df679a4d02b1a49736c035c7e2ab9dd85da0e3a61dec58935595122c519fcc92

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 99.0MB
Sample260816-plcbcaaq2v
SHA256 df679a4d02b1a49736c035c7e2ab9dd85da0e3a61dec58935595122c519fcc92
MD5 f9505b981d91707530d5346ee2ffc098
SHA1 3bb6a7023b60dc16b0b12ae8d6de2038a3f424ba
SHA512 2b290b8d1c9cee30ec67dd60a44a683d813a4df4b271c5c5f7062479254a5429377d28e7f9e6d4e32fd949a5121056519fd7e0e67ffd0c580f9f18710997c260
SSDEEP 196608:LMJEzrLjv+bhqNVoB8Ck5c7GpNlpq41J21bk9NtlDfJf:qOL+9qz88Ck+7q3p91JdtfR
TLSH
T1133833A4B3400CF5DB7B623DCA16815DEBB2B9221765C9DB03B8A3361E174D4CC3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5560	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1736	powershell.exe
948	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
948	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5888	tasklist.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c618-21.dat	upx
behavioral2/memory/4240-24-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp	upx
behavioral2/files/0x000c00000001c60b-27.dat	upx
behavioral2/memory/4240-32-0x00007FF9A40C0000-0x00007FF9A40CF000-memory.dmp	upx
behavioral2/memory/4240-30-0x00007FF99F710000-0x00007FF99F735000-memory.dmp	upx
behavioral2/files/0x000c00000001c616-31.dat	upx
behavioral2/files/0x000c00000001c60e-37.dat	upx
behavioral2/memory/4240-39-0x00007FF99E8F0000-0x00007FF99E91D000-memory.dmp	upx
behavioral2/files/0x000c00000001c60a-40.dat	upx
behavioral2/files/0x000c00000001c611-42.dat	upx
behavioral2/files/0x000c00000001c61c-44.dat	upx
behavioral2/memory/4240-46-0x00007FF99E8A0000-0x00007FF99E8C4000-memory.dmp	upx
behavioral2/memory/4240-45-0x00007FF99E8D0000-0x00007FF99E8E9000-memory.dmp	upx
behavioral2/memory/4240-48-0x00007FF992D00000-0x00007FF992E76000-memory.dmp	upx
behavioral2/files/0x000c00000001c610-49.dat	upx
behavioral2/files/0x000c00000001c61b-51.dat	upx
behavioral2/memory/4240-52-0x00007FF99E880000-0x00007FF99E899000-memory.dmp	upx
behavioral2/files/0x000c00000001c612-55.dat	upx
behavioral2/memory/4240-54-0x00007FF9A2AD0000-0x00007FF9A2ADD000-memory.dmp	upx
behavioral2/memory/4240-62-0x00007FF98B3B0000-0x00007FF98B8D2000-memory.dmp	upx
behavioral2/files/0x000c00000001c615-61.dat	upx
behavioral2/files/0x000c00000001c617-60.dat	upx
behavioral2/memory/4240-59-0x00007FF99E490000-0x00007FF99E4C3000-memory.dmp	upx
behavioral2/memory/4240-58-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp	upx
behavioral2/memory/4240-64-0x00007FF99F710000-0x00007FF99F735000-memory.dmp	upx
behavioral2/memory/4240-65-0x00007FF99DAC0000-0x00007FF99DB8D000-memory.dmp	upx
behavioral2/files/0x000c00000001c60d-66.dat	upx
behavioral2/files/0x000c00000001c60f-69.dat	upx
behavioral2/files/0x000c00000001c61d-73.dat	upx
behavioral2/memory/4240-74-0x00007FF99D6A0000-0x00007FF99D7BB000-memory.dmp	upx
behavioral2/memory/4240-71-0x00007FF9A2810000-0x00007FF9A281D000-memory.dmp	upx
