1662db0f08b6ab3da6496493bbda081b873bcad405374bf94e47689e73121ff5

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe
Size 81.5MB
Sample260710-2w2efagw3s
SHA256 1662db0f08b6ab3da6496493bbda081b873bcad405374bf94e47689e73121ff5
MD5 1fef3532970410030f1c0fd138cc051a
SHA1 2847eb74b1fb37d9a449b0cc8a6003b77d082898
SHA512 08108fb786a2a61aae337b60b3de403594ff5631537a0a0186e6c0a0b718790bf2197f1997b1d53c6cb195870013b42a25faaafa97ac1caf401f273fd0be0786
SSDEEP 1572864:rAwJk1ISuBSnShjzBPW/n15DmWP4jQQHgOF+Z6+3N0Cv81+KcB5dZ4OeWTXU+mU8:rLk1ISbnShfBWn3qI4MEgOF+I25v8IK5
TLSH
T16C183362BE42D0FFD4CA0275D83EB77DBA3751A6C76A84C346DD0C5868E22A0191739F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
2532	RoMacro.App.exe
5380	RoMacro.App.exe

Loads dropped DLL 64 IoCs

pid	Process
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
2532	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe
5380	RoMacro.App.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2612	2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe
2612	2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	RoMacro.App.exe
Token: SeDebugPrivilege	5380	RoMacro.App.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2532	2612	2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe	88
PID 2612 wrote to memory of 5380	2612	2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1fef3532970410030f1c0fd138cc051a_akira_amadey_blankgrabber_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.exe
  "C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.exe" --veloapp-install 0.2.0-beta.4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.exe
  "C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DirectWriteForwarder.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\DirectWriteForwarder.dll
Size 490KB
SHA256 34c687571471cf4e9cad757525d9f468dd791e243798de02d3243d5c54ade408
MD5 01271212ba354b76fedd4e1d6f26ed91
SHA1 15b4c7d7fee2ca841967b9d0b50ae6009e3a685b
SHA512 3507bc53b5a76415de8b432963884fd09b23f672a92f69f560aec80e4968a84612b1169d8bac6eac066ccc3c103fd1f7a6379ad1366645e72f0db710717af2ed
SSDEEP 12288:TJ+ScTeRKdH33Bz2xMIq9J0goK/3HNcEdD:tBcTeRKdXp2idboebF
TLSH
T117B49E14B7852B97F61DC5BF8253C6A2D630AAF14302E3C7C64186A62E2F7C1D77B492
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Primitives.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 37dbf1ffb68c9c2a72aac38329bd2f3cb3c031d12dd00758e697b4b1e5c365e8
MD5 69552902375db2f40d001e6ed7f8dad8
SHA1 35875a41f6cb686c806e19b64c82874110a897b7
SHA512 ef6aa58865bbecbb76a7534b5ae81379e1d5002973b30e26ad243f7fc6037a0d4470a1d86bc59d977caf45cc00869f3263d0b0a8728d808ea79a2c992fa79923
SSDEEP 384:KiLuhWhPtpWofLXmztvGHRN7HMGZGl8BR9ztqpT:KPyVjQtaHjZ99zteT
TLSH
