Overview

overview

10

Static

static

3

2026-07-23...om.exe

windows10-2004-x64

10

2026-07-23...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 04:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_e9c8e37a7d9af0d7bde966abc8a81f3f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 59.2MB
  • Sample260723-fa99kawva1
  • SHA256 a76bd7365be725e2b26dd12d502ee937b465bf654026d8797f475571ecf4d33f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealertrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 10 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 35 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 64 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 10 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 23 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 17 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 9 IoCs
    defense_evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_e9c8e37a7d9af0d7bde966abc8a81f3f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_e9c8e37a7d9af0d7bde966abc8a81f3f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\2026-07-23_e9c8e37a7d9af0d7bde966abc8a81f3f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-23_e9c8e37a7d9af0d7bde966abc8a81f3f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:6104
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
          4⤵
          • Views/modifies file attributes
          PID:5852
      • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:6064
        • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
          C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1376
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1172
            • C:\Windows\system32\attrib.exe
              attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
              6⤵
              • Views/modifies file attributes
              PID:2136
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe""
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3252
            • C:\Windows\system32\attrib.exe
              attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"
              6⤵
              • Views/modifies file attributes
              PID:480
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe""
            5⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:2888
            • C:\Windows\system32\attrib.exe
              attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"
              6⤵
              • Views/modifies file attributes
              PID:5748
          • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
            C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
            5⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:2684
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\PidostealerWifiExport_24352471cf6646beb145245f37b28184"
              6⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:4748
            • C:\Windows\SYSTEM32\netsh.exe
              "netsh" wlan show profiles
              6⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:3412
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\Windows\system32\attrib.exe
              attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
              6⤵
              • Views/modifies file attributes
              PID:1692
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe""
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:552
            • C:\Windows\system32\attrib.exe
              attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"
              6⤵
              • Views/modifies file attributes
              PID:1128
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe""
            5⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:3472
            • C:\Windows\system32\attrib.exe
              attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe"
              6⤵
              • Views/modifies file attributes
              PID:4700
          • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe
            C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5756
            • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe
              C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3132
              • C:\Windows\SYSTEM32\wscript.exe
                wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
                7⤵
                • Executes a VBScript file via the Windows Script Host.
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:936
                • C:\Windows\system32\mspaint.exe
                  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                  8⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4216
              • C:\Windows\SYSTEM32\wscript.exe
                wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
                7⤵
                • Executes a VBScript file via the Windows Script Host.
                • Hide Artifacts: Hidden Files and Directories
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2952
                • C:\Windows\system32\mspaint.exe
                  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                  8⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4184
              • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
                C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
                  C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
                  8⤵
                  • Modifies WinLogon for persistence
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:1204
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fo csv /nh
                    9⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5364
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fo csv /nh
                    9⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4940
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fo csv /nh
                    9⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4132
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fo csv /nh
                    9⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1192
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fo csv /nh
                    9⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4520
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      10⤵
                        PID:3412
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4960
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3116
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2044
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1252
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      PID:5632
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      PID:456
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      PID:4632
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fo csv /nh
                      9⤵
                      • Enumerates processes with tasklist
                      PID:4712
                • C:\Windows\SYSTEM32\wscript.exe
                  wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
                  7⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:4680
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2180
                • C:\Windows\SYSTEM32\wscript.exe
                  wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe""
                  7⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1516
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2680
                • C:\Windows\SYSTEM32\wscript.exe
                  wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_2.exe""
                  7⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2764
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:6032
                • C:\Windows\SYSTEM32\wscript.exe
                  wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_3.exe""
                  7⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • Hide Artifacts: Hidden Files and Directories
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3740
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:3364
                • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_3.exe
                  C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_3.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5892
                  • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_3.exe
                    C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_3.exe
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:3224
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1936
                    • C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                      C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:1112
                      • C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                        C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                        10⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:4260
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2892
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1092
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5116
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5032
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5768
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6076
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:912
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5792
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2724
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          PID:2660
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          PID:1808
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          PID:1392
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fo csv /nh
                          11⤵
                          • Enumerates processes with tasklist
                          PID:4660
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4752
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4048
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5360
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2832
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2896
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:260
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6056
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5260
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3928
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5356
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5508
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5704
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1668
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1460
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4160
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2940
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5260
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3668
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2960
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4644
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4792
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2960
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1140
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3892
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4308
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4328
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:4716
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:1320
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:5364
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:5700
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:4556
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:4636
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:2204
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:5388
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:2108
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:5820
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      PID:4176
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:244
          • C:\Windows\system32\attrib.exe
            attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
            4⤵
            • Views/modifies file attributes
            PID:4724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe""
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Windows\system32\attrib.exe
            attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"
            4⤵
            • Views/modifies file attributes
            PID:4924
        • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
          C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5268
          • C:\Windows\system32\drivers\etc\svchost32.exe
            "C:\Windows\system32\drivers\etc\svchost32.exe"
            4⤵
            • UAC bypass
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Drops file in Drivers directory
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4560
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "WindowsDefenderScan" /f
              5⤵
              • Indicator Removal: Clear Persistence
              • Suspicious use of WriteProcessMemory
              PID:3148
              • C:\Windows\system32\schtasks.exe
                schtasks /delete /tn "WindowsDefenderScan" /f
                6⤵
                  PID:1764
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "WindowsDefenderScan" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
                5⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5592
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /tn "WindowsDefenderScan" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1980
              • C:\Windows\SYSTEM32\wscript.exe
                wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" cmd.exe /c attrib +h +s +r +i /D & attrib +h +s +r "%userprofile%\Desktop\!!!READ_ME!!!.txt" & attrib +h +s +r "%userprofile%\Documents\!!!READ_ME!!!.txt"
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                • Hide Artifacts: Hidden Files and Directories
                • Modifies registry class
                PID:4256
                • C:\Windows\system32\mspaint.exe
                  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:5988
              • C:\Windows\SYSTEM32\taskkill.exe
                taskkill.exe /im Explorer.exe /f
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4284
              • C:\Windows\SYSTEM32\wscript.exe
                wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                • Modifies registry class
                PID:1764
                • C:\Windows\system32\mspaint.exe
                  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:6076
      • C:\Windows\SYSTEM32\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat
        1⤵
        • Executes a VBScript file via the Windows Script Host.
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\Windows\system32\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2924
      • C:\Windows\SYSTEM32\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Local\Temp\femcrypt_show.vbs" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat
        1⤵
        • Executes a VBScript file via the Windows Script Host.
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5128
        • C:\Windows\system32\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\femcrypt_block.png"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4612
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
        1⤵
        • Checks SCSI registry key(s)
        PID:432
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
          PID:4300
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:5272
        • C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
          C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
          1⤵
          • Executes dropped EXE
          PID:3396
          • C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
            C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2920
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2860
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3828
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              3⤵
              • Enumerates processes with tasklist
              PID:2732
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              3⤵
              • Enumerates processes with tasklist
              PID:2248
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              3⤵
              • Enumerates processes with tasklist
              PID:996
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              3⤵
                PID:4308
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004D0
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4592

