80db3ea3a0376d33436a1d1fad2c16095f33b43264f1d70a25159aaffb755078

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 16.7MB
Sample260528-krss3aa19q
SHA256 80db3ea3a0376d33436a1d1fad2c16095f33b43264f1d70a25159aaffb755078
MD5 25e1d02165f46e71058750641eae3fac
SHA1 26d31e319c76dd4c390c2af775c942af9cd40fd9
SHA512 e2e7c2ef68b27fa1a6228dd72cb6af7a351512c94838178916427a982d9608bdf9ed2c639c332333ec149940101118dee59e67812c242a4d06cbde8e4b121b7b
SSDEEP 393216:V85vzC5PI16CvHbxx9rrUXMCHWUjlVg74wRugWIu/MFGeDpnJxx:C5vzCPQbVvPUXMb8PDwRuGHFGynXx
TLSH
T1EE07330CF5F005ABECE7967A9BA7CC6CE234BEA51B66C4CB47E042651D630E1493CD62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 35 IoCs

pid	Process
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	discord.com
22	discord.com

Enumerates processes with tasklist 1 TTPs 15 IoCs

discovery

Process Discovery

T1057

pid	Process
1664	tasklist.exe
5208	tasklist.exe
5652	tasklist.exe
1056	tasklist.exe
6084	tasklist.exe
4988	tasklist.exe
5212	tasklist.exe
1068	tasklist.exe
4668	tasklist.exe
5200	tasklist.exe
3044	tasklist.exe
5024	tasklist.exe
4952	tasklist.exe
3280	tasklist.exe
1044	tasklist.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
4832	reg.exe
4648	reg.exe
2844	reg.exe
4624	reg.exe
3876	reg.exe
1200	reg.exe
4372	reg.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5208	tasklist.exe
Token: SeDebugPrivilege	6084	tasklist.exe
Token: SeDebugPrivilege	4988	tasklist.exe
Token: SeDebugPrivilege	5212	tasklist.exe
Token: SeDebugPrivilege	5200	tasklist.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	3280	tasklist.exe
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeDebugPrivilege	5652	tasklist.exe
Token: SeDebugPrivilege	4668	tasklist.exe
Token: SeDebugPrivilege	1044	tasklist.exe
Token: SeDebugPrivilege	1664	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	5024	tasklist.exe
Token: SeDebugPrivilege	4952	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2928	3024	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	80
PID 2928 wrote to memory of 4556	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	81
PID 4556 wrote to memory of 5208	4556	cmd.exe	83
PID 4556 wrote to memory of 2996	4556	cmd.exe	84
PID 2928 wrote to memory of 1524	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	86
PID 1524 wrote to memory of 6084	1524	cmd.exe	88
PID 1524 wrote to memory of 1788	1524	cmd.exe	89
PID 2928 wrote to memory of 3940	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3940 wrote to memory of 4988	3940	cmd.exe	92
PID 3940 wrote to memory of 1732	3940	cmd.exe	93
PID 2928 wrote to memory of 744	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	94
PID 744 wrote to memory of 5212	744	cmd.exe	96
PID 744 wrote to memory of 2016	744	cmd.exe	97
PID 2928 wrote to memory of 3428	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	98
PID 3428 wrote to memory of 5200	3428	cmd.exe	100
PID 3428 wrote to memory of 5948	3428	cmd.exe	101
PID 2928 wrote to memory of 1988	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	102
PID 1988 wrote to memory of 3044	1988	cmd.exe	104
PID 1988 wrote to memory of 5844	1988	cmd.exe	105
PID 2928 wrote to memory of 2948	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	106
PID 2948 wrote to memory of 3280	2948	cmd.exe	108
PID 2948 wrote to memory of 3536	2948	cmd.exe	109
PID 2928 wrote to memory of 5860	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	110
PID 5860 wrote to memory of 1068	5860	cmd.exe	112
PID 5860 wrote to memory of 4712	5860	cmd.exe	113
PID 2928 wrote to memory of 3660	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	114
PID 3660 wrote to memory of 5652	3660	cmd.exe	116
