e6990afc1004418aab0b32dc1b97393a3ef94dc0c8cb627701a8290e72958867

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 14.0MB
Sample260727-ymnkfazgla
SHA256 e6990afc1004418aab0b32dc1b97393a3ef94dc0c8cb627701a8290e72958867
MD5 b5c77a3b65edb061b5ccdf2b6a89dd08
SHA1 39d20cb6db3a6d19a6a6915875a8a2a2ff59c6cb
SHA512 d5971446d58f30d7e068c58cc0e09724af26b594cc31fe2b232983d67c543ee9192bb5b8dcab64321b7ef9f19ce7b0b2a3bce4106ce69294e7bd3bf3997f43be
SSDEEP 393216:VtSdORBU7hhnGCnGjbi2bjRo/iKO2xgPNGzQGenDyPHXOIdeJ:/S0YrnGCnkbi2nRWiKCPNMQGenDM3Vdo
TLSH
T16CE63384BAD204E3EEC34A3A44E7F525DBB8FD211B71D4CF466656552E231E2A43EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 31 IoCs

pid	Process
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3212	powershell.exe
3756	powershell.exe
3116	powershell.exe
4800	powershell.exe
3952	powershell.exe
4888	powershell.exe

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2952	cmd.exe
2492	cmd.exe
2740	cmd.exe
2768	cmd.exe
2088	cmd.exe
5492	cmd.exe
5784	cmd.exe
4596	cmd.exe
4360	cmd.exe
4144	cmd.exe
4348	cmd.exe
4436	cmd.exe
4840	cmd.exe
3484	cmd.exe
1764	cmd.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
2164	taskkill.exe
1808	taskkill.exe
3028	taskkill.exe
2408	taskkill.exe
5972	taskkill.exe
2136	taskkill.exe
3420	taskkill.exe
4768	taskkill.exe
5828	taskkill.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	5828	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	5972	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeIncreaseQuotaPrivilege	3212	powershell.exe
Token: SeSecurityPrivilege	3212	powershell.exe
Token: SeTakeOwnershipPrivilege	3212	powershell.exe
Token: SeLoadDriverPrivilege	3212	powershell.exe
Token: SeSystemProfilePrivilege	3212	powershell.exe
Token: SeSystemtimePrivilege	3212	powershell.exe
Token: SeProfSingleProcessPrivilege	3212	powershell.exe
Token: SeIncBasePriorityPrivilege	3212	powershell.exe
Token: SeCreatePagefilePrivilege	3212	powershell.exe
Token: SeBackupPrivilege	3212	powershell.exe
Token: SeRestorePrivilege	3212	powershell.exe
Token: SeShutdownPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeSystemEnvironmentPrivilege	3212	powershell.exe
Token: SeRemoteShutdownPrivilege	3212	powershell.exe
Token: SeUndockPrivilege	3212	powershell.exe
Token: SeManageVolumePrivilege	3212	powershell.exe
Token: 33	3212	powershell.exe
Token: 34	3212	powershell.exe
Token: 35	3212	powershell.exe
Token: 36	3212	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeIncreaseQuotaPrivilege	3756	powershell.exe
Token: SeSecurityPrivilege	3756	powershell.exe
Token: SeTakeOwnershipPrivilege	3756	powershell.exe
Token: SeLoadDriverPrivilege	3756	powershell.exe
Token: SeSystemProfilePrivilege	3756	powershell.exe
Token: SeSystemtimePrivilege	3756	powershell.exe
Token: SeProfSingleProcessPrivilege	3756	powershell.exe
Token: SeIncBasePriorityPrivilege	3756	powershell.exe
Token: SeCreatePagefilePrivilege	3756	powershell.exe
Token: SeBackupPrivilege	3756	powershell.exe
Token: SeRestorePrivilege	3756	powershell.exe
