Overview

overview

10

Static

static

3

2026-08-04...om.exe

windows10-2004-x64

10

2026-08-04...om.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    65s
  • max time network
    164s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 68.7MB
  • Sample260804-rmx1jssemg
  • SHA256 7563c675b473dac235a9fec3b7d82e3eaea406f82ac139ed6179a84ef9cc8dbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Launches sc.exe 27 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies Control Panel 3 IoCs
    defense_evasion
  • Modifies registry class 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Adds policy Run key to start application
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6124
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1428
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1220
      • C:\Windows\SYSTEM32\sc.exe
        sc create WUDFHostService "binPath= \"C:\Windows\SysWOW64\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
        3⤵
        • Launches sc.exe
        PID:4256
      • C:\Windows\SYSTEM32\sc.exe
        sc description WUDFHostService "Manages user-mode drivers on Windows"
        3⤵
        • Launches sc.exe
        PID:4640
      • C:\Windows\SYSTEM32\sc.exe
        sc start WUDFHostService
        3⤵
        • Launches sc.exe
        PID:1964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
        3⤵
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3268
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4544
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3312
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4236
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c049431a1ec2305a7dac5fc168288c10_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4224
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /query /tn MicrosoftWindowsUpdateService
        3⤵
          PID:1836
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /query /tn WindowsDriverFoundationUpdate
          3⤵
            PID:1156
          • C:\Windows\SYSTEM32\sc.exe
            sc query WUDFHostService
            3⤵
            • Launches sc.exe
            PID:4520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3716
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:1172
        • C:\Windows\SysWOW64\WUDFHost.exe
          C:\Windows\SysWOW64\WUDFHost.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\SysWOW64\WUDFHost.exe
            C:\Windows\SysWOW64\WUDFHost.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3632
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              3⤵
              • Executes a command shell one-liner
              PID:5744
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:6652
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:6860
            • C:\Windows\SysWOW64\sc.exe
              sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
              3⤵
              • Launches sc.exe
              PID:6960
            • C:\Windows\SysWOW64\sc.exe
              sc description WUDFHostService "Manages user-mode drivers on Windows"
              3⤵
              • Launches sc.exe
              PID:6396
            • C:\Windows\SysWOW64\sc.exe
              sc start WUDFHostService
              3⤵
              • Launches sc.exe
              PID:7088
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2336
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:7100
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3260
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2212
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2432
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4492
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:6208
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:6216
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3768
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:6184
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /query /tn MicrosoftWindowsUpdateService
              3⤵
                PID:5216
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /query /tn WindowsDriverFoundationUpdate
                3⤵
                  PID:6544
                • C:\Windows\SysWOW64\sc.exe
                  sc query WUDFHostService
                  3⤵
                  • Launches sc.exe
                  PID:6676
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:6896
            • C:\Windows\SysWOW64\WUDFHost.exe
              "C:\Windows\SysWOW64\WUDFHost.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4372
              • C:\Windows\SysWOW64\WUDFHost.exe
                C:\Windows\SysWOW64\WUDFHost.exe
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1152
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "ver"
                  3⤵
                  • Executes a command shell one-liner
                  PID:4940
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:4516
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4380
                • C:\Windows\SysWOW64\sc.exe
                  sc create WUDFHostService "binPath= \"C:\Windows\System32\drivers\etc\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                  3⤵
                  • Launches sc.exe
                  PID:2096
                • C:\Windows\SysWOW64\sc.exe
                  sc description WUDFHostService "Manages user-mode drivers on Windows"
                  3⤵
                  • Launches sc.exe
                  PID:3204
                • C:\Windows\SysWOW64\sc.exe
                  sc start WUDFHostService
                  3⤵
                  • Launches sc.exe
                  PID:3440
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4492
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3816
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\WUDFHost.exe\""
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3048
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\WUDFHost.exe\""
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2256
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SysWOW64\""
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2212
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\""
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3744
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5044
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3952
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:6004
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1272
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /query /tn MicrosoftWindowsUpdateService
                  3⤵
                    PID:5492
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /query /tn WindowsDriverFoundationUpdate
                    3⤵
                      PID:6904
                    • C:\Windows\SysWOW64\sc.exe
                      sc query WUDFHostService
                      3⤵
                      • Launches sc.exe
                      PID:7068
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                      3⤵
                        PID:7156
                  • C:\Windows\system32\wbem\WmiApSrv.exe
                    C:\Windows\system32\wbem\WmiApSrv.exe
                    1⤵
                      PID:5628
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                      1⤵
                        PID:2596
                      • C:\Windows\System32\drivers\etc\WUDFHost.exe
                        C:\Windows\System32\drivers\etc\WUDFHost.exe
                        1⤵
                          PID:4144
                          • C:\Windows\System32\drivers\etc\WUDFHost.exe
                            C:\Windows\System32\drivers\etc\WUDFHost.exe
                            2⤵
                              PID:6600
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "ver"
                                3⤵
                                • Executes a command shell one-liner
                                PID:6180
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:1312
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:1016
                              • C:\Windows\SYSTEM32\sc.exe
                                sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                3⤵
                                • Launches sc.exe
                                PID:404
                              • C:\Windows\SYSTEM32\sc.exe
                                sc description WUDFHostService "Manages user-mode drivers on Windows"
                                3⤵
                                • Launches sc.exe
                                PID:2432
                              • C:\Windows\SYSTEM32\sc.exe
                                sc start WUDFHostService
                                3⤵
                                • Launches sc.exe
                                PID:4224
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                3⤵
                                  PID:4516
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1256
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:4148
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:700
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\WUDFHost.exe\""
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:6864
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\""
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:6392
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:4524
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows Defender\Scans\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:3096
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:4544
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:5716
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:5504
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:6892
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /query /tn MicrosoftWindowsUpdateService
                                  3⤵
                                    PID:124
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    schtasks /query /tn WindowsDriverFoundationUpdate
                                    3⤵
                                      PID:7400
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc query WUDFHostService
                                      3⤵
                                      • Launches sc.exe
                                      PID:7700
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                                      3⤵
