sheetrat | 701829635e439b4209d8974a8ca02b5dfce503d1fc31a537ff1fe8b996e58d50

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 53.9MB
Sample260721-2fs35avepc
SHA256 701829635e439b4209d8974a8ca02b5dfce503d1fc31a537ff1fe8b996e58d50
MD5 229a70e06858456c54afeb25f036a346
SHA1 6974d0377c059ae67f38aca7a564723a3c0b3c78
SHA512 25f29aa8d0857e9aba191458d16e061a3de6f81c4e7500d996a7156bc48681ebfd7583c313dbd736fee97056845ad0c827c213c88734c3673d1d92e8c2a31276
SSDEEP 1572864:j2f7v8/e/W8dVkcz1sDQirbGVHy1Ak08m81KxadPhXj:j2Tke9t1sDQirqUKkiG
TLSH
T16BC733AA511A0C8BF43685BE9541EA38D7427FC12F6A838B11F51D0BFD6778B0C396B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default credential_access defense_evasion discovery execution sheetrat persistence privilege_escalation pyinstaller spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Default

144.31.159.199:1616

Mutex

Sheet_dczmbxujdeorsi

Attributes

ddr
IPMODE
hidden_file
true
install
true
install_watch_dog
false
path_client
%ProgramFiles%\xdwdiTunes.exe
path_watch_dog
%MyDocuments%\xdwdVLC Media Player Update.exe
pump
true
rootkit
false
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x00070000000243de-43.dat	family_sheetrat_v1
behavioral1/memory/4972-44-0x00000000003B0000-0x00000000003FE000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\xdwdiTunes.exe"	input.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1256	powershell.exe
4800	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
4972	input.exe
4000	Cryptor.dll
4496	Cryptor.dll
2280	1.exe
3284	stealer.exe
4152	stealer.exe
2548	sletikpcfccn.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe

Loads dropped DLL 58 IoCs

pid	Process
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4496	Cryptor.dll
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
17	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1828	powercfg.exe
1268	powercfg.exe
4212	powercfg.exe
4316	powercfg.exe
4788	powercfg.exe
4324	powercfg.exe
1040	powercfg.exe
1864	powercfg.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	sletikpcfccn.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\MRT.exe	1.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 4024	2280	1.exe	129
PID 2548 set thread context of 2064	2548	sletikpcfccn.exe	161
PID 2548 set thread context of 1408	2548	sletikpcfccn.exe	166
PID 2548 set thread context of 1104	2548	sletikpcfccn.exe	167

