de07984d4e7004ece62f95f26584a10fd152885b137fdc57397f388eb327c488

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mudinho Stealer.exe
Size 180.0MB
Sample261007-y589vset2w
SHA256 de07984d4e7004ece62f95f26584a10fd152885b137fdc57397f388eb327c488
MD5 d8bd224e414a914c2c9b2badc79dc882
SHA1 11d7705231f0b5175dfff6c0063ad287e90e2dcf
SHA512 599c57d0f11f3b013ff8d1b70dd5fc6d2d3041a488d6dc55138f2a6c9c6a24e1db6280bfc76fce87fddfc58cd2606244d2e8affe84a3423b64aeb6df4d8ad592
SSDEEP 1572864:hH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:msok+hK7
TLSH
T15B988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Mudinho Stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
5116	powershell.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3456	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3928	powershell.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3216	sc.exe
2612	sc.exe
3560	sc.exe
2980	sc.exe
3372	sc.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
5116	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1956	powershell.exe
4732	powershell.exe
4120	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mudinho Stealer.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3456	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Mudinho Stealer.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1424	reg.exe
4792	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5116	powershell.exe
5116	powershell.exe
1956	powershell.exe
1956	powershell.exe
4732	powershell.exe
4732	powershell.exe
4732	powershell.exe
2252	powershell.exe
2252	powershell.exe
2252	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
3928	powershell.exe
3928	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	1428	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	1428	Mudinho Stealer.exe
Token: SeIncreaseQuotaPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeTakeOwnershipPrivilege	5116	powershell.exe
Token: SeLoadDriverPrivilege	5116	powershell.exe
Token: SeSystemProfilePrivilege	5116	powershell.exe
Token: SeSystemtimePrivilege	5116	powershell.exe
Token: SeProfSingleProcessPrivilege	5116	powershell.exe
Token: SeIncBasePriorityPrivilege	5116	powershell.exe
Token: SeCreatePagefilePrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeRestorePrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeSystemEnvironmentPrivilege	5116	powershell.exe
Token: SeRemoteShutdownPrivilege	5116	powershell.exe
Token: SeUndockPrivilege	5116	powershell.exe
Token: SeManageVolumePrivilege	5116	powershell.exe
Token: 33	5116	powershell.exe
Token: 34	5116	powershell.exe
Token: 35	5116	powershell.exe
Token: 36	5116	powershell.exe
Token: SeIncreaseQuotaPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeTakeOwnershipPrivilege	5116	powershell.exe
Token: SeLoadDriverPrivilege	5116	powershell.exe
Token: SeSystemProfilePrivilege	5116	powershell.exe
Token: SeSystemtimePrivilege	5116	powershell.exe
Token: SeProfSingleProcessPrivilege	5116	powershell.exe
Token: SeIncBasePriorityPrivilege	5116	powershell.exe
Token: SeCreatePagefilePrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeRestorePrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeSystemEnvironmentPrivilege	5116	powershell.exe
Token: SeRemoteShutdownPrivilege	5116	powershell.exe
Token: SeUndockPrivilege	5116	powershell.exe
Token: SeManageVolumePrivilege	5116	powershell.exe
Token: 33	5116	powershell.exe
Token: 34	5116	powershell.exe
Token: 35	5116	powershell.exe
Token: 36	5116	powershell.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeShutdownPrivilege	1428	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	1428	Mudinho Stealer.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1956	powershell.exe
Token: SeSecurityPrivilege	1956	powershell.exe
Token: SeTakeOwnershipPrivilege	1956	powershell.exe
Token: SeLoadDriverPrivilege	1956	powershell.exe
Token: SeSystemProfilePrivilege	1956	powershell.exe
Token: SeSystemtimePrivilege	1956	powershell.exe
Token: SeProfSingleProcessPrivilege	1956	powershell.exe
Token: SeIncBasePriorityPrivilege	1956	powershell.exe
Token: SeCreatePagefilePrivilege	1956	powershell.exe
Token: SeBackupPrivilege	1956	powershell.exe
Token: SeRestorePrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeSystemEnvironmentPrivilege	1956	powershell.exe
Token: SeRemoteShutdownPrivilege	1956	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4380	1428	Mudinho Stealer.exe	89
