4fd15b46b798eb13f017577970a67075888515b8b6f969fdf74b4e1f2f7fd84b

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/09/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 7.5MB
Sample260914-ejd22sthmc
SHA256 4fd15b46b798eb13f017577970a67075888515b8b6f969fdf74b4e1f2f7fd84b
MD5 84fa7928083a472bc421f03e79197995
SHA1 b8f815d9cdaf3e672c393a0ee69b07180c3549a1
SHA512 d52fe4f39dd181fec97f54337c5002b2f0f4de1b6272a7adfadb23920384f82d449cc4473f01d49716e6cc8531b2ce49d50a4e341e15bd1d4de25729c1b0a3ec
SSDEEP 196608:GMQCwVPMEurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1m:cVEEurEUWjqeWx06rYYm
TLSH
T1DC8633416394497AFCBB123D8537A81BC7B2BC6A07A0D6CB03A446D65F136E16E37B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5356	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2232	powershell.exe
5380	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5380	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5124	tasklist.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c553-21.dat	upx
behavioral2/memory/808-25-0x00007FFCB3560000-0x00007FFCB3C24000-memory.dmp	upx
behavioral2/files/0x000d00000001c545-27.dat	upx
behavioral2/files/0x000d00000001c551-29.dat	upx
behavioral2/memory/808-30-0x00007FFCCA7C0000-0x00007FFCCA7E5000-memory.dmp	upx
behavioral2/memory/808-32-0x00007FFCCC040000-0x00007FFCCC04F000-memory.dmp	upx
behavioral2/files/0x000d00000001c549-37.dat	upx
behavioral2/files/0x000e00000001c544-40.dat	upx
behavioral2/memory/808-39-0x00007FFCCA790000-0x00007FFCCA7BD000-memory.dmp	upx
behavioral2/memory/808-43-0x00007FFCCBF80000-0x00007FFCCBF9A000-memory.dmp	upx
behavioral2/files/0x000d00000001c54c-42.dat	upx
behavioral2/files/0x000d00000001c557-45.dat	upx
behavioral2/memory/808-46-0x00007FFCCA760000-0x00007FFCCA784000-memory.dmp	upx
behavioral2/memory/808-48-0x00007FFCC55C0000-0x00007FFCC573F000-memory.dmp	upx
behavioral2/files/0x000d00000001c54b-49.dat	upx
behavioral2/memory/808-51-0x00007FFCCBEF0000-0x00007FFCCBF09000-memory.dmp	upx
behavioral2/files/0x000d00000001c556-52.dat	upx
behavioral2/memory/808-55-0x00007FFCCC030000-0x00007FFCCC03D000-memory.dmp	upx
behavioral2/files/0x000d00000001c54d-54.dat	upx
behavioral2/files/0x000d00000001c552-59.dat	upx
behavioral2/memory/808-58-0x00007FFCCA720000-0x00007FFCCA753000-memory.dmp	upx
behavioral2/files/0x000d00000001c550-57.dat	upx
behavioral2/memory/808-61-0x00007FFCB3560000-0x00007FFCB3C24000-memory.dmp	upx
behavioral2/memory/808-62-0x00007FFCB3030000-0x00007FFCB3559000-memory.dmp	upx
behavioral2/memory/808-64-0x00007FFCCA7C0000-0x00007FFCCA7E5000-memory.dmp	upx
behavioral2/memory/808-65-0x00007FFCBA080000-0x00007FFCBA14D000-memory.dmp	upx
behavioral2/files/0x000d00000001c54a-70.dat	upx
behavioral2/memory/808-72-0x00007FFCCA710000-0x00007FFCCA71D000-memory.dmp	upx
behavioral2/memory/808-71-0x00007FFCCA790000-0x00007FFCCA7BD000-memory.dmp	upx
behavioral2/memory/808-68-0x00007FFCCA9F0000-0x00007FFCCAA04000-memory.dmp	upx