T11E624BA1976C4203EDA78DB092B9DB473C3D97C75A009A5B0995FA581C67781CF3063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\Microsoft.Win32.Registry.dll
Size 118KB
SHA256 72914d10232f4160029fe38f19d98cf789e624545e9a16473170479b433aa143
MD5 238eacdaa946d918625ac86304a14ffd
SHA1 488cead0dbb741cad2daddce0245d8706aa8821c
SHA512 788872385741e73abd18f80df231002bf27d1f8473a4ac50fb4fc87d35d67c246bd82502b622f318bd84dd3385f994b8532f6a09df681608826699b08a7ffc79
SSDEEP 3072:fW1jNXwrxr7wECisvqzJSvEVcULViTZiZ1d53k:ONI/FC6zJSvEVziYTU
TLSH
T1CEC3291177C8430FFAABCA7988638985E272E1871701EECF9685C15E3F5BBC6E671601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationCore.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\PresentationCore.dll
Size 8.1MB
SHA256 297be6de365adb61de44888ec06fde5147833c733a35e8eeb8e175b6c2ae5cce
MD5 3a673c3ad0ff135b1f68ec79cda89d67
SHA1 cd2afa5ea693bbcd2314ab7feb4dd8cc48a478a4
SHA512 25a870bb0e88f4685e57a2d91e9ec61fb858481d72508d1728984267ef4749fa5880a57026abe5d29980cc49de1f31df7983ed1a062725e7cd6f2cc455e33a88
SSDEEP 98304:kssdj3IQ4fTVx9x23xZwOroHy7xAz+BianjIhwYl6bQy6E9sck:O3oBx9xuxZrrmanjIhwYljy6zck
TLSH
T11B867D14B3C4451DD2BF96BE83929222E670A0735316D1CB745CCB292FE37C1A6F66A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\PresentationFramework.dll
Size 15.4MB
SHA256 3721b5c5a26caf6a74d3796fdcb97ff8e0e07f88bd84507eebdeebdb4714d247
MD5 6314394ccd767bca0a0c0dfa281bd4ba
SHA1 20b4d909f7448f5dcc739566411aaea3364bb104
SHA512 b9f3bd35eebeaf1171053d0add9ac6af638595c6bfe6d362c8eeca8871c746451eb4cfa4e8a4056719dadc6f26ae1a692c7270cb53a9bbf6c64a70be60ae7e21
SSDEEP 196608:psaCQJQPkTMct7Yg/kj76xPgkTSZdYkxYA208Zh02PCGN:psaCQ2KM9g/kj76xPgkTSnpJmHP1
TLSH
T171F69E2593DC4A05D37EBEFCD2634102E9F0F4926B32D4CF8916D9092F877C1667AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\PresentationNative_cor3.dll
Size 1.2MB
SHA256 36a4da0eef1dfec37488a065efdac01e7c7757539c5d4b58964a6ba50ae122d9
MD5 06b8c10ba9cdd5ed9d63e2b62aa8be1b
SHA1 4a96c4f71e6a1d45818db4797e8787cb383c81ce
SHA512 dbcc8d0273485d00f6698b39f98860138da176404825e55db8e95ae365f35267aa402ceaba4d76d91a37677b611e3cef03beb8d775b7325e3d58fac0efd01465
SSDEEP 24576:JfvkOGr4HPXwY7FETqbjek1I9iXtJ1aWpOORssww0BzSdxl1pwJVCMNToQs+UBNA:JUOGmPX/ETqbjeG1aWpOfswwMzSdxPpa
TLSH
T19E453A32E2E642E4C47BC1B8C6469727FBB17449231C66CB47608B592F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RoMacro.App.deps.json

Path C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.deps.json
Size 39KB
SHA256 f437c3d8e2266143b30ba38f4629b01485a9c6588b473419e10d695bed8d26ba
MD5 a096f5b08b762823d5891197feb1abf1
SHA1 298ca0fee131314b6f7e591c6691b4ee161a03cb
SHA512 63c7eddf3866af0dd2ebf2c16c74ef2346b1d56be74606887b321f47d63d2134e06442cc73e1c13200bd4d8f3c0b2baee30d4787a2e0c139d3a57cce93385224