behavioral2/memory/4240-68-0x00007FF99E860000-0x00007FF99E874000-memory.dmp	upx
behavioral2/memory/4240-80-0x00007FF99E8A0000-0x00007FF99E8C4000-memory.dmp	upx
behavioral2/memory/4240-88-0x00007FF992D00000-0x00007FF992E76000-memory.dmp	upx
behavioral2/memory/4240-93-0x00007FF99E490000-0x00007FF99E4C3000-memory.dmp	upx
behavioral2/memory/4240-94-0x00007FF98B3B0000-0x00007FF98B8D2000-memory.dmp	upx
behavioral2/memory/4240-95-0x00007FF99DAC0000-0x00007FF99DB8D000-memory.dmp	upx
behavioral2/memory/4240-96-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp	upx
behavioral2/memory/4240-126-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp	upx
behavioral2/memory/4240-165-0x00007FF99E490000-0x00007FF99E4C3000-memory.dmp	upx
behavioral2/memory/4240-156-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp	upx
behavioral2/memory/4240-162-0x00007FF992D00000-0x00007FF992E76000-memory.dmp	upx
behavioral2/memory/4240-170-0x00007FF99D6A0000-0x00007FF99D7BB000-memory.dmp	upx
behavioral2/memory/4240-166-0x00007FF98B3B0000-0x00007FF98B8D2000-memory.dmp	upx
behavioral2/memory/4240-173-0x00007FF99E8F0000-0x00007FF99E91D000-memory.dmp	upx
behavioral2/memory/4240-171-0x00007FF99E8A0000-0x00007FF99E8C4000-memory.dmp	upx
behavioral2/memory/4240-168-0x00007FF99E860000-0x00007FF99E874000-memory.dmp	upx
behavioral2/memory/4240-164-0x00007FF9A2AD0000-0x00007FF9A2ADD000-memory.dmp	upx
behavioral2/memory/4240-163-0x00007FF99E880000-0x00007FF99E899000-memory.dmp	upx
behavioral2/memory/4240-174-0x00007FF99E8D0000-0x00007FF99E8E9000-memory.dmp	upx
behavioral2/memory/4240-172-0x00007FF9A40C0000-0x00007FF9A40CF000-memory.dmp	upx
behavioral2/memory/4240-169-0x00007FF9A2810000-0x00007FF9A281D000-memory.dmp	upx
behavioral2/memory/4240-167-0x00007FF99DAC0000-0x00007FF99DB8D000-memory.dmp	upx
behavioral2/memory/4240-157-0x00007FF99F710000-0x00007FF99F735000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5568	cmd.exe
5552	cmd.exe
4316	cmd.exe
6112	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
948	powershell.exe
948	powershell.exe
1736	powershell.exe
1736	powershell.exe
4552	WMIC.exe
4552	WMIC.exe
4552	WMIC.exe
4552	WMIC.exe
1736	powershell.exe
948	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5888	tasklist.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4552	WMIC.exe
Token: SeSecurityPrivilege	4552	WMIC.exe
Token: SeTakeOwnershipPrivilege	4552	WMIC.exe
Token: SeLoadDriverPrivilege	4552	WMIC.exe
Token: SeSystemProfilePrivilege	4552	WMIC.exe
Token: SeSystemtimePrivilege	4552	WMIC.exe
Token: SeProfSingleProcessPrivilege	4552	WMIC.exe
Token: SeIncBasePriorityPrivilege	4552	WMIC.exe
Token: SeCreatePagefilePrivilege	4552	WMIC.exe
Token: SeBackupPrivilege	4552	WMIC.exe
Token: SeRestorePrivilege	4552	WMIC.exe
Token: SeShutdownPrivilege	4552	WMIC.exe
Token: SeDebugPrivilege	4552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4552	WMIC.exe
