dedea55918c54fbb92b4ea1a8fa7e570e6118045430f26fdf487833c96f0eca2

Analysis

max time kernel
151s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 73.7MB
Sample260924-cdm2nabf88
SHA256 dedea55918c54fbb92b4ea1a8fa7e570e6118045430f26fdf487833c96f0eca2
MD5 bc70e4ffe3c49cb6b491076369504a09
SHA1 d738105e1ac2926c46fde61fd5b3f6cd843dd46d
SHA512 46f4cba70c44c02d6083934d7fe809b57c829bc9cb2a4603028426753abf0a248b963a42e8f7e291261be2fcbe442dbeeca1f2bbc45a3fc5545d24918de73057
SSDEEP 1572864:GFckoJZ6+qqt9HRW2ETUpH+cbdLh4+pRPU1YgaYgXXZ:l8qfHRW2ETU51h5o1YjX
TLSH
T1A50833683190A217F673A9B33AD15606AF56F90C13905A6B87783F227E270E3573CB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c622-62.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/memory/928-102-0x0000000000F70000-0x0000000001156000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with Goliath 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c622-62.dat	INDICATOR_EXE_Packed_Goliath
behavioral2/memory/928-102-0x0000000000F70000-0x0000000001156000-memory.dmp	INDICATOR_EXE_Packed_Goliath

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
200	powershell.exe
2756	powershell.exe
5164	powershell.exe
2808	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3144	cmd.exe
4604	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3768	pnpm-build.exe
928	Extreme Injector v3.exe
2116	pnpm-build.exe

Loads dropped DLL 50 IoCs

pid	Process
3300	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3300	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3300	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3300	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3768	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4348	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
4	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2504	cmd.exe
4652	cmd.exe
5996	cmd.exe
4908	cmd.exe
4376	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2484	netsh.exe