SSDEEP 384:QWol2MaKURVG1nxvoEybHzfzNujzdmjSxmriys7RLZS0vxRbe:QGFS4iJvSv
TLSH
T1CE03B335C9404DE704356BDE287A5A46F3B2036F7080588EB4BC381D9F7BABA9165B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RoMacro.App.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.dll
Size 640KB
SHA256 dea643378b846b5063475f609961f0415182e3ed25cf65eeeaeef7ec55262b83
MD5 ec720cbb429919a8542a15b8d6514b07
SHA1 4bfe5a3e1e8cd636915d49471bd3da6273801097
SHA512 879da79bd0bb2767d376add252d59435e23ff85f4e5c78783139965dcb873f9828a57669966da3ee077076c3150f9a72a2117eea9f4e49d78b1c28397d145974
SSDEEP 12288:DkC06N4WpzyhzyV33Bn8XP1iBUgz8p8m6EI1qR:TxnIPczdm6EmqR
TLSH
T11DD48D10B3F84654F2BF2BB598B202548F3B7D47E9B9E70C058518DC1DA6B82EA21737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RoMacro.App.exe

Path C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.exe
Size 196KB
SHA256 54ef56b0610fdcff19b5f92e55e33bbffaf00dc5bee4458fb64686e245b9c39c
MD5 577e9eee83b14302e9c91d3449772ded
SHA1 9b303ae33190c08065d2cebabaf6f0d9a1a5fc6c
SHA512 89e6d3c308793fa2cbe22f869c1ecf445794cc71e590b16ae9d30cc471fd1d5519194f77f75a043c51eb38c45c95120bbefd9c2e1c8a2f2b048d993119e411d6
SSDEEP 3072:mLp44Gswj7UR3eO17GUlhoVUtC5EAh5XUFTK7znUNyiJXv/jHFZJv14E2Ll1H:mLp44j3eO1aYtRY5kFTK7znUvJXH6H
TLSH
T109145C17B6A950FED2ABA678C9920901FB737C9647B1A3CF035049B60F66BD09F39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RoMacro.App.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\RoMacro\current\RoMacro.App.runtimeconfig.json
Size 468B
SHA256 a529b2abd5ea10607bda13b74047da74562bcdb9207813c0065bb6bf4ef5c419
MD5 99ce5baa52935420ddc96179cb790a18
SHA1 f1e85ada686ff95e4d292936a2a30d31bfdffa33
SHA512 23b92510d5c3784e01df731e52d5ac58e42c8c8f3ba8c072b8ee2252b496f6d3e98b5edb268aec4989230d6d33694309c679a494b236332682ba8f35ffcdddf6
TLSH
T152F0ED7ADA146C7714FA777ED676C1C2EB30232B10001D9278FC080C6F7B9A64112F9A
MD5 SHA1 SHA512 TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Collections.NonGeneric.dll
Size 102KB
SHA256 6ea5f2119e1bca2730a82263c66cb4592db7f543e719e7b0758aa75f5508f5e3
MD5 3d8544a20c684970e9b40d9661c6eebf
SHA1 204d3e93d2369189cd30e43d10b6ad1b2d148287
SHA512 3ae42113dbaadaa8a4b0dcfbf8deb5b9544e2b96d4fc16a085cc55958d4748c2123a661541daca76817b993fdc23b296b5bc69616f9b7acef3b5dd64d2043cfc
SSDEEP 1536:HSx0tJVDX9LvIbwNC5IQ7XVrMZqz9AmWGUdVXEkPM5zP:Hc0dzNvIc+IQLGZqzKmS0k0L
TLSH
T112A3282677D80322C66E6BFC91938A01E6B5F4D26713D1DF1618A9CC1F9BBC2C6B2147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Collections.Specialized.dll
Size 102KB
SHA256 0b2c5bda62eb2bdf3e65b555d98b5cfa04f73e1ea20a9b2011bf348ae2834c49
MD5 dd1585a7f1e1fc4f7c53bf12ae8d0f02
SHA1 df1ffdbee8baef005f7974d47f57ef28ceb80375
