Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 15:19
Behavioral task
behavioral1
Sample
AccountsGenerator.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
AccountsGenerator.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target AccountsGenerator.exe
- Size 20.1MB
- Sample261113-sqffcac16p
- SHA256 626f95453ecf12da3c34b36d1ac1a5239fc526054ce2602f4fb388a8c47e7aa8
- MD5 2a0499100106c0fc3a03847818460e52
- SHA1 bb27999bf3ad746e596302c575a0ca28ab21e7af
- SHA512 39c0efcee88d505c3efb034092675d0a49f6bd99ce6ed1bc488a7fe8cf39970d89e96f7859f31efe5c1517a44df67368c6a1c91040b7fdcdd51b9e66c17dad5f
- SSDEEP 393216:ENAEkx73xELZHHRtYNDKar/ySKly1pw6eWyjPZE34Ja2sdLszb6QCI:EdtdHLYNO2/yNly7w60+Onsdo/6fI
- TLSH T1EE27330DC79402E2F8B39874CEA3D019C7F3BC724B6A8AC786F6417A65775D9293E409
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityUpdate.exe AccountsGenerator.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityUpdate.exe AccountsGenerator.exe - Loads dropped DLL 44 IoCs
pid Process 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 2484 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 3300 AccountsGenerator.exe 2484 AccountsGenerator.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AccountsGenerator.exe" AccountsGenerator.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AccountsGenerator.exe" AccountsGenerator.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 18 discord.com 19 discord.com 12 discord.com 14 discord.com 15 discord.com 16 discord.com 3 discord.com 6 discord.com 10 discord.com 13 discord.com - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 3 ip-api.com 7 api.ipify.org - Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2736 tasklist.exe 3568 tasklist.exe -
pid Process 2996 powershell.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 12 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5080 cmd.exe 2080 cmd.exe 5572 cmd.exe 1100 cmd.exe 5124 cmd.exe 4364 cmd.exe 2972 cmd.exe 3556 cmd.exe 6132 cmd.exe 5676 cmd.exe 5040 cmd.exe 3720 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname AccountsGenerator.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain AccountsGenerator.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3720 cmd.exe 1960 netsh.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1160 WMIC.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4628 schtasks.exe 4536 schtasks.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2764 WMIC.exe 2764 WMIC.exe 2764 WMIC.exe 2764 WMIC.exe 5764 WMIC.exe 5764 WMIC.exe 5764 WMIC.exe 5764 WMIC.exe 1808 WMIC.exe 1808 WMIC.exe 1808 WMIC.exe 1808 WMIC.exe 1160 WMIC.exe 1160 WMIC.exe 1160 WMIC.exe 1160 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 5984 WMIC.exe 5984 WMIC.exe 5984 WMIC.exe 5984 WMIC.exe 2996 powershell.exe 2996 powershell.exe 4256 WMIC.exe 4256 WMIC.exe 4256 WMIC.exe 4256 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2764 WMIC.exe Token: SeSecurityPrivilege 2764 WMIC.exe Token: SeTakeOwnershipPrivilege 2764 WMIC.exe Token: SeLoadDriverPrivilege 2764 WMIC.exe Token: SeSystemProfilePrivilege 2764 WMIC.exe Token: SeSystemtimePrivilege 2764 WMIC.exe Token: SeProfSingleProcessPrivilege 2764 WMIC.exe Token: