Overview

overview

8

Static

static

3

pc_scanner.exe

windows10-2004-x64

8

pc_scanner.exe

windows11-ltsc_2024-x64

8

Resubmissions

24/08/2026, 17:33

260824-v4zggsaq7v8

24/08/2026, 17:31

260824-v3regsec878

Analysis

  • max time kernel
    78s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 17:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pc_scanner.exe
  • Size 15.3MB
  • Sample260824-v3regsec87
  • SHA256 691dc0c50cee6b32dc04a6d3ef6d27e162fafa9e15de95f1c6ff2506dee74414
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

    Using powershell.exe command.

    execution
  • Loads dropped DLL 22 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 19 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Power Settings 1 TTPs 6 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe
    "C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5124
    • C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe
      "C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $os = Get-CimInstance Win32_OperatingSystem $cs = Get-CimInstance Win32_ComputerSystem $csp = Get-CimInstance Win32_ComputerSystemProduct $page = Get-CimInstance Win32_PageFileUsage $activePlan = (powercfg /getactivescheme 2>$null | Out-String).Trim() $secureBoot = $null try { $secureBoot = Confirm-SecureBootUEFI -ErrorAction Stop } catch {} $tpm = $null try { $tpm = Get-Tpm | Select-Object TpmPresent, TpmReady, ManagedAuthLevel, ManufacturerIdTxt, ManufacturerVersion } catch {} [PSCustomObject]@{ Caption = $os.Caption Version = $os.Version Build = $os.BuildNumber Architecture = $os.OSArchitecture InstallDate = $os.InstallDate LastBoot = $os.LastBootUpTime RegisteredUser = $os.RegisteredUser SerialNumber = $os.SerialNumber WindowsDirectory = $os.WindowsDirectory SystemDirectory = $os.SystemDirectory ComputerManufacturer = $cs.Manufacturer ComputerModel = $cs.Model SystemFamily = $csp.Version SystemSku = $csp.SKUNumber TotalPhysicalMemoryBytes = $cs.TotalPhysicalMemory VirtualizationFirmwareEnabled = $cs.VirtualizationFirmwareEnabled HypervisorPresent = $cs.HypervisorPresent SecureBoot = $secureBoot ActivePowerPlan = $activePlan PageFiles = @($page | ForEach-Object { [PSCustomObject]@{ Name=$_.Name; AllocatedBaseSizeMB=$_.AllocatedBaseSize; CurrentUsageMB=$_.CurrentUsage; PeakUsageMB=$_.PeakUsage } }) TPM = $tpm } | ConvertTo-Json -Depth 6 -Compress "
        3⤵
        • Power Settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5868
        • C:\Windows\system32\powercfg.exe
          "C:\Windows\system32\powercfg.exe" /getactivescheme
          4⤵
          • Power Settings
          PID:4388
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $prod = Get-CimInstance Win32_ComputerSystemProduct $bios = Get-CimInstance Win32_BIOS [PSCustomObject]@{ Manufacturer = $cs.Manufacturer Model = $cs.Model SystemType = $cs.SystemType Domain = $cs.Domain Workgroup = $cs.Workgroup PartOfDomain = $cs.PartOfDomain ProductName = $prod.Name ProductVersion = $prod.Version ProductSerial = $prod.IdentifyingNumber BIOSVersion = (($bios.SMBIOSBIOSVersion -join '; ')) SMBIOSMajor = $bios.SMBIOSMajorVersion SMBIOSMinor = $bios.SMBIOSMinorVersion } | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.PartialProductKey -and $_.Name -like 'Windows*' } | ForEach-Object { [PSCustomObject]@{ Name = $_.Name Description = $_.Description LicenseStatus = $_.LicenseStatus PartialProductKey = $_.PartialProductKey GracePeriodMinutes = $_.GracePeriodRemaining } } | Select-Object -Unique Name, Description, LicenseStatus, PartialProductKey, GracePeriodMinutes | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5168
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "powercfg /a 2>$null"
        3⤵
        • Power Settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\system32\powercfg.exe
          "C:\Windows\system32\powercfg.exe" /a
          4⤵
          • Power Settings
          PID:3652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_Processor | ForEach-Object { [PSCustomObject]@{ Name = $_.Name Manufacturer = $_.Manufacturer PhysicalCores = $_.NumberOfCores LogicalProcessors = $_.NumberOfLogicalProcessors BaseClockMHz = $_.CurrentClockSpeed MaxClockMHz = $_.MaxClockSpeed CurrentClockMHz = $_.CurrentClockSpeed Socket = $_.SocketDesignation Architecture = $_.Architecture L2CacheKB = $_.L2CacheSize L3CacheKB = $_.L3CacheSize AddressWidth = $_.AddressWidth DataWidth = $_.DataWidth VirtualizationFirmwareEnabled = $_.VirtualizationFirmwareEnabled SecondLevelAddressTranslationExtensions = $_.SecondLevelAddressTranslationExtensions VMMonitorModeExtensions = $_.VMMonitorModeExtensions Status = $_.Status } } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3408
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, CsNumberOfLogicalProcessors, CsNumberOfProcessors | Format-List | Out-String"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3844