behavioral2/files/0x000d00000001c548-67.dat	upx
behavioral2/files/0x000d00000001c558-73.dat	upx
behavioral2/memory/808-75-0x00007FFCB9F60000-0x00007FFCBA07B000-memory.dmp	upx
behavioral2/memory/808-104-0x00007FFCCA760000-0x00007FFCCA784000-memory.dmp	upx
behavioral2/memory/808-108-0x00007FFCCA790000-0x00007FFCCA7BD000-memory.dmp	upx
behavioral2/memory/808-114-0x00007FFCCA720000-0x00007FFCCA753000-memory.dmp	upx
behavioral2/memory/808-115-0x00007FFCB3030000-0x00007FFCB3559000-memory.dmp	upx
behavioral2/memory/808-116-0x00007FFCBA080000-0x00007FFCBA14D000-memory.dmp	upx
behavioral2/memory/808-119-0x00007FFCB9F60000-0x00007FFCBA07B000-memory.dmp	upx
behavioral2/memory/808-118-0x00007FFCCA710000-0x00007FFCCA71D000-memory.dmp	upx
behavioral2/memory/808-117-0x00007FFCCA9F0000-0x00007FFCCAA04000-memory.dmp	upx
behavioral2/memory/808-111-0x00007FFCC55C0000-0x00007FFCC573F000-memory.dmp	upx
behavioral2/memory/808-113-0x00007FFCCC030000-0x00007FFCCC03D000-memory.dmp	upx
behavioral2/memory/808-112-0x00007FFCCBEF0000-0x00007FFCCBF09000-memory.dmp	upx
behavioral2/memory/808-110-0x00007FFCCA760000-0x00007FFCCA784000-memory.dmp	upx
behavioral2/memory/808-109-0x00007FFCCBF80000-0x00007FFCCBF9A000-memory.dmp	upx
behavioral2/memory/808-105-0x00007FFCB3560000-0x00007FFCB3C24000-memory.dmp	upx
behavioral2/memory/808-107-0x00007FFCCC040000-0x00007FFCCC04F000-memory.dmp	upx
behavioral2/memory/808-106-0x00007FFCCA7C0000-0x00007FFCCA7E5000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4896	cmd.exe
2464	cmd.exe
6116	cmd.exe
3708	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2232	powershell.exe
5820	WMIC.exe
5820	WMIC.exe
5820	WMIC.exe
5820	WMIC.exe
5380	powershell.exe
5380	powershell.exe
2232	powershell.exe
2232	powershell.exe
5380	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	5124	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5820	WMIC.exe
Token: SeSecurityPrivilege	5820	WMIC.exe
Token: SeTakeOwnershipPrivilege	5820	WMIC.exe
Token: SeLoadDriverPrivilege	5820	WMIC.exe
Token: SeSystemProfilePrivilege	5820	WMIC.exe
Token: SeSystemtimePrivilege	5820	WMIC.exe
Token: SeProfSingleProcessPrivilege	5820	WMIC.exe
Token: SeIncBasePriorityPrivilege	5820	WMIC.exe
Token: SeCreatePagefilePrivilege	5820	WMIC.exe
Token: SeBackupPrivilege	5820	WMIC.exe
Token: SeRestorePrivilege	5820	WMIC.exe
Token: SeShutdownPrivilege	5820	WMIC.exe
Token: SeDebugPrivilege	5820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5820	WMIC.exe
Token: SeRemoteShutdownPrivilege	5820	WMIC.exe
Token: SeUndockPrivilege	5820	WMIC.exe
Token: SeManageVolumePrivilege	5820	WMIC.exe
Token: 33	5820	WMIC.exe
Token: 34	5820	WMIC.exe
Token: 35	5820	WMIC.exe
Token: 36	5820	WMIC.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeIncreaseQuotaPrivilege	5820	WMIC.exe
Token: SeSecurityPrivilege	5820	WMIC.exe
Token: SeTakeOwnershipPrivilege	5820	WMIC.exe
Token: SeLoadDriverPrivilege	5820	WMIC.exe