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\xdwdiTunes.exe	input.exe
File opened for modification	C:\Program Files\xdwdiTunes.exe	input.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4168	sc.exe
2416	sc.exe
472	sc.exe
2696	sc.exe
3216	sc.exe
3896	sc.exe
3400	sc.exe
1960	sc.exe
4540	sc.exe
3216	sc.exe
3952	sc.exe
3708	sc.exe
4828	sc.exe
2960	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00070000000243e0-47.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4812	cmd.exe
1356	CMD.exe
1556	cmd.exe
3904	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1556	cmd.exe
1104	netsh.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,944 15,943 6,1329 15,1329 100,1329 6,943 10,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02hqtopusfgelphs\AppIdList	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02cldmscayyggsuq	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02oivxjekjgraymq	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02mzhambvfmrtcik\Provision Tuesday, July 21, 2026 22:33:02 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzOKhFb5twUewYxAtHCm0gwAAAAACAAAAAAAQZgAAAAEAACAAAACKdEXbHAWulQK1yeOwD88mu4hVOKrnGC606WOzqTcgGwAAAAAOgAAAAAIAACAAAACOvHGnazp+v2FtMerBWavPYcqjydAOcSwAAoCmxs2t/yAAAABGKcPyBFGLLc3WOJWR0dOMPFagh31PQkl/wy6TTwdf9kAAAAAi80IoE4Wk3WjVKP+Z8Qsh4+TcUvKHCnTpqPsfRRHfwaY1/QRFzOB6ZvEx7IL3D+mDFpGFVJc97y7anQNMDkaL"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1784673229"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 21 Jul 2026 19:36:11 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02mzhambvfmrtcik	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02lifkmanenhlste	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02cldmscayyggsuq\Provision Tuesday, July 21, 2026 22:33:02 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzOKhFb5twUewYxAtHCm0gwAAAAACAAAAAAAQZgAAAAEAACAAAAChMk+psQOSiqaldhuV2D4paXly7CCKQYcXR6miqwmmMwAAAAAOgAAAAAIAACAAAABLCj6onzkIvzgFwVxDCHV/z1UONxsL+R0x06UjTZM+fiAAAAD8ZYGxEcL2KOxDiwcZSwbDLxa2B85v5l4HIx8tX6VaCEAAAADrFIzagDKlbT2HSYhzZSsQ2sC3hqMtlW7j4HcYkcfDWBPVJt7s5No0Cyfzv1VtDJwDA0N449OSP/vE1tm/oDwQ"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02oivxjekjgraymq\Provision Tuesday, July 21, 2026 22:33:02 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzOKhFb5twUewYxAtHCm0gwAAAAACAAAAAAAQZgAAAAEAACAAAAB6ULUYKluR/rhRl4xrni9Supfk+bPDPu/RUHl1sc5/2AAAAAAOgAAAAAIAACAAAAAn7eMrlQB91c9fRkuO0ady90sMkNskNv8+nL7K6a9GCiAAAABA8Kdxk6ANkGNQlcH8LYKkvMaBH3S9Kzy/2qvP6ch8TEAAAAAPnfjb3n+l/vnYk8/VBjjWuVwtQjBfv6Yxb6S8pAdemouwuE3bWNwxBSOIkClBePjDnK856ca0PEkhWcSbVXks"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
4152	stealer.exe
2280	1.exe
4800	powershell.exe
4800	powershell.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
2280	1.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
2280	1.exe
4024	dialer.exe
4024	dialer.exe
2280	1.exe
2280	1.exe
2548	sletikpcfccn.exe
4024	dialer.exe
4024	dialer.exe
1256	powershell.exe
4024	dialer.exe
4024	dialer.exe
1256	powershell.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
1256	powershell.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
1256	powershell.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe
4024	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	input.exe
Token: SeDebugPrivilege	4152	stealer.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	2280	1.exe
Token: SeDebugPrivilege	4024	dialer.exe
Token: SeShutdownPrivilege	1040	powercfg.exe
Token: SeCreatePagefilePrivilege	1040	powercfg.exe
Token: SeShutdownPrivilege	1864	powercfg.exe
Token: SeCreatePagefilePrivilege	1864	powercfg.exe
Token: SeShutdownPrivilege	1268	powercfg.exe
Token: SeCreatePagefilePrivilege	1268	powercfg.exe
Token: SeShutdownPrivilege	1828	powercfg.exe
Token: SeCreatePagefilePrivilege	1828	powercfg.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	2548	sletikpcfccn.exe
Token: SeDebugPrivilege	2064	dialer.exe
Token: SeShutdownPrivilege	4316	powercfg.exe
Token: SeCreatePagefilePrivilege	4316	powercfg.exe
Token: SeShutdownPrivilege	4212	powercfg.exe
Token: SeCreatePagefilePrivilege	4212	powercfg.exe
Token: SeShutdownPrivilege	4788	powercfg.exe
Token: SeCreatePagefilePrivilege	4788	powercfg.exe
Token: SeShutdownPrivilege	4324	powercfg.exe
Token: SeCreatePagefilePrivilege	4324	powercfg.exe
Token: SeLockMemoryPrivilege	1104	dialer.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4732	OpenWith.exe
3836	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 724	2076	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	86
PID 724 wrote to memory of 2004	724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	87
PID 724 wrote to memory of 4972	724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 724 wrote to memory of 4000	724	2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 4000 wrote to memory of 4496	4000	Cryptor.dll	93
PID 4496 wrote to memory of 1268	4496	Cryptor.dll	94
PID 4496 wrote to memory of 2280	4496	Cryptor.dll	96
PID 4972 wrote to memory of 1356	4972	input.exe	97
PID 1356 wrote to memory of 4364	1356	CMD.exe	99
PID 4496 wrote to memory of 3284	4496	Cryptor.dll	100
PID 3284 wrote to memory of 4152	3284	stealer.exe	103
PID 4152 wrote to memory of 1556	4152	stealer.exe	105
PID 1556 wrote to memory of 1104	1556	cmd.exe	106
PID 3904 wrote to memory of 1108	3904	cmd.exe	115
PID 2280 wrote to memory of 4024	2280	1.exe	129
PID 2280 wrote to memory of 4024	2280	1.exe	129
PID 2280 wrote to memory of 4024	2280	1.exe	129
PID 2280 wrote to memory of 4024	2280	1.exe	129
PID 2280 wrote to memory of 4024	2280	1.exe	129
PID 4024 wrote to memory of 620	4024	dialer.exe	5
PID 4024 wrote to memory of 680	4024	dialer.exe	7
PID 4024 wrote to memory of 884	4024	dialer.exe	11
PID 4024 wrote to memory of 1016	4024	dialer.exe	13
PID 4024 wrote to memory of 516	4024	dialer.exe	14
PID 4024 wrote to memory of 1012	4024	dialer.exe	15
PID 4024 wrote to memory of 1064	4024	dialer.exe	16
PID 4024 wrote to memory of 1124	4024	dialer.exe	17
PID 4024 wrote to memory of 1136	4024	dialer.exe	18
PID 4024 wrote to memory of 1220	4024	dialer.exe	20
PID 4024 wrote to memory of 1240	4024	dialer.exe	21
PID 4024 wrote to memory of 1288	4024	dialer.exe	22
PID 4024 wrote to memory of 1340	4024	dialer.exe	23
PID 4024 wrote to memory of 1384	4024	dialer.exe	24
PID 4024 wrote to memory of 1464	4024	dialer.exe	25
PID 4024 wrote to memory of 1516	4024	dialer.exe	26
PID 4024 wrote to memory of 1544	4024	dialer.exe	27
PID 4024 wrote to memory of 1684	4024	dialer.exe	28
PID 4024 wrote to memory of 1708	4024	dialer.exe	29
PID 4024 wrote to memory of 1840	4024	dialer.exe	30
PID 4024 wrote to memory of 1848	4024	dialer.exe	31
PID 4024 wrote to memory of 1920	4024	dialer.exe	32
PID 4024 wrote to memory of 1940	4024	dialer.exe	33
PID 4024 wrote to memory of 2012	4024	dialer.exe	34
PID 4024 wrote to memory of 2096	4024	dialer.exe	35
PID 4024 wrote to memory of 2104	4024	dialer.exe	36
PID 4024 wrote to memory of 2140	4024	dialer.exe	37
PID 4024 wrote to memory of 2152	4024	dialer.exe	38
PID 4024 wrote to memory of 2244	4024	dialer.exe	39
PID 4024 wrote to memory of 2292	4024	dialer.exe	40
PID 4024 wrote to memory of 2376	4024	dialer.exe	42
PID 4024 wrote to memory of 2524	4024	dialer.exe	43
PID 4024 wrote to memory of 2656	4024	dialer.exe	44
PID 4024 wrote to memory of 2668	4024	dialer.exe	45
PID 4024 wrote to memory of 2684	4024	dialer.exe	46
PID 4024 wrote to memory of 2740	4024	dialer.exe	47
PID 4024 wrote to memory of 2788	4024	dialer.exe	48
PID 4024 wrote to memory of 2800	4024	dialer.exe	49
PID 4024 wrote to memory of 2680	4024	dialer.exe	51
PID 4024 wrote to memory of 2768	4024	dialer.exe	52
PID 4024 wrote to memory of 2784	4024	dialer.exe	53
PID 4024 wrote to memory of 560	4024	dialer.exe	54
PID 4024 wrote to memory of 3196	4024	dialer.exe	55
PID 4024 wrote to memory of 3304	4024	dialer.exe	56
PID 4024 wrote to memory of 3428	4024	dialer.exe	57