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_VideoController | ForEach-Object { [PSCustomObject]@{ Name = $_.Name Manufacturer = $_.AdapterCompatibility VRAMBytes = $_.AdapterRAM DriverVersion = $_.DriverVersion DriverDate = $_.DriverDate VideoProcessor = $_.VideoProcessor CurrentBitsPerPixel = $_.CurrentBitsPerPixel Resolution = \"$($_.CurrentHorizontalResolution)x$($_.CurrentVerticalResolution)\" HorizontalResolution = $_.CurrentHorizontalResolution VerticalResolution = $_.CurrentVerticalResolution RefreshRate = $_.CurrentRefreshRate PNPDeviceID = $_.PNPDeviceID DeviceID = $_.DeviceID Status = $_.Status VideoModeDescription = $_.VideoModeDescription } } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:6112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_BaseBoard | ForEach-Object { [PSCustomObject]@{ Manufacturer = $_.Manufacturer Model = $_.Product Version = $_.Version Serial = $_.SerialNumber PartNumber = $_.PartNumber HostingBoard = $_.HostingBoard Status = $_.Status } } | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4540
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_BIOS | ForEach-Object { [PSCustomObject]@{ Manufacturer = $_.Manufacturer Name = $_.Name Version = $_.SMBIOSBIOSVersion ReleaseDate = $_.ReleaseDate Serial = $_.SerialNumber SMBIOSMajor = $_.SMBIOSMajorVersion SMBIOSMinor = $_.SMBIOSMinorVersion Status = $_.Status } } | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_PhysicalMemory | ForEach-Object { [PSCustomObject]@{ Manufacturer = $_.Manufacturer PartNumber = $_.PartNumber CapacityBytes = $_.Capacity SpeedMHz = $_.Speed ConfiguredSpeedMHz = $_.ConfiguredClockSpeed ConfiguredVoltage = $_.ConfiguredVoltage MinVoltage = $_.MinVoltage MaxVoltage = $_.MaxVoltage Slot = $_.DeviceLocator BankLabel = $_.BankLabel Serial = $_.SerialNumber SMBIOSMemoryType = $_.SMBIOSMemoryType FormFactor = $_.FormFactor DataWidth = $_.DataWidth TotalWidth = $_.TotalWidth TypeDetail = $_.TypeDetail } } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $modules = @(Get-CimInstance Win32_PhysicalMemory) $cs = Get-CimInstance Win32_ComputerSystem [PSCustomObject]@{ InstalledCapacityBytes = ($modules | Measure-Object Capacity -Sum).Sum ModuleCount = $modules.Count AvailableRamSlots = $null PhysicalMemoryBytes = $cs.TotalPhysicalMemory ErrorCorrection = (($modules | Select-Object -First 1).DataWidth) } | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5912
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_DiskDrive | ForEach-Object { [PSCustomObject]@{ Model = $_.Model Manufacturer = $_.Manufacturer Serial = $_.SerialNumber Interface = $_.InterfaceType MediaType = $_.MediaType SizeBytes = $_.Size Firmware = $_.FirmwareRevision DeviceID = $_.DeviceID PNPDeviceID = $_.PNPDeviceID Status = $_.Status BytesPerSector = $_.BytesPerSector Partitions = $_.Partitions } } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1128
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-PhysicalDisk | ForEach-Object { [PSCustomObject]@{ FriendlyName=$_.FriendlyName SerialNumber=$_.SerialNumber MediaType=$_.MediaType BusType=$_.BusType SizeBytes=$_.Size HealthStatus=$_.HealthStatus OperationalStatus=$_.OperationalStatus Usage=$_.Usage FirmwareVersion=$_.FirmwareVersion CanPool=$_.CanPool SpindleSpeed=$_.SpindleSpeed } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4060
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $result = @() try { $disks = @(Get-PhysicalDisk) foreach ($d in $disks) { try { $r = Get-StorageReliabilityCounter -PhysicalDisk $d -ErrorAction Stop $result += [PSCustomObject]@{ FriendlyName=$d.FriendlyName SerialNumber=$d.SerialNumber TemperatureC=$r.Temperature ReadErrorsTotal=$r.ReadErrorsTotal ReadErrorsUncorrected=$r.ReadErrorsUncorrected WriteErrorsTotal=$r.WriteErrorsTotal WriteErrorsUncorrected=$r.WriteErrorsUncorrected Wear=$r.Wear PowerOnHours=$r.PowerOnHours PowerCycleCount=$r.PowerCycleCount ReadLatencyMax=$r.ReadLatencyMax WriteLatencyMax=$r.WriteLatencyMax } } catch {} } } catch {} $result | ConvertTo-Json -Depth 6 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-Volume | ForEach-Object { [PSCustomObject]@{ DriveLetter=$_.DriveLetter Path=$_.Path FileSystem=$_.FileSystem FileSystemLabel=$_.FileSystemLabel SizeBytes=$_.Size SizeRemainingBytes=$_.SizeRemaining HealthStatus=$_.HealthStatus OperationalStatus=$_.OperationalStatus DriveType=$_.DriveType } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1300
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-Partition | ForEach-Object { [PSCustomObject]@{ DiskNumber=$_.DiskNumber PartitionNumber=$_.PartitionNumber DriveLetter=$_.DriveLetter SizeBytes=$_.Size OffsetBytes=$_.Offset Type=$_.Type GptType=$_.GptType IsBoot=$_.IsBoot IsSystem=$_.IsSystem IsActive=$_.IsActive } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3196
