2177b545fb5cf6551b0ab3712b906360452f09a91eade477c19e0524ed2edb4d

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 26.4MB
Sample260924-lr35gascph
SHA256 2177b545fb5cf6551b0ab3712b906360452f09a91eade477c19e0524ed2edb4d
MD5 45e3752e45783970e8147d5be54eb354
SHA1 f074c6e9825fcb554ac6b63eea3e870cf8114c86
SHA512 db5a03ab4bd0e6d76cc12f6f8394b53a2ec5ee755e39cbdbe054770f50b88e8dcdc4a1c77ef9292fea6c76e3eea11ef01aac863bd965e49684ec28e7d6b5c6b7
SSDEEP 786432:LrJioW+e5RY2j6+s7LWB75zupeoztZ026e5g8QT:VW+eHY2qHWB75ip509
TLSH
T1F9573359A28454F7FBEA843BD5124177F223F4215360D66F5BB4523207CF22B8F3992A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Loads dropped DLL 44 IoCs

pid	Process
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
11	discord.com
12	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
8	ipinfo.io

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5500	cmd.exe
4708	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5028	wmic.exe
5028	wmic.exe
5028	wmic.exe
5028	wmic.exe
4588	powershell.exe
4588	powershell.exe
3016	powershell.exe
3016	powershell.exe
1052	wmic.exe
1052	wmic.exe
1052	wmic.exe
1052	wmic.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
3048	powershell.exe
3048	powershell.exe
4108	wmic.exe
4108	wmic.exe
4108	wmic.exe
4108	wmic.exe
4440	powershell.exe
4440	powershell.exe
3228	powershell.exe
3228	powershell.exe
5068	wmic.exe
5068	wmic.exe
5068	wmic.exe
5068	wmic.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
5868	powershell.exe
5868	powershell.exe
4280	powershell.exe
4280	powershell.exe
6088	wmic.exe
6088	wmic.exe
6088	wmic.exe
6088	wmic.exe
1736	powershell.exe
1736	powershell.exe
3212	powershell.exe
3212	powershell.exe
2572	wmic.exe
2572	wmic.exe
2572	wmic.exe
2572	wmic.exe
3132	powershell.exe
3132	powershell.exe
1432	powershell.exe
1432	powershell.exe
2816	wmic.exe
2816	wmic.exe
2816	wmic.exe
2816	wmic.exe
2144	powershell.exe
2144	powershell.exe
2972	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeIncreaseQuotaPrivilege	5028	wmic.exe
Token: SeSecurityPrivilege	5028	wmic.exe
Token: SeTakeOwnershipPrivilege	5028	wmic.exe
Token: SeLoadDriverPrivilege	5028	wmic.exe
Token: SeSystemProfilePrivilege	5028	wmic.exe
Token: SeSystemtimePrivilege	5028	wmic.exe
Token: SeProfSingleProcessPrivilege	5028	wmic.exe
Token: SeIncBasePriorityPrivilege	5028	wmic.exe
Token: SeCreatePagefilePrivilege	5028	wmic.exe
Token: SeBackupPrivilege	5028	wmic.exe
Token: SeRestorePrivilege	5028	wmic.exe
Token: SeShutdownPrivilege	5028	wmic.exe
Token: SeDebugPrivilege	5028	wmic.exe
Token: SeSystemEnvironmentPrivilege	5028	wmic.exe
Token: SeRemoteShutdownPrivilege	5028	wmic.exe
Token: SeUndockPrivilege	5028	wmic.exe
Token: SeManageVolumePrivilege	5028	wmic.exe
Token: 33	5028	wmic.exe
Token: 34	5028	wmic.exe
Token: 35	5028	wmic.exe
Token: 36	5028	wmic.exe
Token: SeIncreaseQuotaPrivilege	5028	wmic.exe
Token: SeSecurityPrivilege	5028	wmic.exe
Token: SeTakeOwnershipPrivilege	5028	wmic.exe
Token: SeLoadDriverPrivilege	5028	wmic.exe
Token: SeSystemProfilePrivilege	5028	wmic.exe
Token: SeSystemtimePrivilege	5028	wmic.exe
Token: SeProfSingleProcessPrivilege	5028	wmic.exe
Token: SeIncBasePriorityPrivilege	5028	wmic.exe
Token: SeCreatePagefilePrivilege	5028	wmic.exe
Token: SeBackupPrivilege	5028	wmic.exe
Token: SeRestorePrivilege	5028	wmic.exe
Token: SeShutdownPrivilege	5028	wmic.exe
Token: SeDebugPrivilege	5028	wmic.exe
Token: SeSystemEnvironmentPrivilege	5028	wmic.exe
Token: SeRemoteShutdownPrivilege	5028	wmic.exe
Token: SeUndockPrivilege	5028	wmic.exe
Token: SeManageVolumePrivilege	5028	wmic.exe
Token: 33	5028	wmic.exe
Token: 34	5028	wmic.exe
Token: 35	5028	wmic.exe
Token: 36	5028	wmic.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeIncreaseQuotaPrivilege	1052	wmic.exe
Token: SeSecurityPrivilege	1052	wmic.exe
Token: SeTakeOwnershipPrivilege	1052	wmic.exe
Token: SeLoadDriverPrivilege	1052	wmic.exe
Token: SeSystemProfilePrivilege	1052	wmic.exe
Token: SeSystemtimePrivilege	1052	wmic.exe
Token: SeProfSingleProcessPrivilege	1052	wmic.exe