Kills process with taskkill 28 IoCs

defense_evasion

pid	Process
5116	taskkill.exe
5124	taskkill.exe
4748	taskkill.exe
4280	taskkill.exe
3608	taskkill.exe
4924	taskkill.exe
5324	taskkill.exe
4688	taskkill.exe
5284	taskkill.exe
4564	taskkill.exe
1652	taskkill.exe
2556	taskkill.exe
6072	taskkill.exe
4676	taskkill.exe
1160	taskkill.exe
5288	taskkill.exe
4628	taskkill.exe
3916	taskkill.exe
3544	taskkill.exe
1096	taskkill.exe
6016	taskkill.exe
1964	taskkill.exe
2464	taskkill.exe
828	taskkill.exe
4548	taskkill.exe
4668	taskkill.exe
2000	taskkill.exe
4940	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
2116	pnpm-build.exe
4604	powershell.exe
4604	powershell.exe
2756	powershell.exe
2756	powershell.exe
2808	powershell.exe
2808	powershell.exe
5164	powershell.exe
5164	powershell.exe
4604	powershell.exe
5164	powershell.exe
2756	powershell.exe
2808	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
2932	powershell.exe
2932	powershell.exe
2932	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe
4772	powershell.exe
4772	powershell.exe
4772	powershell.exe
468	powershell.exe
468	powershell.exe
468	powershell.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
5628	powershell.exe
5628	powershell.exe
5628	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
200	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	Extreme Injector v3.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeDebugPrivilege	928	Extreme Injector v3.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeDebugPrivilege	2116	pnpm-build.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeIncreaseQuotaPrivilege	6016	powershell.exe
Token: SeSecurityPrivilege	6016	powershell.exe
Token: SeTakeOwnershipPrivilege	6016	powershell.exe
Token: SeLoadDriverPrivilege	6016	powershell.exe
Token: SeSystemProfilePrivilege	6016	powershell.exe
Token: SeSystemtimePrivilege	6016	powershell.exe
Token: SeProfSingleProcessPrivilege	6016	powershell.exe
Token: SeIncBasePriorityPrivilege	6016	powershell.exe
Token: SeCreatePagefilePrivilege	6016	powershell.exe
Token: SeBackupPrivilege	6016	powershell.exe
Token: SeRestorePrivilege	6016	powershell.exe
Token: SeShutdownPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeSystemEnvironmentPrivilege	6016	powershell.exe
Token: SeRemoteShutdownPrivilege	6016	powershell.exe
Token: SeUndockPrivilege	6016	powershell.exe
Token: SeManageVolumePrivilege	6016	powershell.exe
Token: 33	6016	powershell.exe
Token: 34	6016	powershell.exe
Token: 35	6016	powershell.exe
Token: 36	6016	powershell.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeDebugPrivilege	2116	pnpm-build.exe
Token: SeDebugPrivilege	2116	pnpm-build.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	5164	powershell.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: 33	928	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	928	Extreme Injector v3.exe
Token: SeDebugPrivilege	3544	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5164	powershell.exe
Token: SeSecurityPrivilege	5164	powershell.exe
Token: SeTakeOwnershipPrivilege	5164	powershell.exe
Token: SeLoadDriverPrivilege	5164	powershell.exe
Token: SeSystemProfilePrivilege	5164	powershell.exe
Token: SeSystemtimePrivilege	5164	powershell.exe
Token: SeProfSingleProcessPrivilege	5164	powershell.exe
Token: SeIncBasePriorityPrivilege	5164	powershell.exe
Token: SeCreatePagefilePrivilege	5164	powershell.exe
Token: SeBackupPrivilege	5164	powershell.exe
Token: SeRestorePrivilege	5164	powershell.exe
Token: SeShutdownPrivilege	5164	powershell.exe
Token: SeDebugPrivilege	5164	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5928 wrote to memory of 3300	5928	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 3300 wrote to memory of 3768	3300	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 3300 wrote to memory of 928	3300	2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3768 wrote to memory of 2116	3768	pnpm-build.exe	93
PID 2116 wrote to memory of 6016	2116	pnpm-build.exe	140
PID 2116 wrote to memory of 2484	2116	pnpm-build.exe	96
PID 2116 wrote to memory of 4908	2116	pnpm-build.exe	98
PID 2116 wrote to memory of 5996	2116	pnpm-build.exe	99
PID 2116 wrote to memory of 4652	2116	pnpm-build.exe	100
PID 2116 wrote to memory of 3144	2116	pnpm-build.exe	104
PID 2116 wrote to memory of 2504	2116	pnpm-build.exe	105