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $monitors = @(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorID -ErrorAction SilentlyContinue) $basic = @(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams -ErrorAction SilentlyContinue) $result = foreach ($monitor in $monitors) { $manufacturer = -join ($monitor.ManufacturerName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $product = -join ($monitor.ProductCodeID | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $serial = -join ($monitor.SerialNumberID | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $user = -join ($monitor.UserFriendlyName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $instance = -join ($monitor.InstanceName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) [PSCustomObject]@{ Manufacturer=$manufacturer ProductCode=$product Serial=$serial UserFriendlyName=$user InstanceName=$instance Active=$monitor.Active } } $result | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1516
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ InstanceName=$_.InstanceName Active=$_.Active MaxHorizontalImageSizeCm=$_.MaxHorizontalImageSize MaxVerticalImageSizeCm=$_.MaxVerticalImageSize VideoInputType=$_.VideoInputType } } | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5808
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_DesktopMonitor | ForEach-Object { [PSCustomObject]@{ Name=$_.Name MonitorType=$_.MonitorType PNPDeviceID=$_.PNPDeviceID ScreenHeight=$_.ScreenHeight ScreenWidth=$_.ScreenWidth Status=$_.Status } } | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5500
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-NetAdapter -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ Name=$_.Name InterfaceDescription=$_.InterfaceDescription Manufacturer=$_.Manufacturer MacAddress=$_.MacAddress LinkSpeed=$_.LinkSpeed Status=$_.Status MediaType=$_.MediaType DriverInformation=($null) ifIndex=$_.ifIndex Virtual=$_.Virtual } } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:4012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-NetIPConfiguration -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ InterfaceAlias=$_.InterfaceAlias InterfaceIndex=$_.InterfaceIndex IPv4Address=@($_.IPv4Address | ForEach-Object { $_.IPAddress }) IPv6Address=@($_.IPv6Address | ForEach-Object { $_.IPAddress }) IPv4DefaultGateway=@($_.IPv4DefaultGateway | ForEach-Object { $_.NextHop }) IPv6DefaultGateway=@($_.IPv6DefaultGateway | ForEach-Object { $_.NextHop }) DNSServers=@($_.DNSServer | ForEach-Object { $_.ServerAddresses }) NetProfileName=(Get-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue).Name NetworkCategory=(Get-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue).NetworkCategory } } | ConvertTo-Json -Depth 7 -Compress "
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:1456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-DnsClientServerAddress -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ InterfaceAlias=$_.InterfaceAlias AddressFamily=$_.AddressFamily ServerAddresses=@($_.ServerAddresses) } } | Where-Object { $_.ServerAddresses.Count -gt 0 } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:5104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "netsh wlan show interfaces 2>$null"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3308
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" wlan show interfaces
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:3396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "netsh wlan show networks mode=bssid 2>$null"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" wlan show networks mode=bssid
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:5168
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-NetTCPConnection -ErrorAction Stop | Sort-Object State,RemoteAddress | Select-Object -First 50 | ForEach-Object { [PSCustomObject]@{ LocalAddress=$_.LocalAddress LocalPort=$_.LocalPort RemoteAddress=$_.RemoteAddress RemotePort=$_.RemotePort State=$_.State OwningProcess=$_.OwningProcess } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4120
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-NetTCPConnection -State Listen -ErrorAction Stop | Sort-Object LocalPort | Select-Object -First 100 | ForEach-Object { [PSCustomObject]@{ LocalAddress=$_.LocalAddress LocalPort=$_.LocalPort OwningProcess=$_.OwningProcess } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $temps = Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue $result = foreach ($temp in $temps) { $celsius = ($temp.CurrentTemperature / 10) - 273.15 [PSCustomObject]@{ Zone = $temp.InstanceName TemperatureC = [math]::Round($celsius, 1) CriticalTripPointC = if ($temp.CriticalTripPoint) { [math]::Round(($temp.CriticalTripPoint / 10) - 273.15, 1) } else { $null } PassiveTripPointC = if ($temp.PassiveTripPoint) { [math]::Round(($temp.PassiveTripPoint / 10) - 273.15, 1) } else { $null } } } $result | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3716
