Analysis

  • max time kernel
    149s
  • max time network
    111s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/10/2026, 16:44

General

  • Target
    2026-10-03_21b13e67b8d95f03869d69a0f03034d4_akira_cobalt-strike.exe
  • Size 820KB
  • Sample261004-t8tlcssdld
  • SHA256 e3ff8e650481bbe423f3f86239a784b29b7e7bd2b9ef71a32faaec647305be46
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-03_21b13e67b8d95f03869d69a0f03034d4_akira_cobalt-strike.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-03_21b13e67b8d95f03869d69a0f03034d4_akira_cobalt-strike.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:5560
    • C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe
      "C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe" C:\Users\Admin\AppData\Local\Temp\gp.py --quiet --disable-pip-version-check
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:4088
    • C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe
      "C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe" -c "import sys;exec(sys.stdin.read())"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'powershell.exe','python.exe','pythonw.exe' -ExclusionPath \"$env:LOCALAPPDATA\Temp\",\"$env:APPDATA\Microsoft\",\"$env:USERPROFILE\Downloads\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
      • C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe
        C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe -m pip install -q --target C:\Users\Admin\AppData\Local\Temp\pylib_1907 --no-warn-script-location --index-url https://pypi.org/simple pycryptodome requests psutil mss
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:2244
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
          PID:2796
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM Telegram.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3724
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3356
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:480
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:5348

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                __PSScriptPolicyTest_j4oyv1hz.osq.psm1

                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j4oyv1hz.osq.psm1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH

                gp.py

                • Path C:\Users\Admin\AppData\Local\Temp\gp.py
                • Size 2.1MB
                • SHA256 fb24e693bab954209a063d90953621412ccad4a500905a726286e038f508ddf6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\certifi-2026.7.22.dist-info\RECORD
                • Size 1KB
                • SHA256 54fa8ebe7e5d1cd4a48064f94e706e5f7a6cdcccef364379692ed7657bfed982
                • MD5 SHA1 SHA512 TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\charset_normalizer-3.5.2.dist-info\RECORD
                • Size 2KB
                • SHA256 b932635de481dfbc9a4a07910584bf41b0af04abad7e83048e64c063cfa4ef3d
                • MD5 SHA1 SHA512 TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\idna-3.20.dist-info\RECORD
                • Size 1KB
                • SHA256 9498c9cd8995a22f7afbcb755d5f2d2cd63f5512b61e0c9ae315453d63753ba5
                • MD5 SHA1 SHA512 TLSH

                __main__.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\idna\__main__.py
                • Size 83B
                • SHA256 e0930aeba5a3e2e2d94ca6c5fac4f72c0c4eb2be9bba283becf98e909091471c
                • MD5 SHA1 SHA512 TLSH

                intranges.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\idna\intranges.py
                • Size 1KB
                • SHA256 838f6c70b4a4a89b4084b98e3836bb8551eb8928e66fad2d893b04a287097412
                • MD5 SHA1 SHA512 TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\mss-10.2.0.dist-info\RECORD
                • Size 2KB
                • SHA256 7890f76d6b0584c6f96682c1c8a535a7fb570c0850dd0fd99848bf0cfd36f9d0
                • MD5 SHA1 SHA512 TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\psutil-7.2.2.dist-info\RECORD
                • Size 1KB
                • SHA256 55fd2f55e72c18fd0017a0a033af4661d0227e339c5d772a40a29375e6f740d7
                • MD5 SHA1 SHA512 TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\pycryptodome-3.23.0.dist-info\RECORD
                • Size 41KB
                • SHA256 a90027cb862c913936d7b7b78c67f8f288533f1cae2a156debd3a06bcbda8714
                • MD5 SHA1 SHA512 SSDEEP TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests-2.34.2.dist-info\RECORD
                • Size 3KB
                • SHA256 da741c2b9ead7ebcdbe3837ca1f094090666b76db41385596e6c57ee5d90938e
                • MD5 SHA1 SHA512 TLSH

                __version__.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\__version__.py
                • Size 435B
                • SHA256 abba90670b0370a3dc40d97c2dea46a35d4bec941ff10d7c3cf3098ef04a17f9
                • MD5 SHA1 SHA512 TLSH

                _internal_utils.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\_internal_utils.py
                • Size 1KB
                • SHA256 4c7d8d132c9898fc7d715e473f3ac74785ddc4ab96d2c9240f87835dc6d981ff
                • MD5 SHA1 SHA512 TLSH