Token: SeShutdownPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeSystemEnvironmentPrivilege	3756	powershell.exe
Token: SeRemoteShutdownPrivilege	3756	powershell.exe
Token: SeUndockPrivilege	3756	powershell.exe
Token: SeManageVolumePrivilege	3756	powershell.exe
Token: 33	3756	powershell.exe
Token: 34	3756	powershell.exe
Token: 35	3756	powershell.exe
Token: 36	3756	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeIncreaseQuotaPrivilege	3116	powershell.exe
Token: SeSecurityPrivilege	3116	powershell.exe
Token: SeTakeOwnershipPrivilege	3116	powershell.exe
Token: SeLoadDriverPrivilege	3116	powershell.exe
Token: SeSystemProfilePrivilege	3116	powershell.exe
Token: SeSystemtimePrivilege	3116	powershell.exe
Token: SeProfSingleProcessPrivilege	3116	powershell.exe
Token: SeIncBasePriorityPrivilege	3116	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1584	4264	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 1584 wrote to memory of 2740	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 2740 wrote to memory of 1808	2740	cmd.exe	93
PID 1584 wrote to memory of 2088	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 2088 wrote to memory of 3420	2088	cmd.exe	96
PID 1584 wrote to memory of 4348	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 4348 wrote to memory of 4768	4348	cmd.exe	99
PID 1584 wrote to memory of 4436	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 4436 wrote to memory of 3028	4436	cmd.exe	102
PID 1584 wrote to memory of 4840	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 4840 wrote to memory of 5828	4840	cmd.exe	105
PID 1584 wrote to memory of 1764	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 1764 wrote to memory of 2408	1764	cmd.exe	108
PID 1584 wrote to memory of 2952	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 2952 wrote to memory of 5972	2952	cmd.exe	111
PID 1584 wrote to memory of 2492	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 2492 wrote to memory of 2164	2492	cmd.exe	114
PID 1584 wrote to memory of 3484	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 3484 wrote to memory of 2136	3484	cmd.exe	117
PID 1584 wrote to memory of 5492	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 5492 wrote to memory of 3212	5492	cmd.exe	120
PID 1584 wrote to memory of 5784	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 5784 wrote to memory of 3756	5784	cmd.exe	123
PID 1584 wrote to memory of 4596	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 4596 wrote to memory of 3116	4596	cmd.exe	127
PID 1584 wrote to memory of 4360	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 4360 wrote to memory of 4800	4360	cmd.exe	130
PID 1584 wrote to memory of 4144	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 4144 wrote to memory of 3952	4144	cmd.exe	133