Token: SeSystemProfilePrivilege	5820	WMIC.exe
Token: SeSystemtimePrivilege	5820	WMIC.exe
Token: SeProfSingleProcessPrivilege	5820	WMIC.exe
Token: SeIncBasePriorityPrivilege	5820	WMIC.exe
Token: SeCreatePagefilePrivilege	5820	WMIC.exe
Token: SeBackupPrivilege	5820	WMIC.exe
Token: SeRestorePrivilege	5820	WMIC.exe
Token: SeShutdownPrivilege	5820	WMIC.exe
Token: SeDebugPrivilege	5820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5820	WMIC.exe
Token: SeRemoteShutdownPrivilege	5820	WMIC.exe
Token: SeUndockPrivilege	5820	WMIC.exe
Token: SeManageVolumePrivilege	5820	WMIC.exe
Token: 33	5820	WMIC.exe
Token: 34	5820	WMIC.exe
Token: 35	5820	WMIC.exe
Token: 36	5820	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5380	powershell.exe
Token: SeSecurityPrivilege	5380	powershell.exe
Token: SeTakeOwnershipPrivilege	5380	powershell.exe
Token: SeLoadDriverPrivilege	5380	powershell.exe
Token: SeSystemProfilePrivilege	5380	powershell.exe
Token: SeSystemtimePrivilege	5380	powershell.exe
Token: SeProfSingleProcessPrivilege	5380	powershell.exe
Token: SeIncBasePriorityPrivilege	5380	powershell.exe
Token: SeCreatePagefilePrivilege	5380	powershell.exe
Token: SeBackupPrivilege	5380	powershell.exe
Token: SeRestorePrivilege	5380	powershell.exe
Token: SeShutdownPrivilege	5380	powershell.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeSystemEnvironmentPrivilege	5380	powershell.exe
Token: SeRemoteShutdownPrivilege	5380	powershell.exe
Token: SeUndockPrivilege	5380	powershell.exe
Token: SeManageVolumePrivilege	5380	powershell.exe
Token: 33	5380	powershell.exe
Token: 34	5380	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 808	4448	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	87
PID 808 wrote to memory of 4896	808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 808 wrote to memory of 2464	808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 808 wrote to memory of 6116	808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 4896 wrote to memory of 2232	4896	cmd.exe	94
PID 808 wrote to memory of 3708	808	2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	95
PID 2464 wrote to memory of 5380	2464	cmd.exe	97
PID 6116 wrote to memory of 5124	6116	cmd.exe	98
PID 3708 wrote to memory of 5820	3708	cmd.exe	99
PID 2464 wrote to memory of 5356	2464	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-13_84fa7928083a472bc421f03e79197995_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5380
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
MD5 47ad9cc420da0514ba1b00c8644623c3
SHA1 ae21313963068b048e67ea7211e2e3b62269795b
SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
TLSH
T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_bz2.pyd
Size 48KB
SHA256 88087fef2cff82a3d2d2d28a75663618271803017ea8a6fcb046a23e6cbb6ac8
MD5 5cd942486b252213763679f99c920260
SHA1 abd370aa56b0991e4bfee065c5f34b041d494c68