PID 2116 wrote to memory of 1652	2116	pnpm-build.exe	108
PID 2116 wrote to memory of 4376	2116	pnpm-build.exe	110
PID 2504 wrote to memory of 4688	2504	cmd.exe	159
PID 3144 wrote to memory of 4604	3144	cmd.exe	113
PID 4908 wrote to memory of 5164	4908	cmd.exe	114
PID 4652 wrote to memory of 2756	4652	cmd.exe	115
PID 5996 wrote to memory of 2808	5996	cmd.exe	116
PID 4376 wrote to memory of 5252	4376	cmd.exe	117
PID 2116 wrote to memory of 4280	2116	pnpm-build.exe	118
PID 2116 wrote to memory of 4348	2116	pnpm-build.exe	120
PID 2116 wrote to memory of 2556	2116	pnpm-build.exe	153
PID 4348 wrote to memory of 3456	4348	cmd.exe	125
PID 2116 wrote to memory of 3544	2116	pnpm-build.exe	190
PID 2116 wrote to memory of 1096	2116	pnpm-build.exe	128
PID 2116 wrote to memory of 2000	2116	pnpm-build.exe	130
PID 2116 wrote to memory of 5956	2116	pnpm-build.exe	199
PID 2116 wrote to memory of 3608	2116	pnpm-build.exe	134
PID 2116 wrote to memory of 6072	2116	pnpm-build.exe	136
PID 2116 wrote to memory of 4676	2116	pnpm-build.exe	138
PID 2116 wrote to memory of 6016	2116	pnpm-build.exe	140
PID 2116 wrote to memory of 2932	2116	pnpm-build.exe	142
PID 2116 wrote to memory of 1964	2116	pnpm-build.exe	144
PID 2116 wrote to memory of 4924	2116	pnpm-build.exe	147
PID 2116 wrote to memory of 1160	2116	pnpm-build.exe	149
PID 2116 wrote to memory of 5324	2116	pnpm-build.exe	206
PID 2116 wrote to memory of 2556	2116	pnpm-build.exe	153
PID 2116 wrote to memory of 4940	2116	pnpm-build.exe	188
PID 2116 wrote to memory of 5288	2116	pnpm-build.exe	157
PID 2116 wrote to memory of 4688	2116	pnpm-build.exe	159
PID 2116 wrote to memory of 2336	2116	pnpm-build.exe	161
PID 2116 wrote to memory of 4628	2116	pnpm-build.exe	162
PID 2116 wrote to memory of 2464	2116	pnpm-build.exe	165
PID 2116 wrote to memory of 5116	2116	pnpm-build.exe	167
PID 2116 wrote to memory of 828	2116	pnpm-build.exe	169
PID 2116 wrote to memory of 5124	2116	pnpm-build.exe	171
PID 2116 wrote to memory of 3216	2116	pnpm-build.exe	173
PID 2116 wrote to memory of 4548	2116	pnpm-build.exe	175
PID 2116 wrote to memory of 4668	2116	pnpm-build.exe	177
PID 2116 wrote to memory of 5284	2116	pnpm-build.exe	179
PID 2116 wrote to memory of 3916	2116	pnpm-build.exe	181
PID 2116 wrote to memory of 4564	2116	pnpm-build.exe	183
PID 2116 wrote to memory of 4772	2116	pnpm-build.exe	185
PID 2116 wrote to memory of 4748	2116	pnpm-build.exe	187
PID 2116 wrote to memory of 468	2116	pnpm-build.exe	189
PID 2116 wrote to memory of 1416	2116	pnpm-build.exe	191
PID 2116 wrote to memory of 3972	2116	pnpm-build.exe	193
PID 2116 wrote to memory of 3828	2116	pnpm-build.exe	195
PID 2116 wrote to memory of 5628	2116	pnpm-build.exe	197
PID 2116 wrote to memory of 5956	2116	pnpm-build.exe	199
PID 2116 wrote to memory of 3856	2116	pnpm-build.exe	201
PID 2116 wrote to memory of 2584	2116	pnpm-build.exe	203
PID 2116 wrote to memory of 200	2116	pnpm-build.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_bc70e4ffe3c49cb6b491076369504a09_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Users\Admin\AppData\Local\Temp\_MEI59282\pnpm-build.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI59282\pnpm-build.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\_MEI59282\pnpm-build.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI59282\pnpm-build.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_ComputerSystemProduct).UUID
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6016
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\_MEI59282\pnpm-build.exe""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\_MEI59282\pnpm-build.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\charliekirk\dakirk.exe""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5996
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\charliekirk\dakirk.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath "C:\Users\Admin""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4652
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2504
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:4688
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /query /tn kirkyboiiii /v /fo list"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn kirkyboiiii /v /fo list
        6⤵
        
