Download
memory/1476-996-0x00007FF9E52F0000-0x00007FF9E5314000-memory.dmp

Filesize
144KB

Download
memory/1476-767-0x00007FF9E1C80000-0x00007FF9E1CAE000-memory.dmp

Filesize
184KB

Download
memory/1476-768-0x00007FF9E1090000-0x00007FF9E114C000-memory.dmp

Filesize
752KB

Download
memory/1476-760-0x00007FF9E5DE0000-0x00007FF9E5DED000-memory.dmp

Filesize
52KB

Download
memory/1476-761-0x00007FF9E5890000-0x00007FF9E589D000-memory.dmp

Filesize
52KB

Download
memory/1476-782-0x00007FF9E52D0000-0x00007FF9E52E5000-memory.dmp

Filesize
84KB

Download
memory/1476-755-0x00007FF9E18E0000-0x00007FF9E1916000-memory.dmp

Filesize
216KB

Download
memory/1476-752-0x00007FF9E6EC0000-0x00007FF9E6ED9000-memory.dmp

Filesize
100KB

Download
memory/1476-753-0x00007FF9E1EA0000-0x00007FF9E1ECD000-memory.dmp

Filesize
180KB

Download
memory/1476-729-0x00007FF9EB3A0000-0x00007FF9EB3AF000-memory.dmp

Filesize
60KB

Download
memory/1476-726-0x00007FF9E52F0000-0x00007FF9E5314000-memory.dmp

Filesize
144KB

Download
memory/1476-718-0x00007FF9CF970000-0x00007FF9CFF60000-memory.dmp

Filesize
5.9MB

Download
memory/1476-938-0x00007FF9D6410000-0x00007FF9D6436000-memory.dmp

Filesize
152KB

Download
memory/1476-962-0x00007FF9D08A0000-0x00007FF9D08C3000-memory.dmp

Filesize
140KB

Download
memory/1476-964-0x00007FF9D07B0000-0x00007FF9D07E8000-memory.dmp

Filesize
224KB

Download
memory/1476-963-0x00007FF9CEE80000-0x00007FF9CEFF6000-memory.dmp

Filesize
1.5MB

Download
memory/1476-966-0x00007FF9E13E0000-0x00007FF9E13EF000-memory.dmp

Filesize
60KB

Download
memory/1476-939-0x00007FF9CF970000-0x00007FF9CFF60000-memory.dmp

Filesize
5.9MB

Download
memory/1476-961-0x00007FF9DD860000-0x00007FF9DD878000-memory.dmp

Filesize
96KB

Download
memory/1476-951-0x00007FF9E1870000-0x00007FF9E18A3000-memory.dmp

Filesize
204KB

Download
memory/1476-947-0x00007FF9E5890000-0x00007FF9E589D000-memory.dmp

Filesize
52KB

Download
memory/1476-940-0x00007FF9E52F0000-0x00007FF9E5314000-memory.dmp

Filesize
144KB

Download
memory/1476-983-0x00007FF9CF120000-0x00007FF9CF649000-memory.dmp

Filesize
5.2MB

Download
memory/1476-970-0x00007FF9CF970000-0x00007FF9CFF60000-memory.dmp

Filesize
5.9MB

Download
memory/1476-1022-0x00007FF9E13E0000-0x00007FF9E13EF000-memory.dmp

Filesize
60KB

Download
memory/1476-1021-0x00007FF9DC9F0000-0x00007FF9DCA77000-memory.dmp

Filesize
540KB

Download
memory/1476-1020-0x00007FF9D62B0000-0x00007FF9D637D000-memory.dmp

Filesize
820KB

Download
memory/1476-1019-0x00007FF9D07B0000-0x00007FF9D07E8000-memory.dmp

Filesize
224KB

Download
memory/1476-1018-0x00007FF9CEE80000-0x00007FF9CEFF6000-memory.dmp

Filesize
1.5MB

Download
memory/1476-1017-0x00007FF9D08A0000-0x00007FF9D08C3000-memory.dmp

Filesize
140KB

Download
memory/1476-1016-0x00007FF9DD860000-0x00007FF9DD878000-memory.dmp

Filesize
96KB

Download
memory/1476-1015-0x00007FF9CF000000-0x00007FF9CF11C000-memory.dmp

Filesize
1.1MB

Download
memory/1476-1014-0x00007FF9D6410000-0x00007FF9D6436000-memory.dmp

Filesize
152KB

Download
memory/1476-1013-0x00007FF9E2170000-0x00007FF9E217B000-memory.dmp

Filesize
44KB

Download
memory/1476-1012-0x00007FF9CEC30000-0x00007FF9CEE75000-memory.dmp

Filesize
2.3MB

Download
memory/1476-1011-0x00007FF9DD880000-0x00007FF9DD894000-memory.dmp

Filesize
80KB

Download
memory/1476-1010-0x00007FF9E0480000-0x00007FF9E0492000-memory.dmp

Filesize
72KB

Download
memory/1476-1009-0x00007FF9E52D0000-0x00007FF9E52E5000-memory.dmp

Filesize
84KB

Download
memory/1476-1008-0x00007FF9D0150000-0x00007FF9D0179000-memory.dmp

Filesize
164KB

Download
memory/1476-1007-0x00007FF9E1870000-0x00007FF9E18A3000-memory.dmp

Filesize
204KB

Download
memory/1476-1006-0x00007FF9E18B0000-0x00007FF9E18DB000-memory.dmp

Filesize
172KB

Download
memory/1476-1005-0x00007FF9E1090000-0x00007FF9E114C000-memory.dmp

Filesize
752KB

Download
memory/1476-1004-0x00007FF9E1C80000-0x00007FF9E1CAE000-memory.dmp

Filesize
184KB

Download
memory/1476-1003-0x00007FF9E5890000-0x00007FF9E589D000-memory.dmp

Filesize
52KB

Download
memory/1476-1002-0x00007FF9E5DE0000-0x00007FF9E5DED000-memory.dmp

Filesize
52KB

Download
memory/1476-1001-0x00007FF9E5B80000-0x00007FF9E5B99000-memory.dmp

Filesize
100KB

Download
memory/1476-1000-0x00007FF9E18E0000-0x00007FF9E1916000-memory.dmp

Filesize
216KB

Download
memory/1476-999-0x00007FF9E1EA0000-0x00007FF9E1ECD000-memory.dmp

Filesize
180KB

Download
memory/1476-998-0x00007FF9E6EC0000-0x00007FF9E6ED9000-memory.dmp

Filesize
100KB

Download
memory/1476-997-0x00007FF9EB3A0000-0x00007FF9EB3AF000-memory.dmp

Filesize
60KB

Download
memory/4168-834-0x000001CD2EC90000-0x000001CD2ECB2000-memory.dmp

Filesize
136KB

Download