PID 1584 wrote to memory of 2768	1584	2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 2768 wrote to memory of 4888	2768	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-27_b5c77a3b65edb061b5ccdf2b6a89dd08_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM qqbrowser.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM qqbrowser.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM opera.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM opera.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM firefox.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM chrome.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM brave.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM brave.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM browser.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM browser.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM 360chrome.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM 360chrome.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM msedge.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 1584" /IM vivaldi.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /FI "PID ne 1584" /IM vivaldi.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Cipher\_chacha20.pyd
Size 13KB
SHA256 5736506ad6dc2f3d893b978c8727d74c2f0ae87bbc2fcfcfe8c7e982ea5e86e2
MD5 ae0d9cbaf7463843e438dbccef1b27fe
SHA1 87889089322bcbd79fcad0453667f577216597ef
SHA512 566a28152ce33e185f8990d55408e4f36eb51b4c9970e12bfdd47462a9e2ca5e17cda61f5f5dba6f6177f3b6937efe04cc337af08525c41228e79ff4781dfb68
SSDEEP 192:v30Y+Ne3erKrgMntNGWCL6qT043ZJPsBne9lkNEcqg2:v3ko1KLK2J19i4g
TLSH
T1FB523A89FB7054EDE56240B5C433070EEAF1BB20E711ABCB4360959A1EA3BD1313FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Cipher\_raw_aes.pyd
Size 34KB
SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
MD5 4c869a3047220f0b344536ca22b2987e
SHA1 5812d84fa35514c9cfce57bbc36242f930386158
SHA512 84e6c817b3b860c538e04698e90aa0ea82e21a19ef70066e5fba7a1203baf5ef6c12990ea8c27db8180620f3dce6bd81ad4b24b4132af94684f191c326d4e2ee
SSDEEP 384:UnqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRX:Unqs3C75tCKaVS4j990th9VCbT
TLSH
T19CF2061465A92656DF850E7AFF03CC0BD6B17821B762F23625E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
MD5 0b2596c23bd2792fa5cdb304417dd36d
SHA1 c3dde92f4355aa8152e3b8794c5d44cd90665448
SHA512 0716b03540f0d4a91d0aa2c9308e16158e166a62744294903181cfdd58c2299ba0d8cde1a4617df2ca63dfe4c813f14ae77e34bcdf2b57baceaf42a9ab5b2632
SSDEEP 192:dqTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUtsXIIMQkcqgGTqc:dlhNkYjCXOJvNuarPYUtKkgI
TLSH
T103622A8EF65644BCF61502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 6c6c5fac1b5933fb857fcc3e5a87765257b5484285de147e9bb5fc854223a707
MD5 a8cd12651f1f241e6664e92f135072e1
SHA1 68215631fec0e3166379e30d6a7ce269fb8051f4
SHA512 5d6cbe4493432d727d41fedfb9f8d6e189e5b7623a6b80d763e020458be465e1ab8da4d278a5e2132d14838d7145d50733707d6bc41eeda3565265641a2d5bd3
SSDEEP 96:X4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdAqke:XJB3jD2hoeeqLO9I1oC07xlYm6tcqg9
TLSH
T10532184BEA258BF9D1134336C0770649AAB5BB10B38277CF0365916A2D337D2723E795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 229994e4cb838079a5711c8c0ffeb25fb4684a70ecda497ddb49c8a315594a83
MD5 c22f3989dd44fcb927f0e9b2dfe7805d
SHA1 47bec547b0ddfd064910e8af19bb69f2602b5b01