Token: SeRemoteShutdownPrivilege	4552	WMIC.exe
Token: SeUndockPrivilege	4552	WMIC.exe
Token: SeManageVolumePrivilege	4552	WMIC.exe
Token: 33	4552	WMIC.exe
Token: 34	4552	WMIC.exe
Token: 35	4552	WMIC.exe
Token: 36	4552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4552	WMIC.exe
Token: SeSecurityPrivilege	4552	WMIC.exe
Token: SeTakeOwnershipPrivilege	4552	WMIC.exe
Token: SeLoadDriverPrivilege	4552	WMIC.exe
Token: SeSystemProfilePrivilege	4552	WMIC.exe
Token: SeSystemtimePrivilege	4552	WMIC.exe
Token: SeProfSingleProcessPrivilege	4552	WMIC.exe
Token: SeIncBasePriorityPrivilege	4552	WMIC.exe
Token: SeCreatePagefilePrivilege	4552	WMIC.exe
Token: SeBackupPrivilege	4552	WMIC.exe
Token: SeRestorePrivilege	4552	WMIC.exe
Token: SeShutdownPrivilege	4552	WMIC.exe
Token: SeDebugPrivilege	4552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4552	WMIC.exe
Token: SeRemoteShutdownPrivilege	4552	WMIC.exe
Token: SeUndockPrivilege	4552	WMIC.exe
Token: SeManageVolumePrivilege	4552	WMIC.exe
Token: 33	4552	WMIC.exe
Token: 34	4552	WMIC.exe
Token: 35	4552	WMIC.exe
Token: 36	4552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1736	powershell.exe
Token: SeSecurityPrivilege	1736	powershell.exe
Token: SeTakeOwnershipPrivilege	1736	powershell.exe
Token: SeLoadDriverPrivilege	1736	powershell.exe
Token: SeSystemProfilePrivilege	1736	powershell.exe
Token: SeSystemtimePrivilege	1736	powershell.exe
Token: SeProfSingleProcessPrivilege	1736	powershell.exe
Token: SeIncBasePriorityPrivilege	1736	powershell.exe
Token: SeCreatePagefilePrivilege	1736	powershell.exe
Token: SeBackupPrivilege	1736	powershell.exe
Token: SeRestorePrivilege	1736	powershell.exe
Token: SeShutdownPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeSystemEnvironmentPrivilege	1736	powershell.exe
Token: SeRemoteShutdownPrivilege	1736	powershell.exe
Token: SeUndockPrivilege	1736	powershell.exe
Token: SeManageVolumePrivilege	1736	powershell.exe
Token: 33	1736	powershell.exe
Token: 34	1736	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4240	720	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 4240 wrote to memory of 6112	4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 4240 wrote to memory of 4316	4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 4240 wrote to memory of 5568	4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	95
PID 4240 wrote to memory of 5552	4240	2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 5568 wrote to memory of 5888	5568	cmd.exe	99
PID 6112 wrote to memory of 1736	6112	cmd.exe	100
PID 4316 wrote to memory of 948	4316	cmd.exe	101
PID 5552 wrote to memory of 4552	5552	cmd.exe	102
PID 4316 wrote to memory of 5560	4316	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-16_f9505b981d91707530d5346ee2ffc098_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:948
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_bz2.pyd