        PID:5252
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM orbitum.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /delete /tn kirkyboiiii /f"
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:4348
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn kirkyboiiii /f
        6⤵
        
        PID:3456
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chromium.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM iron.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM wavebrowser.exe
        5⤵
        Kills process with taskkill
        
        PID:1096
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM samsunginternet.exe
        5⤵
        Kills process with taskkill
        
        PID:2000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_OperatingSystem).Caption
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5956
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM iridium.exe
        5⤵
        Kills process with taskkill
        
        PID:3608
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        5⤵
        Kills process with taskkill
        
        PID:6072
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM 7chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:4676
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM zen.exe
        5⤵
        Kills process with taskkill
        
        PID:6016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_OperatingSystem).BuildType
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2932
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:1964
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM mullvadbrowser.exeamigo.exe
        5⤵
        Kills process with taskkill
        
        PID:4924
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM epic.exe
        5⤵
        Kills process with taskkill
        
        PID:1160
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM comet.exe
        5⤵
        Kills process with taskkill
        
        PID:5324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_BIOS).SerialNumber
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2556
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM shift.exe
        5⤵
        Kills process with taskkill
        
        PID:4940
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM escosiabrowser.exe
        5⤵
        Kills process with taskkill
        
        PID:5288
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM duckduckgo.exe
        5⤵
        Kills process with taskkill
        
        PID:4688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance -Class SoftwareLicensingService).OA3xOriginalProductKey
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2336
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM dragon.exe
        5⤵
        Kills process with taskkill
        
        PID:4628
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM brave.exe
        5⤵
        Kills process with taskkill
        
        PID:2464
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM opera.exe
        5⤵
        Kills process with taskkill
        
        PID:5116
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        5⤵
        Kills process with taskkill
        
        PID:828
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM hola.exe
        5⤵
        Kills process with taskkill
        
        PID:5124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_OperatingSystem).InstallDate
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3216
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM AVGBrowser.exe
        5⤵
        Kills process with taskkill
        
        PID:4548
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM hola-browser.exe
        5⤵
        Kills process with taskkill
        
        PID:4668
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM waterfox.exe
        5⤵
        Kills process with taskkill
        
        PID:5284
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM seamonkey.exe
        5⤵
        Kills process with taskkill
        
        PID:3916
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM AvastBrowser.exe
        5⤵
        Kills process with taskkill
        
        PID:4564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4772
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM browser.exe
        5⤵
        Kills process with taskkill
        