                _types.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\_types.py
                • Size 5KB
                • SHA256 d06df79f54a279c0cc3faec596c446246d5ad14edfd529eb328defbd62a44a89
                • MD5 SHA1 SHA512 SSDEEP TLSH

                api.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\api.py
                • Size 6KB
                • SHA256 4d15480ac046f089209798e8650476ef4a28ebe6f81b400758f8ef42ec6b5509
                • MD5 SHA1 SHA512 SSDEEP TLSH

                auth.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\auth.py
                • Size 11KB
                • SHA256 e93951a552d4c3c5fd9b84a5e1d49b03caaba4723c4ff112da6053600ec85a65
                • MD5 SHA1 SHA512 SSDEEP TLSH

                cookies.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\cookies.py
                • Size 21KB
                • SHA256 0a1ce6140f2b9420522c5080e356e689fa796c2522f55ca10826f5ed8e0a723c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                hooks.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\hooks.py
                • Size 1KB
                • SHA256 ebd8a02475d31a0e473a8f553e9501ff43645b9563885ad52844e7a63f0d76ab
                • MD5 SHA1 SHA512 TLSH

                sessions.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\sessions.py
                • Size 33KB
                • SHA256 96fbb30bbbf06a59a5268d13b57885149756aa3f31695b5c15e41dd7bb2f67a6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                status_codes.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\status_codes.py
                • Size 4KB
                • SHA256 1950f47c89cf18019787e07d8ce48f66d6b38e622f7d94d70a90247fee6c040e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                structures.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\requests\structures.py
                • Size 4KB
                • SHA256 ba9460c39078f25e6f1d2a24ac941ac6f8d2ee97197fa8c8d0c262d8a1e67a02
                • MD5 SHA1 SHA512 SSDEEP TLSH

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3-2.8.0.dist-info\RECORD
                • Size 5KB
                • SHA256 5d88c4832d0406a7fd3c000f924b00394c2d7f694b332bc441370d1a7f5fe392
                • MD5 SHA1 SHA512 SSDEEP TLSH

                __init__.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\__init__.py
                • Size 6KB
                • SHA256 24ca35b60d67215d40789daf10d0bf4f17e5d1ee61e86ce5f43195935ad645ba
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _base_connection.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\_base_connection.py
                • Size 5KB
                • SHA256 1f37121077b1803ad152beb48cd9e20762908ddc3ded279d0f996e45f1ed0978
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _collections.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\_collections.py
                • Size 17KB
                • SHA256 1fac8ba8659d64d919d0b9bf7e72c4caaba59ce716eaab570a1daacf183bdf15
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _request_methods.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\_request_methods.py
                • Size 9KB
                • SHA256 802785f3948efd45385a83f0607228cffb70f9e33f1153a42c5a7c385b02ec30
                • MD5 SHA1 SHA512 SSDEEP TLSH

                connection.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\contrib\emscripten\connection.py
                • Size 8KB
                • SHA256 822125b01a14b0a55445b6736fc182ac99aa5b6dd79ef8f668dc90545e36b258
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fetch.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\contrib\emscripten\fetch.py
                • Size 22KB
                • SHA256 e7171dfbebe217165dda7072d1a2bbdddb49f53b21d7261953f4945f09f089b9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                request.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\contrib\emscripten\request.py
                • Size 566B
                • SHA256 98bdbcb33cb52af137349856a2be633666aba7c830a650d4fbb8301996398344
                • MD5 SHA1 SHA512 TLSH

                response.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\contrib\emscripten\response.py
                • Size 9KB
                • SHA256 083a58d0616896e47723110290cda01f9b837d80ccd042f5156afb07beb0b603
                • MD5 SHA1 SHA512 SSDEEP TLSH

                exceptions.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\exceptions.py
                • Size 9KB
                • SHA256 8503c7a2aa38cb0e3a7ac3525647225505d5520031580825b21e8c6f242d6be4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fields.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\fields.py
                • Size 10KB
                • SHA256 6862c5015669554f856c996596f7b8021834fa91fd659050d88cfb95fa648e43
                • MD5 SHA1 SHA512 SSDEEP TLSH

                filepost.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\filepost.py
                • Size 2KB
                • SHA256 53c78d67e9a928a1e1ae56c7104893c7180ad7a21e8e111aeeecf8db2a80fdd2
                • MD5 SHA1 SHA512 TLSH