Size 48KB
SHA256 41eb95b13a115594ca40eacbb73b27233b7a8f40e9dbfbc597b9f64f0a06b485
MD5 2152fe099ca3e722a8b723ea26df66c6
SHA1 1daaaba933501949e5d0e3d3968f4279dcde617d
SHA512 5168f3c554ba8f6c1d923a047ca6784c106b56b8e1944113059190e2a9c19bd8722f14106ea7300ab222696e5164ee66d857b5d619328dd29bbb27943b073cf9
SSDEEP 1536:uscTnfmhcU0UHpuF/g7Z2Zyqm7zIpCVVB7SyTUxIS:KTnfmCNUUF/wNvIpCVVB+
TLSH
T17623CFF38274AC78DD77E8B038D85A34DB35791B45A087EF728CC1565F213423E8666A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_ctypes.pyd
Size 59KB
SHA256 e92c373cc790a5411681a78ade2b75ecb03f3cf17aab7d98c0fb3afa2254684d
MD5 1b06133298f03ff20e5d31cb3b0bca63
SHA1 0678e26f8d03e2ea0ba8d78d6d14809914d9c0a8
SHA512 18c50a5ff69c0c7e19c27039eda0cade0e8bc8d617cca4bc8981dc8a519fa86a05a86b0662aaa493604e9801edf6a41ee65336332b715188e5e17a60a8154cbc
SSDEEP 1536:ew1k7TaJIRmh4ojzkHhqccsmgvGaCaaY0O4CNXGtQzOPe7IpLPFz7SykACdxU:nJIK4CkBVNGO9XGV+IpLPFzuE
TLSH
T14053D0B34168ACA4FD369DB475D45A29E9347E93C910C2F7318C80BA4F66B413F863B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_hashlib.pyd
Size 35KB
SHA256 462b55ca1a405cf11a20798cf38873a328d3720bbd9e46242ce40a5bc82f47d1
MD5 ee8c405267c3baaa133e2e8d13b28893
SHA1 b048112268f8300b3e47e441c346dea35e55d52a
SHA512 da290e352fa759414bbfa84d1c213be9c5722f5b43ab36ae72ea816e792a04e9aaa5253b935d6acdc34611f0ef17c2c0e8d181d014ce3cb117b5775e406f820a
SSDEEP 768:Q6nLeqO/i25L2qrKBMK4XpMcfIpOIYe5YiSyvfsAMxkET:rtO/P5ZTKXcfIpOIYU7SyHqxn
TLSH
T1B9F2C07381B86838D9176DF230D45535ED30B9530A60CBDB325DA1AA8FB13816FB62B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_lzma.pyd
Size 86KB
SHA256 d94c8b2004a570d0f3b1cfd0333e4b1a82696fe199a1614d9054f8bfef4ba044
MD5 cf374ecc905c5694986c772d7fc15276
SHA1 a0ee612388a1c68013f5e954e9280ba0db1bd223
SHA512 0074b3e365782721de8d0a6ee4aa43871d9498eae07a24443b84b755fa00ec3335e42aedeefed0499e642bde9f4ad08843f36b97e095ef212ec29db022676a42
SSDEEP 1536:PeAeeAQ2otR9fI9zq2FYDnbrEVmcrpr8byTjvO31IpZ1u37SyGxe:Zr9w9q2ODSmGpQyTjvOlIpZ1u3V
TLSH
T11383F1938B71ED5CC86349B135F60269FE2A7C879620C7EB225CC13A4F257542FBA1B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_queue.pyd
Size 26KB
SHA256 dff778a28f75ea484a8e2e91c31235eb8d44128f5ace83491e4fbe923addffad
MD5 a56e79b7526129f06c4feacf1f8ed117
SHA1 99f4b0e65c01604f1f5beaff1c0549b1c5a807c5
SHA512 b1f1fee24e1041424e5e05e2087440a6b9eb79ab57367d6f83fa83c6a39c7eb693d6edac9a7ac1c22a26109014fb4a12ef31b33775b23e857afeca777ae0bbcb
SSDEEP 768:izemeFCt412MpaqIpQUYZ5YiSyv/AMxkEG:We7F6UqqIpQUYH7SynxC
TLSH
T1EFC29EE342A49C28DD178D7135D89924EE32BEA75A51C3DF318882374F723412ED63BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_socket.pyd
Size 44KB
SHA256 2a56f2fdbd69a386924d2c00266f1a57954e09c9eb022280be713d0c6ef805ce
MD5 cd2becb9c6dc5cc632509da8cbd0b15d
SHA1 28a705e779ed0e40651875cb62fa8e07d3e27e10
SHA512 fb22b719d4db4c50ab11984ba1bef29a2154d3f2a283b9fa407fd5ec079b67bedf188d5bb94b45b3d18e9000dce11ebf8bb3cd35d465ccbe49c54e150d21a62a