        PID:4748
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_VideoController).MaxRefreshRate
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:468
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_TimeZone).Caption
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_ComputerSystem).Model
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_ComputerSystem).SystemType
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_Processor).Name
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_BIOS).SMBIOSBIOSVersion
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_VideoController).CurrentHorizontalResolution
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance Win32_VideoController).CurrentVerticalResolution
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (Get-CimInstance -Namespace 'root/SecurityCenter2' -ClassName 'AntivirusProduct').DisplayName
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:200
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5324
- - C:\Users\Admin\AppData\Local\Temp\_MEI59282\Extreme Injector v3.exe
    "C:\Users\Admin\AppData\Local\Temp\_MEI59282\Extreme Injector v3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_ctypes.pyd
Size 124KB
SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
MD5 f8d2950d5496d3940aef6758c9e9e576
SHA1 ed68c88c14e44871a085e93bf8cf6aabc816ce28
SHA512 ab25ff65abd64f39b156f7aa91c35a327c930f31d3a5d128e67e00c6307e0a0637595ab812931dc2ffec7102e33a2afc746de6267f6130d4f5a8d3445bcded79
SSDEEP 3072:+X+A2TuMyOpRf8/dy+5pf/EaWODBiPxI+LPKaO:3VTuTOpRIpf/EaNDCo
TLSH
T1C5C36D0B379400A6EBA35178C5736E07D7B1B45B172193CF12A4C6992F637A36E3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_hashlib.pyd
Size 65KB
SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
MD5 5b08c2dcbe1b1dea46abbd6c9425878e
SHA1 8fe7d98d8f3ccab36d92da7e84cdc0f7d10dbadd
SHA512 3843966697558800c639037a34da13f6bd6a0c3816bc0bbd292f04db13acc03f0b79a8fab4c58ad25fe18dd11471bc9dc20cc0d9c97c4c63fbe025ea6242b4d7
SSDEEP 1536:axO3I17/ZRoh3IcV3WFI+OImPyUzR9pfIPn:AFZR0IcNWFI+OIz/
TLSH
T1E9638D09A69540A9D6778174C9A39F87F9F1F2421710A7EF4268C28D2F233C3D77A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_queue.pyd
Size 32KB
SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
MD5 6f8624f0746fa31cf72ef568d6a121f1
SHA1 1054fb373ea2aa51cb04fe98e6efd130be34fc43
SHA512 e52199265a0360027d21034060984dd2100b79faeb03b86cb7a6545da10c00d860117598f659ca38c5bddf368d2f525e4a337011cc78bbce5307baa52588fb9a
SSDEEP 768:j1zRmezU6rGS17r4xI+QUtlJyUFRYT2Ip4ACxf1mlD0D8:9Rm01Gw7r4xI+QUtvyUzR9xfIID8
TLSH
T1ABE27DCBAA684047D563D670C2B2DE92F935B7D3160187DF206AC18D2F277C2A72971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_socket.pyd
Size 83KB
SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
MD5 dc5a5ab89e6e2b48cb50b463b214fd89
SHA1 f7740ff9d75767ccdac7aa0dde8659d3133249a2
SHA512 98a886daa82848bc4ca352ec7e7f663822cbad5cd40c5ea7915821097964167d0628af47b8f19f22a825f9696f3199ffbaa94d699ae773a7eb57ae6dc1c3814f
SSDEEP 1536:bOYxHEUZql2HLSyypHT9/s+S+pzm8iaWmIHJyKNxI+LwWWyUzR9nfIc2Xm:qdUZqzyypHT9/sT+pzm8NxIplNxI+Lw5
TLSH
T175836A05A6A051FADB63C175C2639E23FBB4B5C11395A35F10A2C65A1F337C2BF39A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_sqlite3.pyd
Size 124KB
SHA256 c135f756acf749cb5bac4c4eb48adc06a22a6c5318399ea26763530bd73df5f6
MD5 97c255c1a9db767941d8dad861be443f
SHA1 a6d2bbce1c9e882dc1c4a08cfc8425ade036eb3c
SHA512 380325bc4a912a86d83a4783ac42cd7bd0ff0b5cea73652380afb566db3271a94e11fedd19e0c347634a249e0a7e52ee8099ef602bcfa7f39cf0ae41cdf62c6a
SSDEEP 3072:cNjpgcptGwb/0+CO4w5ygFlA/nN7kLBqeFI+OQik:cCtC5nlAF7uBqeb
TLSH
T17BC34A67231810AAE9B751B8C1734A03EB75F5621371939F41A0C6892F377C2AF3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_ssl.pyd
Size 175KB
SHA256 81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128
MD5 25d4b1c6ca053c573a55d68ae3db5ce2
SHA1 ed6bc021e3d5e5ca8083e22b718bc89d55d3ab7f
SHA512 396a5432461408059ccda92cc9ca641e68150aad02efcb635dcd3f7d68d9dd09ccec0619705abf3f43a959997b4f8821b726822b89c217c4054f8e8a67eb7fc3