Token: SeIncBasePriorityPrivilege	1052	wmic.exe
Token: SeCreatePagefilePrivilege	1052	wmic.exe
Token: SeBackupPrivilege	1052	wmic.exe
Token: SeRestorePrivilege	1052	wmic.exe
Token: SeShutdownPrivilege	1052	wmic.exe
Token: SeDebugPrivilege	1052	wmic.exe
Token: SeSystemEnvironmentPrivilege	1052	wmic.exe
Token: SeRemoteShutdownPrivilege	1052	wmic.exe
Token: SeUndockPrivilege	1052	wmic.exe
Token: SeManageVolumePrivilege	1052	wmic.exe
Token: 33	1052	wmic.exe
Token: 34	1052	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 5960	432	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5960 wrote to memory of 5028	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 5960 wrote to memory of 4588	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	93
PID 5960 wrote to memory of 3016	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	95
PID 5960 wrote to memory of 1052	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 5960 wrote to memory of 5500	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	98
PID 5500 wrote to memory of 900	5500	cmd.exe	101
PID 5960 wrote to memory of 4484	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	102
PID 5960 wrote to memory of 4708	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	104
PID 4708 wrote to memory of 3388	4708	cmd.exe	106
PID 5960 wrote to memory of 3048	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	107
PID 5960 wrote to memory of 4108	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	149
PID 5960 wrote to memory of 4440	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	111
PID 5960 wrote to memory of 3228	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	113
PID 5960 wrote to memory of 5068	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	115
PID 5960 wrote to memory of 4828	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	117
PID 5960 wrote to memory of 2748	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	160
PID 5960 wrote to memory of 2756	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	121
PID 5960 wrote to memory of 5868	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	163
PID 5960 wrote to memory of 4280	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	125
PID 5960 wrote to memory of 6088	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	167
PID 5960 wrote to memory of 1736	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	210
PID 5960 wrote to memory of 3212	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	131
PID 5960 wrote to memory of 2572	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 5960 wrote to memory of 3132	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	135
PID 5960 wrote to memory of 1432	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	254
PID 5960 wrote to memory of 2816	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	180
PID 5960 wrote to memory of 2144	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	141
PID 5960 wrote to memory of 2972	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	143
PID 5960 wrote to memory of 5540	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 5960 wrote to memory of 1904	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	147
PID 5960 wrote to memory of 4108	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	149
PID 5960 wrote to memory of 3480	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	192
PID 5960 wrote to memory of 1708	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	153
PID 5960 wrote to memory of 4516	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	155
PID 5960 wrote to memory of 2340	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	197
PID 5960 wrote to memory of 2880	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	159
PID 5960 wrote to memory of 1144	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	161
PID 5960 wrote to memory of 5868	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	242