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:516

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b9cb8146-c166-41c8-a0ad-766a1c71c450 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7c3b586a-a489-4f85-ba98-2d98ad6adb49 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8e10394e-e3e1-4977-9c1e-212e5da2e532 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f8f7578f-4a84-4dcf-b4ba-44bc7ea12715 -LifetimeId:10612e32-84af-4db3-89c5-a4fef59a0e4e -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1220
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1544
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2244

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3196

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\SYSTEM32\calc.exe
      calc.exe
      4⤵
      Modifies registry class
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\tmp_nqczz68\input.exe
      C:\Users\Admin\AppData\Local\Temp\tmp_nqczz68\input.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Paint" /tr "C:\Program Files\xdwdiTunes.exe" & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1356
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Paint" /tr "C:\Program Files\xdwdiTunes.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\tmpbmznj2_v\Cryptor.dll
      C:\Users\Admin\AppData\Local\Temp\tmpbmznj2_v\Cryptor.dll
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\tmpbmznj2_v\Cryptor.dll
        
        C:\Users\Admin\AppData\Local\Temp\tmpbmznj2_v\Cryptor.dll
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Windows\SYSTEM32\calc.exe
        
        calc.exe
        6⤵
        Modifies registry class
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\tmpp5g683le\1.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpp5g683le\1.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:1108
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:2416
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:1960
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:4540
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:3216
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:472
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4756
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4148
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2432
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "NUXCTTKD"
        7⤵
        Launches sc.exe
        
        PID:3952
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:876
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "NUXCTTKD" binpath= "C:\ProgramData\yjwwbpjfgyjw\sletikpcfccn.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:3708
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1212
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:2696
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "NUXCTTKD"
        7⤵
        Launches sc.exe
        
        PID:4828
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\tmpuhg4jnb8\stealer.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpuhg4jnb8\stealer.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\tmpuhg4jnb8\stealer.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpuhg4jnb8\stealer.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        8⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        9⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3620

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1716

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3260

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4256

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:3488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3836

