1781222fb252f72d19a611ecfe4a1623812b24b4483dea834053e2821039e537

Analysis

max time kernel
151s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 27.8MB
Sample260805-pfppgsxblh
SHA256 1781222fb252f72d19a611ecfe4a1623812b24b4483dea834053e2821039e537
MD5 27a66e2bbf465d7e2d77e4b23b7e9703
SHA1 fa5bd9d0b12f4dc313097b4566460b6f23bf7bf2
SHA512 c00cf0c9629b4c68fba3d61622d8f06b0b4961cc4d4ebf67008da3dafc0c5245cd909f9a8773f65c15e6e2eedf11cf067d3e9243703e4f8404d23ad717c1e0b7
SSDEEP 786432:GrbnhJMUpruldmABoUR5TZ6zU1/WtsUgQlSiKD3OVq:GPhJn8TWUTTZ6zc/QLgQZc+V
TLSH
T1E257330438F14494D66A923032AE6E1AFF537C66260DADF342CF9586F72F392AD27D50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3772	proto.exe
4680	proto.exe

Loads dropped DLL 33 IoCs

pid	Process
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe
3572	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4716	cmd.exe
3436	cmd.exe
2884	cmd.exe
5620	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
3572	powershell.exe
3572	powershell.exe
3572	powershell.exe
4532	WMIC.exe
4532	WMIC.exe
4532	WMIC.exe
4532	WMIC.exe
1900	WMIC.exe
1900	WMIC.exe
1900	WMIC.exe
1900	WMIC.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
2800	WMIC.exe
2800	WMIC.exe
2800	WMIC.exe
2800	WMIC.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeIncreaseQuotaPrivilege	4532	WMIC.exe
Token: SeSecurityPrivilege	4532	WMIC.exe
Token: SeTakeOwnershipPrivilege	4532	WMIC.exe
Token: SeLoadDriverPrivilege	4532	WMIC.exe
Token: SeSystemProfilePrivilege	4532	WMIC.exe
Token: SeSystemtimePrivilege	4532	WMIC.exe
Token: SeProfSingleProcessPrivilege	4532	WMIC.exe
Token: SeIncBasePriorityPrivilege	4532	WMIC.exe
Token: SeCreatePagefilePrivilege	4532	WMIC.exe
Token: SeBackupPrivilege	4532	WMIC.exe
Token: SeRestorePrivilege	4532	WMIC.exe
Token: SeShutdownPrivilege	4532	WMIC.exe
Token: SeDebugPrivilege	4532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4532	WMIC.exe
Token: SeRemoteShutdownPrivilege	4532	WMIC.exe
Token: SeUndockPrivilege	4532	WMIC.exe
Token: SeManageVolumePrivilege	4532	WMIC.exe
Token: 33	4532	WMIC.exe
Token: 34	4532	WMIC.exe
Token: 35	4532	WMIC.exe
Token: 36	4532	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4532	WMIC.exe
Token: SeSecurityPrivilege	4532	WMIC.exe
Token: SeTakeOwnershipPrivilege	4532	WMIC.exe
Token: SeLoadDriverPrivilege	4532	WMIC.exe
Token: SeSystemProfilePrivilege	4532	WMIC.exe
Token: SeSystemtimePrivilege	4532	WMIC.exe
Token: SeProfSingleProcessPrivilege	4532	WMIC.exe
Token: SeIncBasePriorityPrivilege	4532	WMIC.exe
Token: SeCreatePagefilePrivilege	4532	WMIC.exe
Token: SeBackupPrivilege	4532	WMIC.exe
Token: SeRestorePrivilege	4532	WMIC.exe
Token: SeShutdownPrivilege	4532	WMIC.exe
Token: SeDebugPrivilege	4532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4532	WMIC.exe
Token: SeRemoteShutdownPrivilege	4532	WMIC.exe
Token: SeUndockPrivilege	4532	WMIC.exe
Token: SeManageVolumePrivilege	4532	WMIC.exe
Token: 33	4532	WMIC.exe
Token: 34	4532	WMIC.exe