SHA512 6cd703e93ebccb0fd896d3c06ca50f8cc2e782b6cc6a7bdd12786fcfb174c2933d39ab7d8e674119faeca5903a0bfac40beffb4e3f6ca1204aaffefe1f30642c
SSDEEP 1536:LPtQ7tq8qiE34NBVBFPGeIV/cISCV0+W87Syyxt+:L1YtZdEUBkHWISCV0+BL
TLSH
T19223D09341A5A81DCE379A7178A48F35B534BD464580C3EB3399A265CF613C13FB9372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_ctypes.pyd
Size 59KB
SHA256 d699e09727eefe5643e0fdf4be4600a1d021af25d8a02906ebf98c2104d3735d
MD5 4878ad72e9fbf87a1b476999ee06341e
SHA1 9e25424d9f0681398326252f2ae0be55f17e3540
SHA512 6d465ae4a222456181441d974a5bb74d8534a39d20dca6c55825ebb0aa678e2ea0d6a6853bfa0888a7fd6be36f70181f367a0d584fccaa8daa940859578ab2b8
SSDEEP 1536:kGd2xRPNLaGFQFjd9MuCOc8armISLPUL7Sycx4:PMxVhFyjd9M3CISLPULj
TLSH
T1AE53E1A346742C30CE1B8CB234D88525DD33B9E74A5286EB31DD82795BB27815F973B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_hashlib.pyd
Size 35KB
SHA256 09a0be93d58ce30fa7fb8503e9d0f83b10d985f821ce8a9659fd0bbc5156d81e
MD5 edfb41ad93bc40757a0f0e8fdf1d0d6c
SHA1 155f574eef1c89fd038b544778970a30c8ab25ad
SHA512 3ba7d225828b37a141ed2232e892dad389147ca4941a1a85057f04c0ed6c0eab47b427bd749c565863f2d6f3a11f3eb34b6ee93506dee92ec56d7854e3392b10
SSDEEP 768:8xMpCu7ErBLxwS6/v2tHp2jnISOIR75YiSyvCQmAMxkE5:TpdWBLaS6H2t8jnISOIRF7SyZUxN
TLSH
T114F2C0B389B46C98CD239CF234D0DD64FE36B9475D1143EB3218832A4F61746EBA91B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_lzma.pyd
Size 86KB
SHA256 2fbc631716ffd1fd8fd3c951a1bd9ba00cc11834e856621e682799ba2ab430fd
MD5 25b96925b6b4ea5dd01f843ecf224c26
SHA1 69ba7c4c73c45124123a07018fa62f6f86948e81
SHA512 97c56ce5040fb7d5785a4245ffe08817b02926da77c79e7e665a4cfa750afdcb7d93a88104831944b1fe3262c0014970ca50a332b51030eb602bb7fb29b56ae3
SSDEEP 1536:jaMIb+tRnEHExDhlSdLtyMvC6Vzb2q/GP2SWEEDSaHM7mmsEXC+OUlISZ1PLo7SF:lWgREk1qBywCsb2qOP2SWmaHMCwXCMIA
TLSH
T1CB83F1B35934EC21DBA39DB123D48A6CDAB13DE34AD5C35A325CD12B5B15BC02E62372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_queue.pyd
Size 26KB
SHA256 d8b60222732bdcedddbf026f96bddda028c54f6ae6b71f169a4d0c35bc911846
MD5 c2ba2b78e35b0ab037b5f969549e26ac
SHA1 cb222117dda9d9b711834459e52c75d1b86cbb6e
SHA512 da2bf31eb6fc87a606cbaa53148407e9368a6c3324648cb3df026a4fe06201bbaab1b0e1a6735d1f1d3b90ea66f5a38d47daac9686520127e993ecb02714181f
SSDEEP 768:u/kKC4ngW+qlVNneplp+KISQURg5YiSyv86lAMxkEzc:9CgWnbNnepeKISQURy7SyU6dxPc
TLSH
T139C28FE342749C28DD378D7238D08435FE31B9975951C2DB319D826A4F723426BA63B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_socket.pyd
Size 44KB
SHA256 5427daade880df81169245ea2d2cc68355d34dbe907bc8c067975f805d062047
MD5 aa8435614d30cee187af268f8b5d394b
SHA1 6e218f3ad8ac48a1dde6b3c46ff463659a22a44e
SHA512 3ccf7ec281c1dc68f782a39f339e191a251c9a92f6dc2df8df865e1d7796cf32b004ea8a2de96fe75fa668638341786eb515bac813f59a0d454fc91206fee632
SSDEEP 768:HW6CmTt8yeoC7UMOBQ9ixy4bYEnP3kKnH9qxEMpdjFISLw0BX5YiSyvTmAMxkEh:Hld8yi+BQdM3xnH9qE+jFISLw0BJ7Syc
TLSH