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $result = @() $providers = @( @{ Namespace='root\LibreHardwareMonitor'; Name='LibreHardwareMonitor' }, @{ Namespace='root\OpenHardwareMonitor'; Name='OpenHardwareMonitor' } ) foreach ($provider in $providers) { try { $sensors = Get-CimInstance -Namespace $provider.Namespace -ClassName Sensor -ErrorAction Stop foreach ($sensor in $sensors) { $result += [PSCustomObject]@{ Name = $sensor.Name Hardware = $sensor.Hardware SensorType = $sensor.SensorType Value = $sensor.Value Min = $sensor.Min Max = $sensor.Max Index = $sensor.Index InstanceId = $sensor.InstanceId Provider = $provider.Name } } if ($result.Count -gt 0) { break } } catch {} } $result | ConvertTo-Json -Depth 6 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:428
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_Battery -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ Name=$_.Name DeviceID=$_.DeviceID Status=$_.Status BatteryStatus=$_.BatteryStatus EstimatedChargeRemaining=$_.EstimatedChargeRemaining EstimatedRunTimeMinutes=$_.EstimatedRunTime DesignVoltage=$_.DesignVoltage Chemistry=$_.Chemistry Availability=$_.Availability } } | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:6120
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "powercfg /getactivescheme 2>$null"
        3⤵
        • Power Settings
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\system32\powercfg.exe
          "C:\Windows\system32\powercfg.exe" /getactivescheme
          4⤵
          • Power Settings
          PID:5980
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $paths = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $result = foreach ($path in $paths) { try { Get-ItemProperty $path -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | ForEach-Object { [PSCustomObject]@{ Name=$_.DisplayName Version=$_.DisplayVersion Publisher=$_.Publisher InstallDate=$_.InstallDate InstallLocation=$_.InstallLocation } } } catch {} } $result | Where-Object { $_.Name } | Sort-Object Name -Unique | Select-Object -First 250 | ConvertTo-Json -Depth 4 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        PID:5488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " $items = @() $locations = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce' ) foreach ($path in $locations) { try { $props = Get-ItemProperty -Path $path -ErrorAction Stop foreach ($property in $props.PSObject.Properties) { if ($property.Name -notlike 'PS*') { $items += [PSCustomObject]@{ Location=$path Name=$property.Name Command=[string]$property.Value } } } } catch {} } try { Get-CimInstance Win32_StartupCommand | ForEach-Object { $items += [PSCustomObject]@{ Location=$_.Location Name=$_.Name Command=$_.Command User=$_.User } } } catch {} $items | ConvertTo-Json -Depth 5 -Compress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-CimInstance Win32_Service | Where-Object { $_.State -eq 'Running' -or $_.StartMode -eq 'Auto' } | ForEach-Object { [PSCustomObject]@{ Name=$_.Name DisplayName=$_.DisplayName State=$_.State StartMode=$_.StartMode StartName=$_.StartName PathName=$_.PathName } } | Sort-Object State,Name | Select-Object -First 250 | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, AntispywareEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, NISEnabled, RealTimeProtectionEnabled, AntivirusSignatureVersion, AntispywareSignatureVersion, QuickScanAge, FullScanAge | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5076
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-NetFirewallProfile | ForEach-Object { [PSCustomObject]@{ Name=$_.Name; Enabled=$_.Enabled; DefaultInboundAction=$_.DefaultInboundAction; DefaultOutboundAction=$_.DefaultOutboundAction } } | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3924
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-BitLockerVolume | ForEach-Object { [PSCustomObject]@{ MountPoint=$_.MountPoint; VolumeStatus=$_.VolumeStatus; ProtectionStatus=$_.ProtectionStatus; EncryptionMethod=$_.EncryptionMethod; EncryptionPercentage=$_.EncryptionPercentage } } | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4520
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerIdTxt, ManufacturerVersion, ManagedAuthLevel | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3432
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3} -MaxEvents 20 -ErrorAction Stop | ForEach-Object { [PSCustomObject]@{ TimeCreated=$_.TimeCreated Id=$_.Id Level=$_.LevelDisplayName Provider=$_.ProviderName Message=$_.Message } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2,3} -MaxEvents 20 -ErrorAction Stop | ForEach-Object { [PSCustomObject]@{ TimeCreated=$_.TimeCreated Id=$_.Id Level=$_.LevelDisplayName Provider=$_.ProviderName Message=$_.Message } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-PnpDevice -PresentOnly -ErrorAction Stop | Group-Object Class | ForEach-Object { [PSCustomObject]@{ Class=$_.Name; Count=$_.Count } } | Sort-Object Class | ConvertTo-Json -Depth 4 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-PnpDevice -ErrorAction Stop | Where-Object { $_.Status -ne 'OK' } | Select-Object -First 100 Class, FriendlyName, InstanceId, Manufacturer, Status, ProblemCode | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4396