C:\ProgramData\yjwwbpjfgyjw\sletikpcfccn.exe
C:\ProgramData\yjwwbpjfgyjw\sletikpcfccn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  PID:4812
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4052
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4168
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3216
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3896
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1956
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3400
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3808
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3108
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3972
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4740
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1408
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_decimal.pyd
Size 283KB
SHA256 8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706
MD5 4bebc4da7d6319283a8c664bfc55408e
SHA1 4dc69a8105272711673afa5f712af982a18532e1
SHA512 411cd0ee4189654e836579efb4df509a02cba39cd9793e6d7250aa4e239449dafb6936ac57cb8ee7bd97cf2fb178beea17f658bf6ae7149ed8ed927a7c47bdf3
SSDEEP 6144:ASM9SUWXvOOiSx1u8llV6zeGqqM43fIWeA9O8O8OOT6MPgz/:ASM9SUWfQSx1ucapLIz/
TLSH
T1D5547C52A3490CA4EF7384388A479A57F7B2B8414360D78F47A48A972F933E3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_hashlib.pyd
Size 67KB
SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
MD5 dcf15b3e1858d9324be2c719e4e990c9
SHA1 8311c2fb0bb75342367a83fcca7161a0f7fadafb
SHA512 fa2783d0cbbba477a08bf4f2fa3df21d6d0bf5bd5bc7cef25254a3d29fc7d01229337ad5dd54c2f0e67b956fd43953aa98586240102511ddd48d04c674b7ff93
SSDEEP 1536:KXwAzOYBQca7JKs2+C5oIGDIUy1Ni97BfIkxd8:0J/yJKs2+IoIGDIm6o8
TLSH
T1EF635B8AA6984092DA2382B5C9E34F43F974F252271197DF6678C18E2F233C3573B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_socket.pyd
Size 85KB
SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
MD5 7a16a21ad11d3e9829ca3b379a2bb010
SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
TLSH
T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_ssl.pyd
Size 186KB
SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
MD5 e4ba5a52f5fa2a64baec46486cbdcf82
SHA1 ff213b504a70d50871eb8432cea1b22563364cb4
SHA512 111c926a0157d46c48a26da30face546b065eb4afddb6dcf27442fd4f73432808de43978f78f5b297b22a63d82d0d5bf305701e137f6060f59cbd601012e61fa
SSDEEP 3072:FVpZeIk2MZ7IifVvQto7qrvYLrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrQII:Bxk2MZZVvQtmL4457qTVMrQ
TLSH
T1AD147B47B5446EF7D802E8BAC6234543FBB4F045331297DE48D6EA520F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\base_library.zip
Size 1.3MB
SHA256 c470e956a8d9f4a71d4378ab983ae8d77e24ef8acbf579b1e2392340b2dda64f
MD5 08ab2378ac6eceb04b9d61a60a9d68a9
SHA1 0951b69456e3649ab5c21fc8d4f5e6d76074da63
SHA512 d1b024bd085c38a2f46eab411ac93ecc71db6106c12cbf3aac873a8657a5264fb943ea3dd93d53007ba056c341e6983e0ed510cc422caa9b559fee5b8ea26ffd
SSDEEP 24576:vhuUF4BQZsjdqLuYGQeOdP2m2dfymlbeRpvM:5uUF8xdVYG/wRq
TLSH
T1A8552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\select.pyd
Size 32KB
SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
MD5 43a869da7432298fce80f8c163ad8e7f
SHA1 65d259ba8350561668706a563ee0800c1748c173
SHA512 26c57d276b82fcb9c4f971a8e74847e14dc1a3b942a62f442740d6244ee8f23ba29c9e56b5001c2734db3fd1ac52a6bda02926f47d12cf727e38703971fa9d55
SSDEEP 768:TB7YLZnCaqF8IGRGCy1KPuBL2Ip4pTxf1ml9dHu7L3:TB7C5CaqF8IGRGCy1Ni9bfIbHun3
TLSH
T17FE28CCAAB345047EA63C671C6A2CE83FA39F7E35611469F31B5918A1E237C1A337354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\unicodedata.pyd
Size 741KB
SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
MD5 4df357dfce07299b9e6759583f41ca68
SHA1 d5810b7f7d05ac3a37592566ee898f428919cb53
SHA512 f741882d4444a4be4342f89932b2510c57fd943cf782079551c202c419805a90a06203464cdf1a209a8da3e56677426dc9af388b2077a5746b3daf0f2da1f69f
SSDEEP 12288:jIwYBAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtyqt:jIwYS5ZmDPqO54lDJPTMyqt
TLSH
T11EF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
Size 213KB
SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
MD5 d6b2c2d2851a63b90e7210a943d0fdf6
SHA1 642bfeae924b9d4e6ed642b5946ac8e745cfc531
SHA512 64b43766740e11a9e5cb370f9ca26f80c5a379015e1804128e0b4f206c5e481cc14bce541c9caf99482eb334599c6aba34c22006fa6992dfe1fe842efdec132c