Token: 35	4532	WMIC.exe
Token: 36	4532	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1900	WMIC.exe
Token: SeRemoteShutdownPrivilege	1900	WMIC.exe
Token: SeUndockPrivilege	1900	WMIC.exe
Token: SeManageVolumePrivilege	1900	WMIC.exe
Token: 33	1900	WMIC.exe
Token: 34	1900	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 6016	3844	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	89
PID 6016 wrote to memory of 2708	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	90
PID 6016 wrote to memory of 3572	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	93
PID 6016 wrote to memory of 4716	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	95
PID 4716 wrote to memory of 4532	4716	cmd.exe	97
PID 6016 wrote to memory of 3436	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	98
PID 6016 wrote to memory of 3772	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	100
PID 3772 wrote to memory of 5824	3772	proto.exe	102
PID 3772 wrote to memory of 5824	3772	proto.exe	102
PID 3772 wrote to memory of 3968	3772	proto.exe	105
PID 3772 wrote to memory of 3968	3772	proto.exe	105
PID 6016 wrote to memory of 2884	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	106
PID 2884 wrote to memory of 1900	2884	cmd.exe	108
PID 6016 wrote to memory of 4680	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	109
PID 4680 wrote to memory of 912	4680	proto.exe	111
PID 4680 wrote to memory of 912	4680	proto.exe	111
PID 4680 wrote to memory of 3180	4680	proto.exe	114
PID 4680 wrote to memory of 3180	4680	proto.exe	114
PID 6016 wrote to memory of 5620	6016	2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	115
PID 5620 wrote to memory of 2800	5620	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-05_27a66e2bbf465d7e2d77e4b23b7e9703_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject -Query 'SELECT * FROM Win32_Bios' | ConvertTo-Json -Depth 2"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject -Query 'SELECT * FROM Win32_PnPEntity' | ConvertTo-Json -Depth 2"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\jello_proto_iznj8th0\proto.exe
    C:\Users\Admin\AppData\Local\Temp\jello_proto_iznj8th0\proto.exe all -o C:\Users\Admin\AppData\Local\Temp\jello_proto_iznj8th0\output
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- - C:\Users\Admin\AppData\Local\Temp\jello_proto_1qs3vedb\proto.exe
    C:\Users\Admin\AppData\Local\Temp\jello_proto_1qs3vedb\proto.exe all -o C:\Users\Admin\AppData\Local\Temp\jello_proto_1qs3vedb\output
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a02e3e88be7f73de16fe0882b196eb68ff340900a10fb3199f5610c7f065ef78
MD5 4f113d02171b4ec924b3913bfb1b2c76
SHA1 6ec708fda08fc44bfc874b684f3d55f48ebdf1dc
SHA512 5371c4f83a2bf04bbf33fb33d04885e9c304a8f6080881fafc6d3e0c3e8c24ab5dddf59ffb2ded0b33bb7473a96a2477e3c27a75751389da6b1621223119bd35
TLSH
T13F31BC37B7CC46D5C85E443610CD9C1032F586DBC0DEDFABB741D444696F5C4EA68950
MD5 SHA1 SHA512 TLSH