T12913DFF346A07800DD27EDB239D14A19EE35F5979E50C3E72289D2364F60281AF973B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_sqlite3.pyd
Size 57KB
SHA256 79977cbda8d6b54868d9cfc50159a2970f9b3b0f8df0ada299c3c1ecfdc6deb0
MD5 81a43e60fc9e56f86800d8bb920dbe58
SHA1 0dc3ffa0ccbc0d8be7c7cbae946257548578f181
SHA512 d3a773f941f1a726826d70db4235f4339036ee5e67667a6c63631ff6357b69ba90b03f44fd0665210ee243c1af733c84d2694a1703ebb290f45a7e4b1fc001c7
SSDEEP 1536:4fq0nJ4R7vFybskRPCMgc1TJOCISOQEi7Sy/x5:4KIbRP/gkTJbISOQEiZ
TLSH
T1D743E1B3D2A8AC5DCD0389B134C4C515EB36F99B0921CBE73248D2755FA97413F9A2B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\_ssl.pyd
Size 66KB
SHA256 66a0e06cce76b1e332278f84eda4c032b4befbd6710c7c7eb6f5e872a7b83f43
MD5 c0512ca159b58473feadc60d3bd85654
SHA1 ac30797e7c71dea5101c0db1ac47d59a4bf08756
SHA512 3999fc4e673cf2ce9938df5850270130247f4a96c249e01258a25b125d64c42c8683a85aec64ed9799d79b50f261bcfac6ee9de81f1c5252e044d02ac372e5c4
SSDEEP 1536:FSAiSbKlBy5NdOUgmXn09RlqjeVKRO6KIkBgQf+WIDt4NGbeaISC7/0p7SyWx/:piSbKlBy38Fm309o/nKNaQGJtk47ISC1
TLSH
T15463F1E359319C18CD378DB221C89A38AD76B4A79954C3CB638D833A9FB13423B553B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\base_library.zip
Size 1.3MB
SHA256 10b1adf18da86baebdbe7ee7561bc0ffa2aabf88e9f03cc34ab7943b25665769
MD5 100dfe4e2eb2ce4726a43dbd4076b4ee
SHA1 5671116823ad50f18c7f0e45c612f41711cff8fe
SHA512 1b63f7841ea699c46c86568407d4f1cff21db9f5d57aecc374e3eae3c283349090d828df909f0213d1b177992b49caf22d5154958080fc06238e9e3b0cdf7bb3
SSDEEP 12288:NttcY+bS4OmE1jc+fYNXPh26UZWAzDX7jOIqL3QtRtI1dmoPJHz1dT+4/BaYcUA:NttcY+NHSPD/eMe1dmoPtzKcaYcUA
TLSH
T1CE55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\blank.aes
Size 108KB
SHA256 d8bd5461c3cc2139f45ecedb23ebae68526ebbd4961ee5c93a389a465232f4e5
MD5 c1bf89938d34e383b6b451ddf3f9223a
SHA1 0f09baf2a6d8d67555f8b8448f8f1bafa8849dc1
SHA512 df396312e9b4408040a3efe92efc4953dac33a88075d189f8b71e5dd2fb93f23bc9af781db8aca5f9e207ac57e72d042318f5c7b76fab3b43c4507eae9291d5a
SSDEEP 3072:QW1u8YOEKPaAAvEfGHH4aihBB0UOW9t5V:QYzYOEKCAAckHzVUOWZV
TLSH
T123B3E05131D2D67BF93AF772390922ADB37D86A0B74ADB27B58D00690FA2552AC04DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\blank.aes
Size 109KB
SHA256 3d38648b7861beb0f476ae80e8e24b5a1ceaf03940923882003c15b31de5f70a
MD5 3e9bb0b1c4b9fb5ef476f15a9333fb04
SHA1 18486e1bb19a44915787e682c8b50d89eed34c3d
SHA512 374a404fa07d053bace8c074849c349fbed1c44b6416eb1f0ec3ce6eb5193156042333fe7791da9f7d3683be1c490890f5640f44e5146d4da7b86d12b60d90fa
SSDEEP 3072:DCRjtHlkm0iLzue68dRHXjigzBw2r//GrKwnkk68kpI8Qa:+jtFkiLjpdBTigPO+wn9fXK
TLSH
T136B312DB6956C99ECC1753BF85432EE4CB608DE8DE5EBB0AB2500C35C12CC6A2542BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\libcrypto-3.dll
Size 1.6MB
SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
MD5 7f1b899d2015164ab951d04ebb91e9ac
SHA1 1223986c8a1cbb57ef1725175986e15018cc9eab
SHA512 ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d