SSDEEP 3072:H1l+KugCpMRjN/fP6X6z7Gx8nvgkKuFBZd4rYcvsswCfyX0NoFNI+C7Bt:H1QKugCpAJHP6X6gQvg9gFq
TLSH
T15B048C07B6442AF7D813E4B9C2334903EBB1F155331257DE48D5D68A0F07B4AAE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\_wmi.pyd
Size 39KB
SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
MD5 e203a46e89f443646cec65d96aceadba
SHA1 6ec891960ac4b9d501e593157f5e89bcddeb0cb4
SHA512 5678c0cff56e41b59577c13fd206af279831bfca6fa9e56b4fd6f960f3c11834775498ed2d9008a21b6ef65cb2dfffa0152a4e2ad1da4cf198ecceedcb599e4d
SSDEEP 768:YEkKOSx+lZbHE+NQ6PlNI+Ci2JyUFRYT2Ip4/Txf1mlBqsyvvqJ:YE9O5XQ+NQcNI+Ci6yUzR9FfIQsy3qJ
TLSH
T1AE036D8AE7680046E963DA75CAB6CE53F974B7D31712D38F325585990F223C0E73932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\base_library.zip
Size 1.3MB
SHA256 fc1aa50ae0e0296672342be34f31c59c7483dccb93371c5428edbc02fb26b404
MD5 9e83b5ab4a210943d75099f8acad3eb1
SHA1 5e68f677be36ad3541336dde707a967a28102cfc
SHA512 eec477fc46babd19d44dcefa436c6655d796eb02144b7d79169f5eee672370a7bebe69eedd1dfae03767e175155609d8bee7545fefba92624638ec242280453c
SSDEEP 12288:C2twy2/HWdN8lJGUm47HbP1dm+Rp/R6nVTVihlyixmpvQXMHYBrmn94NZs:C272/Ha8lJGU/bP1dm+HMho69ms
TLSH
T10C55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\charset_normalizer\md.cp312-win_amd64.pyd
Size 10KB
SHA256 76a535e0953b48a2348b877236a5799cf1d01cb21422c7f17942f35367cb5c8f
MD5 52726cc0c88dd2c0b528dcf1e936ea88
SHA1 edb91fa3ba8f1a128b581c297621c495e5b90f1e
SHA512 48d432cb6e3f6ed76be4ab2079f00b44b4ad9022f9f6c66ba925b4c5dddc8a4a851c3aed901b694b7bd658d98ee32df8a6bf8bf65b5f13c9a6df8642a7b46c97
SSDEEP 192:M6dxGrmoX+sMl/++Ch9p8mBd1pcVL58A0JH6:7dx4m446BDXcj8Ae
TLSH
T1A022085CFF6458EAD9268134C9375E4AB132BB22170277CF8770906A2FA37F26534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 124KB
SHA256 0830c3ff6e6f8394a7df170f95fc10de65ab9f22b30f9d2383f0cc299b8df101
MD5 1bb4e612320cc2aca375db74384ed88a
SHA1 c706ab2e599a656b9f9dd2344b890215a41cec49
SHA512 beac2a1628d5fbe7e2f7a17e41afeb7c5e84fe5fde9de6a87a19dbf42a022e8ca6fb5d49e38d9bc0d5e2949cd86f63207ab6fbbcb710701a33b585cfb2385597
SSDEEP 1536:Yn/j8rmzdfRYc0L/JBffqUpMJ4pNuk6G4JdeqBSQxwg1uZ1geLusbq63a:Yn/Irwqci/JBHqUpJuFPeeer9Lusbq
TLSH
T1F6C3192762950077CA634279CDB7A512D7E1F5510B3263CF04A4C6A95F03BEABEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\psutil\_psutil_windows.pyd
Size 65KB
SHA256 43e09408673687a787415912336ac13fcca9a7d7945b73d0c84ac4bb071e9106
MD5 2c62184e46ecc1641b8e09690f820405
SHA1 953db2789d5eeab981558388a727bd4d42364dd6
SHA512 2df440a9bf87345a5a0727cf4ae68592b32324a3a4d4611d047fbca7984a9b8e55487d89e83e80df8e0580c2a1db26db9722dbf18d4b2c8fd2770a55309e573e
SSDEEP 1536:PwseNxkc7Xva0Y420G1UD+dS4LBeLmRy:Pskcbi0Y42bUD+dS4VeiRy
TLSH
T179635C46B36800F4D95BA17C89B36933E9B2B0521729A7CF05A0D69A0F63BD7633DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\python3.dll
Size 68KB
SHA256 7c3e2956271eff4949145d14635c0ca659db5ed19215201d2d8b3a4a3d3006f9
MD5 acd6bad0ea9a91ce06189bb63d594b41
SHA1 46ee5089000b5c312739a909662142104d4d8be9
SHA512 79b888bda9804a9091f5fe8d411f2a81439d3d9618e6bd73a3f729bc977cd8e15914f3fd9f90462331aee431713c8ed7ffe864c975faa6083d7925d17d43b315
SSDEEP 1536:zDmF61JFn+/OzxI+L04yUzR96fI+vuGVR:zqU1txI+L0U4VR
TLSH
T16A637142BB54F893D7FA66FC7AD199CE642B12CC472988ECA47593D30D1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\pywin32_system32\pywintypes312.dll
Size 131KB
SHA256 bd33548dbdbb178873be92901b282bad9c6817e3eac154ca50a666d5753fd7ec
MD5 26d752c8896b324ffd12827a5e4b2808
SHA1 447979fa03f78cb7210a4e4ba365085ab2f42c22
SHA512 99c87ab9920e79a03169b29a2f838d568ca4d4056b54a67bc51caf5c0ff5a4897ed02533ba504f884c6f983ebc400743e6ad52ac451821385b1e25c3b1ebcee0
SSDEEP 3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
TLSH
T174D34A47374684CAE936D37DCDA71A02D3A2B0110715E3CF46A0C29B5F63BE66E3A746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\select.pyd
Size 32KB
SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