SHA512 2763e2f08fb52ce797b3a547ee98f549d082e190d8e36f29225640ead9805c21f77948e0f082c5830821360fd54f49c042954890773a8138a1b4f7c8740e27bc
SSDEEP 1536:Rn3dRfAJP9WSJLeI620hCYCARk4YIAO8xocgM50Dd0VIOOXNKzVxdZ:Rn3fAhpeJDPAOSocgMaDOBOcFZ
TLSH
T170A35B2433D84B22CB3E92FC85978941E731F1E31362D2CF1558D9891E9BBC68B7612B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Collections.dll
Size 254KB
SHA256 2372c36b9f3df448112c8df0bf265d74e65df74796876667cec37c298b4482ae
MD5 aa5d3369f43589ced25c1f47d1cad52e
SHA1 16a350628f306674fd534941fa82b1c691d6de55
SHA512 733ff187d94a83af184b0d1131ee0f9e1909bca610094ed8a1723d378bf4cd661d240b9945b16521f09d6061f46afaffa8d88dbdbc41788b4b7ef4e4e8b9ce0a
SSDEEP 6144:mnxoXL7DXDiKNYX8qTKfAyryS1rIgj3J8Q4:+xC7DXDiQ+jTURrhFrJ81
TLSH
T15D444A2A778C4E12F56F457EE6A3C012D7B390A34712C2CB06BEE5840E97BC1BEB6155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 3a3b7935263f7b59f38f61b2edaedc4ccec65ae7850e6eea04a72213cc86df94
MD5 0102fb45f53799cadf550b8baed29fcd
SHA1 137d72e5cfcb1c1f4d2941a6b0d8450284e2c36c
SHA512 cececcca8f0ecfe3b1c20e78b9d0f33ee6dd8152f3a8097b390b9c10043d97fb6b76bbfd18d47b1d215ac9fe69893b672edd7471f7a70385e11dc066e3daa94a
SSDEEP 1536:PF5/UZMu4+hd+Cv8A/oqevD2ols3cbktLXEyLzDY:Po4s+S85qKD2om3c2UsHY
TLSH
T135735B1823EC0116EBBD427C9673A921D574F6821713D9CF4AA0D90E1F9BBC2E27063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Configuration.ConfigurationManager.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Configuration.ConfigurationManager.dll
Size 1.0MB
SHA256 4e691b249b6a22798819012456992d466c0938d2f4e51c78b92bf45b0ba3fb7f
MD5 fd2f8401a5d0507601bf7e2ab9d8e584
SHA1 0821ab94cd401bb50686bb58cb6950c24fe67cdb
SHA512 7084156947c7079dd7540c7885c55b6e394590f0da5a4e3b9904ace1e651ec765f42b34fa7667ceaaddc1a35e58bcea14453942c2be283cd94fc622ad34eb585
SSDEEP 12288:TP7P0JcnrfOsdV0Z8oApKK1sPTdokGH5OTNWLOdN2wyhtAVv5d6wGGDSxw0aY1Ei:Twmnuxy/6TlGGD6zaIE16k96H1uC
TLSH
T190354A2663D44B1AF3AA567CC5265501DAF8F8830323C2CF0595BD4E3FA7BC296B1627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Debug.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Diagnostics.Debug.dll
Size 15KB
SHA256 22a1a6cb679b507271470e8db2d0584b1d790d0b235ec63d6dd3cdc1268c5bc5
MD5 537cb0b7cd637686ffc97b066961092f
SHA1 66c8a6725571c580b6871f37be8c61ea9c19b4d5
SHA512 477202328a438438db54f7860196211c834a7c6c4e00f25e4f2d2b7ebe84be494fe4753c9e03116f40fc91ca1850d0818e82f76c0d6ceb5f58b25fdaf12fdb17
SSDEEP 192:SfRxAuW2ImWMejWaLlVmchOIEvYFHnhWgN7aIWryvpGX01k9z3AzLAu:K5W2ImWjfLXmztvGHRN7XpGR9zecu
TLSH
T17E725BA5C76C1203EEA74DB093E9D8833D39A7C35D119A6A0AD2F6451C63780EF35B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Packaging.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.IO.Packaging.dll
Size 286KB
SHA256 05ec1e997f7301f41ee1a43226e21ca45a8fcd877a838cbac8b45aa7cc44f00d
