e16001a8d80af46d306d1112bb0b577bc8e7900f393316aa384a082ad9ae778a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fleasion-v2.3.0-Windows.exe
Size 56.9MB
Sample260804-gba2jagn71
SHA256 e16001a8d80af46d306d1112bb0b577bc8e7900f393316aa384a082ad9ae778a
MD5 9a041b7a2d2ab62a19d5eba886bcd8bd
SHA1 cd4274a45529d0e79a28bde58aeab2cd62f7f5aa
SHA512 6640f5280b98bdb2ca60baddb281512bb9825e2e8f1b2155ed882c975821b368234c73fdfa897a805a5a0de67bf5a8af6988757203539b0afa452cff2f8203de
SSDEEP 1572864:sgsszz1xWwVqYS312G7tvd1j48tq8Wo/Lmp+iwQHwSqP:Xz1xWwVNGp88w8Ha4nz
TLSH
T1CCD73324AF40A993F0A1587FB852C9A361812DA15B0CC6FF5B707E871D7F741AEB6603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Fleasion-v2.3.0-Windows.exe

Loads dropped DLL 54 IoCs

pid	Process
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe

Contacts third-party web service commonly abused for C2 1 TTPs 25 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
17	raw.githubusercontent.com
18	raw.githubusercontent.com
33	raw.githubusercontent.com
40	raw.githubusercontent.com
44	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
39	raw.githubusercontent.com
43	raw.githubusercontent.com
3	raw.githubusercontent.com
5	raw.githubusercontent.com
30	raw.githubusercontent.com
41	raw.githubusercontent.com
45	raw.githubusercontent.com
2	raw.githubusercontent.com
7	raw.githubusercontent.com
14	raw.githubusercontent.com
35	raw.githubusercontent.com
38	raw.githubusercontent.com
42	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000001c946-288.dat	upx
behavioral2/memory/2584-292-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp	upx
behavioral2/files/0x000a00000001c871-297.dat	upx
behavioral2/memory/2584-300-0x00007FFBD1960000-0x00007FFBD198A000-memory.dmp	upx
behavioral2/files/0x000900000001c8e7-301.dat	upx
behavioral2/files/0x000a00000001c86f-303.dat	upx
behavioral2/memory/2584-305-0x00007FFBD1940000-0x00007FFBD195A000-memory.dmp	upx
behavioral2/files/0x000a00000001c888-309.dat	upx
behavioral2/memory/2584-311-0x00007FFBC6010000-0x00007FFBC6090000-memory.dmp	upx
behavioral2/memory/2584-308-0x00007FFBD1910000-0x00007FFBD193E000-memory.dmp	upx
behavioral2/files/0x000a00000001c879-312.dat	upx
behavioral2/memory/2584-314-0x00007FFBCEBE0000-0x00007FFBCEBFA000-memory.dmp	upx
behavioral2/files/0x000a00000001c865-316.dat	upx
behavioral2/memory/2584-328-0x00007FFBC5FE0000-0x00007FFBC6005000-memory.dmp	upx
behavioral2/memory/2584-331-0x00007FFBCE060000-0x00007FFBCE06D000-memory.dmp	upx
behavioral2/files/0x000a00000001c874-336.dat	upx
behavioral2/memory/2584-335-0x00007FFBCE050000-0x00007FFBCE05F000-memory.dmp	upx
behavioral2/memory/2584-334-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp	upx
behavioral2/memory/2584-340-0x00007FFBCDD00000-0x00007FFBCDD14000-memory.dmp	upx
behavioral2/files/0x000900000001c8e6-341.dat	upx
behavioral2/memory/2584-339-0x00007FFBD1960000-0x00007FFBD198A000-memory.dmp	upx
behavioral2/memory/2584-342-0x00007FFBB8EB0000-0x00007FFBB95BC000-memory.dmp	upx
behavioral2/files/0x000a00000001c884-344.dat	upx
behavioral2/memory/2584-347-0x00007FFBC48A0000-0x00007FFBC48D6000-memory.dmp	upx
behavioral2/memory/2584-349-0x00007FFBBCF90000-0x00007FFBBD0E0000-memory.dmp	upx
behavioral2/memory/2584-346-0x00007FFBD1940000-0x00007FFBD195A000-memory.dmp	upx
behavioral2/files/0x000900000001c8e8-348.dat	upx
behavioral2/files/0x000a00000001c867-352.dat	upx
behavioral2/memory/2584-359-0x00007FFBCEBE0000-0x00007FFBCEBFA000-memory.dmp	upx
behavioral2/files/0x000a00000001c86a-361.dat	upx
behavioral2/memory/2584-364-0x00007FFBBB6B0000-0x00007FFBBB971000-memory.dmp	upx
behavioral2/memory/2584-365-0x00007FFBBA050000-0x00007FFBBA57F000-memory.dmp	upx
behavioral2/files/0x000a00000001c866-372.dat	upx
behavioral2/memory/2584-374-0x00007FFBB7CB0000-0x00007FFBB7F1A000-memory.dmp	upx
behavioral2/memory/2584-373-0x00007FFBC5FE0000-0x00007FFBC6005000-memory.dmp	upx
behavioral2/memory/2584-378-0x00007FFBCCD00000-0x00007FFBCCD0B000-memory.dmp	upx
behavioral2/memory/2584-380-0x00007FFBBDCB0000-0x00007FFBBDCEE000-memory.dmp	upx
behavioral2/memory/2584-379-0x00007FFBCDD00000-0x00007FFBCDD14000-memory.dmp	upx
behavioral2/memory/2584-388-0x00000273B4C40000-0x00000273B4D24000-memory.dmp	upx
behavioral2/memory/2584-390-0x00007FFBBBDF0000-0x00007FFBBBE2E000-memory.dmp	upx
behavioral2/memory/2584-392-0x00007FFBCC560000-0x00007FFBCC56B000-memory.dmp	upx
behavioral2/memory/2584-391-0x00007FFBBA050000-0x00007FFBBA57F000-memory.dmp	upx
behavioral2/memory/2584-393-0x00007FFBB7CB0000-0x00007FFBB7F1A000-memory.dmp	upx
behavioral2/memory/2584-394-0x00007FFBB78C0000-0x00007FFBB7CA7000-memory.dmp	upx
behavioral2/memory/2584-389-0x00007FFBC81A0000-0x00007FFBC81BC000-memory.dmp	upx
behavioral2/memory/2584-387-0x00007FFBCC570000-0x00007FFBCC57B000-memory.dmp	upx
behavioral2/memory/2584-386-0x00007FFBBCF90000-0x00007FFBBD0E0000-memory.dmp	upx
behavioral2/memory/2584-385-0x00007FFBC48A0000-0x00007FFBC48D6000-memory.dmp	upx
behavioral2/memory/2584-395-0x00007FFBB64F0000-0x00007FFBB78BB000-memory.dmp	upx
behavioral2/memory/2584-384-0x00007FFBC37D0000-0x00007FFBC37F6000-memory.dmp	upx
behavioral2/memory/2584-383-0x00007FFBBC110000-0x00007FFBBC14B000-memory.dmp	upx
behavioral2/memory/2584-382-0x00007FFBBBE30000-0x00007FFBBBEED000-memory.dmp	upx
behavioral2/memory/2584-381-0x00007FFBB8EB0000-0x00007FFBB95BC000-memory.dmp	upx
behavioral2/memory/2584-377-0x00007FFBCE050000-0x00007FFBCE05F000-memory.dmp	upx
behavioral2/memory/2584-396-0x00007FFBC2220000-0x00007FFBC2242000-memory.dmp	upx
behavioral2/memory/2584-398-0x00007FFBB6260000-0x00007FFBB64EC000-memory.dmp	upx
behavioral2/memory/2584-397-0x00007FFBBDCB0000-0x00007FFBBDCEE000-memory.dmp	upx
behavioral2/memory/2584-376-0x00007FFBCCFA0000-0x00007FFBCCFAD000-memory.dmp	upx
behavioral2/memory/2584-375-0x00007FFBCE060000-0x00007FFBCE06D000-memory.dmp	upx
behavioral2/memory/2584-400-0x00007FFBC24B0000-0x00007FFBC24C2000-memory.dmp	upx
behavioral2/memory/2584-399-0x00007FFBC5FC0000-0x00007FFBC5FD8000-memory.dmp	upx
behavioral2/memory/2584-357-0x00000273B4C40000-0x00000273B4D24000-memory.dmp	upx
behavioral2/memory/2584-356-0x00007FFBC6010000-0x00007FFBC6090000-memory.dmp	upx
behavioral2/files/0x000a00000001c886-333.dat	upx