MD5 208cef2d2c60a3457b13aa428dceb347
SHA1 f78ddbe4be3ff0b21f06aea5f2266625d489470b
SHA512 8b0d14d1c93089368d34bdf49602f4c8e1daa1711c2760eeb2c59a10dbf7611fce098af0f11d7d5aa53d7d07dde39b1f31ecf5f62f7f91f31d7abeed5d828b19
SSDEEP 768:+FypHfy2YxI+QGXJyUFRYT2Ip4UJCxf1mltdK2363:+Fyp/y2YxI+QGZyUzR9UefI/K2e
TLSH
T1ABE27DCA6B745047EAA3D631C6A2CE43F939B7A35711869F30B9D1890E137C1B73A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\sqlite3.dll
Size 1.5MB
SHA256 272c41fb992490d32a1b4904b28ef3fad7fbbd07bbdcee625d849960809cf0bd
MD5 e082f3eb41fda914810a1ab45c4054bd
SHA1 410b72b64c6ab4280483ae99253d2fe71135a586
SHA512 9ae3040c9a16090f4bf3c4206a574347476282b296da3f1635a6015812703f80fe7716ff53fdf1d683c7dd706e3657acacc156727ea062cf97697fed63d354b9
SSDEEP 24576:deIwKJQJk9PHrkAJNIsI8jCf85+tJGGyhb6hsqFJh3Ea5yb0Owg8IXWABoR:rPLkAJNIqjCfU+SGu6hLFJtEa5ybXZXU
TLSH
T136658C4BF2B801ADC0A7C1B9C91B5707EBB2B4051774A7DB5590CA692F13FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37682\win32\win32crypt.pyd
Size 121KB
SHA256 f6ead250fc2de4330bd26079a44ded7f55172e05a70e28ad85d09e7881725155
MD5 47c91c74bb2c5cf696626af04f3705ab
SHA1 c086bc2825969756169fab7dd2e560d360e1e09c
SHA512 e6b6a4425b3e30cea7bf8b09971fa0c84d6317b1a37bc1518266dc8d72c166099a8fc40a9b985300901bd921e444ff438fd30b814c1f1c6a051df3471615c2bd
SSDEEP 3072:07jbPA0SD9S3vrCqf93qMHxCjdLZn1Ya:07jtS9SfuCRCjFV
TLSH
T117C32B17739559CAECAAE3BDC8235907E7A0B00943116BCF09A0C6D90F67BD46D3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extreme Injector v3.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI59282\Extreme Injector v3.exe
Size 1.9MB
SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
MD5 ec801a7d4b72a288ec6c207bb9ff0131
SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
TLSH
T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59282\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59282\_bz2.pyd
Size 84KB
SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
MD5 03bad8289d9aa18e859ed7270a719e92
SHA1 ee371b1afc7d5be754553d54bd0db8968568c703
SHA512 5267906b6daf79e898f87d24b6c0467f75df4c53fe0f44c5dcb02eeffef3b9b7078b2b1af3417ba92ab7586a7968a6b4fdb44b398287cdc1cb0c1dff2e4e9aab
SSDEEP 1536:smNz7JrA+VLsS7XtGHakUwFHkklV88YmTNiR1iNI+CVzyUzR9pfI/KYF:jNzdb7XfQVpn/pTSYNI+CVCb
TLSH
T171839E86E36962F6F46B91B986910393F730BA51075093BFF258C2592F03F816E6C35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59282\_lzma.pyd
Size 156KB
SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
MD5 02b16654f73129b1a1220c00d757112d
SHA1 7ce602e4c2854be7c6b439bc64162d58b1467750
SHA512 8daf5d68230d0340e5d940067afca39922078ce94b6753f2be7ae208d7982e87f5273aca768465b110477f83735f4c8e14f7bf95c2a48e2e5457bc723398e541
SSDEEP 3072:dA1h7DfXFDu7NjQ69wJGznfV9mNojn+RN1VlHNiNI+Z1zxVVm:dMDfZOX9YOjKlHNiHw
TLSH
T117F34B96A394F0D6F3628C78D6628F53E7F5781A0310929E01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI59282\base_library.zip
Size 1.3MB
SHA256 5b4bcfe12ff09c1aaa2b20171d4c0ee6b153e4203080413da2364f7ef35a8daa
MD5 9dd9ab7076ec00842b0dac33d093de72
SHA1 325150876d27bfef995e202721ae377106259e99
SHA512 ed15f0e73bf894ef6319b4c98ab25ddc08e3f7497bb48b56a3b8adcc99f736a2cc4572496c9712e9b91a14a91ce33a1d2952757affb49ee296371dbfebacb9ad
SSDEEP 12288:9rmn9lqR4NxD8lJGUmLHbP1dmGsnVTVihlyixmpvQXMHYw2tq/R82/HkDd:969M48lJGUObP1dm5hr2A62/Hsd
TLSH
T1DE55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59282\python312.dll
Size 6.6MB
SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
MD5 f9a43765b486c561bf0895eb9390ed1f
SHA1 b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
SHA512 f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
SSDEEP 98304:8HdLykRHSHAtre59efJBVvTHqMiEnrZpd50:8HdLykRXg9Y5iEZpdu
TLSH
T11A667C567358C0A9C97BA0B0CC13C68EE7B27C517F50930B70AAB75E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_em0slway.uvb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_em0slway.uvb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-296-0x000001ECC5950000-0x000001ECC5A02000-memory.dmp