SSDEEP 6144:sjTLQQOvUVTTPDlxkP8VXaVHaT8fyFmiGJZMzEKAqsCbb:sjTLTPGgn
TLSH
T14124193A52580061DD7352758C63A423E5F2B262073256CF09E0C7756F27BE9B7BEB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_asyncio.pyd
Size 70KB
SHA256 adaaf0c703641f6dbed30d101a5e23c17cc9454c36303394b9e28a52ea457471
MD5 0693819137d5c98bfae7f06b0d76a8f9
SHA1 d9d92845f0f41a600e3967a1fd05ca69f2147a34
SHA512 ab08c8fc551d96c5f5cfa81b72f2ef8256c852c676cfb2c60a93f06dbfd07577679ddd0cc3356092ac91412e6442572f8af92cc467c4cde0475c4cbb918ae4d2
SSDEEP 1536:wCY0h2ZouTTuqsHQH79Iyvnuyrcz895fIiJ:wCD2rnuqsHG79IyvnKRy
TLSH
T1D3638E87A2A44247DA97B274C5736F56FBB0F6521902534F61E8C28E2F13791C3FE622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
MD5 f2eff52a9b6ed2534f84cc7b77379649
SHA1 05947063d4912dfc288ea1fb2a768b9d23c60dfd
SHA512 2ab45ab98af90433ca6c122136c9ef7b7cd9eafea306aae1b412fbb7df8e86407858bb9da5124ac5ff8a80a9f9f3aa8839a2c871952469bf3abe9965175fb504
SSDEEP 3072:DsI2F3Ar92NZtfmzsYDZhXkQ1ISuigE2QvHNjOhKQchdqS7xxSTL7KNCtRnh+HRS:Ds5tfmo231ISuig9QvHw8hsgxSTLOcda
TLSH
T1EF044B5B329C10B6D5A2517886675B53E3B3B471130197CF01A0C7B92F1BBE67A7FA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_decimal.pyd
Size 273KB
SHA256 90045140e45edcfe4f4859b3190184faff1249220011330a9d01319745766607
MD5 90071379b9e53b2d1834d49f4fd804ec
SHA1 c4cde25cff9cbf90c55bf908bdaa8a14a82311ad
SHA512 a67feade76fda58faa8a9842f6a07d8b12eb477c5baaf51f323de90fdcc8c5f62f2a756f30e1ea494b95eaaededbbe95f2aaf6659175e6e141057af0aac6f514
SSDEEP 6144:nkzuKqPj7/lk9VLCLko0Xoy9qWM53pLW1AyH3V+METaei6g:nxLlk9VmLko0Y7ePXV
TLSH
T127546C97A2090CA4EA738474D95B9B47F7F278960321C78F43A48AA73F93393636D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_hashlib.pyd
Size 68KB
SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
MD5 9ec1021fa8a3c252e1f805ac7f172753
SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
TLSH
T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_multiprocessing.pyd
Size 36KB
SHA256 7b21c5b0ebee82b0d85724f245857d65e23f82c6aaf392efcd4f800462025d92
MD5 25fc0102fdb08c54e6bd72c0b11b1a4c
SHA1 2dc0d9a3bbcfef184699c147ac2cfa2fcb40a7b8
SHA512 89640ff838030ca75309184bcf1ad58a8ad3a917564a4185675bc7494630bbfc5b821dfab53081b5a786553aae89958b057c369b4d56af12ccb0fcea983e3d03
SSDEEP 768:L+hu80ZnR2VcZ7Dz2dtIyntAXyrcEOJh2Ip4i6Cxf1mlY6Ce:Khu80Yu7Dz2dtIyntSyrcz89WfIie
TLSH
T122F28D4AA6684053E963A671C5A3DF8AF538F7831B21864F7195D2CD1E33381A36E34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_overlapped.pyd
Size 56KB
SHA256 fae5e0e822434da7b1707b9ae4c77b8fa7d1d7b810e7e2f5cacf04449c714086
MD5 4a721637bc0c8b53d13485f5030da7b5
SHA1 7424dde1d136649e68b1f13cd0e738a1d428393a
SHA512 fff4270fd6d759d31ae6784510208ab4d2eb0b454799d393f4d2155a6dad9c8b836233eb3d233002491019bbeba87e9e862c8eee608a51a0f83194a9a5110e13
SSDEEP 1536:dMm7HdS/l5atPzKAdE+DRIyWt9yrcz89WzfIW44zvrdn:ThBzVdEeRIyWtnaW4IDR
TLSH
T1C1437C496B9400DAED63C1B9D5A38E47FB78B3D34601531F61A8D24E1F73392B72E289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_queue.pyd
Size 33KB
SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
MD5 8fc4810cff733e6f17a7530d3fb67d58
SHA1 20163031892c87a67169f4ae25115e4e33845626
SHA512 c45ebdb450f30d034ba113729ada2a006baa2ad8c7a83cc59ee55e6fd10511d6f663b1d7f24fbcd493884a84cbedd1368e3a2136ff7da58fb47394147b021f45
SSDEEP 768:BFJpl1r6rWcgds5Iy9UxLXyrcEOJh2Ip48XlCxf1ml0ZMz7:BDr8Wcgds5Iy9Uxyrcz89ayfIbz7
TLSH
T10AF28ECAAA684047D663C671C1E7EF42F974F7D34A11879F2169828E1F23381F726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_socket.pyd
Size 84KB
SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
MD5 c2938dbdcdaba1ccbefee37f6a06cd0c
SHA1 944cb024144f327ba517ccf72af9bb9a79b8b23e
SHA512 79e9f40665b7049c9feb04742a91c8c88749c1998794f1a51ac7b47a5f5ac3c1a2b441dcb9cd126e395581d9553305c24356b54d81d0a9fbecb41a4341af776f
SSDEEP 1536:axl/h+6SDo3OkB+ecI4xyJwoQlyJ+9+nzpjTOKxtS44O05IyywFyrcz89jfIW44a:axko35X4yJwoQlyJs+nzlqKxBw5IyywZ
TLSH
T154836B10A69041FAEB63D1B5C2639E63FBB4B5C11391A35F0066C55A1F333C2BF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_sqlite3.pyd
Size 127KB
SHA256 443b801d2a372b67155044a928be68af0a677d1302655e5599131180ddd87659
MD5 540980b7e2a93b434819c736aca01c68
SHA1 f2d19b38b466a5c03fdc329ad064b23d8fc4cb18