PID 3660 wrote to memory of 1228	3660	cmd.exe	117
PID 2928 wrote to memory of 776	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	118
PID 776 wrote to memory of 4668	776	cmd.exe	120
PID 776 wrote to memory of 2480	776	cmd.exe	121
PID 2928 wrote to memory of 1660	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	122
PID 1660 wrote to memory of 1044	1660	cmd.exe	124
PID 1660 wrote to memory of 1512	1660	cmd.exe	125
PID 2928 wrote to memory of 4032	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	126
PID 4032 wrote to memory of 1664	4032	cmd.exe	128
PID 4032 wrote to memory of 1888	4032	cmd.exe	129
PID 2928 wrote to memory of 2144	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	130
PID 2144 wrote to memory of 1056	2144	cmd.exe	132
PID 2144 wrote to memory of 5432	2144	cmd.exe	133
PID 2928 wrote to memory of 5944	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	134
PID 5944 wrote to memory of 5024	5944	cmd.exe	136
PID 5944 wrote to memory of 5036	5944	cmd.exe	137
PID 2928 wrote to memory of 3896	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	138
PID 3896 wrote to memory of 4952	3896	cmd.exe	140
PID 3896 wrote to memory of 4920	3896	cmd.exe	141
PID 2928 wrote to memory of 4496	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	142
PID 4496 wrote to memory of 4372	4496	cmd.exe	144
PID 2928 wrote to memory of 696	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 696 wrote to memory of 5460	696	cmd.exe	147
PID 2928 wrote to memory of 6068	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	148
PID 6068 wrote to memory of 4832	6068	cmd.exe	150
PID 2928 wrote to memory of 3624	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	151
PID 3624 wrote to memory of 5244	3624	cmd.exe	153
PID 2928 wrote to memory of 5904	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	154
PID 5904 wrote to memory of 4648	5904	cmd.exe	156
PID 2928 wrote to memory of 3272	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	157
PID 3272 wrote to memory of 4524	3272	cmd.exe	159
PID 2928 wrote to memory of 2492	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	160
PID 2492 wrote to memory of 2844	2492	cmd.exe	162
PID 2928 wrote to memory of 5784	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	163
PID 5784 wrote to memory of 1728	5784	cmd.exe	165
PID 2928 wrote to memory of 6016	2928	2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	166
PID 6016 wrote to memory of 4624	6016	cmd.exe	168

C:\Users\Admin\AppData\Local\Temp\2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-28_25e1d02165f46e71058750641eae3fac_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq ollydbg.exe" 2>NUL | find /I "ollydbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ollydbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5208
  - - C:\Windows\system32\find.exe
      find /I "ollydbg.exe"
      4⤵
      PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq x64dbg.exe" 2>NUL | find /I "x64dbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x64dbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6084
  - - C:\Windows\system32\find.exe
      find /I "x64dbg.exe"
      4⤵
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq x32dbg.exe" 2>NUL | find /I "x32dbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x32dbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4988
  - - C:\Windows\system32\find.exe
      find /I "x32dbg.exe"
      4⤵
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq ida.exe" 2>NUL | find /I "ida.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5212
  - - C:\Windows\system32\find.exe
      find /I "ida.exe"
      4⤵