SSDEEP 768:x1X8N3Hvl24aQ4V/npCjdsCsEWsVf+odBfnpw24IpLwlBa5YiSyv0axAMxkEX3:7Xo3PIQ0pChsvEWsF5dBfe24IpLwlB4X
TLSH
T16413C07751A4B828EC22CC3235D08879BF35F98B9850C7D7229D82698F717C26FA17B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_sqlite3.pyd
Size 57KB
SHA256 79769e9318b6e525a145293affedc97b5e7a2e994c88f9df445b887df75f92ee
MD5 a045491faa0cba94b3230b254db7f2d2
SHA1 11a87b7f872e24bab0b278bd88c514b5788975b1
SHA512 a279306e78f34feed13dedd7ecedd226304d5f06746a14c0f9759a7191953de6409b244d23629b25fe9c4a374528ffc6ac92bd1090e218ee5962815491fdcb43
SSDEEP 1536:NW6W6CtwjHecGAg2FakvwzgoBr5EaOdIpOQ107SyTxJ:NW6vCtwjDgF/cucIpOQ10J
TLSH
T16543E0F302249C6DD9239D7231E4853E6E7275976BC1C7E3228C52AB4FA67412FA1336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_ssl.pyd
Size 65KB
SHA256 3e2d13bda93c59fdd1b9bbb2b30c682774e8da4503248e96e0e3c1b0fe588ce7
MD5 7b0d6d717535bc48f0176fd6455a133b
SHA1 a3fd5e6495d961eeaa66ccb7b2a8135812210356
SHA512 861443c982a821f61bd971f57f65998366f325d084f21636e38f91aaaac752e7dc2b2344f414db3cb7fddec08210cfc197c1815a44e9b726ff5eabe2c62f42f9
SSDEEP 1536:VoAuijXACpT59jGxJkHNcdU38umWs2EamTSqUCr5IpC7e3E7SyCxYM:mi0k4JkHmvL2ETmqUCFIpC7eU6
TLSH
T1C863E0B2C674AC58CD33CC7962CC1E35F6367A4789A1C5AB22CDC25D4F612811BE6772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\base_library.zip
Size 1.3MB
SHA256 eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
MD5 ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1 f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA512 4f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1d1YgCCaYcet:uttcY+UHCiCAd+cqHdmmPHzqEaYcet
TLSH
T17455D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\blank.aes
Size 107KB
SHA256 6f59b0968df27ccd0d72c938f954c075fce5db43deb13299b169defe744443c7
MD5 840ee9274c53709c889d92005a234595
SHA1 d8cb2128d87eda522535c1c910709d0676ea609d
SHA512 e681557e9bf783fb31d780359f5018b5cd637654cd29989fd4c339991fe8979e6c4765f195107856fe2c6959ff3128aad839fbac116ca40b78252c0c05137856
SSDEEP 3072:A1oHUmM/9CAdmGe2lr4R/C1gD3YIknwlh1wu5BR:AzpCPGeW4RL3gnYhnzR
TLSH
T177B3E1C5B6C2D6BBF90EF6B25A29231E73AE04F4F302C723769E15655FA5A005C44ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\blank.aes
Size 107KB
SHA256 adc8f191a38cc3c827e2ef6d622287116bf858284e41cdd9f83b5c6d35ed94c2
MD5 7a855e7e7102cb10b9fb0b1ed94c239c
SHA1 b1237b898e261657c9370f02a787829d140b67a5
SHA512 791762f9874f9ade550e1f01145460fc416e797a75d426156a77eeb1b07ff44aef2def549b79d94fb63991ff54314aa10a2e1306f6110e772b65e5cad05b0876
SSDEEP 3072:02Nlgne2+VMs3cnbz7ZJgdPD4NC8ne6grlxy:02MneRVMs3cnX7ZJgdPDRgexDy
TLSH
T187B312E1FA804C5CA6177CC0AD2C979EFEC279739C7EACA723D8B2514A27799C5106D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libcrypto-3.dll
Size 1.6MB
SHA256 fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
MD5 27515b5bb912701abb4dfad186b1da1f