SHA512 62c7441be9d46df11adb4a44fd2ed4f3a29759622e3306a55c2135e7d59a06bb975766a58f424a709d7cf73f3ee64e563c15d1360dcfbbb2e56b26f1b8d7321d
SSDEEP 192:9fiEXDMXiKEEEEEm9JdwdNuRxe7CO/vJcf30pdA4kFoxX6z3IlPrx2cqgVVv:96EXYz9JdwdNuSLvJz/A49qzYltWgr
TLSH
T132621A06FA545CBDF61242B8C972450D92BFB9046360BBDF0765D2962E23AC4337FAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 da4eacde396e7388ec5da5133762409757dcdaae3022590a73d9ad950844c31f
MD5 fc23d10db102260ced6d1b0a82e83017
SHA1 4ce14b23706f2ebad29b80a83588eadbd8829af4
SHA512 e9c284de1a1fa18d0dde9308facd0caef58d25afce004094d825ac1594bcb59f3dd69d364bd07d1a115b258014c2aae51b8b2ad37f3264bfb6987447f75676a8
SSDEEP 96:dkiC5MmvMN3zAhrZMo4hwFD01tbOlYjMIJKUSUsPNfSzViqZ7EhSGfcX6g53:dkPJUN3zQGWFD0gB3UrWhncqg5
TLSH
T1E322E849FA5648F6EA1682F5C9374E0EA179B720572233CF0374962E1E627CB3139781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 88e734c772909ccc7158f54ce8d488bd0b412ebe2e932c5539e07cb6674243cc
MD5 3f88ecb30005ad315311c8d7ff18b5c9
SHA1 0d5e269d40392b6833a8c7e967e3174c803b1b40
SHA512 184a56e835a58d50e865d0251b54adf6a475dffdad5d7d3237ff834eca49726791b6b4f23048c7bc8cac4e57dd33350cfcf834904beb5064388667514ac94adc
SSDEEP 192:Jd8+SBjsK5tcGndG4xfSo06lwtDy8gJcqgwxCLx:L8575trWCKcgwxCL
TLSH
T16F525C85F6A985FEE81B42B98673494999B9F410635033CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_clmul.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Hash\_ghash_clmul.pyd
Size 12KB
SHA256 c8cc9583c2d91d8ef25073e01a863a40c09fa0a89007f8bb0442df46ba26f0e3
MD5 9f00be52a0c7c07573ad46579a21a684
SHA1 c60dbe3f84101036a5c21d3db0c112fb377c24da
SHA512 c42aa46cd20ae88214c453a5b02bad24f309a01d9dc4adcf89075e6de79058d7d13a48feb78e2af19c5dbd65a693c7acb865fd6184d99e5f2f2a244617bde147
SSDEEP 96:0/7XzBHOTvaNKigvldRMKgUU4sEvJLaVah01YlVlJnOJdS4sPiF1PzwCl28dOJoo:U7gTEnb4pJLqah0ux41bwCQPS0T7cqg
TLSH
T13F421A4CFA9656ADE4170175C93B4B4A5AF5761867E0A3DF036280BA1D333D2332DBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Hash\_ghash_portable.pyd
Size 12KB
SHA256 cd1d79a0d8923c39f7368c92fae0c731ae60ecd34d1c9f387d4824b2af168036
MD5 54166057f210820c7338545ebff610ee
SHA1 8074c8bfa71ca5e6ed2559c39e4ae126e06d352b
SHA512 1516ba4cab3950f78a8cf9229476f904bf0e8c0f1d40bcdac0f100c16051938d430fb4bc8ceb7cbe27a078dab695c14dc2050f98189cc277461c7d67d7de2c92
SSDEEP 192:+T7f40jJIUxDDr+f0SUVxZ7JuVA78VUbB5cqgs:SDq6rSyZ7hd9g
TLSH
T1CC420A8EF65459E9CD1A0175C4334F0AB6F9FA2067916BCB036266692D33EC1333BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Hash\_poly1305.pyd
Size 13KB
SHA256 7f39864610a7e2275d521ee8bed6093b7fefb3256eeec3c1baa3bd800d1bf423
MD5 1a390d8c6331688a67a0d9f3579944a1
SHA1 a24ecf1e2ac33ec518c2bd44bd75cd7ef8f5ca78
SHA512 d59c247c314b94534b792559d25bf224d939196bfbeb366eb55c7f718fd2a3ec3dc1de017192cca621400d8a3734b4ff12e1e82cb43ecba22039770de041e02c
SSDEEP 192:L+CxGqkbOfnVSu41fMlps6BsS10NXloWGc6NIXu3cqgmO:LAq5f3Vpl4xiWGxNpJg
TLSH
T111521A8BFA5515F9E83682B588334A4DEA797A11135067CF436089EE0C33BC272397D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\Cryptodome\Util\_cpuid_c.pyd
Size 10KB
SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