                                        PID:7872
                                  • C:\Windows\System32\drivers\etc\WUDFHost.exe
                                    "C:\Windows\System32\drivers\etc\WUDFHost.exe"
                                    1⤵
                                      PID:2804
                                      • C:\Windows\System32\drivers\etc\WUDFHost.exe
                                        C:\Windows\System32\drivers\etc\WUDFHost.exe
                                        2⤵
                                          PID:6804
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "ver"
                                            3⤵
                                            • Executes a command shell one-liner
                                            PID:6360
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                                            3⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5452
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:4136
                                          • C:\Windows\SYSTEM32\sc.exe
                                            sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                            3⤵
                                            • Launches sc.exe
                                            PID:7100
                                          • C:\Windows\SYSTEM32\sc.exe
                                            sc description WUDFHostService "Manages user-mode drivers on Windows"
                                            3⤵
                                            • Launches sc.exe
                                            PID:1644
                                          • C:\Windows\SYSTEM32\sc.exe
                                            sc start WUDFHostService
                                            3⤵
                                            • Launches sc.exe
                                            PID:1648
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                            3⤵
                                              PID:900
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                                              3⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4568
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:4624
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\WUDFHost.exe\""
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:2788
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Windows\System32\drivers\etc\""
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:4744
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:3336
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:4764
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows Defender\Scans\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:5472
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:6180
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:6032
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:1368
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:2776
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks /query /tn MicrosoftWindowsUpdateService
                                              3⤵
                                                PID:6232
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks /query /tn WindowsDriverFoundationUpdate
                                                3⤵
                                                  PID:5024
                                                • C:\Windows\SYSTEM32\sc.exe
                                                  sc query WUDFHostService
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:7228
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                                                  3⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:7348
                                            • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                              "C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe"
                                              1⤵
                                                PID:5248
                                                • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                  2⤵
                                                    PID:6608
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                      3⤵
                                                      • Executes a command shell one-liner
                                                      PID:5024
                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                      schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2664
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:5012
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:5796
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc description WUDFHostService "Manages user-mode drivers on Windows"
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:6912
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc start WUDFHostService
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:7504
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                                      3⤵
                                                        PID:1092
                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                        schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3296
                                                  • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                    1⤵
                                                      PID:6732
                                                      • C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                        C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe
                                                        2⤵
                                                          PID:6536
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                            3⤵
                                                            • Executes a command shell one-liner
                                                            PID:2836
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /create /tn MicrosoftWindowsUpdateService /xml C:\Users\Admin\AppData\Local\Temp\wudf_task.xml /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:7732
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:7660
                                                          • C:\Windows\SYSTEM32\sc.exe
                                                            sc create WUDFHostService "binPath= \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\"" "start= auto" "DisplayName= \"Windows Driver Foundation Service\""
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:7808
                                                          • C:\Windows\SYSTEM32\sc.exe
                                                            sc description WUDFHostService "Manages user-mode drivers on Windows"
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:7484
                                                          • C:\Windows\SYSTEM32\sc.exe
                                                            sc start WUDFHostService
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:5044
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:7792
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /create /tn WindowsDriverFoundationUpdate /xml C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:7496
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\""
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:3020
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\""
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:6612
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:1720
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows Defender\Scans\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:3272
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\drivers\etc\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:7636
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\SysWOW64\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:7316
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Service\" -Direction Outbound -Program \"C:\Windows\System32\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:2788
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName \"Windows Update Helper\" -Direction Outbound -Program \"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\WUDFHost.exe\" -Action Allow -Profile Any -ErrorAction SilentlyContinue"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:2620
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /query /tn MicrosoftWindowsUpdateService
                                                            3⤵
                                                              PID:7980
                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                              schtasks /query /tn WindowsDriverFoundationUpdate
                                                              3⤵
                                                                PID:5452
                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                sc query WUDFHostService
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:6568
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command "Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq \"WindowsUpdateFilter\"}"
                                                                3⤵
                                                                  PID:5376
                                                            • C:\Windows\SysWOW64\WUDFHost.exe
                                                              C:\Windows\SysWOW64\WUDFHost.exe
                                                              1⤵
                                                                PID:5948
                                                                • C:\Windows\SysWOW64\WUDFHost.exe
                                                                  C:\Windows\SysWOW64\WUDFHost.exe
                                                                  2⤵
                                                                    PID:6740
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                      3⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:5860