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5244	schtasks.exe
4844	schtasks.exe
5160	schtasks.exe
6712	schtasks.exe
1100	schtasks.exe
5832	schtasks.exe
2252	schtasks.exe
1564	schtasks.exe
7104	schtasks.exe
4644	schtasks.exe
4780	schtasks.exe
1732	schtasks.exe
1636	schtasks.exe
7120	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2584	Fleasion-v2.3.0-Windows.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3428	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3428	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe
2584	Fleasion-v2.3.0-Windows.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 6492 wrote to memory of 2584	6492	Fleasion-v2.3.0-Windows.exe	91
PID 2584 wrote to memory of 1860	2584	Fleasion-v2.3.0-Windows.exe	93
PID 2584 wrote to memory of 4504	2584	Fleasion-v2.3.0-Windows.exe	95
PID 2584 wrote to memory of 6424	2584	Fleasion-v2.3.0-Windows.exe	97
PID 2584 wrote to memory of 5860	2584	Fleasion-v2.3.0-Windows.exe	99
PID 2584 wrote to memory of 5424	2584	Fleasion-v2.3.0-Windows.exe	101
PID 2584 wrote to memory of 5832	2584	Fleasion-v2.3.0-Windows.exe	103
PID 2584 wrote to memory of 2252	2584	Fleasion-v2.3.0-Windows.exe	106
PID 2584 wrote to memory of 1564	2584	Fleasion-v2.3.0-Windows.exe	109
PID 2584 wrote to memory of 7104	2584	Fleasion-v2.3.0-Windows.exe	111
PID 2584 wrote to memory of 4644	2584	Fleasion-v2.3.0-Windows.exe	113
PID 2584 wrote to memory of 7120	2584	Fleasion-v2.3.0-Windows.exe	115
PID 2584 wrote to memory of 4780	2584	Fleasion-v2.3.0-Windows.exe	117
PID 2584 wrote to memory of 1732	2584	Fleasion-v2.3.0-Windows.exe	119
PID 2584 wrote to memory of 5244	2584	Fleasion-v2.3.0-Windows.exe	121
PID 2584 wrote to memory of 1636	2584	Fleasion-v2.3.0-Windows.exe	123
PID 2584 wrote to memory of 4844	2584	Fleasion-v2.3.0-Windows.exe	125
PID 2584 wrote to memory of 5160	2584	Fleasion-v2.3.0-Windows.exe	127
PID 2584 wrote to memory of 6712	2584	Fleasion-v2.3.0-Windows.exe	129
PID 2584 wrote to memory of 1100	2584	Fleasion-v2.3.0-Windows.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe
"C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6492
- C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe
  "C:\Users\Admin\AppData\Local\Temp\Fleasion-v2.3.0-Windows.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\System32\certutil.exe
    C:\Windows\System32\certutil.exe -store Root
    3⤵
    PID:1860
- - C:\Windows\System32\certutil.exe
    C:\Windows\System32\certutil.exe -store Root 85D7B8007AC7ADB036FFD232BADF57B541F3CDC0
    3⤵
    PID:4504
- - C:\Windows\System32\certutil.exe
    C:\Windows\System32\certutil.exe -addstore -f Root C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.crt
    3⤵
    PID:6424
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /TN Fleasion-HostsWatchdog /F
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\netsh.exe
    netsh winhttp show proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5424
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5832
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2252
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7104
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7120
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5244
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1636
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5160
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6712
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /TN Fleasion-HostsWatchdog /XML C:\Users\Admin\AppData\Local\Temp\fleasion_watchdog_task.xml /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fleasion.log