SHA512 3a3adc84efaeaecfd77aa78adbb9d8067c69b318d4aa219beebb0c502aa477dcb721f11d6090b314e75e8cb6941edadbaf644a5bb8a41d400b9294eb95477144
SSDEEP 3072:bqwsUCFtHjXBy3tnjYC5ac5yVS8tueooe9IyvQrsN:bT6HjRy5Dv5f0ueooez
TLSH
T10AD35B2B631400A6F9E79278C1734603EB75F962576143DF41E0C6892F377C2AE7AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_ssl.pyd
Size 177KB
SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
MD5 893ee1e905ec5a1f74b10d73a8b94e6a
SHA1 23d6eb756eb48c1632b02a24f53aacf71bdfa409
SHA512 237c9b37f4b44ae37726f3fef750f6eda65b9d8a540f386c5a43e1bcef400dfed0f9f37f2dc4042fe0c4fec0ed9aeb700797396bae2e5f052525851760288b61
SSDEEP 3072:/TzN6X1nguzjfD6C3xPsMn6osf87vOifHZHmzislIyL7rXH:/TzgX5gID6C3mMn+2s/
TLSH
T12B047C47B5842AF7D813E4B9C2234903EBB1F155331257DE48D6EA490F03746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\_wmi.pyd
Size 39KB
SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
MD5 609206d81f38626f1c022d1a0ff1466b
SHA1 cef724eceae7995d425c169912e292ac43572ed7
SHA512 e973f30ee976b580913f3a5c2d762364897054f958fb26236eeccd17832cce0bfa1bc04c0981d221c0536f5c9b1d21551ec12a873cbae64fc6b50634dc9d0166
SSDEEP 768:ZEpKg2a5YDQy1ZuNccibJlIyLiMXyrcEOJh2Ip47YCxf1mlPrY0Bb:ZEkg2KY3UNccitlIyLiWyrcz891fITYW
TLSH
T16C038D89E7644052E663DB75C9A2DE43F875B7D35B11938F326482980F233C1E73A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\base_library.zip
Size 1.3MB
SHA256 4908e7fa6ef45ce467f71b155c0fd8fd60c1666e7c8e90f624182cd0b0718ea3
MD5 85aee0f8c89313a203a2abc85867f12f
SHA1 9b77cdd3b5969c9ab094b8daef941c353569f242
SHA512 38ab187d4502a67ade37809aa0d8a80fe9c38701f1e4f94d6e9df849a19a293f8f6ff93ee4c2a68dbec6b43e16cbc36bd120b5a0fdb21086e4473c415dc5c4a7
SSDEEP 12288:DtYzGNcT1pGkW7WpHfqhTswtyuOBa80201jwCVRDVoioSYBZRn6Ni6djdTtKi2cK:eSeT1W7Wp/qi5zAdZ45cPPdxhYLs8
TLSH
T11D550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\pyexpat.pyd
Size 199KB
SHA256 567f19a92479e66b652ffaadbddba26b7c5dda43d5e97c67a4a76a076021b736
MD5 feb79984518146b9703d3913d54f2106
SHA1 6a4eb8d7e593f008308f05bf26f7caf7d76a1716
SHA512 4b5a67c38aa149cde71ccc1171cd55af8a12a66d514f63fb543005d9ee8f19226f839d28782187a0e46e0f205e3307e4e0739e1b2bd64c0e99e0af794c1836e8
SSDEEP 6144:xS4jcle1bq6XFdTW4yxB+LjrKHP1XcPump:Fclaq6wT1Xaump
TLSH
T143145C4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\python3.DLL
Size 70KB
SHA256 85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b
MD5 c947a886e61ad18d052840e095aaa5fc
SHA1 4a2d0092e50757e0b951565c02dd541ab48da96e
SHA512 d4b3d769fa4c22e914e12ac8b63263bacda72b351bea5bd53ba1d0fd6a6c57c98fc392645170f26e7c84fdf855fbe587615f4f3b1f150285420f5b26bda2da0a
SSDEEP 1536:LotssyKcunV8PT5Iyy00yrcz89YfIZRSjB:MtssyKQ5Iyy0AcZoB
TLSH
T120634CC25B5BF8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\select.pyd
Size 32KB
SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
MD5 e5728d041bfb1841fc460db4027a2952
SHA1 71e6aaa90e905a72ac83450796af4fb2bb3503d7
SHA512 a53efe3872b035445b7d66a71dffb690cfd00ff6296af25d0dbdfe92c904a8d06442c91e9638b2d5e54420f6998220d65f39b35ef3c1a87e812e9deea1967ab9
SSDEEP 768:hCOFHfRme5Iy9GKXyrcEOJh2Ip4SBITxf1mlDeI6QKF:hCOF/Rme5Iy9GEyrcz89+0fIUQ+
TLSH
T191E27D8AAB245047F9A2C97185B6DF43F939B7A34B11829F30A5D2990F137C1F73A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\sqlite3.dll
Size 1.5MB
SHA256 8f3adef8fc3f3870ec29c927d7e418a176326eb234d6589d67518cef389cb28f
MD5 8d5b3e4d55c16910619125e497272d65
SHA1 80e78e1d734c0860e24c85af5c73308a12ac9571
SHA512 6f276b430f02b9e1b74e7bca5b5d0db54be136242b926fc4a3ee557f00da122d50dfaa5d801733ca917b4e84511b2bc922e027515578b05d61b29afc1546d01c
SSDEEP 24576:p5NomuyEciwLghc4NFU68guPx/ns2h6RNbc4eOL88TG04MIXTbjPsWg:oJjNx8guPx/s5R2s88TfUbjc
TLSH
T136759C4BF2B801ADD0A7C1B9C51B170BEBB174051B74A7DB5194CA692F23FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40002\unicodedata.pyd
Size 695KB
SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
MD5 0a3be15d03e1c55c4df0c7e4fa4005bd
SHA1 a8b30adb77dccd9b7bdc1ec3b1800127e586e3f6
SHA512 2a408d178dd0261dfeccfb791fe05a40caedc64b7ad6cd543fafd31d1e676721240020ad43f26cd8adf94a8c3e68522fc96ebb0f987fe0ba15b9287aac1242b2
SSDEEP 12288:aYgdLI/X77mvfldCKGihH32W3cnPSqrUgu+f:aYgW7qNxr3cnPXu+f
TLSH
T11FE4F6D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jmlplit2.q4x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jmlplit2.q4x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