MD5 eb770277b5a8953cc46eeb143abd7572
SHA1 4cf00cea7e01dd93981b8c119b970e12ba8a96dd
SHA512 39d1eb3658bb754fb052668f0265a05a1dcdd0971e6b55648bd4884ad0a9d20269684796c45aecb0a5b80b0f46a1876881fb522125b43ab363d4b757109d7177
SSDEEP 96:dkbFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJz6xqaC4HcX6gWtDs1:dktNuzaJjTD0KRB/VLanHcqgWC
TLSH
T1E4221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996E1E623CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_queue.pyd
Size 34KB
SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
MD5 fee7303e90a0bb9197ec83a4a7ab7669
SHA1 c0a9edd7070a06f9a6c35002ec947abbe14644a1
SHA512 dedf77507ab46a6f2a9b34191f7c3e1b4a2af5ff6ee52f914653dde0d81f3fd8b580a73ce8742b47e175098649a1add77b2dc271616af68a3c3389273c32db3e
SSDEEP 768:H2Zhyt9jf8lIF9UJyy1KPuBL2Ip4PTxf1ml6Z+7U/Fg5U6:2+9jf8lIF9UUy1Ni91fILYqU6
TLSH
T133F26DC66B685047E663C630C1E7EE92F535F7D35A018B6F20A8D28A1E233C2D376359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_socket.pyd
Size 84KB
SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
MD5 a40238c4b5c9821defaef7cbf70574c3
SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
TLSH
T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_sqlite3.pyd
Size 128KB
SHA256 ff76e7c20008fa59e8cd9c6bb8ec47f689a2cc2dc0c9b8ad9e19572b37b9d7db
MD5 fe837834aa5d513bdf3717e6e90ef269
SHA1 7da69c6989920c6d754b8bf357646af6243de795
SHA512 b7c5e76a0f13ac210117ca8de4743f9a0d7932b7b9f07c8e1266294cf2cf66b5f90411cf6453ec76d3193275a119c97469cc37bb04cc9350a8484955cd5da78e
SSDEEP 3072:qNixQwcTa80myttKD/56SttOtN5p2xcTtPuTBxIFvQAt:UT/V/5GTNuTBy
TLSH
T137D35B5B6314009AF9B742B8C1734A03EB75F5625731439F55A0C68A2F377C3AE3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ssl.pyd
Size 177KB
SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
MD5 d41518f976563868b1626afd2eafb825
SHA1 2d1189562e4d37949d8b254ee3b94825d3787e29
SHA512 f9e1284720bd98e9e53feb2f2d16a0b86a6ddef4245789a9593e3e0bf230595577f1509f9050fae26619850661c6f5892ca5d33429b92efc6976565dd47bb98e
SSDEEP 3072:L9fZJvjN6U2kGMlfV6Cv/1UOmI7IM/cbPuC/Je5IFL7Oa5:L9xJrEU2tqV6CvqOss05
TLSH
T1AB048C47B5945AF7D813E4F9C1234903EBB0F155331247DE48D6E64A0F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
Size 221KB
SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
MD5 ebe91ea40d152dd778e975805369e4c3
SHA1 793150512a5cf9a5da394ea0882683e3d4fa5122
SHA512 8c1369dd31e13687dc9c2e059c98dcab175944e4f1a9eec3ac384599f4a79274a9899cc17015de08d74addd8460949fa7fd141f57eb05deab6d3b0cb3706e4e5
SSDEEP 6144:UYuBpEZSXmSFhx8cQxkP8VXaVlaz8fnt4HtFmiGJyMItUxCRv:fuBGZShx8crIl
TLSH
T140243A3662880062ED7752758C63E123DAF2B161473262CF05E0CBA55F27BDAB6FDB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\base_library.zip
Size 1.3MB
SHA256 8ba0c57100c3651e636ea56d0a5da12b35d7f43f4477928f1cb8f76eec9d3162
MD5 683dff2d482a0dc71ff1240a36bb28a5
SHA1 8ed29cce325b8420fcd0272efd83b5a3542fae74
SHA512 e5915ff13e91fdce8daae2aa783e436f151b5e5a20b26bec806f9d0e01d0d6b15fb8a2bc84a3d0330113688554610f9b6ae79f5ed261fff4d369378bc00b5a9a