Path C:\Users\Admin\AppData\Local\FleasionNT\logs\fleasion.log
Size 1KB
SHA256 45a01b8ff3361ac2d6bce4fe1f6514399573854e74e3ed89cc872460f321f322
MD5 d4dff46753b690aa9c127c4dc4ac14e8
SHA1 9fece5e6aea8c111c5417e08abf8aa3b5fcffd66
SHA512 80ffeaf5d6756e69630aa0fb6876d06122462cb601d063c0a35ef4fab99ee7d8e2af4b253b690874780076a407c312083345311302b145a27008ff0ad7a1f616
TLSH
T16B210BD965D734242CA24169B3036DDA057BB21AFECAA52CB23D23CE09C3A30F555CAD
MD5 SHA1 SHA512 TLSH

Submit Download

fleasion.log

Path C:\Users\Admin\AppData\Local\FleasionNT\logs\fleasion.log
Size 4KB
SHA256 af889b44716cfd0140c3631837ec9c67e0458990198d5419b73afcd9e3ab77d5
MD5 d4234f7429bc499d3ad6f73380fb064d
SHA1 415d2f4ecec0fb4f74258f892407cdd7d6ebb955
SHA512 cebfa45e0d675d48ecef28183d58e544212822ae84cd2a553e36d4eef74397a1c18fbc95be9ee6a22de1be0b09b3c036dd97f4614c4a7fdff10b69d88e0555f6
SSDEEP 96:Kv1BQ9En48Molulxm44I4rkXo0NygL88qDwMCN3UXqCqlqqbqdJd4dPUfidx1gCO:u1BQ9k485lulxm44I4rk40NygL88q8Mz
TLSH
T1D2915B9D61D734292C624069E3022DC915BB721AFD9DE298F23933CF49C3A61F615C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.crt

Path C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.crt
Size 1KB
SHA256 a3a34fdb583b35a5a13a6e4bdccc64ac0f2e06a0d5c3fd542ac013c62fc799c2
MD5 40efb309131fb6d7111cbdabba691b06
SHA1 b237f0ff2f2ee722c7bd55c51b7da36dfcc2ec6c
SHA512 98bd84c39830be8244fc0cbcd577e0cbb8f5c374cfde8642bba94d8cfce7f56dfa773c288223cf95cc871231fdbec389df86979dbdd5238e950eab2374e0168d
TLSH
T1CB21AAC50F415CC456AF5279C0CB04738C3A2890AED3E53855592A0BDE413DF99DE75A
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key