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Command and Scripting Interpreter

                                                                      2
                                                                      T1059

                                                                      PowerShell

                                                                      1
                                                                      T1059.001

                                                                      Windows Command Shell

                                                                      1
                                                                      T1059.003

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Scheduled Task

                                                                      1
                                                                      T1053.005

                                                                      System Services

                                                                      1
                                                                      T1569

                                                                      Service Execution

                                                                      1
                                                                      T1569.002

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      3
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      3
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      1
                                                                      T1543

                                                                      Windows Service

                                                                      1
                                                                      T1543.003

                                                                      Event Triggered Execution

                                                                      1
                                                                      T1546

                                                                      Component Object Model Hijacking

                                                                      1
                                                                      T1546.015

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Scheduled Task

                                                                      1
                                                                      T1053.005

                                                                      Privilege Escalation

                                                                      Boot or Logon Autostart Execution

                                                                      3
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      3
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      1
                                                                      T1543

                                                                      Windows Service

                                                                      1
                                                                      T1543.003

                                                                      Event Triggered Execution

                                                                      1
                                                                      T1546

                                                                      Component Object Model Hijacking

                                                                      1
                                                                      T1546.015

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Scheduled Task

                                                                      1
                                                                      T1053.005

                                                                      Defense Evasion

                                                                      Modify Registry

                                                                      2
                                                                      T1112

                                                                      Credential Access

                                                                      Credentials from Password Stores

                                                                      1
                                                                      T1555

                                                                      Credentials from Web Browsers

                                                                      1
                                                                      T1555.003

                                                                      Unsecured Credentials

                                                                      1
                                                                      T1552

                                                                      Credentials In Files

                                                                      1
                                                                      T1552.001

                                                                      Discovery

                                                                      Query Registry

                                                                      1
                                                                      T1012

                                                                      System Network Configuration Discovery

                                                                      1
                                                                      T1016

                                                                      Internet Connection Discovery

                                                                      1
                                                                      T1016.001

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      1
                                                                      T1005