PID 5960 wrote to memory of 6056	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	165
PID 5960 wrote to memory of 6088	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	167
PID 5960 wrote to memory of 4080	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	169
PID 5960 wrote to memory of 1348	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	171
PID 5960 wrote to memory of 2780	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	252
PID 5960 wrote to memory of 2964	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	175
PID 5960 wrote to memory of 5336	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	218
PID 5960 wrote to memory of 1296	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	179
PID 5960 wrote to memory of 3548	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	181
PID 5960 wrote to memory of 1568	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	183
PID 5960 wrote to memory of 1160	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	185
PID 5960 wrote to memory of 4824	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	187
PID 5960 wrote to memory of 256	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	189
PID 5960 wrote to memory of 3692	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	191
PID 5960 wrote to memory of 3348	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	193
PID 5960 wrote to memory of 6068	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	195
PID 5960 wrote to memory of 2340	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	197
PID 5960 wrote to memory of 3524	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	199
PID 5960 wrote to memory of 5616	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	201
PID 5960 wrote to memory of 5584	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	203
PID 5960 wrote to memory of 1120	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	205
PID 5960 wrote to memory of 3944	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	207
PID 5960 wrote to memory of 4496	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	209
PID 5960 wrote to memory of 5060	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	211
PID 5960 wrote to memory of 3404	5960	2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	213

C:\Users\Admin\AppData\Local\Temp\2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_45e3752e45783970e8147d5be54eb354_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
      4⤵
      PID:900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
      4⤵
      PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3228
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2748
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4280
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3212
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1432
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4108
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:6056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:6088
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2816
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1160
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3480
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2340
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4496
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1736
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:1516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:4692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5656
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:4380
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5980
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:4660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:5368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:1432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:2868
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:2848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:3148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