SeIncBasePriorityPrivilege 2764 WMIC.exe Token: SeCreatePagefilePrivilege 2764 WMIC.exe Token: SeBackupPrivilege 2764 WMIC.exe Token: SeRestorePrivilege 2764 WMIC.exe Token: SeShutdownPrivilege 2764 WMIC.exe Token: SeDebugPrivilege 2764 WMIC.exe Token: SeSystemEnvironmentPrivilege 2764 WMIC.exe Token: SeRemoteShutdownPrivilege 2764 WMIC.exe Token: SeUndockPrivilege 2764 WMIC.exe Token: SeManageVolumePrivilege 2764 WMIC.exe Token: 33 2764 WMIC.exe Token: 34 2764 WMIC.exe Token: 35 2764 WMIC.exe Token: 36 2764 WMIC.exe Token: SeIncreaseQuotaPrivilege 2764 WMIC.exe Token: SeSecurityPrivilege 2764 WMIC.exe Token: SeTakeOwnershipPrivilege 2764 WMIC.exe Token: SeLoadDriverPrivilege 2764 WMIC.exe Token: SeSystemProfilePrivilege 2764 WMIC.exe Token: SeSystemtimePrivilege 2764 WMIC.exe Token: SeProfSingleProcessPrivilege 2764 WMIC.exe Token: SeIncBasePriorityPrivilege 2764 WMIC.exe Token: SeCreatePagefilePrivilege 2764 WMIC.exe Token: SeBackupPrivilege 2764 WMIC.exe Token: SeRestorePrivilege 2764 WMIC.exe Token: SeShutdownPrivilege 2764 WMIC.exe Token: SeDebugPrivilege 2764 WMIC.exe Token: SeSystemEnvironmentPrivilege 2764 WMIC.exe Token: SeRemoteShutdownPrivilege 2764 WMIC.exe Token: SeUndockPrivilege 2764 WMIC.exe Token: SeManageVolumePrivilege 2764 WMIC.exe Token: 33 2764 WMIC.exe Token: 34 2764 WMIC.exe Token: 35 2764 WMIC.exe Token: 36 2764 WMIC.exe Token: SeIncreaseQuotaPrivilege 5764 WMIC.exe Token: SeSecurityPrivilege 5764 WMIC.exe Token: SeTakeOwnershipPrivilege 5764 WMIC.exe Token: SeLoadDriverPrivilege 5764 WMIC.exe Token: SeSystemProfilePrivilege 5764 WMIC.exe Token: SeSystemtimePrivilege 5764 WMIC.exe Token: SeProfSingleProcessPrivilege 5764 WMIC.exe Token: SeIncBasePriorityPrivilege 5764 WMIC.exe Token: SeCreatePagefilePrivilege 5764 WMIC.exe Token: SeBackupPrivilege 5764 WMIC.exe Token: SeRestorePrivilege 5764 WMIC.exe Token: SeShutdownPrivilege 5764 WMIC.exe Token: SeDebugPrivilege 5764 WMIC.exe Token: SeSystemEnvironmentPrivilege 5764 WMIC.exe Token: SeRemoteShutdownPrivilege 5764 WMIC.exe Token: SeUndockPrivilege 5764 WMIC.exe Token: SeManageVolumePrivilege 5764 WMIC.exe Token: 33 5764 WMIC.exe Token: 34 5764 WMIC.exe Token: 35 5764 WMIC.exe Token: 36 5764 WMIC.exe Token: SeIncreaseQuotaPrivilege 5764 WMIC.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2484 1616 AccountsGenerator.exe 90 PID 2484 wrote to memory of 4364 2484 AccountsGenerator.exe 91 PID 4364 wrote to memory of 4536 4364 cmd.exe 93 PID 2188 wrote to memory of 3300 2188 AccountsGenerator.exe 97 PID 2484 wrote to memory of 5080 2484 AccountsGenerator.exe 98 PID 5080 wrote to memory of 2764 5080 cmd.exe 100 PID 2484 wrote to memory of 2972 2484 AccountsGenerator.exe 101 PID 3300 wrote to memory of 3556 3300 AccountsGenerator.exe 103 PID 2972 wrote to memory of 5764 2972 cmd.exe 105 PID 3556 wrote to memory of 4628 3556 cmd.exe 106 PID 2484 wrote to memory of 2080 2484 AccountsGenerator.exe 107 PID 2080 wrote to memory of 1808 2080 cmd.exe 109 PID 2484 wrote to memory of 5572 2484 AccountsGenerator.exe 110 PID 5572 wrote to memory of 1160 5572 cmd.exe 112 PID 2484 wrote to memory of 6132 2484 AccountsGenerator.exe 113 PID 6132 wrote to memory of 1776 6132 cmd.exe 115 PID 2484 wrote to