Path C:\Users\Admin\AppData\Local\FleasionNT\proxy_ca\ca.key
Size 1KB
SHA256 cba2a36335f26dc7e3ef65d6b3e2b96779051253e5688795e52e3a29759941f9
MD5 074f74309efd9984cb0d455d0ab04db6
SHA1 c614aecb59452b240ee8f0c87355565d5f0f7076
SHA512 af255b90c438195aa9d02f84bc940d0c53d04e420107d7b9875eae873d0fc08c19be37eb8985539b0894fa7f534cf687beca102037025fe0b7cf4841d9ac5564
TLSH
T11C31DA44D9B04C8D83924A7850AF0EB290BED2E16F85E17006573609D966F761C7D37C
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\MSVCP140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\MSVCP140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\Qt6Core.dll
Size 10.0MB
SHA256 fae4778a42e93adc82b831c879c886a05147e9cc26760808d21116be5547259b
MD5 3b5c8f8981b2cca0c4741dcf09d7a79d
SHA1 a5179fbfc72c59a5aca26ebdbb08d944ce5b864c
SHA512 4bed16fef4c00773892fb6da163134cdf7819ccb165987e5bbdcf9153d7b042490be14eae984903e84b48b61fadc6f5735671df16641b3b131c0c0ecdb5260f2
SSDEEP 98304:meAbhLTfRmoOKFdu9CwJsv6tnYNJMAA1gcV/3cNuWXelc:mhn8KFdu9CwJsv6tnuSA+/3cNuWXB
TLSH
T1A5B6390766FA0102F6FBDA34DAB75116DBB27C466B3096EF025861185D337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\Qt6Gui.dll
Size 9.1MB
SHA256 8fceee959a670372aaa5763287c2ef7924cd9ecdbe2c29cf4b6c12a63079c503
MD5 5d0da93b83dc26e65d414ff04cf86e21
SHA1 b50cf7f75e9003825e1097f7ad095157b3d564fb
SHA512 cbdf076636b80c412fbdeda23593826e4cbe62b056f08d7357955b3be9719e4684c9b4db88c6b368b6783724eadc3a8826cc2da336f13d9bbfa16b6ba615aaba
SSDEEP 98304:+frUrVK+HdzDGqLVUkG/9r1hzJbgseVxDVkqtjuQQ2SI:+fABfzDnUfr1hzJb7QxvjBQXI
TLSH
T147A68D57A2A911D8C47BD13C8B9B9517EBB2701503529FDB01A5CA162F33BF12ABF321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\Qt6Network.dll
Size 1.7MB
SHA256 0232076731e386b6cc353bdf743d5fb17e95a3493c2d02afac984db87ed47b96
MD5 c1f79b2e138a1658d122eccc3c446a4b
SHA1 4edee52c0faee2bb72dce08f635c9ff541047980
SHA512 bc9280b4eb94ea1803b6e1299d62a6427a8a326a091457adfbcb9579dca79d73d0ba6743b4387585e3382a32ab79ed514caeb6548e76596c52598c5efa5948dc
SSDEEP 24576:yQrj1h2y2YNJ+wPBqmgvR6YFamR2bvaKLhToqYkiaKD7:Prj18o+wsoQjQZLhTYkU
TLSH
T1F5857D57A3A54295C86EC17DCB4B860BFA72700483669BDF42658F152F73BE22B3D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\Qt6Widgets.dll
Size 6.3MB
SHA256 4d603bff620ae0830d15c25a787f9f10ed3f972d998f1f17c9c4f83937280399
MD5 fe194f3803df1543fad6f316a50477b8
SHA1 b9433f51f6bc4c61fa0fdb79619b64861d567b1f
SHA512 74ec1e7bc22cc3814b1906a647beaeb4d080fd7f40ee786811990f597d0f1537700ab90198776f2e5f5ec6cd9cff568d9be8bf659cf37a265645b7096b6cc5de
SSDEEP 98304:vM+neySH06w0WYXVxRjYqnzIjWyHTM1R6wtO0MPS:vM+neym06wvYvRjYqnzIiyza6KqPS
TLSH
T15B666A5763EA0185C4ABD13DCB4B8A17EBB2700453629BCF0265CA592F737E22E7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\Qt6\bin\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\QtCore.pyd
Size 531KB
SHA256 3fa18e59502e591af5d9b90d26d94b088185c2076582953aa1ebee1ccf650e87
MD5 dc8ecd60c62ab0ebb0744f7f270391b3
SHA1 ccfc0501f4f43b814d01949e8331b1bd0b3af15b
SHA512 8717e993a59b76f30e7eb73f6234c97c81ce81f595df36ebfe0752d6ea0e2e24ed99bc699ae5648a8c1f0b2d2d97d686dce8f25efa6b7c66e9e47a1ab3e76f99
SSDEEP 12288:g+v22F2M0gHIiD2SkcrygK9lCwaSK4+vsDS2QBwog:z3JJLqZyKnCwaSK4pS2QBB
TLSH
T1C3C423C3A29B7CFFCAB657F60C7B85F0931220A928350D1D97E5933E29DD4706AB9450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\QtGui.pyd
Size 446KB
SHA256 9d2f10476b69fc80e3a3843d227ed7ee7b045dfd32d8d9c6120c978402a83a88
MD5 13e76f8525a69840cedc6ed5ddfb251a
SHA1 40b4a7330fb276ad26b45ce27438d85f1f2dfdab
SHA512 4f6bd3f82f8ae43156b564a9cca55d5632df53282cdf785b33b432ac1a3ef968320e14c8f1be9fc23c68dce3c6da616c6d185f625c354051cdb9fb12e5a983ce