MD5 e6a8d33648820752b04254098d837621
SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
TLSH
T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375
MD5 20708935fdd89b3eddeea27d4d0ea52a
SHA1 85a9fe2c7c5d97fd02b47327e431d88a1dc865f7
SHA512 f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b
SSDEEP 192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
TLSH
T1F7421A4AE9A585F9F96B4178C4330A49E5B6B900374177CF0332425A1E33BD1373A7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Cipher\_raw_cfb.pyd
Size 13KB
SHA256 faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45
MD5 43bbe5d04460bd5847000804234321a6
SHA1 3cae8c4982bbd73af26eb8c6413671425828dbb7
SHA512 dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b
SSDEEP 192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
TLSH
T12B520708F7D404B8F96B41B9C9371A5E96B97548272167DF032051AD2DA3BC23B3EBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8
MD5 c6b20332b4814799e643badffd8df2cd
SHA1 e7da1c1f09f6ec9a84af0ab0616afea55a58e984
SHA512 d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4
SSDEEP 192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
TLSH
T1AE620A0AEA9045B9F767427888724E0EE6FE74042352BBDF137592692E137C4333EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543
MD5 fee13d4fb947835dbb62aca7eaff44ef
SHA1 7cc088ab68f90c563d1fe22d5e3c3f9e414efc04
SHA512 dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2
SSDEEP 96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
TLSH
T13522F98DFE9149EFEA2581B985630E4AE079BB10175273CF1370962E1F663C7357A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Cipher\_raw_ofb.pyd
Size 12KB
SHA256 c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd
MD5 4d9182783ef19411ebd9f1f864a2ef2f
SHA1 ddc9f878b88e7b51b5f68a3f99a0857e362b0361
SHA512 8f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185
SSDEEP 192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
TLSH
T1AD421889FAE489FEE92642B6C4730A45A5B5B910378067CF0330525F1E233DA377A786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284
MD5 9d28433ea8ffbfe0c2870feda025f519
SHA1 4cc5cf74114d67934d346bb39ca76f01f7acc3e2
SHA512 66b4d00100d4143ea72a3f603fb193afa6fd4efb5a74d0d17a206b5ef825e4cc5af175f5fb5c40c022bde676ba7a83087cb95c9f57e701ca4e7f0a2fce76e599
SSDEEP 192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
TLSH
T116521856F9A444FEF96642F980B30A4D92F9B611A36173CF1320526B2E237C0667E3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Hash\_SHA1.pyd
Size 19KB
SHA256 a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725
MD5 ab0bcb36419ea87d827e770a080364f6
SHA1 6d398f48338fb017aacd00ae188606eb9e99e830
SHA512 3580fb949acee709836c36688457908c43860e68a36d3410f3fa9e17c6a66c1cdd7c081102468e4e92e5f42a0a802470e8f4d376daa4ed7126818538e0bd0bc4
SSDEEP 384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
TLSH
T1A9926C59E77E80ACD72D803CDA838E1B66B675198325B7DF03E1065E0C172E65D3B362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639
MD5 8f4313755f65509357e281744941bd36
SHA1 2aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0
SHA512 fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4
SSDEEP 96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
TLSH
T13A220A8DFD9249FFE62942B9C5670E4AE139BB10175273CF1370956A1E623C7313A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\PIL\_imaging.cp312-win_amd64.pyd
Size 2.5MB
SHA256 a2d830dca681d54c8ea8ce7ab454cb747e3ecd944d353b6adc52dc567e512a1b
MD5 ff6d9c67013d8608550df0aa2278f563
SHA1 3f7ebc6cb265031575c48f06302a672c6dff742c
SHA512 14b2e5bd724efeadba05fc57aa89d499b74b6e602d5bd78a7b79515b56dbd2bff8198950e442678ac9135bf8ca2e5896bcfdb2bed80b80fb212ba9a98a842c91
SSDEEP 49152:jqRN6h/N7gO4o6JlTzK7xVlkOZLrLrLrLzo0nx:eGSK7xj
TLSH
T147C55B02E5915896C7B28034CDABD626E371781D17F286F77284A7F93E23BD0353A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_asyncio.pyd
Size 69KB
SHA256 f8305023f6ad81ddc7124b311e500a58914b05a9b072bf9a6d079ea0f6257793
MD5 70fb0b118ac9fd3292dde530e1d789b8