MD5 92cdda4dd682e2f135e3b96645d79b88
SHA1 3e80b8edd1ab7006c2e48699d1485db2d3d39970
SHA512 c9679e75cf87099ebdfc5d32756bc9f892e4f06c315cf3b77ad4c6d3f2fad16579a938ac32a14f3c01f668ec38f0ac45dd033d1b86dcffb30bd5fda97c0efa03
SSDEEP 6144:U98GGgTmHmNRF7bLn8qsEYk7GkB1dgDXlQ+:U98XmNXn8qR7GCQl3
TLSH
T18D54282677E80607FBBB96789573E011E638B8921761C7DF46E0948D0F97BC18E71B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Memory.dll
Size 154KB
SHA256 b2ebd81f0275eeff2fbf92b099d41aa8848ca266c4d710fb48399a8d91a8b8bb
MD5 c92cd49e4a78ab26f73912021648bdd5
SHA1 596e04596e5088df967270b3f7bd51eb855c6044
SHA512 a3bc1c53e73d972ef692fb443c9bd34eb80003a4909e861cdf555055f6e22b776e842f99cfac9e6b6a0ebbe0f4090ffc1b9c009c15947acd618fe28d26dc24cd
SSDEEP 3072:7HyyZN/j+0sbFbqX63vwZuIBo7M5F8966oYdNCBuqmwqhtTihd505:DZCb6oIBo7qDGNCBuRhqU
TLSH
T17CF35B1BE2980657DA3FCAFAAD225302DBB36152572192CB4CE4DA841E53BD0FF73461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebClient.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Net.WebClient.dll
Size 166KB
SHA256 96ae85ae37adf7d04e7d03a02a92192505af736c865a83a12899efe6a1ac2a24
MD5 c7abce941b5aac6fb77868b1d6383823
SHA1 4076232c06504642cbcf63fb675f56bc3ca95e6b
SHA512 8dafb7059c038428fcbdd4f04d0eb7cbb612d562dc0b7e4e066adb695d045fb28ebae30be76c766dc339d6f8fbb616913462426698539635a660ad0049ae6704
SSDEEP 3072:0u6InCtQ8/qNIJ55jOpC2poY3ykJ9riqAFpR/yEC:oXtv/8IJOvpAFHyL
TLSH
T13EF35B2797982687D71F81BCC4A76240E7B384A60301D7CBA9A895740EC37C2BF7656E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Private.CoreLib.dll
Size 12.6MB
SHA256 8c02ae48f60515183f6ca1efeb103064e391c665fec04772f322bd3be8d4f392
MD5 ea92484aa235ca2a786c02660785d2dd
SHA1 27c211028dd641d95b990028ba1b6c5994ebb33a
SHA512 e5b79cd0e9f8aa25b50ff672d4fbe2c716e9ebddbb0bdf1b943bdbd6337420af8519282b05986ee07a8b1d01ebbbc134a88f984cf4da3cbac1a811c1ac869093
SSDEEP 196608:EkcLvvR/jussGW+5ks5OtsFSynOkLU3B5B2:I/j/sGH5L5OtsFzOkmf2
TLSH
T17AD69E21A7C85F27E12ED27D82634385F770F4A6535296CF944EDA882F17BC09B3B261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Private.Uri.dll
Size 254KB
SHA256 a62bfd1e8d0b15fdd5bc3d66106eb96f8f11bb7865b9459ece86a0d5aed30b8e
MD5 3e988af30f4a24d6f4d5f1f60c5fceac
SHA1 7e6d88d022b747138f8e678f280d59be36881ac5
SHA512 59aa0d5bfda01fa089350b8719056fd6c12dd52798046c0cad6701ff991ba3990fc276c94e5605090664db249c1737e85f2594dc3d64d959f6f53f29c5108fde
SSDEEP 6144:FfAAcZ5InBPKCeDc6Ci9MG3CMeVmtGuFsGu6MyNQ4:KFfDciMG3HamtGufuV81
TLSH
T19E448D25E3840E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Private.Xml.dll
Size 7.6MB
SHA256 028344ddb1fce6394a078c42afa7eab5d80643d1f1facf5ce09703aa7036e699
MD5 43b074c007774ed93152a071ae7729d8
SHA1 fb7cfb39578d783adc986f6c91bd2734d74e2d1a