                                                                      Command and Control

                                                                      Web Service

                                                                      1
                                                                      T1102

                                                                      Exfiltration

                                                                      Impact

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      ModuleAnalysisCache
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                      • Size 67KB
                                                                      • SHA256 475fecec1a427daf95fe5e369548cfbf96cc03f8ef712e58803a0fd8fd876378
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 1KB
                                                                      • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 1KB
                                                                      • SHA256 6ea7e8cbac15602c9a7fab2a25c7644ffe4e7cc301de6990ae1dcd46c91cb89d
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 1KB
                                                                      • SHA256 ba122a05f385f085e1ac1509684839b6f075b97fc0802c57a222681027513937
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 1KB
                                                                      • SHA256 805e3c2d6e528a2d43222fdba41677c19e7d2820f628ca6c001f910b88f11db4
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      __PSScriptPolicyTest_2g5bpyrr.yvq.ps1
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2g5bpyrr.yvq.ps1
                                                                      • Size 60B
                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      com_hijack.ps1
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\com_hijack.ps1
                                                                      • Size 273B
                                                                      • SHA256 d3402ab221607a9cdd286740ae48fbcac0a3dfa7bb0adca5df7c32ba7a088a44
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      _SHA224.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2752_793370_Dcq9uIPFDoM\Crypto\Hash\_SHA224.pyd
                                                                      • Size 21KB
                                                                      • SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA224.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2752_793370_Dcq9uIPFDoM\Cryptodome\Hash\_SHA224.pyd
                                                                      • Size 21KB
                                                                      • SHA256 aaf140f60dba7760d89a4cd3771127db18b5fc577c8aed6596f1e75481572a25
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      cd.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2752_793370_Dcq9uIPFDoM\charset_normalizer\cd.pyd
                                                                      • Size 10KB
                                                                      • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      .env
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\.env
                                                                      • Size 240B
                                                                      • SHA256 3bb89e20bd3280494b42125bc24177ebec2aec9c35a0371a7b028fd4a88ff095
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      81d243bd2c585b0f4821__mypyc.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\81d243bd2c585b0f4821__mypyc.pyd
                                                                      • Size 211KB
                                                                      • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _Salsa20.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_Salsa20.pyd
                                                                      • Size 13KB
                                                                      • SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_cbc.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_cbc.pyd
                                                                      • Size 11KB
                                                                      • SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_cfb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_cfb.pyd
                                                                      • Size 12KB
                                                                      • SHA256 cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ctr.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_ctr.pyd
                                                                      • Size 14KB
                                                                      • SHA256 aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_des.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_des.pyd
                                                                      • Size 51KB
                                                                      • SHA256 0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ecb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_ecb.pyd
                                                                      • Size 10KB
                                                                      • SHA256 98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_eksblowfish.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_eksblowfish.pyd
                                                                      • Size 20KB
                                                                      • SHA256 29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ocb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_ocb.pyd
                                                                      • Size 17KB
                                                                      • SHA256 c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ofb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Cipher\_raw_ofb.pyd
                                                                      • Size 11KB
                                                                      • SHA256 1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _BLAKE2s.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_BLAKE2s.pyd
                                                                      • Size 13KB
                                                                      • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _MD5.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_MD5.pyd
                                                                      • Size 15KB
                                                                      • SHA256 ee469ab6d4dbdac22eea7bc40f3e2872442c649e03778d8d6b94a112da1e31aa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA1.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_SHA1.pyd
                                                                      • Size 17KB
                                                                      • SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA384.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_SHA384.pyd
                                                                      • Size 25KB
                                                                      • SHA256 38086fc4e0c53f5153571073995610ac91c454c6aa161588b651286a585526ec
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA512.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_SHA512.pyd
                                                                      • Size 25KB
                                                                      • SHA256 adab3a8ef9daa73b1e9ca83d66a726c8ad256eed119ab2d7d3fcee10f8f013d1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _ghash_clmul.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_ghash_clmul.pyd
                                                                      • Size 12KB
                                                                      • SHA256 63d9bbdac4e8e2c95b1a41eb7a2b42047b6a0c8d36447165e32167d3c7a57aee
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _ghash_portable.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_ghash_portable.pyd
                                                                      • Size 12KB
                                                                      • SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _keccak.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Hash\_keccak.pyd
                                                                      • Size 15KB
                                                                      • SHA256 393c54d090197d55d87619e99528d2e774c9157632115a07fcf35ee50681e78f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _scrypt.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Protocol\_scrypt.pyd
                                                                      • Size 12KB
                                                                      • SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _cpuid_c.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Util\_cpuid_c.pyd
                                                                      • Size 10KB
                                                                      • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _strxor.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Crypto\Util\_strxor.pyd
                                                                      • Size 10KB