                __init__.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\http2\__init__.py
                • Size 1KB
                • SHA256 c73ac0487ed1e4035190f24ea2de651a70133aadca2aec97cc8e36adc9f09aab
                • MD5 SHA1 SHA512 TLSH

                connection.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\http2\connection.py
                • Size 12KB
                • SHA256 9e3960af8c0b862009bed52ac44127e12f79be27db95346b9ab6911e809cbfad
                • MD5 SHA1 SHA512 SSDEEP TLSH

                probe.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\http2\probe.py
                • Size 2KB
                • SHA256 9e7024a9b8406a43a217be6bcfb5b4b9d677f047a1fee0fc7e357be0def71442
                • MD5 SHA1 SHA512 TLSH

                __init__.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\__init__.py
                • Size 1001B
                • SHA256 faa792d1071e8af6b3bc110a0cd142008fba00271d0ce1384ccbe8ed22cd9404
                • MD5 SHA1 SHA512 TLSH

                connection.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\connection.py
                • Size 4KB
                • SHA256 2633bbdb69731e5ccb5cf4e4afd65605d86c7979cc5633126f50c92d5ad74a74
                • MD5 SHA1 SHA512 SSDEEP TLSH

                proxy.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\proxy.py
                • Size 1KB
                • SHA256 b1e3fcf90e41e9b07474cb703e3f98719650df4bc7b8ba91bbeb48d096767f3b
                • MD5 SHA1 SHA512 TLSH

                response.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\response.py
                • Size 3KB
                • SHA256 bd013adfdba81218f5be98c4771bb994d22124249466477ba6a965508d0164e0
                • MD5 SHA1 SHA512 TLSH

                ssl_match_hostname.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\ssl_match_hostname.py
                • Size 5KB
                • SHA256 16de38289cd3cc632629f7ff6573fdd658b65785a19af132d7a3ca05cbf8bd99
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ssltransport.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\ssltransport.py
                • Size 8KB
                • SHA256 133e0ef2947fbd3f1d6a7fc5bea0584ba7600df05710c7d57ebcdc754a167e2e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                util.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\util.py
                • Size 1KB
                • SHA256 8f795b64ad633f28b00f7e13f08809cdd5846554fee04fb4bd82098bd52378d0
                • MD5 SHA1 SHA512 TLSH

                wait.py

                • Path C:\Users\Admin\AppData\Local\Temp\pip-target-63ebf3bk\lib\python\urllib3\util\wait.py
                • Size 4KB
                • SHA256 fe987c22b511deca8faa2d0ea29420254947e30ce419e3390a2c80ed7186b662
                • MD5 SHA1 SHA512 SSDEEP TLSH

                INSTALLER

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\Lib\site-packages\pip-26.2.1.dist-info\INSTALLER
                • Size 4B
                • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                • MD5 SHA1 SHA512

                RECORD

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\Lib\site-packages\pip-26.2.1.dist-info\RECORD
                • Size 67KB
                • SHA256 50abdc859c39880068dbce0d45cf85eff50cbc2db910793ff956a0147381cd84
                • MD5 SHA1 SHA512 SSDEEP TLSH

                LICENSE

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\Lib\site-packages\pip-26.2.1.dist-info\licenses\src\pip\_vendor\requests\LICENSE
                • Size 9KB
                • SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                LICENSE

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\Lib\site-packages\pip-26.2.1.dist-info\licenses\src\pip\_vendor\tomli_w\LICENSE
                • Size 1KB
                • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                • MD5 SHA1 SHA512 TLSH

                pip3.12.exe

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\Scripts\pip3.12.exe
                • Size 105KB
                • SHA256 a39337d772437d79fa9e8a75757f03266f461bdeedd143f2f0444413d49bf002
                • MD5 SHA1 SHA512 SSDEEP TLSH

                VCRUNTIME140.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\VCRUNTIME140.dll
                • Size 116KB
                • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                • MD5 SHA1 SHA512 SSDEEP TLSH

                VCRUNTIME140_1.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _bz2.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_bz2.pyd
                • Size 83KB
                • SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _ctypes.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_ctypes.pyd
                • Size 122KB
                • SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _decimal.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_decimal.pyd
                • Size 251KB
                • SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _hashlib.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_hashlib.pyd
                • Size 64KB
                • SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _lzma.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_lzma.pyd
                • Size 156KB
                • SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _queue.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_queue.pyd
                • Size 31KB
                • SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _socket.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_socket.pyd
                • Size 81KB
                • SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _sqlite3.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_sqlite3.pyd
                • Size 122KB
                • SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _ssl.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_ssl.pyd
                • Size 174KB
                • SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _uuid.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_uuid.pyd
                • Size 25KB
                • SHA256 acbf831004fb8b8d5340fe5debd9814c49bd282dd765c78faeb6bb5116288c78
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _wmi.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\_wmi.pyd
                • Size 36KB
                • SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libcrypto-3.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libffi-8.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libssl-3.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\libssl-3.dll
                • Size 768KB
                • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pyexpat.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\pyexpat.pyd
                • Size 197KB
                • SHA256 efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                python.exe