Submit Download

proto.exe

Path C:\Users\Admin\AppData\Local\Temp\jello_proto_1qs3vedb\proto.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_brotli.pyd
Size 836KB
SHA256 15265d9fe191f377e10dfb282a787c8c072b159bc237f9d13d9e31ee609206a8
MD5 76012ab1d7039f1977d629386ea9e1ed
SHA1 68dd4d0a7d17bdbad331aab851c492bacaf6c581
SHA512 63ddc3f7867e7771084413334edb9919f5f9dceb3f019f20a2fdd91862c92fb6dec614efb4e84154f8c9219a171d4a4728607ccb50f334f9ac7dd57a096e37db
SSDEEP 12288:Fq9Id+oUVg/GOzfYiIAHhlyq8hnnb3xKWulsONrc:Fq9VFBbAilgWulsON
TLSH
T1ED058D0BD8B35779C82BC4798DAB1336EB357558530089A7B25CE5313B43A141BBB3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_bz2.pyd
Size 81KB
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
SSDEEP 1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
TLSH
T10B839D93F76095B5F41BA2759AA14393E331FE49039093EFB244831B2F13B913C6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_cffi_backend.pyd
Size 175KB
SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
MD5 04fd1a452e91605545a267cb04cdd78f
SHA1 482d3bc8b0059d7c755cff695c0366be402c86ba
SHA512 12549b3a03e869998cc808079da1ca13e00949efa7c15ba97aa510feca2e481bdc74eefa12ab1f6a08d9cca06957a6d4769aa67e9973b59ad4fb9ef04a95b37b
SSDEEP 3072:1X9Iup1Rz9vapoU+EX+QRhbUvpzLcmIXPpSfJ0KN3kS7ORSTL7K3gqFb2HF:1jL0poIFRhbUvpncmIUGDRSTLOwU2H
TLSH
T140046C5A329C10B6D6A6513886579B53E3B3B430174197CF0160C7B52F1BBEABA7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_hashlib.pyd
Size 60KB
SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
MD5 d856a545a960bf2dca1e2d9be32e5369
SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
SSDEEP 1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
TLSH
T136536D05A69440B9D8674278CAD71F5BEAB1F0405351ABEF0358C1CE2F237C3EAB6796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_lzma.pyd
Size 153KB
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
SSDEEP 3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
TLSH
T1F8F33992B394F4E6F6228C78D6664F13D7F678490320829A12CCC37D2B1FB755A2A717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_queue.pyd
Size 29KB
SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
MD5 52d0a6009d3de40f4fa6ec61db98c45c
SHA1 5083a2aff5bcce07c80409646347c63d2a87bd25
SHA512 cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824
SSDEEP 768:yez/DF36r3CkrAIeRI77UNYiSyvlfUvPxWEl:yeDM3CkrAIeRI77UN7SyOvPx
TLSH
T1DFD28E479AA45CD6D433C07094E75E25FA31FB52870183EF3218C25E1F327826BE676A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_socket.pyd
Size 75KB
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
SSDEEP 1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
TLSH
T1B0735B12A69050B9D2738175C6635F23FB70F480139593CF1264DAAE2F23792EF7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_ssl.pyd
Size 155KB
SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
MD5 9ddb64354ef0b91c6999a4b244a0a011
SHA1 86a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA512 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca
SSDEEP 3072:xOoLGtbSpE3z/J/PUE1ueW5J2oEPwu3rE923+nuI5Piev9mutI7t7L+xu:xOoitbSpE3zhH7ueAE8nuaF9muy
TLSH
T15CF37C47F24419A7E817E4BDC2230A53EBB5F045231147CE49D6D68A0F13B46AFBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\_tkinter.pyd
Size 63KB
SHA256 4262cabac7e97220d0e4bd72deb337ffd9df429860ab298b3e2d5c9223874705
MD5 470364d8abdc5c22828df8e22c095ed2
SHA1 4c707b1061012deb8ce4ab38772a21d3195624c2
SHA512 70eb15796ead54cdadf696ea6581ff2f979057c3be8c95c12ab89be51c02b2aba591f9ee9671e8c4f376c973b154d0f2e0614498c5835397411c876346429cd5
SSDEEP 1536:71MazUiVl77hMM81C/LCYrzFI75S47SybPxqU:713zUxMp/LCYrzFI75S4dxB
TLSH