SHA512 53cad028d57a38be668866486eddee751d73e54a518a5b56c0eecc2ff2fc1be4fdb645dda670029bf88c079d5f03a34b51fa723aa1ca746ed6788b346604ab11
SSDEEP 49152:uQN//hGMR1H47gI5Uymd+YItx2TOMAKfW0rMZDSO3EzwAanU54BQcezIEBopjszr:uWxOemUo0rFagxVmIwo2uaaf5WtF6cgv
TLSH
T14A868C24B3D40A15C73F827D8272A625E2FAF453139697CF0458EAD91F837C1A67A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.VisualC.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Runtime.CompilerServices.VisualC.dll
Size 30KB
SHA256 501fa4dfc5d48ace8d5aa8cacb446b8c4ca86f3d06f4de30ebe32e689ec6a524
MD5 7d14493e3d54a7650518018a09f812f0
SHA1 daf474184daa3cf0802a7d35c7f6fc5b44e6d0a4
SHA512 9673ab52678a074086eaff43126f9cb40a9a7c53bc9509db16083acf2378a1fa714c98a305436fa231030abe2ad59be7902fbc2066a2942bc131769c8539d396
SSDEEP 384:/WsHLWzOjxoeFVw6MwnHRN7DR9ztkBKSH:nkUFlXl9ztgKS
TLSH
T1C3D25CB0ABACC257DE670C74D5F9F6432D39A3829B4296D7019DF2061CA27C48B30B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.Extensions.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Runtime.Extensions.dll
Size 17KB
SHA256 6502a27f8d25151b6ba9fb79f5a4882821e107c42b6db3765088032fc6e16e41
MD5 8b476b8f1340e129bf521523648df529
SHA1 18f85a7986ba7d5bdaf6521367ef7978d1e562fb
SHA512 7110aa370d70a00bb6bef8a711b149013625e4f122c0c994a08dec45992243b9efbb41ff63e06450c0e210162303d3d9aee9484ca57753a67a6978e49996f50a
SSDEEP 384:g7/Sj5rt9x+5kW8BNWTfLXmztvGHRN7hpOE/R9z74sG:g7qj1tU4SjQtabOa9zbG
TLSH
T169826BA29E5C8242DDA74FB09AB6CA833D78B7C3697195BF4586E54418633C0DB3173C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Runtime.InteropServices.dll
Size 94KB
SHA256 77dfd9f30fae65582a95ed5649a82edf63666d5d6446a5dda5bf4c48074c8a5b
MD5 2f3c13dcfb563581f6d15fc3e362868d
SHA1 4d192c6c87ec848f3258b80afeb1b882f3eac5a3
SHA512 fb0ee6635e456e141ab15f143137d2394de251d7321a8b7ee1112a7a0b7db6f1d5c3e88681c407e61d590f9cbb9f4c562be232f5e4c866bcb716d4a22e061be8
SSDEEP 1536:qBM6BupEelCtJfKS6+67NspnSPM+l5+FkmVdKWHcQc8yLzO3:qe6g3lCto+dSPM+rCkmXNcQ1sy3
TLSH
T13C935A2437D8066ACA2A473C9C775D50C9B2F6C613A2E6DF4781895E1D9B7C0C3B23E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Runtime.dll
Size 42KB
SHA256 2e86ad8bacd659b8eadfa0e5659568cd8d64b1243f91b66dc2ba465899dc3a80
MD5 e630691ee0ff6228911dd63cf89618d3
SHA1 11a61b38e2acb09644dea5d71a3d1c8a72512c61
SHA512 749d4204ee86ddb858107b4b6ee2c49b0c0f1779f4d4094b7293fafe6760101c1fa6751ee5485696e8693854f4b239cd233b5c1939d1811ce0451f900c23a6d9
SSDEEP 768:u+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLw:SB/LuYdy50b4b7RSHEKGQckzHq
TLSH
T12B13C365AD484333CD8BAB71DC73AC810DF273C4147A597ED88FEA5913863A48236B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encoding.Extensions.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Text.Encoding.Extensions.dll