                                                                      • SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _Salsa20.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_Salsa20.pyd
                                                                      • Size 13KB
                                                                      • SHA256 59ee075ecb9877bc24f5c27fa2d590bae0f6aa30a6e02432e1eb25cb459abc0e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_aes.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_aes.pyd
                                                                      • Size 34KB
                                                                      • SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_aesni.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_aesni.pyd
                                                                      • Size 15KB
                                                                      • SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_cbc.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_cbc.pyd
                                                                      • Size 11KB
                                                                      • SHA256 6c6c5fac1b5933fb857fcc3e5a87765257b5484285de147e9bb5fc854223a707
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_cfb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_cfb.pyd
                                                                      • Size 12KB
                                                                      • SHA256 26e351c4fade35c146d84df0e22c2468e01186d3a8a1e51bb6c8d8ea87f09cd7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ctr.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_ctr.pyd
                                                                      • Size 14KB
                                                                      • SHA256 229994e4cb838079a5711c8c0ffeb25fb4684a70ecda497ddb49c8a315594a83
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ecb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_ecb.pyd
                                                                      • Size 10KB
                                                                      • SHA256 da4eacde396e7388ec5da5133762409757dcdaae3022590a73d9ad950844c31f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_eksblowfish.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_eksblowfish.pyd
                                                                      • Size 20KB
                                                                      • SHA256 40e1a78102a078058cb06b4ff41411f89203564915bc0bce04f4c2643deb9b24
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ocb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_ocb.pyd
                                                                      • Size 17KB
                                                                      • SHA256 61f8a3ca451db3a07b3815c4d91a37100c416f160e3ccfa6113bef0c80d0c12b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _raw_ofb.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Cipher\_raw_ofb.pyd
                                                                      • Size 11KB
                                                                      • SHA256 b77a2a9322c28d1dd79dd9176bd6d697f2ee3dd10cb2ce24cdfd9d42b533feff
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _BLAKE2s.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_BLAKE2s.pyd
                                                                      • Size 13KB
                                                                      • SHA256 88e734c772909ccc7158f54ce8d488bd0b412ebe2e932c5539e07cb6674243cc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _MD5.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_MD5.pyd
                                                                      • Size 15KB
                                                                      • SHA256 ee1174e8047988975fbf32ef309f959b7d71654e636e5ab1dde1812bd78c8470
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA1.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_SHA1.pyd
                                                                      • Size 17KB
                                                                      • SHA256 76dd83ba91ceccd982d4daafcbb3c6950f8812a92b619fa3da24a50e23c43e17
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA384.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_SHA384.pyd
                                                                      • Size 25KB
                                                                      • SHA256 a30d3afce8c4bfe98c494b09d6cea4db642bbf194eceb90875a79434c703db65
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _SHA512.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_SHA512.pyd
                                                                      • Size 25KB
                                                                      • SHA256 a341b50b34a4a85028ab7a4d1822d04055a65bde4ee8518b5f79cf792957ce4d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _ghash_clmul.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_ghash_clmul.pyd
                                                                      • Size 12KB
                                                                      • SHA256 c8cc9583c2d91d8ef25073e01a863a40c09fa0a89007f8bb0442df46ba26f0e3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _ghash_portable.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_ghash_portable.pyd
                                                                      • Size 12KB
                                                                      • SHA256 cd1d79a0d8923c39f7368c92fae0c731ae60ecd34d1c9f387d4824b2af168036
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _keccak.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Hash\_keccak.pyd
                                                                      • Size 15KB
                                                                      • SHA256 ca84a6475c144856f5cd72a58b9d319f2086393939f14ba799b7fb65666eec03
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _scrypt.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Protocol\_scrypt.pyd
                                                                      • Size 12KB
                                                                      • SHA256 11cf9155436c23de02abc126ef5abc0c59d0d5b3555fc51f167912af21ad38f6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _cpuid_c.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Util\_cpuid_c.pyd
                                                                      • Size 10KB
                                                                      • SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _strxor.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\Cryptodome\Util\_strxor.pyd
                                                                      • Size 10KB
                                                                      • SHA256 c80c1b169b894b141a60f99fd80e0dceb1c9a598748315c26b955831d9df46b5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _avif.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\PIL\_avif.pyd
                                                                      • Size 7.5MB
                                                                      • SHA256 21e5118201e7d9a1d8e22f2dc62af5d550943d5cc020c077703c5c8385a9a059
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _imaging.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\PIL\_imaging.pyd
                                                                      • Size 2.5MB
                                                                      • SHA256 e04dfdb2bdba09efc4bee07924e7be18b0b324a890eae81a12509d54370d4621
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _imagingcms.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\PIL\_imagingcms.pyd
                                                                      • Size 265KB
                                                                      • SHA256 2533e49538d43bf7655379234cfdccb364fa523f454b245bc7b4726ef9bd11ea
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _imagingft.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\PIL\_imagingft.pyd
                                                                      • Size 2.1MB
                                                                      • SHA256 36de3f5dcf98e5d0a04c391fd6cc7ccee5cb807f6a4881e894c973ba085f8547
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _imagingmath.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\PIL\_imagingmath.pyd
                                                                      • Size 24KB
                                                                      • SHA256 947d15f95576d6a156ece0111a408818cfe00413c64a34ae89f5800dcd3aa590
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _webp.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\PIL\_webp.pyd
                                                                      • Size 400KB
                                                                      • SHA256 bcc87ca62bab7d494703413d513022653545f8f6ad5fc117dcb0086c17c5639f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _decimal.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\_decimal.pyd
                                                                      • Size 247KB
                                                                      • SHA256 c70f05f6bc564fe400527b30c29461e9642fb973f66eec719d282d3d0b402f93
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _elementtree.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\_elementtree.pyd
                                                                      • Size 125KB