SSDEEP 6144:Suc9Mh2Fau4UqPIRfNFw094ijbWLOlWvQ+1T/3W5UKaHgiMY088pTVlrs/YC:rc9Mh2aONFw1ijC131T/31Nd8pTvsQC
TLSH
T1B8A423032A9D7DF8D4E24AB37107CE7A8FE40ADA59A1295913B43BF60650355DFC8F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtNetwork.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\QtNetwork.pyd
Size 155KB
SHA256 5f9a8720669836947cb3e1ac2c7545619d89539c36ef1de3246844e8df980836
MD5 3732630b79c4e19398aa72e333bff838
SHA1 02cec736a8c90636ae8ac9fb35d2cc4810f3b7d1
SHA512 76fc909c12456a59e9a0922afd4fdb9c607cfa47f3aba0c1e85384889951aed856253144c1bc631c06834a5c0d2f318fdde132bc7f412b81d96f7e5d3d866682
SSDEEP 3072:xS2dY0SHmiF8dZxG1K1Si4IWDOMhATKvntD:xcGiPg1SFvKWl
TLSH
T1F6F3232B0E45C4D5CCF3C0FAEC652C52B191FE37B96A021914DCA0FA8E7A641B4D53AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\QtWidgets.pyd
Size 773KB
SHA256 9592f80520cbf9b59ee5dfcc8a34a7a41d4b3b4b8870b167ae8ec38d5b69b3ba
MD5 dd1240e0957aaaf525613235f0bd8a15
SHA1 3c902012e9685c2735863bc6eb93acf7d3e5bc74
SHA512 617a06a49ac6881ee81a8feb7212b63831058e717b1648f420cad06ea36e264bf0759bfd890d19383b8a8f86bf0f8430d1a3f738ae5af2dc4ec97e2f38f310d8
SSDEEP 12288:UzKO8jF1VlWCQLg+IOUdZl9iopC6HfJsc3Bj7uDKyWmC6u6MnHGS2Q4UTx:UKOgFLlWb3IdVioplHbj8CjHmS2Q4UT
TLSH
T1DBF433506417B034E8A91877BB321978F3037A357F9BFBEE15A04858CE9D27C674C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\PyQt6\sip.cp314-win_amd64.pyd
Size 47KB
SHA256 eafdc6a8e92974fb2793766b1e1a0890c96eba72a4f9b4696485dbf3ebf1ab28
MD5 b62a1071fd1d4b9c5fe6d6c812663d05
SHA1 0e3fd27af092c5d95c41ba71d2812f358ce73ec7
SHA512 599e530d6ff5560eee6e57137698fea3db87f21450ef51b32258a283689cb1b21793d77d54419eca72db1594fb5e2064d6c4991eca0c8855138c234626530cda
SSDEEP 768:hst8MDENmmU1IAAtcGrPk0yk2hCjADCM1Vbf/LZyLjJaj0uXZswhUHBbvYoCJ8Ic:hst8M4N9UeA7BktjADCMHDtyLo0uX2wO
TLSH
T19723E1DBC2E678B8C00D89BF9725D0E06B1821614A3DD37716113D768C37B6ADE129D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_bz2.pyd
Size 37KB
SHA256 efbfb7760de5f92f3549ab5ff9a9737ae47142e08e938523f417d108183102ce
MD5 d5195da80be04419fa098ba751dc95e9
SHA1 80ab0f43eddd07572daa1364241e12bb23cd3a75
SHA512 5e2617a064d65b4333719f40810d8a7c4e033e8baeda29876b56d9c1ea0206d6b8407416f65980e942da27f65c4dfb9ab6b2bd04e9092a615f79f2631b7ac17c
SSDEEP 768:qk5Lk/U8ke6D9DWOTo757KtNsjsx+bseaxLl0j6tEWGCJrV9h07p1KIG3VR+KpSI:qkOPke6D9DrTaKtNgA+bxanvpNTWKIGJ
TLSH
T12903D0A342F8D1B8D0B554B214969904FF71BCB350CE078E208EAA69DFF19922D537B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_ctypes.pyd
Size 54KB
SHA256 7ac92efadcbe8877de5c07937f3362a1a8f39bb21c0b488707882da972e741f2
MD5 841e6d435735f2de1bc88bebf817fd68
SHA1 f8681b132b93867c53efbef3ee5d806d146224a7
SHA512 e0367e708e4a5d3975574095874d759a0975ead229cb280343ba7186d1878cfa8522ac2c0a1a886939938fb7f7378c6629f37bee924e28323a8929f1152f81de
SSDEEP 1536:tT/hykztKDauiqpYI8TJE+dNa+vGV2Yoyor2IGGPW+K:5/TtuahqH89DNa+vGV2YoxiIGGPv
TLSH
T14F43F153AABEE1F0F6B740FD16352056D6513839868C47AA34AE453C6FBC792DC43352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_hashlib.pyd
Size 24KB
SHA256 279c13453e96c02660ae5cbad9d85f21dede5afba56a7636fefe2233541a5ca7
MD5 d01167b84c027a6bba582078ef06d652
SHA1 e33cd8621efeef41023a2eadeda826170c039038
SHA512 a9dea79659dd995587c76cf53807aae9d92a2d9c00df76a718f2ee220196ec4eb2bdc6769aaabef7ea8fbc5e184bd8a7805e366ead86ba210dbbafd1f61e824e
SSDEEP 384:oFjcqJ+t5YMTW1K6nafyVA6u1KNeAKbAxWU/I4Za7gJXyxIGDIBa+Wj:oFza5JTyyqVA6/NeAKbrIpixIGDIQ+K
TLSH
T14AB2CF69E27CE0B8D17500B213915A52BB22F967D11253EF3A4C31ADAF7B9409E62373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_lzma.pyd
Size 78KB