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 208af18ee05b9e5ad3cd0de6748fe476db09d36ab117ea6cda38b5705735134c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 7fe930d11881971243550186c3f6793a7c3cbc45172d2b931606ddfcf9ecd587
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 6dc067bae11c9ff81521cdd88d42c1af978e9f9031588314d153811ab483744e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 4c2f43baf1e35ea2b87b15f8658272e0fb08118500cada9789746e87e2f5c385
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 42a15d62270e8efda6a65839202adbf00e62981f3ea746b35acf5a05c20b3aa6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 7bf1ba707c501cfedd43eb5377576d9b243edcbb1748288d2bcb5962a7d765a9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 3be032780ff0750ee4059015502e05a1590d19ea63f2336a5c9686ec91206287
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 98d5921eabf45e428ef518d506aa49d86374e7a440ea8f897fca047ba236b3eb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 8aadca47cfc71233240325bd6f8744ded0cd4ec2a6b57ea931ff8996071add46
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 57783f19b8d400f296920ebe2123ce0285a7580c58c25945535a819f21ce83e2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e29d254a0cec245ca489b88e80ee44e85ae870f85b3112afb85106bd63daa592
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 a5ad4c5a318baa5b26fa1558634bf62c3719bafd8f559f954bc75f71c1d4e3b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2e9525eec2652a5457f7418e1f3865c5887fa98ed553f8a99569cc3430750451
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 775591ab14005efd6d8028a4b5d8b5fc5db05ace8464e566eff7fdc2bae61e62
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e22ae47f7b9361e90771000a168a2bd0667945bf20a3e6d548588466faffc3d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 a9bacc4af226431af273b9343ddf3df2114c0daeecc0bfbdc6fa273407a8f07f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 694ec00a799d64d39ba547ef1f69804d3f7a87c828bff80b46a342eb2981fca1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
        • Size 211KB
        • SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_bz2.pyd
        • Size 85KB
        • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_ctypes.pyd
        • Size 139KB
        • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_hashlib.pyd
        • Size 67KB
        • SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_lzma.pyd
        • Size 157KB
        • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_queue.pyd
        • Size 35KB
        • SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_socket.pyd
        • Size 85KB
        • SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_ssl.pyd
        • Size 180KB
        • SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_wmi.pyd
        • Size 39KB
        • SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\_zstd.pyd
        • Size 491KB
        • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\base_library.zip
        • Size 1.3MB
        • SHA256 89fcca803cb0d88a8f8287cad23e2cd1bc6b5cc0ca6649bd1353da348ef7e532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\certifi\cacert.pem
        • Size 266KB
        • SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\charset_normalizer\cd.cp314-win_amd64.pyd
        • Size 10KB
        • SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\python3.dll
        • Size 72KB
        • SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\python314.dll
        • Size 6.4MB
        • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\select.pyd
        • Size 32KB
        • SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000014042\unicodedata.pyd
        • Size 740KB
        • SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_de1yc4x1.hrr.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_de1yc4x1.hrr.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1456-244-0x000001707FAA0000-0x000001707FABA000-memory.dmp
        Download