                                                                      • SHA256 c2dcbeafd39f8134dcb15a51f825035f71b6e956cd13a2745c00626253148b5e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _multiprocessing.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\_multiprocessing.pyd
                                                                      • Size 33KB
                                                                      • SHA256 b49fe3b3efd833aaad131ce25706126b569d1a1f2eba4d470ec98ffdfa722767
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _queue.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\_queue.pyd
                                                                      • Size 31KB
                                                                      • SHA256 ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _sqlite3.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\_sqlite3.pyd
                                                                      • Size 117KB
                                                                      • SHA256 1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _win32sysloader.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\_win32sysloader.pyd
                                                                      • Size 15KB
                                                                      • SHA256 8ad2e21cd1a627fa36f082ce0b71f81c91f9d3825908a520072245a2545e1be1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      cacert.pem
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\certifi\cacert.pem
                                                                      • Size 230KB
                                                                      • SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _rust.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\cryptography\hazmat\bindings\_rust.pyd
                                                                      • Size 9.4MB
                                                                      • SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      opencv_videoio_ffmpeg4130_64.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\cv2\opencv_videoio_ffmpeg4130_64.dll
                                                                      • Size 27.3MB
                                                                      • SHA256 fcc614672159094a35815b7ea2819a648cbf86c30d90c57e8c6ba1432f594548
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _version.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\lz4\_version.pyd
                                                                      • Size 11KB
                                                                      • SHA256 a47c6276cba0b140720f29b2523253f20cb918a85a2f0053b4473c440141137f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _block.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\lz4\block\_block.pyd
                                                                      • Size 74KB
                                                                      • SHA256 a53e9878f2fc6973a683d0524411a16dcaa325d813c387588419ebbe70b46bb7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy.libs\libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
                                                                      • Size 19.5MB
                                                                      • SHA256 63c857e738469261263c764a36be9436ebdeaa272e340a828f42047a97131080
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
                                                                      • Size 561KB
                                                                      • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _multiarray_tests.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\_core\_multiarray_tests.pyd
                                                                      • Size 63KB
                                                                      • SHA256 adf0e01de577f4ccc2a11099c817cb41c8a78b6174175356dd62e745075cfac8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _multiarray_umath.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\_core\_multiarray_umath.pyd
                                                                      • Size 3.5MB
                                                                      • SHA256 4fb4c5d62a6bd766eea716350eaf5396580e33cf7dc159e305488d1b7d72dad2
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _pocketfft_umath.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\fft\_pocketfft_umath.pyd
                                                                      • Size 270KB
                                                                      • SHA256 e22ee51c9761e8cb2e153efc321d09cb656c5573488e55167f69d6e070d22466
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _umath_linalg.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\linalg\_umath_linalg.pyd
                                                                      • Size 109KB
                                                                      • SHA256 8742391ee3d6dfb4a6e41418626bb45048b102e05229d424279ddefb877d9cd6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _bounded_integers.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_bounded_integers.pyd
                                                                      • Size 215KB
                                                                      • SHA256 418dc5293b11f83a70c63ef77c3c9ca0dc4b9f20c7fadb4625805480305ddcef
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _common.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_common.pyd
                                                                      • Size 166KB
                                                                      • SHA256 f2cdbaa3d3d0dd8f5b74b7b4630470d609be4e4d31f8e37f8681e6c3c5aca895
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _generator.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_generator.pyd
                                                                      • Size 594KB
                                                                      • SHA256 91f53ff9a803213ea5fa38b73be057b448be1728b4a353586d10f08d4f2c021c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _mt19937.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_mt19937.pyd
                                                                      • Size 83KB
                                                                      • SHA256 e66de88dbf0b9a2ae67576cf2f4e7c220e10729d445403787bc8b58f4e8a6750
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _pcg64.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_pcg64.pyd
                                                                      • Size 94KB
                                                                      • SHA256 16e4f9401783c502d82bce06263d98c985c841f3115d301741b22413bbbff851
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _philox.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_philox.pyd
                                                                      • Size 78KB
                                                                      • SHA256 56c44540e500dfb820e5a75004b5cf9945a648a87d0e40d64672325dd22fa3c1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _sfc64.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\_sfc64.pyd
                                                                      • Size 58KB
                                                                      • SHA256 23f03f25c5528ca51c11846bcbb5aaaee7c1c518897249865c47dca913c43863
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      bit_generator.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\bit_generator.pyd
                                                                      • Size 162KB
                                                                      • SHA256 eafa63966c1b3e34397bec8fef991dee5a7944b09058b38afd9f2de40acfd141
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mtrand.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\numpy\random\mtrand.pyd
                                                                      • Size 500KB
                                                                      • SHA256 6f8a3d3ce835c6cd4fea9e4425b757b268ad69b0cef201a225f6cbd1b453182a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _psutil_windows.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\psutil\_psutil_windows.pyd
                                                                      • Size 69KB
                                                                      • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso15924.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso15924.json
                                                                      • Size 20KB
                                                                      • SHA256 cb7e2ed1bd2345a9ac119aad0a38adfaf6170b8699f45b988c30cc102199312d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso3166-1.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso3166-1.json
                                                                      • Size 42KB
                                                                      • SHA256 f01b812b57fba9f31ff621bf33e7c7570a01964dbeb5be2167e94decf538c89f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso3166-2.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso3166-2.json
                                                                      • Size 486KB
                                                                      • SHA256 78c90ef7fc25b5c2631aac5f089bc9ff6ec22c025c05b6ddbc087a1f1be2e46a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso3166-3.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso3166-3.json