SHA256 785db5833ce2116c3e05e3ae54b1575fdaabe4571bafb6ce59aeb9625e460aea
MD5 1df24773a775c964e39ce8265214884c
SHA1 0492ee69f9d589c94368bbd752c541b58326fb88
SHA512 07923a0f70f7934506a448f04a6904cf4667d38969cc4f7ffeea692b962f2e08419a28d976e7a9b53f1a092f76f7f83a35acdd8089c4b3d34a8094400dd8357f
SSDEEP 1536:bokDtTEeUikGiByiZqvLoMYa5ndX6ixp9+Iub9agv/QFIGI1m+K:b5RTEeU+AqD/YYn1xuI7gvGIGI1f
TLSH
T13973F2E297F8D9E8D227F6F64A315811D9172F168426C3A861ED22BC2F0FA105B34B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_queue.pyd
Size 15KB
SHA256 986c8860f2f5597bc59f5ca078051fcb5f83387f6a2132bcd5c236b15afc6be6
MD5 70515b4f032aab5a0add10168454481a
SHA1 542d2561ca36c1c04611fba4e259d5cde8fead9f
SHA512 ff5b68252b9ce8f7ba9fe9b5c32f7628a6ed6a5f9e0a8fca51f0a97ec5a0ee4ac39e88559e681abe1d93ef35a112da595b7f94a31e98a60c969d9be9e30afac3
SSDEEP 384:3A8iyHN5SD4LKsin4f+S+XcUZa7gJXCDIGRUBa+WjgQ:ZHN5HLin44PpyDIGRUQ+K
TLSH
T1EA629E9382F7E1B8D270A5B20A9316549A36BC33961B0B6F75E8117F5F762106312FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_socket.pyd
Size 33KB
SHA256 ca6e7a57c65bff9dc955df061efc5ad918e75bc00b1c2ad68c167573aac37d9d
MD5 190ddad7eebb39f949c0de8bd9c55d9a
SHA1 51259c91285ec3a992759376b05a2a5ee570bf0b
SHA512 56863c0c0a304749dc3df91045c9ad7cf05ddeb200716b3558b17214bcb93f43621e444128c9c59be7d0e42f1ad4af9b95f6fe9b3fcdf2d2330ef5f161a0e4d9
SSDEEP 768:eCAne76FvOuQQRXVDfkVyNLNc1akvO+3stNZeGypqjHIGGwR+KFe:eC8en0NkVyNJcoQO+ctNZeGLjHIGGwRv
TLSH
T158E2D087A5FBC13CF43009B20A1815067751BC66563AC75F34983A6FDFB37428452BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_ssl.pyd
Size 56KB
SHA256 eda20582b4bfe904ea988769ebb0cffc2e5b4c35fefe00e36ea1a576464cf2f2
MD5 77f17e68a98cead665fd265df3c76520
SHA1 cf30bdf9ee53bce95ec38c2fb8ca0c19b70ea47a
SHA512 9feb4965cb6ad1adcdf56d69edd956f79863768196cab7087e0b4e4daf7fa18af994f4230f64cd4a5257d983bc26a11cb41b5b74bfb0a12fd1fb8cd0d58717ba
SSDEEP 1536:dzi6/mUDtu7741I746g7zmjAXMofjd+r76IG372+KEd:hiUm2tuo1T6g7zm0LwGIG37Pv
TLSH
T1924302D36B5AC77DE077B5F260970C40C575BD774406E99B213C1C6A2E3B61AC802AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_wmi.pyd
Size 17KB
SHA256 090dfc88cd6e337947c53d704f6b57e5dca4f1fac7f6b8a0efb435e94e81d86e
MD5 e5d2bdf28453e2daffae01d74b4c4334
SHA1 124ed08a25cdabe69d7a033114e0e1fa54b564d3
SHA512 804bd8f550c21252b0805d9b431bee798bbb320eee196bbcf5cf007daa574784267d1783286cd81d460e04cb801bf1bab2960598747779cadcb74de81f89973b
SSDEEP 384:k+SjgSx+/Ll/bfu9H2EVtW9qZa7gJX70cIG3iha+Wjx+:k+S0i+/5juZdjbpr0cIG3iw+Kg
TLSH
T12B728EA293BCC3BCD1AB59F3129B8A41B662BD37412A4F1F30AC167E5FB21115503376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\_zstd.pyd
Size 163KB
SHA256 bc4684ce38fd22f5a4f1073703bea7b47f335ccbf1226aeafe00f3815126aa0c
MD5 35076e43acf86d1201fbb33687ae972f
SHA1 452a2dc332ebfa6bde9d001dadb7e4a933e160c3
SHA512 5b4d6e68b166cdee3c7f0021923bb6f6d78b65eb2a97dde28ef1b4f69aeb2ff1f0d6d0127a270b0dae49bab498c7447fb9b4ca9e06e951de17c6685265c7cf47
SSDEEP 3072:f1G8v4exyahX6VOBC/kyPq0PZ+7JYmz0eo/c73YmuO1sdE6IGIM6:hv4exyaJjBC/fEqmzgc73YmudI
TLSH
T1DAF3124363FAA3DADA93EB3A6EA416E4B191B9335E42DF4938D13B6D1F1F4027850120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\base_library.zip
Size 1.3MB
SHA256 7fb8b30f0104bf8304c920436ab278d9ed6aa49e60090d8938beef20661540c3
MD5 6a6d7e9435d7d63b41eef62cd8de293a
SHA1 9b7eae3404110d7e800e17ee0ad5afc35e3fd42b
SHA512 8a1023c269a61cb5e49b39fc0fec52d9f54e0cf38fcf4eb0d0edba57d48731f07bfd87c236fae8ccc714d7b58e206988ac34f633777d70c5166e39a7169e2a39
SSDEEP 24576:EuUFgnYAW0IdDL3RpyQeOdP2m2dfMQZQLlbQ:EuUFkYTdnRs/ky
TLSH
T103552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