SHA1 4adc8d81e74fc04bce64baf4f6147078eefbab33
SHA512 1ab72ea9f96c6153b9b5d82b01354381b04b93b7d58c0b54a441b6a748c81cccd2fc27bb3b10350ab376ff5ada9d83af67cce17e21ccbf25722baf1f2aef3c98
SSDEEP 1536:FRaPPkvNV036Fi9PQ1TUT8TIL11Miu0FIpOn27SyTxq:janCNV064YRUT8TIL11MV0FIpOn2S
TLSH
T1DD638E83A294059ADD57E2B4D4632F57EBB1F5520901478F62A8C18F3F6379242FFB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
TLSH
T11E839D93E76665B5F46B82BA99C10323E730FD150350939FB384831B2F22F927D6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_ctypes.pyd
Size 122KB
SHA256 543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
MD5 452305c8c5fda12f082834c3120db10a
SHA1 9bab7b3fd85b3c0f2bedc3c5adb68b2579daa6e7
SHA512 3d52afdbc8da74262475abc8f81415a0c368be70dbf5b2bd87c9c29ca3d14c44770a5b8b2e7c082f3ece0fd2ba1f98348a04b106a48d479fa6bd062712be8f7c
SSDEEP 3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
TLSH
T14AC36C17339410AAEBA34179C4732E07D7B1B45B1B2097CF02A4C6AA2F637936D6F752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
TLSH
T108537C05A69540A8D96781B9C8A35F57F9F2F1011B109BEF0368C18D2F237C3A6FB766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
TLSH
T142F33A92A394F4D5F7628C78D6624F17E7F678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_overlapped.pyd
Size 54KB
SHA256 2e53cc1bfa6e10a4de7e1f4081c5b952746e2d4fa7f8b9929ad818ce20b2cc9f
MD5 54c021e10f9901bf782c24d648a82b96
SHA1 cf173cc0a17308d7d87b62c1169b7b99655458bc
SHA512 e451226ece8c34c73e5b31e06fdc1d99e073e6e0651a0c5e04b0cf011e79d0747da7a5b6c5e94aca44cfceb9e85ce3d85afff081a574d1f53f115e39e9d4ff6c
SSDEEP 1536:3XRnts3McbN6w/xzWSsXZdR1r35IpXtW7Sy56xk3:HRvisXZdR1r5IpXtWz3
TLSH
T141437B1AA79004E9ED77C17EE9A30F16DAB0B1C65601835F62ACC24A1F7374377AE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_queue.pyd
Size 31KB
SHA256 d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
MD5 5aa4b057ba2331eed6b4b30f4b3e0d52
SHA1 6b9db113c2882743984c3d8b70ec49fc4a136c23
SHA512 aa5aa3285ea5c177eca055949c5f550dbd2d2699202a29efe2077213cbc95fff2a36d99eecce249ac04d95baf149b3d8c557a67fc39ead3229f0b329e83447b7
SSDEEP 768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
TLSH
T13DE28E83AA946C9AC423C47194D66E35F971B7525700C7EF3318C25E1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
TLSH
T1F1834911A69050FAEBB3C0B6C1675E23FBB4B4C01390938F1156C66A5F33782BE7DA91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_sqlite3.pyd
Size 121KB
SHA256 f3ca1d6b1ab8bb8d6f35a24fc602165e6995e371226e98ffeeed2eeec253c9df
MD5 de8b1c6df3ed65d3c96c7c30e0a52262
SHA1 8dd69e3506c047b43d7c80cdb38a73a44fd9d727
SHA512 a532ef79623beb1195f20537b3c2288a6b922f8e9b6d171ef96090e4cc00e754a129754c19f4d9d5e4b701bcff59e63779656aa559d117ef10590cfafc7404bb
SSDEEP 3072:YPfqZRAWgyjwjCO4w5ySDUfUK8PFIpOQGJ:RAWgKwGC5bSUvj
TLSH
T13DC35B67235400AAE9B751B9C5730A17DB75B422137083DF42A0C68A2F737C37E7AB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_ssl.pyd
Size 173KB
SHA256 2b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
MD5 6774d6fb8b9e7025254148dc32c49f47
SHA1 212e232da95ec8473eb0304cf89a5baf29020137
SHA512 5d9247dce96599160045962af86fc9e5439f66a7e8d15d1d00726ec1b3b49d9dd172d667380d644d05cb18e45a5419c2594b4bcf5a16ea01542ae4d7d9a05c6e
SSDEEP 3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
TLSH
T116047C47B6942DB7D813E4FAC1230913DBB1F015331257DE49D5D64A0F07B0AADAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\_wmi.pyd
Size 35KB
SHA256 0342916a60a7b39bbd5753d85e1c12a4d6f990499753d467018b21cefa49cf32
MD5 cb0564bc74258cb1320c606917ce5a71
SHA1 5b2bfc0d997cc5b7d985bfadddbfc180cb01f7cf
SHA512 43f3afa9801fcf5574a30f4d3e7ae6aff65c7716462f9aba5bc8055887a44bf38fba121639d8b31427e738752fe3b085d1d924de2633f4c042433e1960023f38
SSDEEP 768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
TLSH
T109F27E56E7641844ED37C6B998D64E1FE672B6468710C3CF3358C25A0F223C2BEBA364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\base_library.zip
Size 1.3MB
SHA256 eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