memory of 5676 2484 AccountsGenerator.exe 116 PID 5676 wrote to memory of 5984 5676 cmd.exe 118 PID 2484 wrote to memory of 2996 2484 AccountsGenerator.exe 119 PID 2484 wrote to memory of 1100 2484 AccountsGenerator.exe 121 PID 1100 wrote to memory of 2736 1100 cmd.exe 123 PID 2484 wrote to memory of 5124 2484 AccountsGenerator.exe 124 PID 5124 wrote to memory of 3568 5124 cmd.exe 126 PID 2484 wrote to memory of 5040 2484 AccountsGenerator.exe 127 PID 5040 wrote to memory of 4256 5040 cmd.exe 129 PID 2484 wrote to memory of 3720 2484 AccountsGenerator.exe 130 PID 3720 wrote to memory of 1960 3720 cmd.exe 132 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe"C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe"C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe" /sc onlogon /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:4536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic cpu get name"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic cpu get NumberOfCores"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get NumberOfCores4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic memorychip get capacity"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get capacity4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:1160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=3 get DeviceID,Size,FreeSpace"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk where drivetype=3 get DeviceID,Size,FreeSpace4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\System32\Wbem\WMIC.exewmic path softwarelicensingservice get OA3xOriginalProductKey4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5984
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
PID:2736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /nh"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\system32\tasklist.exetasklist /nh4⤵
- Discovers running processes
PID:3568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get lastbootuptime"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\System32\Wbem\WMIC.exewmic os get lastbootuptime4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1960
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exeC:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exeC:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe" /sc onlogon /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\AccountsGenerator.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:4628
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_bz2.pyd
- Size 85KB
- SHA256 9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f
- MD5 ba5095177c6df6a13d5504fa1c7082b2
- SHA1 55c6a9506c81c61bb4ed4af5db39d554f776bb44
- SHA512 a1fa533f07e54e60ab565b2a175252b45248cd3a50abe800b6551dac637c6a2bd6308676ad739845d085a92579870a799fea48e5a407847db8e9d49bf06b0010
- SSDEEP 1536:J+xDQz7nIBcZrnq3pRWxO8qQixBQVt28QUbyzYI83V+yyPi9PfIzo9J:4xDQz1ZmPYO8qzBQVtBQYyzYI83VIg
- TLSH T143838F83E3A462F6F5AB81F4D6810753F731BB96031063AFB354C2853F22B91AE59365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_ctypes.pyd
- Size 139KB
- SHA256 adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952
- MD5 820bea314c1ff7bcdb92e67350cc1dfa
- SHA1 5f4b9011ca74e3bf79acd2eb451f6941a57ed7a0