SSDEEP 49152:z6H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:z6c3CFFz8BBpWtbU1CPwDvt3uFlDCP
TLSH
T16575135121BFB90FF68995384F3588568A2A6736A35CEFF32DBD9D090C04E0E0A785DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\libssl-3.dll
Size 222KB
SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
MD5 264be59ff04e5dcd1d020f16aab3c8cb
SHA1 2d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA512 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248
SSDEEP 6144:Gmlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:l+t6Ce6XKtSHYomk2
TLSH
T13B2401D2751F682AC8239FBCDE7060EADB7CB7451780CA933B03D9557B98A0CA27D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\python312.dll
Size 1.7MB
SHA256 8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8
MD5 18677d48ba556e529b73d6e60afaf812
SHA1 68f93ed1e3425432ac639a8f0911c144f1d4c986
SHA512 a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02
SSDEEP 49152:RnCZdKhFC0D7jeJ/7oTvMUGRcAjO/rAAoBrJiI9Q:Rcd0J7ZGKyBrJZQ
TLSH
T12E8533B25C06CC1BDCB9B6BBA471D50B551833C14C9A88D6B860C7C2ABDBB126C6773C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\select.pyd
Size 25KB
SHA256 b3ff47c71e1023368e94314b6d371e01328dae9f6405398c72639129b89a48d2
MD5 f5540323c6bb870b3a94e1b3442e597b
SHA1 2581887ffc43fa4a6cbd47f5d4745152ce40a5a7
SHA512 56ee1da2fb604ef9f30eca33163e3f286540d3f738ed7105fc70a2bccef7163e0e5afd0aeb68caf979d9493cd5a6a286e6943f6cd59c8e18902657807aa652e3
SSDEEP 768:JGXeQMA/5Lcpo72ISQGRz5YiSyvB2AMxkEp:JBA/t72ISQGR97Sy+x9
TLSH
T1AEC29EE382B4DC68DD27CCB131D58A25EE70BD939E40C7DB315C926A4F613426B963B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\sqlite3.dll
Size 644KB
SHA256 ad9afd1225847ae694e091b833b35aa03445b637e35fb2873812db358d783f29
MD5 8a6c2b015c11292de9d556b5275dc998
SHA1 4dcf83e3b50970374eef06b79d323a01f5364190
SHA512 819f4e888831524ceeed875161880a830794a748add2bf887895d682db1cec29eaddc5eddf1e90d982f4c78a9747f960d75f7a87bdda3b4f63ea2f326db05387
SSDEEP 12288:yjFc9XUn2iq3Z7tTogf3AKuApDVPXyHaDRtIRqMo4UE0Azc2kz9p:n98qt37rXy6N60MolE0sc2w9p
TLSH
T124E423D688EADD9CF4F29571E1DB32FB804229A2ACF8D8C7F744C5769D182A273561C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44482\unicodedata.pyd
Size 295KB
SHA256 7dc64867f466b666ff1a209b0ef92585ffb7b0cac3a87c27e6434a2d7b85594f
MD5 3f2da3ed690327ae6b320daa82d9be27
SHA1 32aebd8e8e17d6b113fc8f693259eba8b6b45ea5
SHA512 a4e6d58477baa35100aa946dfad42ad234f8affb26585d09f91cab89bbef3143fc45307967c9dbc43749ee06e93a94d87f436f5a390301823cd09e221cac8a10
SSDEEP 6144:pNy/RGowdgZYbehVzbgmWrsjznunlSCnE0uFGtdepfO7ZuBuxJd+Rk7Vbl:pNy/RKgZqehiLs3ulBnZcpfO7Muxz+RG
TLSH
T10A541222D770BCFAFD23123C77492317BA61F9921424D2CF10EC865FAA75B123B46965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0u1ux2ns.pig.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0u1ux2ns.pig.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/808-64-0x00007FFCCA7C0000-0x00007FFCCA7E5000-memory.dmp