T1E5538DAB5BA4009ACE67C17CC5B34F13DA75B4410A10924F0298D35A2F737D3A7FAB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bcrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\bcrypt\_bcrypt.pyd
Size 309KB
SHA256 4904336e5ddd08db8be7694eef0d1d83de6799d6412952a82dca4847a3f46251
MD5 169518669942f1b7c9a0bc4d0d98651f
SHA1 4c2132a29abcd0b2e26f96d7ba54bc8968cc4853
SHA512 270ab970eb7c9bd5db40fef76f78fca68a40266390f16d971c946a086f7c079314b78e068477cd083d9fae2e76ee7cc8a4d8ba7ddc4f5f5b0c78767b77a4f858
SSDEEP 3072:RrdaOOOJPELEbEhSoKbVeKuJgu3rAkbK7xokgwHSkbj57ytyE/pZxFuVpOUrjenn:SO2h0b0KuJguLbLFhkn57MyE3xFWpOn
TLSH
T1E7642837F6459879D45AC0B8826B5A617A7274880F34BAFF158456383E7AFE02F3C784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
TLSH
T1E8547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\charset_normalizer\md.pyd
Size 10KB
SHA256 45a043c4b7c6556f2acfc827f2ff379365088c3479e8ee80c7f0a2ceb858dcc6
MD5 f4f7f634791f26fc62973350d5f89d9a
SHA1 6be643bd21c74ed055b5a1b939b1f64b055d4673
SHA512 4325807865a76427d05039a2922f853287d420bcebda81f63a95bf58502e7da0489060c4b6f6ffd65aa294e1e1c1f64560add5f024355922103c88b2cf1fd79b
SSDEEP 96:700fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFOCQAASmHcX6g8H4ao:QFCk2z1/t12iwU5usJFqCyVcqgg
TLSH
T1AE222B0CFA6548E9DA264178C53B5E0BF0B5B710076273CF4370956B2FB23E6A93AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\charset_normalizer\md__mypyc.pyd
Size 119KB
SHA256 f646c3b72b5e7c085a66b4844b5ad7a9a4511d61b2d74153479b32c7ae0b1a4c
MD5 47ee4516407b6de6593a4996c3ae35e0
SHA1 293224606b31e45b10fb67e997420844ae3fe904
SHA512 efa245c6db2aee2d9db7f99e33339420e54f371a17af0cf7694daf51d45aebfbac91fc52ddb7c53e9fc73b43c67d8d0a2caa15104318e392c8987a0dad647b81
SSDEEP 1536:5ewkbk74PoxchHGTm/SCtg5MbfFPjPNoSLn2dkp2A/2pQKP:5endPox6HGTOLtg6bfFhDLkkCpQK
TLSH
T1B2C3296653850036C577517E8CB75912CBA2B4910B3153DF05E0CAA9AF077EABEBEF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_openssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\cryptography\hazmat\bindings\_openssl.pyd
Size 3.8MB
SHA256 da0dea85eb34de0e50ab1d343d33ed0a99b3af5e2f479d306fce5c0ed604b1d8
MD5 772cace2ab493c306930c01050a5b667
SHA1 5130913527cb73ca1358875f63464907088f0a5b
SHA512 b0019a4ff07a5d76e1c01dd7079ea9eae5bd1cede64af917ba94206ad434acf946efad90ebfd240cfefcdb22c8ca732af659e4408105a9ff130545950ed1bd2d
SSDEEP 49152:tIU6iL9GtlqiVwASOHU9/RsUkuH+6y/237DqbZ3iAsUJyYWQ6WP1dX7P6nD75pCX:a+SOxLDqgYhWQ6WjTKm+A5q2
TLSH
T14D066C66F6980098D92AC13CCA579317D7B2BC661370A7CB19A8E9790F73BD2173E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\cryptography\hazmat\bindings\_rust.pyd
Size 1.6MB
SHA256 bca2dd906302a6a84e9aa5f41b06c4deef4fee139e861d5c538ba30bd4c40574
MD5 7d6f3ad57f25c087286a55fe1ecd55db
SHA1 df87721286061ef3e5687fd29924c025d230c9e9
SHA512 8a042d70956c6d8d617b9fb73f942209c4396cee11a8ef64b8cce77f5989ac5fc728f04353b342beb1823953c6e73fdc50ccdc0d72721b81f515581ca5c32f6a
SSDEEP 24576:/paFZST2pNXfXj9q/Vys/27ZkmLKS3/Zys:BaFpHfXj9q/Vys/2dfY
TLSH
T119751A23F6A6456DC02AC4B0A2879662AE3178CD0F357AFF46D425B83E35BE45B3C345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\libssl-1_1.dll
Size 686KB
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
TLSH
T1ADE44B95ABB51498D9E6C17C86534A33E37AF4141330AFCF06A5853E0F17BD82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\psutil\_psutil_windows.pyd
Size 75KB
SHA256 d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
MD5 5e9fc79283d08421683cb9e08ae5bf15
SHA1 b3021534d2647d90cd6d445772d2e362a04d5ddf
SHA512 9133011ae8eb0110da9f72a18d26bbc57098a74983af8374d1247b9a336ee32db287ed26f4d010d31a7d64eacdc9cf99a75faab194eff25b04299e5761af1a79
SSDEEP 1536:2ztEQV7I0DiMRAlELBNvpEnd17dO1vIFbHGy:2pESdiQAlEL6dJdO1vibHGy
TLSH
T14E734B46B36A10F8D46AD23DC5B71633EAB1F0A2172283DF4950D9090F6ABD7A375F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\python3.dll