- SHA512 f1314be25c99187cd9a683aa4f10fb67eae836f57e63320375b0aeffbb9f741be35b6fb6a24c2367729797905d7c5b1b9833ec13819fe42d069105a0a546b247
- SSDEEP 3072:iT0vTKEfOfYBgO+cZbU1O8I71Fm91PncI8GPdPB:IqGE2Sbb8I7HkZ1
- TLSH T139E38E4B376840A6D6678138C5739E47EBB1F4525A5087CF01A4C99B2F633A2AF3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_hashlib.pyd
- Size 67KB
- SHA256 9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0
- MD5 c4bfc5af9822c169deec2fdb137a74b6
- SHA1 bd17c8410cdd1b9af80d951701b071c36fc8d4fa
- SHA512 5af39f38b1239c192a0d6ea5ab62b399c6020ba42d2e0c964d317a1b0011ded68e13737b39faa4734f35d6267a8a1100aeb8780c98c64f4f137368e00a956a70
- SSDEEP 1536:Xj13iosf+JZoLRGogzQ6KgY9IovAI8DIYyyPi9SzfIzogDk:JyoKEfKgGIovAI8DI0Uhk
- TLSH T13D636C46A79840A6E52382B4C8E74E53F9B0F2522711A7DF6679C18E2F233C7973B315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_lzma.pyd
- Size 157KB
- SHA256 9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde
- MD5 530166f8399dc049145434d96ba1245f
- SHA1 c046ae34dd1f87632f60b830016c99ee8dfcff46
- SHA512 56145c0f9fdcf4c6e35a2e8cc9b5c7d2fa1b7716a5b97ae1b662750213442cb2794443ec01bea26863f2e0520ed1fddbe3e24cce50819fb8c501b98fd005aed4
- SSDEEP 3072:FJ66g4T5QW7JfyjEqkSkA51b4AznfJ9mNouU7sbYI8I1FLPg+:FUR4Tp4QPZ8N4WxYOkbLP
- TLSH T1CAF34C86B794F0E6F7328C78D2624F57E6F578190320929A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_socket.pyd
- Size 85KB
- SHA256 11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c
- MD5 7898115c16a5d9104ca211a413759819
- SHA1 e232e364d0b73b2589108514667f5e737d7f6025
- SHA512 fb0b138f2d0c91ca919ff11a841cb729149c0db7baabb95d38ecf2e4c27c9101ae6be5dc1e675b4552c7d4d37c0e0a805917715cf7d0d7dab8d31239472455df
- SSDEEP 1536:IhGbog/H3uN1XG4eAypxq7XP+66wSzmN/ab4etbaQtcswPRpbcI8GwvyyPi9PfIP:Tbogf3Mypxq7XPz6wSzmkbtaQes8dcIk
- TLSH T133836B01A66040FAEB72C176C2639E63FBB4F5C11294A75F1456C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_sqlite3.pyd
- Size 130KB
- SHA256 33e91d0de7924180012c86efb17611ec589b93f90b321ed9ec3c2f4c99fae5be
- MD5 731a5e8e38f160eec8f56dd583ae2376
- SHA1 628aefe955c0f5a25708bc55ade8d5ca7ce29ee5
- SHA512 3977fb1fb90230ca9f40c8c149735b727adaf331ef1866894bca563a68fb7c4568edf27697873a46988d87bede4a2ef235842b0034be3b53caf315291228cc8a
- SSDEEP 3072:5tkGDcRi7f70Et88ZRW56xzcWG53vkAI8DQ8PHF:5uGDt7ttxO5dWGJvk8F
- TLSH T1EFD36B2B631401AAE9F782B8C5634643EB75F461572093DF45A0C24A1F373D3AF3AB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_ssl.pyd
- Size 188KB
- SHA256 56fdbe70896e4b3c6d4e8897fad1d011129354172566832371289edca0d85a21
- MD5 8e2d6d87ab061375fb45a2f6432bc7b8
- SHA1 e6891ccc160f43397ccfb89baf63730978e5f359
- SHA512 3389246b1c2720e605e08ac8ad81585ee9230c31b01d8d20d52d1392f03ada1707c8e692070f7edfcd6386e996b500212ede23c6c5178e70b8f4523ca94f6777
- SSDEEP 3072:p59RyIykEqUfqhXqUqm6bhjfjnSVSdCFgp8VuMG4eJ9i1zktdsx/38uGCNOuR6jR:jf1ykcqhXq1bFuvb6bJ
- TLSH T194146A07B6546AF7D812E4FAC6234543FBB4F055331187DE48C2E9A60F03746AE6AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_wmi.pyd
- Size 39KB
- SHA256 c8f6705d2da1be12b10050a1311b7c865fd79f11404cfad1a70b3f8962051056
- MD5 b09bd02926470997822806b225baee30
- SHA1 072191f23b167521f1654b7cdac01c90f8b311c4