SHA1 3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA512 087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
SSDEEP 49152:AMyDwbv70aKbP1zkLO5YHLA1CPwDvt3uFlDCZ:kwbv77KbPaqYHLA1CPwDvt3uFlDCZ
TLSH
T1A275121414BF780BF749A4789F34D8AA8D5E2712B708DFE12D6E8E280C19D0E95BD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libssl-3.dll
Size 223KB
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
SSDEEP 3072:SFfmvsqWLSCMT+MyN6Qp2oZqpN+/fvrqknqbf6CjaBGkfPkZAK1ck2kBVfLwOmFd:SFevsT9JN+vyH1nqLr3CPrYBBRcd
TLSH
T15F2402A2712F8823CC17EEB6DBF860E5D76D770A6F06C8663723C90CBB6091C665C255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\python312.dll
Size 1.8MB
SHA256 d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf
MD5 2f1072ddd9a88629205e7434ed055b3e
SHA1 20da3188dabe3d5fa33b46bfe671e713e6fa3056
SHA512 d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b
SSDEEP 49152:V3Qjrdlkflw6XCRrGhxicF75ShbujR/3z/x:V3Akflw6krEFwujx/x
TLSH
T18B8533372D1E8DF3CF6EBAF42262CB0589621250947B89C269B9C2D34567B046D37F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\select.pyd
Size 25KB
SHA256 94f2bac05e32cb3791f66efb3229c932ab71bc3725a417340304219721b0d50d
MD5 79bb09417365e9b66c8fb984cbb99950
SHA1 517522dbcbefb65e37e309cb06fed86c5f946d79
SHA512 1c2129dd4d8febe2886e122868956ba6032a03b1297da095d3e9c02ab33183d964a8f790086e688b0720ab39aa1e8d0fe91fadbbe99035baf4d7cc5754de9e64
SSDEEP 768:iBzQ8aVMpJjRIpQGYY5YiSyvkrUAMxkErl:2M5VOjRIpQGYq7SyMryxHl
TLSH
T1A4C29EE341746C28C9238DF634D49869FD31BE975940C3DB329D82798F713822B96376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\sqlite3.dll
Size 630KB
SHA256 aa05807dfa35d6fbe1484728110430802a791f3f8723f824696f2d6bd9c5b69a
MD5 5655f540da3e3bd91402e5e5b09a6d2f
SHA1 d44db47026b330d06fa84128fd9f0241f5752011
SHA512 1205dcd5657dcc457f8d02452c47fcb2e7fee108a675aaddc9f7b82d1f2371e38080a6fa0f767524f835c544f129b6f71b2d716180d196b18a9a6dbef6c9bf03
SSDEEP 12288:71Mao81K77fa+Biph8HGq570OuKcmX1SkHCZO1P5JcLpZBwhfitIKJXQ:6h81KHaHpQGM0Ounm49O1PQBq6SKJXQ
TLSH
T12AD423D746634CCEF59363B1F42329DCA55DB262DCFC8BD9F2A4B36A8E10982117250E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\unicodedata.pyd
Size 295KB
SHA256 0ae76f7316506bcaa4a59f31817569129fd1baaaba89032953785dbf9f7a7242
MD5 20f206b5b405d837c201b8fb443cfa5a
SHA1 f06b062505f7218d49a1ef0ea65c6212dc4105b0
SHA512 b36e4af96bef6b8c13d509b66c34f1cdf6ac8830267fabc13a811d7d486d938d798b32b4d195fea762ee550501002674d6681f8985318990b454a5bc5c982088
SSDEEP 6144:CtrmB1o+h9g+j16hJQ8BTAXVSjMrybczs6mNqIHf96eVc4P7u/:4qB15h91j12i8xAXVSjM+b3z/0e+O7u/
TLSH
T1D95423E21460F8ADE063CF377CA7A4687AA079A78CC1C2F939795439DF225147B821F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_h1wppp2n.v25.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1wppp2n.v25.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1736-79-0x0000019AE1830000-0x0000019AE1852000-memory.dmp