Size 15KB
SHA256 d8294806c14b73a938c9e6f73438c706fde773c716ad1760f9b4b2989d55886b
MD5 50215088173a227d10a660f23c282a57
SHA1 d1658d6369b65d0c26f073d5ff63a699fd52eb64
SHA512 b08b6b668c64e2ede5cdd2641974fd95cf41c2285b3e9a7c298c2857c1146cb4c12367a2c3865254800b011aae790f9b01270605df221a17f16ea0c1f4825ff5
SSDEEP 384:ax1pW6dJWcfLXmztvGHRN7nP3U0R9zqryHRa:W5pjQtac49zLHRa
TLSH
T156724BA68B284247EDBB5DB0D5BDEA833C3D6BC25900E6661595F6441CA33C5DF3063C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Threading.Thread.dll
Size 15KB
SHA256 8035c5e42b9c4189ed069fe5356b37e763274684ecaad00fc0eda6fcb75fc6eb
MD5 8d13dbcf4c3f74c237c8efb4910c7d0a
SHA1 992344e7cef2a0d1dc801fd41cba57481e5ea481
SHA512 543b64fd9401c0bb3c4a43f01dde9269e16b6a761d79bafae628c9221fe34fea743d77ebb3a7ea3eac574b209fd6694c151d634b0e39a6edfa74d923a292b42b
SSDEEP 384:24z2Ev058WWcH7WhLwnHRN7VYlORR9zhnCZ:2OX43X4K9zxs
TLSH
T1B8726BD6CBA84243ED671EB0D2BAEA433C3E67D29521CA1B06D1F64518573C9DF3062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Threading.dll
Size 82KB
SHA256 300b039d8bdb9d0e49cbbc048144dd538f0cc1ef11f1d16bf3082490ae5fcb9f
MD5 140e4a89234ae4af18b85e21945b7f3c
SHA1 c88fe602c04d0f73bb709ad73fab0870dc4da6e4
SHA512 76a57f0dd04b803d7ef7595fb9af737aaf48d23486bb8665b1979c479f1efaf950623a0f2a4602f265133fa7b49956201fafd4847d5628b0319612b24c758c1f
SSDEEP 1536:NUgoICPL0ImrmODZcUBeZ8j0GEH9wdj3jGRm3LGg3X2mzC:NUgo9PLNFtZ8j0GEH9wdjyR4Gg3mmu
TLSH
T1E0836B1A7BE80416FA3B47F9EA729946C472FDD20711C6DF5049900C2E67BC1DAB227B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xaml.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Xaml.dll
Size 1.4MB
SHA256 479bd5e88e1ae39f01ac0c782f4663e29b7d5a6b2f909a6577a53c4fd861a248
MD5 9e86fc975aea41f2d5d7304b88067b37
SHA1 54d890bd64a34e9a6ab7c7cf51b7c1a7f8fb8ed0
SHA512 7065ff3f08e687873176d369d3420efda981241a3a236d92caf9894928d070ebb6ecf8b7838113e3590fc7a38069dbcdbae00c10ccb42df655bf35a80dec5a19
SSDEEP 24576:HUN7QWY7d3p2Zz+I6hMza1IOME36EPQY8dqE+s:HUNvY7d3p8a/FqGQh
TLSH
T1C5655A2BABD88615CB7A83FD86A28511D5B1E1472321C1CF4411DEDD2F877C3AB7226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.ReaderWriter.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\System.Xml.ReaderWriter.dll
Size 21KB
SHA256 31f1b84247ed37e26b75e36de45f4307ae87b98d2187b693f1db2a9f1858574b
MD5 925436b648c3fa7e8b987f12f731387a
SHA1 a0b779fd5aac08fc7f0eb7f1b15b5362a926bac0
SHA512 e41907be782dbbb4a7f7279300fa117096e0058aa51d76872ad25b9202bc19504d7440f81a99ed0d0c47bfde0e019dcc62bd7c4481abc0e4a528a44fa5c713d2
SSDEEP 384:G1G5qkxK67ex4FCrxW1KAWrfLXmztvGHRN75nP3U0R9zqrBHRM:c6L4pxjQta5c49zMHRM
TLSH
T10BA2F7A5CD64CE13EDAB7B70D6ABE4C33BF562D130719736D581D50A88A2384AB33718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsBase.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\WindowsBase.dll