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Event Triggered Execution

                2
                T1546

                Image File Execution Options Injection

                1
                T1546.012

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Event Triggered Execution

                2
                T1546

                Image File Execution Options Injection

                1
                T1546.012

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Hide Artifacts

                2
                T1564

                Hidden Files and Directories

                2
                T1564.001

                Impair Defenses

                1
                T1562

                Disable or Modify Tools

                1
                T1562.001

                Indicator Removal

                1
                T1070

                Clear Persistence

                1
                T1070.009

                Modify Registry

                5
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                2
                T1552

                Credentials In Files

                1
                T1552.001

                Credentials in Registry

                1
                T1552.002

                Discovery

                Browser Information Discovery

                1
                T1217

                Peripheral Device Discovery

                2
                T1120

                Process Discovery

                1
                T1057

                Query Registry

                5
                T1012

                System Information Discovery

                5
                T1082

                System Network Configuration Discovery

                1
                T1016

                Wi-Fi Discovery

                1
                T1016.002

                Lateral Movement

                Collection

                Data from Local System

                2
                T1005

                Email Collection

                1
                T1114

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RuntimeBroker.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
                • Size 33.1MB
                • SHA256 143d8974dfd1c494e0e55a9ef054e5003d66fe56eab377ba3b88778c43b1e9d3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RuntimeBroker_1.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
                • Size 4.8MB
                • SHA256 5a6c4177c361e67cb0d86847b64dccc8b5ba18140442eba672c26f694be53457
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\VCRUNTIME140.dll
                • Size 94KB
                • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\_bz2.pyd
                • Size 77KB
                • SHA256 0897e209676f5835f62e5985d7793c884fd91b0cfdfaff893fc05176f2f82095
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _decimal.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\_decimal.pyd
                • Size 242KB
                • SHA256 2673b0ec0769c2513cfb63d72cbfadd3dd43963d30ddc368c6232dab1f607ee1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\_hashlib.pyd
                • Size 59KB
                • SHA256 2e30544d07f1c55d741b03992ea57d1aa519edaaa121e889f301a5b8b6557fe4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\_lzma.pyd
                • Size 150KB
                • SHA256 ce72d59a0e96077c9ea3f1fd7b011287248dc8d80fd3c16916a1d9040a9a941f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\_socket.pyd
                • Size 73KB
                • SHA256 130de3506471878031aecc4c9d38355a4719edd3786f27262a724efc287a47b9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-console-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-console-l1-1-0.dll
                • Size 22KB
                • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-datetime-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-datetime-l1-1-0.dll
                • Size 22KB
                • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-debug-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-debug-l1-1-0.dll
                • Size 22KB
                • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-errorhandling-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-errorhandling-l1-1-0.dll
                • Size 22KB
                • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-fibers-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-fibers-l1-1-0.dll
                • Size 22KB
                • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-file-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-file-l1-1-0.dll
                • Size 26KB
                • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-file-l1-2-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-file-l1-2-0.dll
                • Size 22KB
                • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-file-l2-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-file-l2-1-0.dll
                • Size 20KB
                • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-handle-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-handle-l1-1-0.dll
                • Size 22KB
                • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-heap-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-heap-l1-1-0.dll
                • Size 22KB
                • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-interlocked-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-interlocked-l1-1-0.dll
                • Size 22KB
                • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-libraryloader-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-libraryloader-l1-1-0.dll
                • Size 22KB
                • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-localization-l1-2-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-localization-l1-2-0.dll
                • Size 22KB
                • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-memory-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-memory-l1-1-0.dll
                • Size 22KB
                • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-namedpipe-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-namedpipe-l1-1-0.dll
                • Size 22KB
                • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-processenvironment-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-processenvironment-l1-1-0.dll
                • Size 22KB
                • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-processthreads-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-processthreads-l1-1-0.dll
                • Size 22KB
                • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-processthreads-l1-1-1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-processthreads-l1-1-1.dll
                • Size 22KB
                • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-profile-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-profile-l1-1-0.dll
                • Size 22KB
                • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-rtlsupport-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-rtlsupport-l1-1-0.dll
                • Size 22KB
                • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-string-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-string-l1-1-0.dll
                • Size 22KB
                • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-synch-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-synch-l1-1-0.dll
                • Size 22KB
                • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-synch-l1-2-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-synch-l1-2-0.dll
                • Size 22KB
                • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-sysinfo-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-sysinfo-l1-1-0.dll
                • Size 22KB
                • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-timezone-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-timezone-l1-1-0.dll
                • Size 22KB
                • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-util-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-core-util-l1-1-0.dll
                • Size 22KB
                • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-conio-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-conio-l1-1-0.dll
                • Size 22KB
                • SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-convert-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-convert-l1-1-0.dll
                • Size 26KB
                • SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-environment-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-environment-l1-1-0.dll
                • Size 22KB
                • SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-filesystem-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-filesystem-l1-1-0.dll
                • Size 22KB
                • SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-heap-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-heap-l1-1-0.dll
                • Size 22KB
                • SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-locale-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-locale-l1-1-0.dll
                • Size 22KB
                • SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-math-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-math-l1-1-0.dll
                • Size 30KB
                • SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-process-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-process-l1-1-0.dll
                • Size 22KB
                • SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-runtime-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-runtime-l1-1-0.dll
                • Size 26KB
                • SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-stdio-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-stdio-l1-1-0.dll
                • Size 26KB
                • SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-string-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-string-l1-1-0.dll
                • Size 26KB
                • SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-time-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-time-l1-1-0.dll
                • Size 22KB
                • SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-utility-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\api-ms-win-crt-utility-l1-1-0.dll
                • Size 22KB
                • SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\base_library.zip
                • Size 858KB
                • SHA256 52a4f4858ad0e9c8176efff1253ce4a099c2110e16170aa501308616c41af769
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-1_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\libcrypto-1_1.dll
                • Size 3.3MB
                • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python310.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll
                • Size 4.2MB
                • SHA256 8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\select.pyd
                • Size 25KB
                • SHA256 cb643556c2dcdb957137b25c8a33855067e0d07547e547587c9886238253bfe5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ucrtbase.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\ucrtbase.dll
                • Size 1.1MB
                • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI17122\unicodedata.pyd
                • Size 1.1MB
                • SHA256 09e1d1e9190160959696aeddb0324667fef39f338edc28f49b5f518b92f27f5f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmp36A2.wav
                • Path C:\Users\Admin\AppData\Local\Temp\tmp36A2.wav
                • Size 4.2MB
                • SHA256 487f69533dca417c51a94c53e7fc36e1c4f3b24e71ad311bad141ed3353465ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WindowsDefenderUpdate.exe
                • Path C:\Windows\System32\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                • Size 6.1MB
                • SHA256 9f66757c786d77d7bdf949af96ac2a30d5d0173c44a2e7855582d32e3ad8a40a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2684-395-0x000001E6E96A0000-0x000001E6E96B2000-memory.dmp
                Download

                memory/2684-176-0x000001E6E6E30000-0x000001E6E6E72000-memory.dmp
                Download

                memory/4560-485-0x000000001EBC0000-0x000000001ECB0000-memory.dmp
                Download

                memory/5268-169-0x0000000000920000-0x0000000001D96000-memory.dmp
                Download