input.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp_nqczz68\input.exe
Size 293KB
SHA256 2921e334d9cd82743ee8f123d6b30dd4f9983d733ba53bd7806df0cb84f964cc
MD5 5317ea8d004845882397c98e5878bad2
SHA1 89d4fda4ef0884afaa45f705180c985dee2e2fd4
SHA512 a9c846451c644f91cd06954faccd20532d7aba0f183070f7d76325a1ed2d6652acbc3f6669fc2534c37c70d9c1d01532e52edd480166607fbd6c11f9ece18561
SSDEEP 768:SnyLoD5SDW+mEq5PGL+aNQWuQAG9bOplXFee4Z/rLtdw+8FjyEvTZxCFvsozwhMc:iyU9NrwQWJv9bOHXkxz/8Fuexyvs0dK
TLSH
T1AC548623224A8D46E13463FC4111E3BDCA236FC9B87683125AF57C67F5D5B831E2A6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptor.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpbmznj2_v\Cryptor.dll
Size 43.8MB
SHA256 0fb10f361287df0571b89ab59d58efb3dd73fdf70d451e71e351cde354bfb3c2
MD5 93e76760a1172e41bfe2d8c186f12e4d
SHA1 9a3247e934bc4f455fbf37c04af84e7818eabdfb
SHA512 fbedce4485dee6ba284f983ab63e271110275dc24cd0b2f64208eea4c09d8ad80ee10c0289c4969855c01fde4df4d1a0121bea9b06431cafd67b657382fd7dd6
SSDEEP 786432:rN/ZMswHzXaRMloKBuVPfYomyxIuAba52/F7DQ5RoJxR8fzbWlA68VC2vV/M8+d8:r9ZSjaR1KsVHdsbVN7fkzbWm6eCD8+dn
TLSH
T1B3A73310BBA51659FBC9CC3D807DC12796B870760B62DADB47F296395F0B1F02C2A2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-343-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/516-342-0x0000023467630000-0x000002346765B000-memory.dmp