METADATA

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\fleasion-2.3.0.dist-info\METADATA
Size 24KB
SHA256 3700bfdac53c8d7a48501f15ec2ee7070700d7d172a902180a4004115e71a04e
MD5 79a979df656eb78f419510e0551c016a
SHA1 f0f40ae3bbe6b903a10af57502cc1995b299fd7e
SHA512 400f7683f6a39c26d1db8d14c8702653bcd6e6063ba35d11ffebb8130a13cd044a8d34dcc30132a0c0cc27403a6323d92a455b3f6e7b23e6ad0d1c1e5cd9618f
SSDEEP 384:NUPhmhg2zWwEihp7BLR/4W+rLnKVvvVFh9xEDjncZ3SZTz/BDNFhY3dd9Y6FWHGi:NUPhmhrz7TQK/Fq/RfY3r+6kMU
TLSH
T169B2A5B2A7022D2E3FD2A2CDD14E57521B26B828E68E40B9F4DDB01C53A1D7543A69F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\libcrypto-3-x64.dll
Size 1.6MB
SHA256 cd660614ad4fe6333d4f214a853eefa5cae3781e95d6d6111fb36b4a93067c20
MD5 6ad2d7e7a48080117f5aa1ff5b17224c
SHA1 b017b0d50448cf9c7f31e7ab21e3a4719bc4cfae
SHA512 d8f6c989856b5ca9ad1de390534828cbb1cb8212fe888ecc3c2b3cd21c479599fd290ebc8f9de1f5ad966e0670e52ac4b4993bbebb135588403ed7ec69466748
SSDEEP 49152:HtVTlGA6zt2DlGae6eDnyDTc81CPwDvt3uFA0C+:HtVTsA0raePyDTc81CPwDvt3uFA0C+
TLSH
T12785122024BFBC0FD699997C8F70CD2A866D1302B75CDFB42E7989184818E0F59F59DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\libffi-8.dll
Size 17KB
SHA256 3f4606d4f11b0c882c001400066fb1b3fdae43f55786b3a713b99039fb6b0bea
MD5 1a2811afc5d309ff39e0054548cbd764
SHA1 e5a25bb893bcb3965eb28c33257cb3aa5b3d4e4a
SHA512 0753dcde5b5dffb09a74f58a5c3a7626c5b307325c551f4a564ca9bb509d7b97478c7e139394690656b4512661b3538bfefa482e0a5f845b40e8ffd1e6acad0f
SSDEEP 384:PII2FJdsksOfPhIYkTGUXVC7hDAm1xUfmq8f+Za7gJXx8RCX:EJdsKTkTbC7t1+Fph
TLSH
T13E82B0F3523FE5BCC4D398BB08112D3CFA35786B615106DF09937BBC5CB2A605121A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\libssl-3-x64.dll
Size 365KB
SHA256 303d6f3d0e118487b749c2cb8471decb08d2501e490d981a50c5c46c51413257
MD5 e7a9d0c601aa72d825d6631c778440e1
SHA1 e6a9c9c27b1a9e3f2d0ff224e48f6c3bbfd51b8b
SHA512 f72f0be2b010726504ed42f11df463043c2721215a47ba682be33f6bff23a65ea0ef411c8712d55300aa1e2440902c2ec7b6a34ec124b299f0d89470db97dec4
SSDEEP 6144:JjhcIr0s6rhmQmWRI5sl87Z1xLs18aNF6g+pJc3YRTpjcCFKafV7r1to03MyvLvS:JjhBr0s6O1i67tLmigScoRTRcCFl203O
TLSH
T1DC841252342B2937C863FD75DFB4A4D0E72C2356A686CAA97B47D54C87A034C73AD483
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\python3.dll
Size 58KB
SHA256 17fa74085a56ee0b8d437d40aeab66063ac57e23e9a4933cd73520dd0893bdee
MD5 ddbf33ea98be23a1bc2b284e18c0dc32
SHA1 137fd378e1a4042ef7adad776fbc59db1eb2ce55
SHA512 b3012a2946de5eb93ce7acd7762017d4de262e07d1bcad7768db567a4932e0161bc7ca0195d42125e3d776d53bfa6f15d136288a9f88775b18ed35fcba644459
SSDEEP 768:uQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIW:rbTrnXngXMU+KAIGG0G
TLSH
T1A943F71EAB54F8A2D6F625FC38D199DD241B12FC8F2984DFA57CD3920E1A320A52734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\python314.dll
Size 2.0MB
SHA256 ea3edc5af95eca2161554d18d62cfb8ad4e8b610ad1aa027520d264969e6c762
MD5 b7f4d7caa476cfe13c64e48a0bf6a884
SHA1 96094f636727d044097077a9341a1fdf33953783
SHA512 d86d1f290654e8b384f50bf4b09dfcd5a40c84b0f9017f35a98513c7f90edead82bbccea0609be81628bef54628684842fbca448ee5989eb6703dd7bcfc0d331
SSDEEP 49152:LNfhfbp7451iQbyncX8lVceo912TRpIYkl9Zg4qAYAD76:LNhfbp721FXSk12TRy9ZP+AD7
TLSH
T134A53337BC5ECED7EAC3F5F485A2D59E295201B9D0190FC8A568F94208CBA099B173CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\sounddevice-0.5.5.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI64922\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2584-339-0x00007FFBD1960000-0x00007FFBD198A000-memory.dmp