Download

memory/928-134-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-297-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-110-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-111-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-112-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-148-0x000000001C220000-0x000000001C232000-memory.dmp

Download

memory/928-222-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-108-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-109-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-102-0x0000000000F70000-0x0000000001156000-memory.dmp

Download

memory/928-155-0x000000001F260000-0x000000001F29C000-memory.dmp

Download

memory/928-154-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-168-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-91-0x00007FF84A94F000-0x00007FF84A950000-memory.dmp

Download

memory/928-104-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-277-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/928-266-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp

Download

memory/3216-285-0x0000012370A60000-0x0000012370B12000-memory.dmp

Download

memory/5164-250-0x0000020977420000-0x00000209774D2000-memory.dmp

Download

memory/6016-231-0x00000150EFEF0000-0x00000150EFF1A000-memory.dmp

Download

memory/6016-232-0x00000150EFEF0000-0x00000150EFF14000-memory.dmp

Download

memory/6016-230-0x00000150EFCC0000-0x00000150EFCCA000-memory.dmp

Download

memory/6016-229-0x00000150EFE00000-0x00000150EFEB2000-memory.dmp

Download

memory/6016-228-0x00000150EFCA0000-0x00000150EFCBE000-memory.dmp

Download

memory/6016-225-0x00000150EFC00000-0x00000150EFC22000-memory.dmp

Download