5e33d1bc76338bcec8cd570739af5b6cb37aaefa5bcad6537301d47580e70189

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
Size 139.8MB
Sample260712-tardcaev8x
SHA256 5e33d1bc76338bcec8cd570739af5b6cb37aaefa5bcad6537301d47580e70189
MD5 e73be71f2ace8639ef817a1dca0e111d
SHA1 dad370bd847c1fbb0a3a7ea2322eccceb5f9f9c0
SHA512 304ce27dbb7ccfc2f05d742819b4e656ffff63e8bc1dc9dfd164a5594a5f483adcd96ebba2044b33c998b35fcf92159e00fa6b33b38d713c3465c6cc2385e26b
SSDEEP 786432:PBdSr/5RVvsZXCZMeQ6mtYptgPV1OINWtzUiV6xdUKit4XFe2vuxTLd3:PBdSL5jsZXoQzNWtzUiVynXFelTLd3
TLSH
T177689D0177F6A563D167917946AFA002BB31B0032734DAC7366C8364AF53FE46EBAB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1796	powershell.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
4608	taskkill.exe
3680	taskkill.exe
4848	taskkill.exe
4172	taskkill.exe
3864	taskkill.exe
2252	taskkill.exe
904	taskkill.exe
1716	taskkill.exe
4744	taskkill.exe
4796	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1796	powershell.exe
1796	powershell.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
Token: SeDebugPrivilege	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2356	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	91
PID 2356 wrote to memory of 1796	2356	cmd.exe	92
PID 1796 wrote to memory of 992	1796	powershell.exe	95
PID 992 wrote to memory of 5008	992	csc.exe	96
PID 2852 wrote to memory of 3868	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	97
PID 3868 wrote to memory of 2080	3868	cmd.exe	99
PID 2080 wrote to memory of 3856	2080	net.exe	100
PID 2852 wrote to memory of 4316	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	101
PID 2852 wrote to memory of 1084	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	102
PID 2852 wrote to memory of 1732	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	103
PID 2852 wrote to memory of 3840	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	104
PID 2852 wrote to memory of 2868	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	105
PID 2852 wrote to memory of 5080	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	106
PID 3840 wrote to memory of 2252	3840	cmd.exe	107
PID 4316 wrote to memory of 904	4316	cmd.exe	108
PID 2868 wrote to memory of 4608	2868	cmd.exe	109
PID 1084 wrote to memory of 3680	1084	cmd.exe	110
PID 1732 wrote to memory of 1716	1732	cmd.exe	111
PID 5080 wrote to memory of 4848	5080	cmd.exe	112
PID 2852 wrote to memory of 4372	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	114
PID 2852 wrote to memory of 3248	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	115
PID 2852 wrote to memory of 1636	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	116
PID 2852 wrote to memory of 4220	2852	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	117
PID 3248 wrote to memory of 4172	3248	cmd.exe	118
PID 4220 wrote to memory of 4744	4220	cmd.exe	119
PID 1636 wrote to memory of 3864	1636	cmd.exe	120
PID 4372 wrote to memory of 4796	4372	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lluq4nde\lluq4nde.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA54.tmp" "c:\Users\Admin\AppData\Local\Temp\lluq4nde\CSCF4660387AA68400B915197143E3B19.TMP"
        5⤵
        
        PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESAA54.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAA54.tmp
Size 1KB
SHA256 a2372cba2266f46ff6e75482c3d60d96516d37ba193bb7de3a7885d7a2740508
MD5 7aecd96171a8a9525ae4b8b6486aee9b
SHA1 700a6326fcb7dcea05f75b47b9b336385e6ff645
SHA512 976238f5e135f1b1d97146fce49ec1e95cd98d978eced2ea43c91e9b6d11f188acc207897a5936a944612ae56d26c64ef9c4c67669509af232dec8b4fb4d84d2
TLSH
T1AB21CC0553E84B1BF07347317DFA132BA274FEA5DFA2535B844042281C41208DEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hama3gyy.ru0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hama3gyy.ru0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lluq4nde.dll

Path C:\Users\Admin\AppData\Local\Temp\lluq4nde\lluq4nde.dll
Size 3KB
SHA256 513b108115b34aa184b39d403a96a2419227ee079172cbaf5ed1f6c6d17d5b5a
MD5 b1785182152f8b567268193c6b35018c
SHA1 f6ad0283f1a0ebdc0387074e18a3a01badc7d4e4
SHA512 6732b9531e989e84d03f70e28c27f07bc7b17b0c6b3881c46b0330fc7f81130169536ba477c4bb269d44e9ab6b1eaefbebdbba04abab8fa573629ebd07f4309f
TLSH
T14351FD0657E84A6BE4730730AEF3072637B8FC509B73575D58800218ACA43285E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF4660387AA68400B915197143E3B19.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lluq4nde\CSCF4660387AA68400B915197143E3B19.TMP
Size 652B
SHA256 49c014cacf7197a1fa932e95bd9a06bd7e1a4aa2b6fed3f8c845d6b73bf58bcd
MD5 cbad7bd8857487f1236d9460b1bf2c6d
SHA1 e5c47b11516664a79a696d13bacb466dbb7f4987
SHA512 ab11e66468ee61e580d1eafc600afee8cd9ed96215906fb516871e0b4bb7d55084f2e121b84073b0abcdc22f02fcaa6c09827a3e39845416e29fe02db37fa019
TLSH
T1D1F05E0963F8430EF0F34B30BDF643A391A9BC66DE7293ED148003592C646148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lluq4nde.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lluq4nde\lluq4nde.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

lluq4nde.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lluq4nde\lluq4nde.cmdline
Size 369B
SHA256 dfc4fbe9bef7d67436f1697f4c83347d6f9d17086ca4e44574d33442e8f5257e
MD5 ab67cef7fba9d8c5f2ca6d0163bfbee0
SHA1 4d90d84800dc34f06258619de01c27ac1288f778
SHA512 1f45201ffa95fc6bf3aa86186f6c491918e47f95b84060faf4fcd5d38b3b14eec529de8adceea6c3e8ad9246810d02f0ddaa5aecc0922f25ce1cdb823cc8351f
TLSH
T106E0682B4A4EC27F01E910072369C4FC8B7246436A40BF8CB150440DD09F80227D37D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1796-779-0x000002B357DB0000-0x000002B357DD2000-memory.dmp

Download

memory/1796-787-0x000002B358E90000-0x000002B359052000-memory.dmp

Download

memory/1796-788-0x000002B359590000-0x000002B359AB8000-memory.dmp

Download

memory/1796-778-0x000002B357EB0000-0x000002B357EC0000-memory.dmp

Download

memory/1796-801-0x000002B358AA0000-0x000002B358AA8000-memory.dmp

Download