Size 63KB
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
SSDEEP 768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
TLSH
T1A8535D525B54FCA2DAFAA5FC38D199CD542B12CC872984DCB57893D30E1A310A627F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\python310.dll
Size 4.3MB
SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
MD5 deaf0c0cc3369363b800d2e8e756a402
SHA1 3085778735dd8badad4e39df688139f4eed5f954
SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
SSDEEP 49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
TLSH
T1DC267B22A26401A4D9B79477C5238647CBF1FC552F20E34B41A4BAD92F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\pywintypes310.dll
Size 134KB
SHA256 2984df073a029acf46bcaed4aa868c509c5129555ed70cac0fe2235abdba6e6d
MD5 a44f3026baf0b288d7538c7277ddaf41
SHA1 c23fbdd6a1b0dc69753a00108dce99d7ec7f5ee3
SHA512 9699a2629f9f8c74a7d078ae10c9ffe5f30b29c4a2c92d3fcd2096dc2edceb71c59fd84e9448bb0c2fb970e2f4ade8b3c233ebf673c47d83ae40d12a2317ca98
SSDEEP 3072:bnfstBwsNJzuMZnYrrC0DdZLN+yeLEKoPUZlB+u:zGys7KoYrrC0LxeYK4UZlB
TLSH
T190D34A47374684DAD937933D8DB70A02D7A2B0110712E3CF06A1C29B5F63BE66D3BA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\select.pyd
Size 28KB
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
SSDEEP 768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
TLSH
T111D2AF8B9B9058C9E863C57258E64F02FA34B661875082DF3319C26D2F237C277B6769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\tcl86t.dll
Size 1.8MB
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf
SSDEEP 24576:aNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBH9:aNgjid2LD5W4ac6xdLvIkhHP4ATdeD0
TLSH
T1A785AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\tcl\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\tk86t.dll
Size 1.5MB
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9
SSDEEP 24576:C1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOJ0wd98ydeyRP/ecr:CIyQD9FU43GLUKuPO6EinYTVAFSvESKI
TLSH
T178655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\unicodedata.pyd
Size 1.1MB
SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
MD5 4c8af8a30813e9380f5f54309325d6b8
SHA1 169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA512 ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
SSDEEP 12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
TLSH
T18A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3844_476420_zFWXZXgFXq0\win32crypt.pyd
Size 128KB
SHA256 e8af0bb8d611ee98573bc43f67e6d178a0eb8ad4204b0cd4aa3b09b2171876f9
MD5 e1f9fa54df00f36f17c2fabd135a8035
SHA1 5a83d32262381f11442cea84168e0705c0109986
SHA512 fbc4a4fc03abda5079f6eba0843a7952926f517a0fa749307f4b74b45562425eecec041479fbb9d92e5cbda95b1993cc555e275ab8a73665df4a4ef71a826560
SSDEEP 1536:zs7//x7uQZHh5CIsg+9qkDvrEGIq0nn3YZVVkbjAAwedil3FcHa:iFuwHde8knE1qauVeA2dil3FcHa
TLSH
T1CAD33B5726916CC6E9AA937DC4639D47E7A0B0190712ABCF0990C6C90FB7FE06D3E349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d02a9c0f345f8b19a0d666d1f59b81b826346625b2b732ad24f321e8295f2ec.tmp

Path C:\Windows\Temp\0d02a9c0f345f8b19a0d666d1f59b81b826346625b2b732ad24f321e8295f2ec.tmp
Size 18B
SHA256 f27f7bed2fb63b952961d1ef466f0b7c152ce8dcbc24ae3dd77293fd06bdc6b8
MD5 ec757b3c6f3bf0c721ece247e65e9d55
SHA1 56138fea4238bd57b9fbd54b6ea8842f409d2ca9
SHA512 72368c212c5603a9402b18a353562db081ff66c74b007e28002447e63f4e761d9a68ad54a68e5c7566254645534b1fa4c475113c1bb3642d3e61d4e34634bd62
MD5 SHA1 SHA512

Submit Download

memory/2708-1050-0x0000021951BF0000-0x0000021952118000-memory.dmp

Download

memory/2708-1049-0x00000219514F0000-0x00000219516B2000-memory.dmp

Download

memory/2708-1046-0x0000021950F60000-0x0000021950F82000-memory.dmp

Download