MD5 ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1 f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA512 4f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1d1YgCCaYcet:uttcY+UHCiCAd+cqHdmmPHzqEaYcet
TLSH
T17455D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\psutil\_psutil_windows.pyd
Size 65KB
SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
MD5 3cba71b6bc59c26518dc865241add80a
SHA1 7e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA512 3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2
SSDEEP 1536:BWseNxkc7Xva0Y420G1UD+dS4QBeLmRy:BWkcbi0Y42bUD+dS44eiRy
TLSH
T145635C56B35800F4D95BA17C89B36A33E9B2B0521729A7CF05A0C69A0F63BD7633DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\pyexpat.pyd
Size 194KB
SHA256 cdc09fbae2f103196215facd50d108be3eff60c8ee5795dcc80bf57a0f120cdf
MD5 e2d1c738d6d24a6dd86247d105318576
SHA1 384198f20724e4ede9e7b68e2d50883c664eee49
SHA512 3f9cb64b4456438dea82a0638e977f233faf0a08433f01ca87ba65c7e80b0680b0ec3009fa146f02ae1fdcc56271a66d99855d222e77b59a1713caf952a807da
SSDEEP 3072:jJB/b2LOWs5LS04q1uqtF+ai7dYbmdRLjDxKyw6XUWdRBIpLhCujk:dB6yx5LT1gqtF+XGeL/xiBoR4g
TLSH
T110145B57B1A6C0EBE8938038D6974A07CBB2F865078197CF12D4EB7D5F277423A69305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\python3.DLL
Size 66KB
SHA256 a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
MD5 4038af0427bce296ca8f3e98591e0723
SHA1 b2975225721959d87996454d049e6d878994cbf2
SHA512 db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3
SSDEEP 768:/BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM8:pDmF61JFn+/OJBIpL0j7Sy5xH
TLSH
T10E637152BB54F8A3DBFA65FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\python312.dll
Size 6.7MB
SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
MD5 48ebfefa21b480a9b0dbfc3364e1d066
SHA1 b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA512 4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
SSDEEP 98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
TLSH
T1C5665B127258C0AAD967A0B4CC23C6CEE7B1BC51BF50530B30AAB35E2F73796465E785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
TLSH
T154D28E576B642C49D823C9B2A4D28E26E931B6565710C2CF3368C15D1F327C37BBB369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\sqlite3.dll
Size 1.4MB
SHA256 17d547994008f1626be2877497912687cb3ebd9a407396804310fd12c85aead4
MD5 31cd2695493e9b0669d7361d92d46d94
SHA1 19c1bc5c3856665eca5390a2f9cd59b564c0139b
SHA512 9dd8d1b900999e8cea91f3d5f3f72d510f9cc28d7c6768a4046a9d2aa9e78a6ace1248ec9574f5f6e53a6f1bdbfdf153d9bf73dba05788625b03398716c87e1c
SSDEEP 24576:ATqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFq++I:nk0jwv4tP5kf8ar/74EF2/An4acrVUc2
TLSH
T1CC658C4BF2B800ADC1A7D1BAC61B5707EBB2B405177097DB5594CA692F13FE217BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4322\unicodedata.pyd
Size 1.1MB
SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
MD5 fc47b9e23ddf2c128e3569a622868dbe
SHA1 2814643b70847b496cbda990f6442d8ff4f0cb09
SHA512 7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
TLSH
T1E6354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4i2jp2yw.odv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4i2jp2yw.odv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4588-155-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-159-0x00000246DF830000-0x00000246DF852000-memory.dmp

Download

memory/4588-161-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-162-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-163-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-164-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-165-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-167-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-171-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-160-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-158-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-226-0x00007FFB5B830000-0x00007FFB5C1D4000-memory.dmp

Download

memory/4588-154-0x00007FFB5B9BF000-0x00007FFB5B9C0000-memory.dmp

Download