                                                                      • Size 6KB
                                                                      • SHA256 eb92d1cce3e352559f610e60e2acb23687eb1cf07b23675fb112863a5741a6fa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso4217.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso4217.json
                                                                      • Size 15KB
                                                                      • SHA256 a84a5b83c38591e87569b2e0ba184ed867386e00f2b5a93349a0cd1ded6b6ccf
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso639-3.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso639-3.json
                                                                      • Size 855KB
                                                                      • SHA256 2c61a9bb90a8c50c46bfbab484838863a12335bfdd0a92b4809f3faf1756b22d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      iso639-5.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pycountry\databases\iso639-5.json
                                                                      • Size 8KB
                                                                      • SHA256 12cc06ff3ed95eb809174a686cb2ae73315f3cb16582cf6fe4267ce7a2ad6198
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _pydantic_core.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pydantic_core\_pydantic_core.pyd
                                                                      • Size 5.0MB
                                                                      • SHA256 a0291ce64fc21ad1743626894f97c2e669bcac44226cd54897a661a1e5a147d0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      pyexpat.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pyexpat.pyd
                                                                      • Size 194KB
                                                                      • SHA256 c1ed7017ce55119df27563d470e7dc3fb29234a7f3cd5fc82d317b6fe559300b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      pythoncom311.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pythoncom311.dll
                                                                      • Size 665KB
                                                                      • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      pywintypes311.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\pywintypes311.dll
                                                                      • Size 132KB
                                                                      • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      sqlite3.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\sqlite3.dll
                                                                      • Size 1.4MB
                                                                      • SHA256 919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      svc32.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\svc32.exe
                                                                      • Size 1.4MB
                                                                      • SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcruntime140_1.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\vcruntime140_1.dll
                                                                      • Size 48KB
                                                                      • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      win32clipboard.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\win32clipboard.pyd
                                                                      • Size 28KB
                                                                      • SHA256 391c052914d03f962da03023012f547ce3cddb2b2f010c42e2ea5fa4a843b103
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      win32event.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\win32event.pyd
                                                                      • Size 29KB
                                                                      • SHA256 cd1572c89951ec38ec413b68084ae5fdfba7951f67cf74223dea977964fbafd1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      win32gui.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\win32gui.pyd
                                                                      • Size 214KB
                                                                      • SHA256 8b8b30b50a1fb1230af9a288a558b8a4e502b2684b6656831030e39414ce6963
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      win32ui.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\win32ui.pyd
                                                                      • Size 1.1MB
                                                                      • SHA256 fba5c451d20cab28bd23549041c270a9b3f6145b0f537eeac58ada0d26f50040
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _cffi.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_2804_656015_pqDGRkTEimc\zstandard\_cffi.pyd
                                                                      • Size 651KB
                                                                      • SHA256 f6b7450a953cc6f0facd89992d1d15b22b94f78342a4cf59f15142f71f8dbe46
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VCRUNTIME140.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\VCRUNTIME140.dll
                                                                      • Size 106KB
                                                                      • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _asyncio.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_asyncio.pyd
                                                                      • Size 63KB
                                                                      • SHA256 2b772076c2dba91fb4f61182b929485cc6c660baab4bce6e08aa18e414c69641
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _bz2.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_bz2.pyd
                                                                      • Size 82KB
                                                                      • SHA256 ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _cffi_backend.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_cffi_backend.pyd
                                                                      • Size 174KB
                                                                      • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _ctypes.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_ctypes.pyd
                                                                      • Size 120KB
                                                                      • SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _hashlib.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_hashlib.pyd
                                                                      • Size 63KB
                                                                      • SHA256 241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _lzma.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_lzma.pyd
                                                                      • Size 155KB
                                                                      • SHA256 f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _overlapped.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_overlapped.pyd
                                                                      • Size 49KB
                                                                      • SHA256 24f9971debbd864e3ba615a89d2c5b0e818f9ab2be4081499bc877761992c814
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _socket.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_socket.pyd
                                                                      • Size 77KB
                                                                      • SHA256 eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _ssl.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_ssl.pyd
                                                                      • Size 157KB
                                                                      • SHA256 680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _uuid.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\_uuid.pyd
                                                                      • Size 24KB
                                                                      • SHA256 27b9545f5a510e71195951485d3c6a8b112917546fe5e8e46579b8ff6ce2acb0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _http_parser.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\aiohttp\_http_parser.pyd
                                                                      • Size 247KB
                                                                      • SHA256 511cd7062151ae724f1f194d009caa38cf0c2bbfac709b5476dcc8354a0575ed
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _http_writer.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\aiohttp\_http_writer.pyd
                                                                      • Size 44KB
                                                                      • SHA256 6d2b1bffc5ceb0322b9a924516bac95bbbc91ca0842c20408a6758fb2ba2d5dc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mask.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\aiohttp\_websocket\mask.pyd
                                                                      • Size 34KB
                                                                      • SHA256 1904ebaef453f681cca022fd4e6ae88930fedec16e30b87797cbe72f5b371944