Download

memory/1736-84-0x0000019AF9C70000-0x0000019AF9D22000-memory.dmp

Download

memory/1736-83-0x0000019AE19C0000-0x0000019AE19DE000-memory.dmp

Download

memory/1736-87-0x0000019AE18A0000-0x0000019AE18AA000-memory.dmp

Download

memory/4240-74-0x00007FF99D6A0000-0x00007FF99D7BB000-memory.dmp

Download

memory/4240-94-0x00007FF98B3B0000-0x00007FF98B8D2000-memory.dmp

Download

memory/4240-64-0x00007FF99F710000-0x00007FF99F735000-memory.dmp

Download

memory/4240-65-0x00007FF99DAC0000-0x00007FF99DB8D000-memory.dmp

Download

memory/4240-59-0x00007FF99E490000-0x00007FF99E4C3000-memory.dmp

Download

memory/4240-62-0x00007FF98B3B0000-0x00007FF98B8D2000-memory.dmp

Download

memory/4240-54-0x00007FF9A2AD0000-0x00007FF9A2ADD000-memory.dmp

Download

memory/4240-52-0x00007FF99E880000-0x00007FF99E899000-memory.dmp

Download

memory/4240-71-0x00007FF9A2810000-0x00007FF9A281D000-memory.dmp

Download

memory/4240-68-0x00007FF99E860000-0x00007FF99E874000-memory.dmp

Download

memory/4240-48-0x00007FF992D00000-0x00007FF992E76000-memory.dmp

Download

memory/4240-45-0x00007FF99E8D0000-0x00007FF99E8E9000-memory.dmp

Download

memory/4240-46-0x00007FF99E8A0000-0x00007FF99E8C4000-memory.dmp

Download

memory/4240-80-0x00007FF99E8A0000-0x00007FF99E8C4000-memory.dmp

Download

memory/4240-39-0x00007FF99E8F0000-0x00007FF99E91D000-memory.dmp

Download

memory/4240-30-0x00007FF99F710000-0x00007FF99F735000-memory.dmp

Download

memory/4240-88-0x00007FF992D00000-0x00007FF992E76000-memory.dmp

Download

memory/4240-32-0x00007FF9A40C0000-0x00007FF9A40CF000-memory.dmp

Download

memory/4240-93-0x00007FF99E490000-0x00007FF99E4C3000-memory.dmp

Download

memory/4240-58-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp

Download

memory/4240-95-0x00007FF99DAC0000-0x00007FF99DB8D000-memory.dmp

Download

memory/4240-96-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp

Download

memory/4240-126-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp

Download

memory/4240-165-0x00007FF99E490000-0x00007FF99E4C3000-memory.dmp

Download

memory/4240-156-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp

Download

memory/4240-162-0x00007FF992D00000-0x00007FF992E76000-memory.dmp

Download

memory/4240-170-0x00007FF99D6A0000-0x00007FF99D7BB000-memory.dmp

Download

memory/4240-166-0x00007FF98B3B0000-0x00007FF98B8D2000-memory.dmp

Download

memory/4240-173-0x00007FF99E8F0000-0x00007FF99E91D000-memory.dmp

Download

memory/4240-24-0x00007FF98B8E0000-0x00007FF98BFB8000-memory.dmp

Download

memory/4240-171-0x00007FF99E8A0000-0x00007FF99E8C4000-memory.dmp

Download

memory/4240-168-0x00007FF99E860000-0x00007FF99E874000-memory.dmp

Download

memory/4240-164-0x00007FF9A2AD0000-0x00007FF9A2ADD000-memory.dmp

Download

memory/4240-163-0x00007FF99E880000-0x00007FF99E899000-memory.dmp

Download

memory/4240-174-0x00007FF99E8D0000-0x00007FF99E8E9000-memory.dmp

Download

memory/4240-172-0x00007FF9A40C0000-0x00007FF9A40CF000-memory.dmp

Download

memory/4240-169-0x00007FF9A2810000-0x00007FF9A281D000-memory.dmp

Download

memory/4240-167-0x00007FF99DAC0000-0x00007FF99DB8D000-memory.dmp

Download

memory/4240-157-0x00007FF99F710000-0x00007FF99F735000-memory.dmp

Download