- SHA512 75de74a8c249bb97316145d8348b2488a4d7aa51879cc1045cada3e25068d8a1079d9b4da038e868f7fd9d4d13dc52b806259b592b23a995f46b038d329244ad
- SSDEEP 768:82/EEqrVmjs2uXOQMVYI83iZyy8PuBL2Ip4c4Txf1mlNNo2T/U:ZE9BE2XOQMVYI83iZyyPi9cEfIzouc
- TLSH T183038E86E76800D2EA67C671C4A5CE53F675B7D31711878F32A582990F233D1EB3A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\_zstd.pyd
- Size 491KB
- SHA256 7a7b50c580428daf3d43c87b121988d2e8c7af9533fa2195f1aef8652fc2c489
- MD5 710380b14f6d73936dbc8e47a6ae6030
- SHA1 403b10d922f7a43d1cc35914346841b562f0abf4
- SHA512 fd48327297a7162a58e809bebdee351b987dd36e1f7704ca5c2e8da04c09300b2926a4da6841b5d0fec6836f06649a2acd20024619f38002d566ccf3f8f10378
- SSDEEP 6144:XBmHahOxz2FB2l1eUVc8m7KHw9B8zKhThruVBzeeQRzZefUEocgUMntYpz5+SClQ:Rxcxm7KQv6eeQdZefXotOz5BCl9VmFL
- TLSH T105B48D43F29943EDE13BC4B8CF565A13FBB1780B1214565B93A5CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\base_library.zip
- Size 1.3MB
- SHA256 f34954d0bc7b2c40db5f42ea8ab59c91cd66d50586daa1aba6a74f0262c1049c
- MD5 d3f56a48f0d48aa4dad2fa3e5d18c1fe
- SHA1 372d96602221f4b87a72004511f214b7c4ba2a2b
- SHA512 fcf7a230302758ec0ea409e7917915bc12310fa3f15adfb7baea5c31ae1304d3fc77ac3b6d53beaa07fe0bd9dd0d358fd0d40ba17f1139c8fc9c38b85e0eb849
- SSDEEP 24576:0uUFgQLHGyZgQeOdP2m2dfEjddRZylb9YBDZx:0uUFhg/sddRAYBH
- TLSH T171552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\libcrypto-3.dll
- Size 5.7MB
- SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
- MD5 b306c000f2b892736f0e66d265c61876
- SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
- SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
- SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
- TLSH T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\libssl-3.dll
- Size 1.2MB
- SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
- MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
- SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
- SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
- SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
- TLSH T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\python3.DLL
- Size 72KB
- SHA256 7bb0a7df2d5cb829319dd8d122039843e2a762361bb5a61bb5d24ca34f4040b5
- MD5 0faf1b774b9cd5f9992a9e60ac727bbd
- SHA1 7f7bf3e92cdcb55ab5db6140e7df29fae2bd4560
- SHA512 8362005117c3a03abfcd3b4dfd25dbaab714171c21e43a8232a3e6528e2ca86a4bc5cbec9cc69a595c5c8413e157a9e9f3896f98de7f7134abe99f0919f67003
- SSDEEP 768:oQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:RbTrnXngXMzcI8G0iyyPi9RfIeYYn
- TLSH T11B735E5E6B54F8A2D6B669FC78D199CE242B12FC4F2984DFA47CD3D20D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\python314.dll
- Size 6.5MB
- SHA256 d8a06cc6ca3348925ea29e343e1c5c5895fe0bb433ff913e1cee44caf358aa6a
- MD5 524c235d413bb77d476c1c92abe972c4
- SHA1 d6f3ba7a2a18f17f57249d656237d6e78e8295c8
- SHA512 8e50875e14f75fc3af2144a49bf43bff386feb19129ec3dd81789bad7bfab426ee8a1d1ad6a53ea272bd7bb6454b03e31ac05c606ce6038dfd58fbc23ab42894
- SSDEEP 98304:xecyyERegv2I/5R7ymDbaM7BaRCu644CgvaHDMiEEyHjx:xeMERVj/5R7ypMAF8iMx
- TLSH T13E668D26737811A4D9BB8035C9034647D7B1BC04AB30D34A89A4B6DA3F733635BEEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\pywin32_system32\pywintypes314.dll