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq ida64.exe" 2>NUL | find /I "ida64.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida64.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5200
  - - C:\Windows\system32\find.exe
      find /I "ida64.exe"
      4⤵
      PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq windbg.exe" 2>NUL | find /I "windbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq windbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3044
  - - C:\Windows\system32\find.exe
      find /I "windbg.exe"
      4⤵
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq gdb.exe" 2>NUL | find /I "gdb.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq gdb.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3280
  - - C:\Windows\system32\find.exe
      find /I "gdb.exe"
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq vscode.exe" 2>NUL | find /I "vscode.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vscode.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1068
  - - C:\Windows\system32\find.exe
      find /I "vscode.exe"
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq dnspy.exe" 2>NUL | find /I "dnspy.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq dnspy.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5652
  - - C:\Windows\system32\find.exe
      find /I "dnspy.exe"
      4⤵
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq processhacker.exe" 2>NUL | find /I "processhacker.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq processhacker.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4668
  - - C:\Windows\system32\find.exe
      find /I "processhacker.exe"
      4⤵
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq procexp.exe" 2>NUL | find /I "procexp.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1044
  - - C:\Windows\system32\find.exe
      find /I "procexp.exe"
      4⤵
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq procexp64.exe" 2>NUL | find /I "procexp64.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp64.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1664
  - - C:\Windows\system32\find.exe
      find /I "procexp64.exe"
      4⤵
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq cheatengine.exe" 2>NUL | find /I "cheatengine.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq cheatengine.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1056
  - - C:\Windows\system32\find.exe
      find /I "cheatengine.exe"
      4⤵
      PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq x96dbg.exe" 2>NUL | find /I "x96dbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x96dbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5024
  - - C:\Windows\system32\find.exe
      find /I "x96dbg.exe"
      4⤵
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq debugger.exe" 2>NUL | find /I "debugger.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq debugger.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4952
  - - C:\Windows\system32\find.exe
      find /I "debugger.exe"
      4⤵
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    PID:2692
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    PID:4004
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    PID:3048
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s"
    3⤵
    PID:5124
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
      4⤵
      Modifies registry key
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "nslookup google.com"
    3⤵
    PID:5196
  - - C:\Windows\system32\nslookup.exe
      nslookup google.com
      4⤵
      PID:5180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_asyncio.pyd