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\python.exe
                • Size 101KB
                • SHA256 fd5c46d73d29ba21b04c844bbaf9096066136526911230645a2a040d23fb612b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                python3.DLL

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\python3.DLL
                • Size 66KB
                • SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                python312._pth

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\python312._pth
                • Size 79B
                • SHA256 9fe5713a8c85777f99d941d14409946124df1f322e987485ed30600f4f0afde1
                • MD5 SHA1 SHA512 TLSH

                python312.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\python312.dll
                • Size 6.6MB
                • SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                python312.zip

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\python312.zip
                • Size 3.7MB
                • SHA256 2331635c9f558b4ee3f87118c89e2f96aa68137e288645137a39dce9d13a9e64
                • MD5 SHA1 SHA512 SSDEEP TLSH

                select.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\select.pyd
                • Size 30KB
                • SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sqlite3.dll

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\sqlite3.dll
                • Size 1.5MB
                • SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
                • MD5 SHA1 SHA512 SSDEEP TLSH

                unicodedata.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\python_embed\unicodedata.pyd
                • Size 1.1MB
                • SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp2w2ceq71

                • Path C:\Users\Admin\AppData\Local\Temp\tmp2w2ceq71
                • Size 67KB
                • SHA256 ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp4k3rp5mv

                • Path C:\Users\Admin\AppData\Local\Temp\tmp4k3rp5mv
                • Size 7KB
                • SHA256 dbd8c14c1e4ca1e0c9824a6dbc7cbbf78884f38eb52d91148cd3025f671e4b85
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp5o8_qhiu

                • Path C:\Users\Admin\AppData\Local\Temp\tmp5o8_qhiu
                • Size 18KB
                • SHA256 4764120d81f6c46b503c07f433bef4a2f9bc98d0f91476ec91ee05d53603cad2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp60da9ef6

                • Path C:\Users\Admin\AppData\Local\Temp\tmp60da9ef6
                • Size 4KB
                • SHA256 8c384ba3e979480faae2859d3c5e6c1276dd2c3616e322e124d52c8cfc556f27
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp8e6uylqm

                • Path C:\Users\Admin\AppData\Local\Temp\tmp8e6uylqm
                • Size 10KB
                • SHA256 37ea7e7b8156eb8bf87f7942b6380a150ccfd989f12f2868df68288670997884
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp8z71kgfn

                • Path C:\Users\Admin\AppData\Local\Temp\tmp8z71kgfn
                • Size 4KB
                • SHA256 3a561005822841f2c45f442f6c7a7505172c8c376c9fe274d876c8ac912968cb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmp920oid9d

                • Path C:\Users\Admin\AppData\Local\Temp\tmp920oid9d
                • Size 157KB
                • SHA256 3bbc9ed4642ab34b0d55f637553a0b9b897e384c68e81933d386e042074a43d2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpclvm4eft

                • Path C:\Users\Admin\AppData\Local\Temp\tmpclvm4eft
                • Size 22KB
                • SHA256 a263a40220d921d9cb963fc636d34f817aa2eb72c2696e3e3465d088cdb1976b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpdiivblu5

                • Path C:\Users\Admin\AppData\Local\Temp\tmpdiivblu5
                • Size 133KB
                • SHA256 62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpewtact_7

                • Path C:\Users\Admin\AppData\Local\Temp\tmpewtact_7
                • Size 7KB
                • SHA256 570451fb9a2941d374ebb47d7e79f0c1f13d9a0ba87121379ac27d2b37e49805
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpey7vkuct

                • Path C:\Users\Admin\AppData\Local\Temp\tmpey7vkuct
                • Size 265KB
                • SHA256 80a11ecaa2905ec83d0d919efa46346eab4decc500723a084e7176addc47b0ca
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpfrwyn200

                • Path C:\Users\Admin\AppData\Local\Temp\tmpfrwyn200
                • Size 202KB
                • SHA256 780fbe7cab297b81dad9fb8dc5eb003c0468ffb0d9e5f65068c53a34661a96bc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpfu7ewew4

                • Path C:\Users\Admin\AppData\Local\Temp\tmpfu7ewew4
                • Size 46KB
                • SHA256 49e955a09e1a159e0846872798006e8db7d518d8d70c637066fefdb08d3d9f7b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpggmw4lsw