Download

memory/2584-335-0x00007FFBCE050000-0x00007FFBCE05F000-memory.dmp

Download

memory/2584-346-0x00007FFBD1940000-0x00007FFBD195A000-memory.dmp

Download

memory/2584-364-0x00007FFBBB6B0000-0x00007FFBBB971000-memory.dmp

Download

memory/2584-365-0x00007FFBBA050000-0x00007FFBBA57F000-memory.dmp

Download

memory/2584-349-0x00007FFBBCF90000-0x00007FFBBD0E0000-memory.dmp

Download

memory/2584-347-0x00007FFBC48A0000-0x00007FFBC48D6000-memory.dmp

Download

memory/2584-342-0x00007FFBB8EB0000-0x00007FFBB95BC000-memory.dmp

Download

memory/2584-340-0x00007FFBCDD00000-0x00007FFBCDD14000-memory.dmp

Download

memory/2584-374-0x00007FFBB7CB0000-0x00007FFBB7F1A000-memory.dmp

Download

memory/2584-373-0x00007FFBC5FE0000-0x00007FFBC6005000-memory.dmp

Download

memory/2584-378-0x00007FFBCCD00000-0x00007FFBCCD0B000-memory.dmp

Download

memory/2584-380-0x00007FFBBDCB0000-0x00007FFBBDCEE000-memory.dmp

Download

memory/2584-379-0x00007FFBCDD00000-0x00007FFBCDD14000-memory.dmp

Download

memory/2584-388-0x00000273B4C40000-0x00000273B4D24000-memory.dmp

Download

memory/2584-390-0x00007FFBBBDF0000-0x00007FFBBBE2E000-memory.dmp

Download

memory/2584-392-0x00007FFBCC560000-0x00007FFBCC56B000-memory.dmp

Download

memory/2584-391-0x00007FFBBA050000-0x00007FFBBA57F000-memory.dmp

Download

memory/2584-393-0x00007FFBB7CB0000-0x00007FFBB7F1A000-memory.dmp

Download

memory/2584-394-0x00007FFBB78C0000-0x00007FFBB7CA7000-memory.dmp

Download

memory/2584-389-0x00007FFBC81A0000-0x00007FFBC81BC000-memory.dmp

Download

memory/2584-387-0x00007FFBCC570000-0x00007FFBCC57B000-memory.dmp

Download

memory/2584-386-0x00007FFBBCF90000-0x00007FFBBD0E0000-memory.dmp

Download

memory/2584-385-0x00007FFBC48A0000-0x00007FFBC48D6000-memory.dmp

Download

memory/2584-395-0x00007FFBB64F0000-0x00007FFBB78BB000-memory.dmp

Download

memory/2584-384-0x00007FFBC37D0000-0x00007FFBC37F6000-memory.dmp

Download

memory/2584-383-0x00007FFBBC110000-0x00007FFBBC14B000-memory.dmp

Download

memory/2584-382-0x00007FFBBBE30000-0x00007FFBBBEED000-memory.dmp

Download

memory/2584-381-0x00007FFBB8EB0000-0x00007FFBB95BC000-memory.dmp

Download

memory/2584-377-0x00007FFBCE050000-0x00007FFBCE05F000-memory.dmp

Download

memory/2584-396-0x00007FFBC2220000-0x00007FFBC2242000-memory.dmp

Download

memory/2584-398-0x00007FFBB6260000-0x00007FFBB64EC000-memory.dmp

Download

memory/2584-397-0x00007FFBBDCB0000-0x00007FFBBDCEE000-memory.dmp

Download

memory/2584-376-0x00007FFBCCFA0000-0x00007FFBCCFAD000-memory.dmp

Download

memory/2584-375-0x00007FFBCE060000-0x00007FFBCE06D000-memory.dmp

Download

memory/2584-400-0x00007FFBC24B0000-0x00007FFBC24C2000-memory.dmp

Download

memory/2584-399-0x00007FFBC5FC0000-0x00007FFBC5FD8000-memory.dmp

Download

memory/2584-402-0x00000273C5370000-0x00000273C5380000-memory.dmp

Download

memory/2584-334-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-357-0x00000273B4C40000-0x00000273B4D24000-memory.dmp

Download

memory/2584-356-0x00007FFBC6010000-0x00007FFBC6090000-memory.dmp

Download

memory/2584-359-0x00007FFBCEBE0000-0x00007FFBCEBFA000-memory.dmp

Download

memory/2584-331-0x00007FFBCE060000-0x00007FFBCE06D000-memory.dmp

Download

memory/2584-328-0x00007FFBC5FE0000-0x00007FFBC6005000-memory.dmp

Download

memory/2584-421-0x00007FFBB5510000-0x00007FFBB5E97000-memory.dmp

Download

memory/2584-314-0x00007FFBCEBE0000-0x00007FFBCEBFA000-memory.dmp

Download

memory/2584-308-0x00007FFBD1910000-0x00007FFBD193E000-memory.dmp

Download

memory/2584-319-0x00007FFBBB6B0000-0x00007FFBBB971000-memory.dmp

Download

memory/2584-311-0x00007FFBC6010000-0x00007FFBC6090000-memory.dmp

Download

memory/2584-422-0x00007FFBBB5E0000-0x00007FFBBB616000-memory.dmp

Download

memory/2584-302-0x00007FFBD1CC0000-0x00007FFBD1CCF000-memory.dmp

Download

memory/2584-305-0x00007FFBD1940000-0x00007FFBD195A000-memory.dmp

Download

memory/2584-300-0x00007FFBD1960000-0x00007FFBD198A000-memory.dmp

Download

memory/2584-489-0x00007FFBB78C0000-0x00007FFBB7CA7000-memory.dmp

Download

memory/2584-292-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-516-0x00007FFBB64F0000-0x00007FFBB78BB000-memory.dmp

Download

memory/2584-517-0x00007FFBB6260000-0x00007FFBB64EC000-memory.dmp

Download

memory/2584-553-0x00007FFBC5FC0000-0x00007FFBC5FD8000-memory.dmp

Download

memory/2584-572-0x00007FFBBB5E0000-0x00007FFBBB616000-memory.dmp

Download

memory/2584-566-0x00007FFBB8EB0000-0x00007FFBB95BC000-memory.dmp

Download

memory/2584-568-0x00007FFBBCF90000-0x00007FFBBD0E0000-memory.dmp

Download

memory/2584-571-0x00007FFBB5510000-0x00007FFBB5E97000-memory.dmp

Download

memory/2584-573-0x00000273C6E80000-0x00000273C6EC8000-memory.dmp

Download

memory/2584-561-0x00007FFBBB6B0000-0x00007FFBBB971000-memory.dmp

Download

memory/2584-570-0x00007FFBB7CB0000-0x00007FFBB7F1A000-memory.dmp

Download

memory/2584-569-0x00000273B4C40000-0x00000273B4D24000-memory.dmp

Download

memory/2584-563-0x00007FFBCE060000-0x00007FFBCE06D000-memory.dmp

Download

memory/2584-562-0x00007FFBC5FE0000-0x00007FFBC6005000-memory.dmp

Download

memory/2584-554-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-567-0x00007FFBC48A0000-0x00007FFBC48D6000-memory.dmp

Download

memory/2584-575-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-583-0x00007FFBC5FE0000-0x00007FFBC6005000-memory.dmp

Download

memory/2584-582-0x00007FFBBB6B0000-0x00007FFBBB971000-memory.dmp

Download

memory/2584-604-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-658-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-679-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-700-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-721-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-743-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-764-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-785-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-806-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-847-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download

memory/2584-868-0x00007FFBBAB10000-0x00007FFBBB1EE000-memory.dmp

Download