Size 70KB
SHA256 8cef0cd8333f88a9f9e52fa0d151b5f661d452efbcfc507dc28a46259b82596c
MD5 70dec3ce00e5caf45246736b53ea3ad0
SHA1 3cd7037d211ebf9bd023c248ec6420f193ad7ed2
SHA512 eddbeb527c01167fb69d9c743495c868073b5cacae3652d777b6a635c4feb0344f085bdc2aeb6a775ffef8056394ddb4df5cd47e622ccbf974d11c30857fd536
SSDEEP 1536:TCY0jUiu7HX/9VFkX1FVdIDvnA7yo47Q9SfI38VMnLhM:TCxViHXlVFkXHVdIDvnADIChM
TLSH
T1F7638E87E2A4418BDAD7B274C5636F53EBB0F6821901575F91E8C28E2F5339183FE212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_bz2.pyd
Size 84KB
SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
MD5 057325e89b4db46e6b18a52d1a691caa
SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
TLSH
T15D839E86F79567F2F45B81B686C103A7E771BA91031093AFF258C2552F03F816E6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_cffi_backend.cp313-win_amd64.pyd
Size 175KB
SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
MD5 5cba92e7c00d09a55f5cbadc8d16cd26
SHA1 0300c6b62cd9db98562fdd3de32096ab194da4c8
SHA512 7ab432c8774a10f04ddd061b57d07eba96481b5bb8c663c6ade500d224c6061bc15d17c74da20a7c3cec8bbf6453404d553ebab22d37d67f9b163d7a15cf1ded
SSDEEP 3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
TLSH
T178045B56329C11B2D692517889275B57E3B3B47013419BCF01A4C3B62F2BBE2BA7FB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_ctypes.pyd
Size 131KB
SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
MD5 2185849bc0423f6641ee30804f475478
SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee
SSDEEP 3072:gt2Y/2//P+H9SUNn8LBBhc5Nvf/FH3ofTvaZIDyPn3f2:gst/GH9SUCBIf/FH3ITire
TLSH
T1BDD36C0B775840AADAA78174C533AF47EBB1B453165053CF02A8C69A2F637D7AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_decimal.pyd
Size 273KB
SHA256 f4a486a0ca6a53659159a404614c7e7edccb6bfbcdeb844f6cee544436a826cb
MD5 f465c15e7baceac920dc58a5fb922c1c
SHA1 3a5a0156f5288f14938494609d377ede0b67d993
SHA512 22902c1bcca7f80ed064e1e822c253bc8242b4e15e34a878a623e0a562a11203b45d5ff43904268322a7ef5cebb8e80e5fe1f1f1bcaa972e219348f84a1daf5f
SSDEEP 6144:tQ1cVo7LuKmJCOAzCL9qWM53pLW1AATIxYOqMtz3BMchV:tQ4oX5mAOCCubYObV3mE
TLSH
T116546B57A2080CA8EE738574D9579B47E7B27C560361C28F43A48AA77F933A3636E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_hashlib.pyd
Size 63KB
SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
MD5 cf4120bad9a7f77993dd7a95568d83d7
SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6
SSDEEP 1536:jLDxflFwY9XDhWjLTNwjg40nEdIDvI/7yo47Q9LfIi7K:jJ92AT63Nag40nEdIDvI/EF
TLSH
T1BE538C44A29480A6CA6742B4CAE39F87F6B1F2425740ABDF0354C1CD1F237C3D6BA75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_lzma.pyd
Size 155KB
SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
MD5 3e73bc69efb418e76d38be5857a77027
SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
TLSH
T128F35B86A394F0E5F7728C78D6624F57E7F5781A0320928A01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_multiprocessing.pyd
Size 36KB
SHA256 3262ec7496d397c0b6bfb2f745516e9e225bd9246f78518852c61d559aa89485
MD5 24aee7d83525cb43ad02fd3116b28274
SHA1 68a2870bd5496c959ee7e499f4472d0614fdfd87
SHA512 6ef5082e83f9400e8ffdbb2f945b080085fd48c0e89e2283bcedd193a4e6a9f533f8da78c643dad95db138ec265099110a3a6dc8bc68563dbef5ca08d5e0d029
SSDEEP 768:ROhui7ZmQWd3BpDbESNIDntrQ+Eyobo+Y7N2Ip4njTxf1ml/6dHQ0Zl:AhuilIRpDbESNIDntc7yo47Q9nhfIgHH
TLSH
T1A2037C86AA6C4093E957DAB1C5E3EF86F538F7830A11865E3191C2CD1F37381A36D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_overlapped.pyd
Size 56KB
SHA256 9ef177db14cfa3aa66193078c431a96b6ae70858e9dd774b3d3e3cb6e39d10a3
MD5 51e4c701e4efa92a56adaf5bdc9cf49b
SHA1 1adbc8b57e5ec0a90b9ec629323833daead8c3b4