SSDEEP 12288:ihwsEB6G5L+DMtYzGN8Txs5Gu+djdTRW7Wpk/5uIva80201jwCVRDVoioSYgg7Bh:GwuSuTxhRdZY7Wps4Ywpz5cPPdxhY2
TLSH
T1B2651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\charset_normalizer\cd.cp313-win_amd64.pyd
Size 10KB
SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
MD5 83c5bb15d82a7ec2b207b9c38d6e1018
SHA1 3f065b16e1e2405861a72f6c9e287f317b3034ab
SHA512 062a5f098e8b134869e9daa2219de73ff9ce86945a975e7d472a929d4fa14804b3120b818e7e4498fa9e22e06265236910e3e74c58d35f88b2621043aaf9b8b3
SSDEEP 192:RD0eIaQYVYZuLnN6KxvecRo930aeG1TbhGuE9H7EuO5:jkYVVLN6Kxxo93wmAuEZ4l
TLSH
T1E522E54CFA568CF6DB25023989A70F5E31B5BA25179237CF53B0C12E1EE3BE65278580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\select.pyd
Size 32KB
SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
MD5 9583139460ba3a40961b03c76f12450f
SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
TLSH
T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\sqlite3.dll
Size 1.5MB
SHA256 22d25619e7ccea3e6d1038b5d28bdae5761a88c19a6e228dd867d0a7d5cf2c45
MD5 88154e1974ee6caca4504ae1f3f815c7
SHA1 18e1cd4fe39c0dd2bb9a4f324e9f166c0a8a5c99
SHA512 25d595fc95b079de0637b72ca971b264c9bb9687589e40bd4e899b3e900b766c25dc002f6e4b415fa18dabe6a29bec04da10965f5f631b031674724ee62b8426
SSDEEP 24576:fDKX0pwDaOrROsxNkJPcG/Z2ZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fBX3a:r8pOsxNkJPcGxWQuWRP+bZ6Icf4vC1fQ
TLSH
T116759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7DF1590CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42642\unicodedata.pyd
Size 696KB
SHA256 7f8d28574732959cdb1188127fe3494c3618b602eede69c0a71846f0b5cc8a15
MD5 e812b4f088002142f39d1ec8cded9478
SHA1 44a5ef735de03a29384ce8797897fffc047298cc
SHA512 f4c848a024e62b302b9f2c3b985455d332cb24084809d8163667677b62ed3a4342b324774712443e91c65250ce7e448f28c21d1b3951ee116484eee881e60fd8
SSDEEP 12288:iegxeYedLI/X77mvfldCK1ihH32W3cnPSqrUgTNF:iegxeYeW7qNxq3cnPXTNF
TLSH
T13FE4F5D5BBCF8D26E68B363948E3710F5171C3B35F0A863AB2582361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w4ya155t.vx1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w4ya155t.vx1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\bd_16ka1va_\Browser-Datas\firefox\nightly\fu4ot18b.default-release\bookmarks.txt
Size 336B
SHA256 f62778bc8519b24f20aedc434bc0b2ecbb00ab90732b0c483170294594f4beb7
MD5 3f28800f846ed4de83bc36f415cd9f18
SHA1 a6d805f08e5f68720e4a5ccb331429c79a4df78b
SHA512 e9b8b917abfd21e122313bab3b61735bbf36ee77afc1e07638d1970e21fcb80938d467ee347dbfb003df91f5fcbd063f542fa082a0ee78252dd66ff3852dbd1b
TLSH
T1D7E026A3657242680F00CC557429770A69C7C7188EE616CBB045397184FD3A455E528C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-146-0x00000246CF2D0000-0x00000246CF2F2000-memory.dmp

Download

memory/3212-149-0x00000246CF470000-0x00000246CF48E000-memory.dmp

Download

memory/3212-150-0x00000246CF6A0000-0x00000246CF752000-memory.dmp

Download

memory/3212-151-0x00000246CF490000-0x00000246CF49A000-memory.dmp

Download

memory/3212-152-0x00000246CF8E0000-0x00000246CF90A000-memory.dmp

Download

memory/3212-153-0x00000246CF8E0000-0x00000246CF904000-memory.dmp

Download