- Size 133KB
- SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
- MD5 c11818bd607c6060902836c3f6bf024a
- SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
- SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
- SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
- TLSH T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\sqlite3.dll
- Size 1.5MB
- SHA256 99c296ca2b4372418edbdcbd923ab0df2cdbcf406782694d7376f2b01e5010c9
- MD5 d8c36470cd5a9908bcd091b0adeb383c
- SHA1 a321f6ec608a57c63db75e6bf0b8a5d3f96aa65c
- SHA512 8f45aa8ce4a1118cc5be5905ab7c5bbe6cacd893bd49daccc7086a27136a0d97b498a15983a669de5a99467fef072adb8be5b9e1351f0346991fa33f400dd954
- SSDEEP 24576:UDKX0pwDaOrROsxNkJPcG/Z2ZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fdX3y:w8pOsxNkJPcGxWQuWRP+bZ6Icf4vC1fk
- TLSH T13C759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64ABDF1590CA692F53FE217BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\unicodedata.pyd
- Size 740KB
- SHA256 4c4e9f9e71e299a7e0093830e79f955f2b12b4eb0a6bb45003d42256b6e5985d
- MD5 37a5cb54bdf661eb56d9904b33ac6071
- SHA1 c268df8007aef25e7ce5c56f6c0f93b970a77b66
- SHA512 1350f3d9096ab134a512c5941be58f6155b845676c9f15b9eb50dc5117bc80c0f75f11d147c5b950f94278db37c9d1f3ae25f2f5fd53b0366694c443bfdf3dc4
- SSDEEP 12288:Yi4/dYMAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtfm4L:Yt1YZ5ZmDPqO54lDJPTMfhL
- TLSH T1ACF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\win32\win32api.pyd
- Size 136KB
- SHA256 9004920e2c7863c34d0b3c4183ab3e1482475817cfb64f4f198e1fdd43f48f4e
- MD5 28b70b1aa326df930246f099d93e5ab1
- SHA1 c491c685c0a31901bc708aaef777d44cc157bb94
- SHA512 ff991de71f9301171dad8f35d2198eadbe747257983fcd2b584adbdc5ba8c88dc3fed44d7b3d191302c3a2c7bb3cc76d7750e5c8b0d01f082c7d09c02dd42673
- SSDEEP 3072:8ZW08k/WhmOEYlRVlhLaN/P3MXKqTmW/gD49jEYe:s8wWhmilRVsP3xqlUGjE
- TLSH T137D31883B39900D6D8AAA3BCC4674E63D736B4200721A7CF06A0C18B1F677E97D79795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000006502\win32\win32event.pyd
- Size 29KB
- SHA256 f16242b661c20f510ea13fa3dcac5bd332bccb4d135ef2ab497b3f3f3398c389
- MD5 eb732ce13f0fb8520010b2e7ebfc5a59
- SHA1 3eb1b902fb7f0a3b31005c94d7b5d1e745e75b02
- SHA512 b2143474881e34be4b282e8f389048340e98631de8c5dba6aa26c2bd63a70f602b0cd55b3fcbf95ea80e154c2134cd59dd34f0fabb88651c75581ac6c94eb199
- SSDEEP 768:F9WgtT0f52Pqq0+rxcF/jhfWddbcrlcb6OTfmku36ucaZ:FZhNcF/jhfWddbcCGOTfmku36faZ
- TLSH T11CD2F78723A850D5E526D17DC8660F47E6B6B93103A0B3DF0252D55A1F733E17A38F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI0000088c2\pyreadline3-3.5.6.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cy1izvoy.ucp.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gabber_screenshot.png
- Size 399KB
- SHA256 63bbf53fa08055e2ad401e83d70f802ec89a09b6140d7b1b128d754674f86739
- MD5 b5972dbd3845697cb52e2e740f7b7ab3
- SHA1 cb3da6601dee8317432f3176cd7f333e66e37819
- SHA512 2ec0ffe4960f862ed2fb96c4892ee5c516f68792ec23831e0752166f24142b2e7b3e05802acfa05b057fac986f85d85b071eea583899d15be446e1e4fe004485
- SSDEEP 12288:Kuwxwc8VrOx0I/0GPos3ozjOmMa5DnGD8o:K6c80x0I/osjaKB
- TLSH T1A294224DB0B6DE94FF88E67A4BD2458AEB3C55137065269D26EBB0030820C3D3B119FE
- MD5 SHA1 SHA512 SSDEEP TLSH