Download

memory/808-111-0x00007FFCC55C0000-0x00007FFCC573F000-memory.dmp

Download

memory/808-58-0x00007FFCCA720000-0x00007FFCCA753000-memory.dmp

Download

memory/808-51-0x00007FFCCBEF0000-0x00007FFCCBF09000-memory.dmp

Download

memory/808-61-0x00007FFCB3560000-0x00007FFCB3C24000-memory.dmp

Download

memory/808-62-0x00007FFCB3030000-0x00007FFCB3559000-memory.dmp

Download

memory/808-48-0x00007FFCC55C0000-0x00007FFCC573F000-memory.dmp

Download

memory/808-65-0x00007FFCBA080000-0x00007FFCBA14D000-memory.dmp

Download

memory/808-46-0x00007FFCCA760000-0x00007FFCCA784000-memory.dmp

Download

memory/808-72-0x00007FFCCA710000-0x00007FFCCA71D000-memory.dmp

Download

memory/808-71-0x00007FFCCA790000-0x00007FFCCA7BD000-memory.dmp

Download

memory/808-68-0x00007FFCCA9F0000-0x00007FFCCAA04000-memory.dmp

Download

memory/808-43-0x00007FFCCBF80000-0x00007FFCCBF9A000-memory.dmp

Download

memory/808-39-0x00007FFCCA790000-0x00007FFCCA7BD000-memory.dmp

Download

memory/808-75-0x00007FFCB9F60000-0x00007FFCBA07B000-memory.dmp

Download

memory/808-25-0x00007FFCB3560000-0x00007FFCB3C24000-memory.dmp

Download

memory/808-32-0x00007FFCCC040000-0x00007FFCCC04F000-memory.dmp

Download

memory/808-30-0x00007FFCCA7C0000-0x00007FFCCA7E5000-memory.dmp

Download

memory/808-106-0x00007FFCCA7C0000-0x00007FFCCA7E5000-memory.dmp

Download

memory/808-107-0x00007FFCCC040000-0x00007FFCCC04F000-memory.dmp

Download

memory/808-104-0x00007FFCCA760000-0x00007FFCCA784000-memory.dmp

Download

memory/808-108-0x00007FFCCA790000-0x00007FFCCA7BD000-memory.dmp

Download

memory/808-114-0x00007FFCCA720000-0x00007FFCCA753000-memory.dmp

Download

memory/808-115-0x00007FFCB3030000-0x00007FFCB3559000-memory.dmp

Download

memory/808-116-0x00007FFCBA080000-0x00007FFCBA14D000-memory.dmp

Download

memory/808-119-0x00007FFCB9F60000-0x00007FFCBA07B000-memory.dmp

Download

memory/808-118-0x00007FFCCA710000-0x00007FFCCA71D000-memory.dmp

Download

memory/808-117-0x00007FFCCA9F0000-0x00007FFCCAA04000-memory.dmp

Download

memory/808-55-0x00007FFCCC030000-0x00007FFCCC03D000-memory.dmp

Download

memory/808-113-0x00007FFCCC030000-0x00007FFCCC03D000-memory.dmp

Download

memory/808-112-0x00007FFCCBEF0000-0x00007FFCCBF09000-memory.dmp

Download

memory/808-110-0x00007FFCCA760000-0x00007FFCCA784000-memory.dmp

Download

memory/808-109-0x00007FFCCBF80000-0x00007FFCCBF9A000-memory.dmp

Download

memory/808-105-0x00007FFCB3560000-0x00007FFCB3C24000-memory.dmp

Download

memory/2232-100-0x0000025975EA0000-0x0000025975EBE000-memory.dmp

Download

memory/2232-76-0x000002595DAA0000-0x000002595DAC2000-memory.dmp

Download

memory/5380-103-0x00000152C88D0000-0x00000152C88DA000-memory.dmp

Download

memory/5380-102-0x00000152C8810000-0x00000152C88C2000-memory.dmp

Download