                • Path C:\Users\Admin\AppData\Local\Temp\tmpggmw4lsw
                • Size 8KB
                • SHA256 34fecdf93c56b209c9bf10a2df1c02436bedd3c12b202f1b692f358c030914a2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpgnq3itxj

                • Path C:\Users\Admin\AppData\Local\Temp\tmpgnq3itxj
                • Size 2KB
                • SHA256 ef5af1638fbb23676ac3c5777dfcfc2cd9c348fe4172ed5ba3d277655b248090
                • MD5 SHA1 SHA512 TLSH

                tmphg9jgae6

                • Path C:\Users\Admin\AppData\Local\Temp\tmphg9jgae6
                • Size 25KB
                • SHA256 904c912045d14dc5c2db5aaf3c923ec4c1e283e363482907115fb54a26b1a0b1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpiwqyoz_e

                • Path C:\Users\Admin\AppData\Local\Temp\tmpiwqyoz_e
                • Size 7KB
                • SHA256 10898c620e8007c030e07fa5622b68358a43010025dfbd78a1cb797699de2bb4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpol6je8cz

                • Path C:\Users\Admin\AppData\Local\Temp\tmpol6je8cz
                • Size 37KB
                • SHA256 a9a1662c9adb8b89998f127c395e01dede79216bf5c936cf7357583207099f88
                • MD5 SHA1 SHA512 SSDEEP TLSH

                cacert.pem

                • Path C:\Users\Admin\AppData\Local\Temp\tmpppxkozdy\cacert.pem
                • Size 228KB
                • SHA256 bbc7e9c01d7551bb8a159b5dedd989b8ee3ce105aff522b68eb1b01bf854cab0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pip.zip

                • Path C:\Users\Admin\AppData\Local\Temp\tmpppxkozdy\pip.zip
                • Size 1.7MB
                • SHA256 f366a37ec5340337af123d2aabf80659fc69cab14f8784ad1cd7ab1e2e83bd27
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmps31wb30t

                • Path C:\Users\Admin\AppData\Local\Temp\tmps31wb30t
                • Size 71KB
                • SHA256 2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpsyw6r3ce

                • Path C:\Users\Admin\AppData\Local\Temp\tmpsyw6r3ce
                • Size 30KB
                • SHA256 471606b47a1003e9b397a9ced7f95b00a7ca648375f0a71deb14227cac8b3fdd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpuum75rja

                • Path C:\Users\Admin\AppData\Local\Temp\tmpuum75rja
                • Size 65KB
                • SHA256 e79f428899280e7e64e38365b5bfed683851ebea807eeaeadaf06eb8e0d67197
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpwxg3gzmb

                • Path C:\Users\Admin\AppData\Local\Temp\tmpwxg3gzmb
                • Size 134KB
                • SHA256 eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpwz2husw0

                • Path C:\Users\Admin\AppData\Local\Temp\tmpwz2husw0
                • Size 3KB
                • SHA256 3054c7b6ca96dfa8c968571921d169f91ac8ffa63686629d512dd50aa380bff1
                • MD5 SHA1 SHA512 TLSH

                tmpx6155hsf

                • Path C:\Users\Admin\AppData\Local\Temp\tmpx6155hsf
                • Size 132KB
                • SHA256 0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpyabu7u93

                • Path C:\Users\Admin\AppData\Local\Temp\tmpyabu7u93
                • Size 1.7MB
                • SHA256 c75b52aacc6c0c260f204cbdd834f76edc9fb0d8e0da9fbf8352ef58202564e2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpz1tb4qwh

                • Path C:\Users\Admin\AppData\Local\Temp\tmpz1tb4qwh
                • Size 157KB
                • SHA256 b50c7f5c533e11deae06d04021cec74a96247e269473ff21b4e4f4af9724493b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                memory/2548-2891-0x000001ECC11F0000-0x000001ECC12A2000-memory.dmp

                memory/2548-2890-0x000001ECC11D0000-0x000001ECC11EE000-memory.dmp

                memory/2548-2887-0x000001ECC1130000-0x000001ECC1152000-memory.dmp

                memory/2548-2892-0x000001ECC12B0000-0x000001ECC12BA000-memory.dmp

                memory/5560-2882-0x00007FF7A2690000-0x00007FF7A2719000-memory.dmp

                memory/5560-0-0x00007FF7A2690000-0x00007FF7A2719000-memory.dmp

                memory/5560-48-0x00007FF7A2690000-0x00007FF7A2719000-memory.dmp

                memory/5560-5083-0x00007FF7A2690000-0x00007FF7A2719000-memory.dmp