PID 1428 wrote to memory of 4380	1428	Mudinho Stealer.exe	89
PID 1428 wrote to memory of 5116	1428	Mudinho Stealer.exe	90
PID 1428 wrote to memory of 3456	1428	Mudinho Stealer.exe	95
PID 1428 wrote to memory of 3216	1428	Mudinho Stealer.exe	97
PID 1428 wrote to memory of 2612	1428	Mudinho Stealer.exe	100
PID 1428 wrote to memory of 3560	1428	Mudinho Stealer.exe	102
PID 1428 wrote to memory of 2980	1428	Mudinho Stealer.exe	104
PID 1428 wrote to memory of 3372	1428	Mudinho Stealer.exe	106
PID 1428 wrote to memory of 1500	1428	Mudinho Stealer.exe	108
PID 1428 wrote to memory of 1956	1428	Mudinho Stealer.exe	110
PID 1428 wrote to memory of 4732	1428	Mudinho Stealer.exe	113
PID 4732 wrote to memory of 5060	4732	powershell.exe	115
PID 5060 wrote to memory of 2804	5060	csc.exe	116
PID 1428 wrote to memory of 2252	1428	Mudinho Stealer.exe	117
PID 1428 wrote to memory of 1424	1428	Mudinho Stealer.exe	119
PID 1428 wrote to memory of 4792	1428	Mudinho Stealer.exe	121
PID 1428 wrote to memory of 4120	1428	Mudinho Stealer.exe	123
PID 1428 wrote to memory of 3456	1428	Mudinho Stealer.exe	125
PID 1428 wrote to memory of 3928	1428	Mudinho Stealer.exe	127

C:\Users\Admin\AppData\Local\Temp\Mudinho Stealer.exe
"C:\Users\Admin\AppData\Local\Temp\Mudinho Stealer.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\Mudinho Stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\Mudinho Stealer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Mudinho Stealer" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1740,i,2997454123550901630,956692260423777303,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  PID:4380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SerialNumber,Version | Format-List; Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product,SerialNumber | Format-List"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Queries system WMI classes for hardware identifiers
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\tasklist.exe
  tasklist.exe /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\system32\sc.exe
  sc.exe query VMTools
  2⤵
  - Launches sc.exe
  PID:3216
- C:\Windows\system32\sc.exe
  sc.exe query VBoxService
  2⤵
  - Launches sc.exe
  PID:2612
- C:\Windows\system32\sc.exe
  sc.exe query qemu-ga
  2⤵
  - Launches sc.exe
  PID:3560
- C:\Windows\system32\sc.exe
  sc.exe query XenSvc
  2⤵
  - Launches sc.exe
  PID:2980
- C:\Windows\system32\sc.exe
  sc.exe query prl_tools
  2⤵
  - Launches sc.exe
  PID:3372
- C:\Windows\system32\reg.exe
  reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool GetLastInputInfo(ref LASTINPUTINFO i); [StructLayout(LayoutKind.Sequential)] public struct LASTINPUTINFO { public uint cbSize; public uint dwTime; }' -Name IdleCheck -Namespace WinNative; $i = New-Object WinNative.IdleCheck+LASTINPUTINFO; $i.cbSize = 8; [WinNative.IdleCheck]::GetLastInputInfo([ref]$i) | Out-Null; Write-Output (([Environment]::TickCount - $i.dwTime) / 1000)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0afze4dj\0afze4dj.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20FB.tmp" "c:\Users\Admin\AppData\Local\Temp\0afze4dj\CSC93E469352775495D8D5DA4D1B590ACE4.TMP"
      4⤵
      PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing; $ErrorActionPreference='Stop'; try { $vs=[System.Windows.Forms.SystemInformation]::VirtualScreen; $bw=$vs.Width; $bh=$vs.Height; $bx=$vs.X; $by=$vs.Y; if ($bw -le 0 -or $bh -le 0) { $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bw=$b.Width; $bh=$b.Height; $bx=$b.X; $by=$b.Y }; $bmp=New-Object System.Drawing.Bitmap([int]$bw,[int]$bh); $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen([int]$bx,[int]$by,0,0,$bmp.Size); $ms=New-Object System.IO.MemoryStream; $bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Png); $g.Dispose(); $bmp.Dispose(); [Convert]::ToBase64String($ms.ToArray()) } catch { 'SCREENSHOT_UNAVAILABLE:' + $_.Exception.Message }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:1424
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; Write-Output (\"$($b.Width)x$($b.Height)\")"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Windows\system32\netsh.exe
  netsh.exe wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-Printer -ErrorAction SilentlyContinue | Measure-Object | Select-Object -ExpandProperty Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...