        memory/1456-243-0x0000017067540000-0x0000017067550000-memory.dmp
        Download

        memory/3924-293-0x0000015EE7F80000-0x0000015EE7F8E000-memory.dmp
        Download

        memory/4060-199-0x00000268EAF70000-0x00000268EAF7A000-memory.dmp
        Download

        memory/4352-173-0x00000241F9E00000-0x00000241F9EB2000-memory.dmp
        Download

        memory/5868-121-0x00000289345A0000-0x00000289345BE000-memory.dmp
        Download

        memory/5868-99-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-126-0x0000028935290000-0x00000289357B8000-memory.dmp
        Download

        memory/5868-125-0x0000028934B90000-0x0000028934D52000-memory.dmp
        Download

        memory/5868-107-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-106-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-105-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-104-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-103-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-102-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-111-0x0000028934010000-0x000002893402E000-memory.dmp
        Download

        memory/5868-101-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-100-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-124-0x0000028934060000-0x000002893406A000-memory.dmp
        Download

        memory/5868-98-0x0000028933F70000-0x0000028933F92000-memory.dmp
        Download

        memory/5868-128-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-112-0x0000028934290000-0x0000028934342000-memory.dmp
        Download

        memory/5868-95-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-94-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-108-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-92-0x00007FFEB6C1F000-0x00007FFEB6C20000-memory.dmp
        Download

        memory/5868-120-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-117-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5868-116-0x00000289344A0000-0x00000289344C4000-memory.dmp
        Download

        memory/5868-115-0x00000289344A0000-0x00000289344CA000-memory.dmp
        Download

        memory/5868-114-0x0000028934030000-0x000002893403A000-memory.dmp
        Download

        memory/5868-113-0x00007FFEB6A90000-0x00007FFEB7434000-memory.dmp
        Download

        memory/5912-186-0x000001E95A450000-0x000001E95A502000-memory.dmp
        Download

        memory/6112-160-0x000001EBB2A60000-0x000001EBB2B12000-memory.dmp
        Download