SHA512 35b2d4114aa12843cb767b7d7a2c82b00144fe8fea04b41601b790d8b4026e271148b5186308f461f2ed70d75df7c0ac56c4e023ed069f4f0f6f23f5ea11a2d1
SSDEEP 1536:AMm7HdS/l5Kd+AvCdE+exIDWt57yo47Q9CfIgHHt:ExMAqdEbxIDWt5jYN
TLSH
T173437D4A6B9400CAED63C1B9C5639E57EA74B3D34601531F61A8D28E1F733D2B72E389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_queue.pyd
Size 33KB
SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
MD5 59c05030e47bde800ad937ccb98802d8
SHA1 f7b830029a9371b4e500c1548597beb8fbc1864f
SHA512 4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d
SSDEEP 768:AkTQ6rDvtxZID9UiiQ+Eyobo+Y7N2Ip4SCxf1mljr8VMj:AqhTtxZID9Ui77yo47Q93fI38VMj
TLSH
T10CF27ECA66584147D5A3C9B0C5A2EE53F579B7935B0187DF2054C28D1F233C2A73A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_socket.pyd
Size 82KB
SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
MD5 69c4a9a654cf6d1684b73a431949b333
SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16
SSDEEP 1536:quV3gvWHQdMq3ORCnOypTAQlyJ+9+nztYwsFF6t7lCuZIDywN7yo47Q9EfIb5:quVQvcQTqypTAQlyJs+nztYtF6ntZIDv
TLSH
T17F836B01A69041FAEBA3C1B5C2679E23FB74F5C11395975F00A6C55A1F333C2AF3AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_sqlite3.pyd
Size 126KB
SHA256 1decb0ff369a1c314908e0933da663de8aa7732d8bd1472383906d18029cac67
MD5 42f32a4f1913823e034a948a7031ff03
SHA1 a675a6bdeced07cf668ffcc9c7bef2eb9cf3d7df
SHA512 80b84a774369d1a5d0efbbd12bf41746de502b726ecc3d84baed054f1650eda12ede4c00e919abffb49538d43eb43b77cb8e4094950a4aa2ca507e43a165976f
SSDEEP 3072:L+tL+A3/fvE7qxwDcCpz6j5ydrJumaAsXdIDvQ1qZ:LG9k7qxwDLsj5EVaAsX36
TLSH
T1FFC35B2B631400AAE9E75278C1734603EB75B962532153CF55E0C6892F377D3AF3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_ssl.pyd
Size 178KB
SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
MD5 ce19076f6b62292ed66fd06e5ba67bba
SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143
SSDEEP 3072:A20jYjQ80NV96LE2fU6CosjLEmMPi1ba+VRJNI7IM/H9o/PCrXuII4oFIDL7Riz:500rklqU6CoJ9PijTT4o8W
TLSH
T134047C47B5805AF7D913E4F9C2234903EBB0F155331157DE48D6EA890F03B4AAE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_wmi.pyd
Size 39KB
SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
MD5 e3213cf44340d7b4cb65f7231a65e3a4
SHA1 815e5809a01905ecaa463f6827f657c11b95d243
SHA512 d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a
SSDEEP 768:/oEkKVVgWOZbY7Ect6PlFIDLiTQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/oE9vjk0EctcFIDLi07yo47Q98fIW44w
TLSH
T1AC036C8AE6680046EA67DA75C5A2DE43F934B7D35711938F329586990F233C0E73E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\base_library.zip
Size 1.3MB
SHA256 5b4c4cb09158ca7ab8d840ab183b47f112213b94750d732da30676ae2be50679
MD5 a556e44a5a108c03bf04e518623f3ca3
SHA1 9bd3225e6161108f7ed1d39cafa6dc58e0cfd26e
SHA512 8ae79f054c23bac0743825cf6ca66c02ea5ff7770126606b8677ae23ad72530d24258dfdc9571b9115aee378fc7c6bd1bcadcce75c8ed57376dc026b6ae1a109
SSDEEP 12288:CW7WpG62L+DzIdjdTmuOBa80201jwCVRDVoioSYBqnVJpWVri2cPPdxhY/maGe7Z:b7WpQdZmzqVJ05cPPdxhY/wSeT1Ng
TLSH
T1BF550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\certifi\cacert.pem
Size 290KB
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
TLSH
T196547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
TLSH
T17F222A0CFA6148DAEA158178C52B5E0BF0B5B710172273CF4770956B3FB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
TLSH
T166C32A1722950077C96341B98CB36817DBE2F5510B3253CF05A4CBAA6F13BDABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\pyexpat.pyd
Size 197KB
SHA256 b93e6083eb06137cc9191dac0d9cf4483e47192113d3ac2228b4549f737bac85
MD5 0351dc34c06a7e74e977c142a8784da8
SHA1 1096bc9b3ae3a57dc7f684d53191df5365889164
SHA512 92caee00cc0588d30659d4b0bde38bf229beab0fc07d9aac362b84814b6ea541c39c03aba936124cbfd5d60c219d01cb09eba8005dd2236774503094cbdc609b