Download

memory/620-331-0x000001AB28690000-0x000001AB286B4000-memory.dmp

Download

memory/620-332-0x000001AB28A70000-0x000001AB28A9B000-memory.dmp

Download

memory/620-333-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/680-337-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/680-336-0x000002362DBD0000-0x000002362DBFB000-memory.dmp

Download

memory/884-346-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/884-345-0x0000021128120000-0x000002112814B000-memory.dmp

Download

memory/1012-352-0x00000250572C0000-0x00000250572EB000-memory.dmp

Download

memory/1012-353-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1016-348-0x000002851F5D0000-0x000002851F5FB000-memory.dmp

Download

memory/1016-349-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1064-357-0x000001858FBD0000-0x000001858FBFB000-memory.dmp

Download

memory/1064-358-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1124-361-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1124-360-0x0000012325460000-0x000001232548B000-memory.dmp

Download

memory/1136-367-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1136-366-0x0000019059120000-0x000001905914B000-memory.dmp

Download

memory/1220-369-0x0000021CF0090000-0x0000021CF00BB000-memory.dmp

Download

memory/1220-370-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1240-373-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1240-372-0x00000218CF4F0000-0x00000218CF51B000-memory.dmp

Download

memory/1256-680-0x00000278263B0000-0x00000278263BA000-memory.dmp

Download

memory/1256-676-0x0000027826360000-0x000002782636A000-memory.dmp

Download

memory/1256-675-0x0000027826380000-0x000002782639C000-memory.dmp

Download

memory/1256-674-0x0000027825550000-0x000002782555A000-memory.dmp

Download

memory/1256-673-0x0000027826160000-0x0000027826215000-memory.dmp

Download

memory/1256-672-0x0000027825530000-0x000002782554C000-memory.dmp

Download

memory/1256-677-0x00000278263C0000-0x00000278263DA000-memory.dmp

Download

memory/1256-679-0x00000278263A0000-0x00000278263A6000-memory.dmp

Download

memory/1256-678-0x0000027826370000-0x0000027826378000-memory.dmp

Download

memory/1288-376-0x000001BE83F60000-0x000001BE83F8B000-memory.dmp

Download

memory/1288-377-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1340-381-0x0000018E9F9B0000-0x0000018E9F9DB000-memory.dmp

Download

memory/1340-382-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1384-385-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1384-384-0x000001D45D590000-0x000001D45D5BB000-memory.dmp

Download

memory/1464-396-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1464-395-0x0000027674560000-0x000002767458B000-memory.dmp

Download

memory/1516-399-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1516-398-0x000002C20DE90000-0x000002C20DEBB000-memory.dmp

Download

memory/1544-402-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1544-401-0x000001D8E4F80000-0x000001D8E4FAB000-memory.dmp

Download

memory/1684-405-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1684-404-0x0000012B1F540000-0x0000012B1F56B000-memory.dmp

Download

memory/1708-407-0x0000022CF3B30000-0x0000022CF3B5B000-memory.dmp

Download

memory/1708-408-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1840-410-0x000002A477190000-0x000002A4771BB000-memory.dmp

Download

memory/1840-411-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1848-414-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1848-413-0x0000016DA3790000-0x0000016DA37BB000-memory.dmp

Download

memory/1920-416-0x0000018A9C230000-0x0000018A9C25B000-memory.dmp

Download

memory/1920-417-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/1940-430-0x000001C98BAE0000-0x000001C98BB0B000-memory.dmp

Download

memory/1940-431-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/2012-433-0x0000024F5DB10000-0x0000024F5DB3B000-memory.dmp

Download

memory/2012-434-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/2096-436-0x000001B7C6170000-0x000001B7C619B000-memory.dmp

Download

memory/2096-437-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/2104-439-0x0000015269BC0000-0x0000015269BEB000-memory.dmp

Download

memory/2104-440-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/2140-442-0x0000025044130000-0x000002504415B000-memory.dmp

Download

memory/2140-443-0x00007FF99C3B0000-0x00007FF99C3C0000-memory.dmp

Download

memory/2152-445-0x000001F5A52F0000-0x000001F5A531B000-memory.dmp

Download

memory/4024-328-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4024-320-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4024-321-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4024-326-0x00007FF9DC330000-0x00007FF9DC525000-memory.dmp

Download

memory/4024-327-0x00007FF9DC110000-0x00007FF9DC1CE000-memory.dmp

Download

memory/4024-322-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4024-325-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4024-323-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4800-310-0x0000027674FA0000-0x0000027674FC2000-memory.dmp

Download

memory/4972-44-0x00000000003B0000-0x00000000003FE000-memory.dmp

Download