Size 2.2MB
SHA256 a9cb4a29adb3f98737bd61a2b3aaaf687e5b54ff7ca3c08dcebecddcd67d5f10
MD5 6e6d625838df1e80d7d806aa5d976e77
SHA1 e2dc039fea4cca9b86eb37f85513273861cd4c75
SHA512 2ba448894a15f4c5bdfeac7135fb72b945d249119b8968c18c38183aa5138965ea4808f5e4ad47eff8cf6ddd099de5ec276702e165b0f602b8799c97b2a8abe3
SSDEEP 49152:2SgZ/vZzKTYMebksxP6AjRIOuou82SxVGG2hFGYrB45gka+z:xgwW6A6ou82SxVGG2hFGYCz
TLSH
T114A58D1573C40B16CABA86BC91778101E1B1F8525312D6CFAC49EA3D6FD7FC18B7A262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\clrjit.dll
Size 1.7MB
SHA256 c821a19d7d2dad5d159325e0391bc892f2823077b07064b609f65bdca04f6cfa
MD5 08da92a9f51fbf5afc3b46ed4149b1bf
SHA1 7fe86936a3694467931dd0da8ff5a5a714515fa0
SHA512 0d213d11efb4a4c12675e41a88931b55452eab645284b88cc4ac72007e3818d712d167cd843090502ca544d34801ca6dcaf6ae8e47d248dd18454e47ae159d01
SSDEEP 49152:ahipnyKU/I8KzO9jnpQZNsbL/xYfZToWe230FYtIgKGWcVdO:3pywzOEZNeJYRob230FYtILGo
TLSH
T15185AE46A2FC04FCD0AF9534C6174A1BEBB2B85A13209FDF42F40695AF237E25A1E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\coreclr.dll
Size 4.8MB
SHA256 80d907d1b8e139a8e0f6cc28ee3b6850aaecae16972bf073c18039131a5df8e3
MD5 6295673ab182df55c3ff322a1ec43475
SHA1 0a17e39131dbda3b59040b1de113b016de752a04
SHA512 83269d1815478f5b85e64c2786f53428eb76a5ae460eb3d0bec4a3a04a7eac991c99f9eab7029213188274c82fd2b0c2190a43e7e5bfffb77ca1096774a8b0ea
SSDEEP 49152:X6dOba/xD/dVnrcsaBbVwbXfWp8poH6PlcjEl/ygFVpXTHcmENneFoRNQRVCRXle:9UrfrbaBbVwbXfWplHvEVfFx6gkJ0ZP
TLSH
T1B1368D16F2BE009CD47AC0B9CAD70527FBB178591738DBEB06644A651F23BE16A3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\hostfxr.dll
Size 354KB
SHA256 b9086f3171ab5ed1962ab9cd01ded7a1e98b852266e9e95bcd3b9a961a93c13c
MD5 433599c13bd48c25202c098b961a2e72
SHA1 459873d9ab4ff2b12274b36f473d9ec54c607967
SHA512 5a707cea4a812572d106c2cd7b80b5934f6137282fa389d4e741377782482756fc3a54245c823d730ea6177bf69554313d846292b8d44bc6327839f759f60b5a
SSDEEP 6144:p+XLH+WSnj1NTCEmcvTIngX1WbxXGup+gQQ:gbupxhmcvOtzPZ
TLSH
T1AD742916E6FC017CF1BBA6788A668901E7767C8A4B70D6CF139048661F73BD08E79711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\RoMacro\current\hostpolicy.dll
Size 395KB
SHA256 0254523cc6d87e07a29100fcdf94185660786b5d5dd4cc89a3ea96175dabf0aa
MD5 16b6329ea6529cd9b8ad3925f4ec2601
SHA1 a802d7ab8ef3e2d75d2937586f2111d8e20a16c7
SHA512 7acde314fe343ef3cb17e66cc4b43393dc1ee6f1ec5d5e49aefdc7dde6266b5f41070e0cf6f74c3a328c35b363b40f28e0118c34f402a32c0a22e42e80e80406
SSDEEP 6144:5w51fKrG6mvNL5rOdN0RjIlewbrBz/1EfZUyy1gA:mzfKrG6kLxq6Rj2rVR7gA
TLSH
T1A8842916E6EC00BCE1BBE2788A778901E776784E477096CF135099662F73BD09E7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download