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      reader_c.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\aiohttp\_websocket\reader_c.pyd
                                                                      • Size 138KB
                                                                      • SHA256 3efc2e02a76c14b85eb5aa6beeebe4604cf30c1b957f972c877b10578a635ffb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      davey.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\davey\davey.pyd
                                                                      • Size 1.8MB
                                                                      • SHA256 eb83b23fafae5730b0560e8bf7072c433108a606c047e5088718264b324968c4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _frozenlist.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\frozenlist\_frozenlist.pyd
                                                                      • Size 66KB
                                                                      • SHA256 cb0227473d0c9e53c49fd548b539522a73e5ba7fc02ba7702ef45db8da7b4119
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      libcrypto-1_1.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\libcrypto-1_1.dll
                                                                      • Size 3.3MB
                                                                      • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      libffi-8.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\libffi-8.dll
                                                                      • Size 38KB
                                                                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      libssl-1_1.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\libssl-1_1.dll
                                                                      • Size 688KB
                                                                      • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _multidict.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\multidict\_multidict.pyd
                                                                      • Size 77KB
                                                                      • SHA256 f92555975df808e8f4ba64e60af52ba32ccdebc69aa4dcca23d54d098dcb5d74
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _sodium.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\nacl\_sodium.pyd
                                                                      • Size 396KB
                                                                      • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _helpers_c.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\propcache\_helpers_c.pyd
                                                                      • Size 59KB
                                                                      • SHA256 665a77de007b7f37699ba3f97fb58f7664b64d5c047eaf40720bf888d6846caa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      python3.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\python3.dll
                                                                      • Size 65KB
                                                                      • SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      python311.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\python311.dll
                                                                      • Size 5.5MB
                                                                      • SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      select.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\select.pyd
                                                                      • Size 29KB
                                                                      • SHA256 13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      unicodedata.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\unicodedata.pyd
                                                                      • Size 1.1MB
                                                                      • SHA256 e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      win32api.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\win32api.pyd
                                                                      • Size 135KB
                                                                      • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _quoting_c.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\yarl\_quoting_c.pyd
                                                                      • Size 79KB
                                                                      • SHA256 829484c150e37c06dc93197518bdd0f2d0b78387cee3c879a0dab86a60281ad3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      backend_c.pyd
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\onefile_3264_145141_CUDCwx705Jk\zstandard\backend_c.pyd
                                                                      • Size 512KB
                                                                      • SHA256 35f7bfe8d1965fc33c090febd216a4ef5c3a8b22ce02a689226a3776cc295317
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      tmp7_pisbm6.db
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp7_pisbm6.db
                                                                      • Size 20KB
                                                                      • SHA256 21ee064a58d0ff08dabd693de9b7b602a7c0bf095fd9e1a83af852f2b02e5420
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      tmp91jquoci.db
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp91jquoci.db
                                                                      • Size 40KB
                                                                      • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      tmpcfhivvs5.db
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpcfhivvs5.db
                                                                      • Size 138KB
                                                                      • SHA256 a0a5c8d75dfc450030aedc84b34d5f33f1faa7e8560e78cf667698bab5b4094e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      tmpv0a8ee3h_cookies.txt
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpv0a8ee3h_cookies.txt
                                                                      • Size 232B
                                                                      • SHA256 6f36bf09410f19801a2c02d2db5fab1c4ca8a2e5d14da7bcaa78d64d237c52b4
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      vxk5r5n9
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\vxk5r5n9
                                                                      • Size 4B
                                                                      • SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      wmi_persist.ps1
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wmi_persist.ps1
                                                                      • Size 926B
                                                                      • SHA256 0216a8834ed218a77455c665186e6e25dcc301271f1e861ed8c32ae03591e2bd
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      wudf_task.xml
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wudf_task.xml
                                                                      • Size 1KB
                                                                      • SHA256 354150e29ce2481370fe6ac64ee61041b0439095f159471e9dab61292d670dea
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      wudf_task2.xml
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wudf_task2.xml
                                                                      • Size 2KB
                                                                      • SHA256 c0af559849859e6550fcd282b4552d1703ffdcef571b7a571b56dc24b74ff493
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      memory/1220-249-0x00000273FB820000-0x00000273FB842000-memory.dmp
                                                                      Download

                                                                      memory/1368-1569-0x0000028039AB0000-0x0000028039B62000-memory.dmp
                                                                      Download

                                                                      memory/2212-1206-0x00000188A3E60000-0x00000188A3F12000-memory.dmp
                                                                      Download

                                                                      memory/3312-539-0x000001FAE6580000-0x000001FAE659E000-memory.dmp
                                                                      Download

                                                                      memory/3312-542-0x000001FAE67E0000-0x000001FAE6892000-memory.dmp
                                                                      Download

                                                                      memory/4224-543-0x00000203EA6C0000-0x00000203EA6CA000-memory.dmp
                                                                      Download

                                                                      memory/4224-554-0x00000203EA6F0000-0x00000203EA70E000-memory.dmp
                                                                      Download

                                                                      memory/4224-559-0x00000203EA730000-0x00000203EA74A000-memory.dmp
                                                                      Download

                                                                      memory/4224-558-0x00000203EA6D0000-0x00000203EA6DE000-memory.dmp
                                                                      Download