SSDEEP 3072:DQ38C7XURBox3eNAe5XxBpiedxMmiuXTB+qEEWB062lBDG4gPKR5uECuZIDyhiYY:w7XURBNAeyQxMmiuXTkazZldGPPzOEBf
TLSH
T129145B9A71A2C1EBD8938038D6D78E07D7B2B865038097CF52D4EB7D5F27B423A29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\python3.DLL
Size 70KB
SHA256 4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638
MD5 98b008be9834bfc362b4c2eef4e8cdb9
SHA1 a4a50ced1329c3986e3c1576f089b25aff5ffdf2
SHA512 d594ffd7d44d4d862475711973df87b08fb63a900ddfd87c7771ad27f0cc71e5fbdce92da4d4ad5856fe3cfb803257ce0b71cd8dc24ca5c421ddb1b9b44c7881
SSDEEP 1536:fotssyKcunV8P2ZIDy0Q7yo47Q9dfITzp:AtssyKlZIDy0QGh
TLSH
T121633CC25B57F8A2D6F669FC78DDD9CE242B02CC57258C9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\python313.dll
Size 5.8MB
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
TLSH
T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\pywin32_system32\pywintypes313.dll
Size 132KB
SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
MD5 f7fa93a0bc20b155e9b141b6705870f0
SHA1 72c6bf418a55806e86cf67b3d363a385ae9cfca6
SHA512 3d8b7ae0303020e6fed0066f08eb30ae437541de0918528561e50f923cd42654a6453f59e610f11c4676022552ce09fa63a8fc8b1e13b5a3a8de0378d54c5b2e
SSDEEP 3072:F54SfEA3X4IiyNHpFBiuQdY/r06YrfNaQQDElr4ohgmF+M90X3:j9TH4IiyNH7BodY/rk7NaY4wgs+M90H
TLSH
T19FD34A47374644DAE966E37D8C771E02D3A2B0100711E3CF06A5C2AB6F63BD66D3B646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\select.pyd
Size 31KB
SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
MD5 2663e22900ab5791c6687a264473ae1e
SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
TLSH
T1CBE27C8F6A785087EA93C6B181A2DE43FC39B793861182CF30A5D59D0E537C1B73A359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\sqlite3.dll
Size 1.5MB
SHA256 aba94c2a103e9ab331466823c28217c6fa00f4280ed7f3502c11f5aae71c5814
MD5 08db2deaee0e45043461325310e1cd0f
SHA1 e557691bca88edc4a1ec664b4a4b052eda76c7c5
SHA512 794979ce457c8eaa946a2034d06eaeef22aed264bd3a684927b30065448b1e49d5cbaf06e9fd7ef2da31ec808bd310bff0e143fa41988fa45de6713cbb6bae7b
SSDEEP 24576:/sQ1ZE1JGDqFjmJNO4keGLHe0UJPChzwI5ajkgohxOw6nTs+Zv5YOH:PkjmJNOMGLHe0U1awI54kgohATs+J
TLSH
T10D658C4BF2B801ADC0A7C1B9C91B5707EBB274051770A7DB5590CA696F23FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\unicodedata.pyd
Size 694KB
SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
MD5 c0b4c55ce3711af914b2015f707e4452
SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
TLSH
T185E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\win32\win32crypt.pyd
Size 121KB
SHA256 f07fbdcebda155ece29f64a4ca199db544bfa1f3472661f20b569d2b56926123
MD5 f71f82c87b41b0947773c19ddabb6919
SHA1 114fd986b0f6696aedd67905455f9c0a5f9eb029
SHA512 ad54d68422965b2be4b78eb49a392bac061f4f192b9e6196dd2d2ec13b981a94b1ccc3fa726ca744d8d5d043399b7c97a5da65d922938a204f67e6caafe054be
SSDEEP 3072:ISoHAMz+4O3CCCwgd5uehihNGvvlPU64S:vogMzjO38zdwhNOlPU64S
TLSH
T1FFC34B03729159CAE8AAE3BDC823A907E7A1701507116BCF0590C6DA1F67BE57D3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32process.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\win32\win32process.pyd
Size 53KB
SHA256 9d99c96c6d2e15fc52ed9444dc880ebfb358fbcd1f659ddf8af1a233033294ce
MD5 2fd5b0398872e4c24197721330cef5ce
SHA1 87da4ce9ab3efb9c0dec144f1dfe9f6c4f2cd864
SHA512 143a0cbec5a446172e84ef8f285a01ed385b4474a4026399b3b78c7d696c94cd3729ce257eb65387dadcd45974e47f24382ed7e4b568d2fcdf53973d891df73d
SSDEEP 768:EH+WrlHOP/+p/K3TS0BIdbrEKnnud4yY0EFSrS/wgirzI:5i5O3+p/K3lKlrajY0EYrS//irzI
TLSH
T1DE33078B739A50C9C45AD5B9C1375E27E672B8140722A7DF0274C68B1F237E9B53DB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads