173d75d21b20edd26783db1275fb9838be66280635a8cb9de2b6869c591f892b

Analysis

max time kernel
151s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_be8dd5d8130dd50a27ec8b36d24a7fac_cobalt-strike_elex_glassworm_icedid_njrat.exe
Size 46.1MB
Sample261023-1713davy2m
SHA256 173d75d21b20edd26783db1275fb9838be66280635a8cb9de2b6869c591f892b
MD5 be8dd5d8130dd50a27ec8b36d24a7fac
SHA1 7e2684339db225e9ca385f4318e6e0b5e64f5172
SHA512 8d3638069d4bf17b22633fdc99b479b4ba5c66d8a9850d531752a0eba0bcd69877c47c3280178bac7a694549b61d93fd13d334feeefe272fecf28902fe33de82
SSDEEP 786432:62sjr7whZZyVmdPN2sX7tnep9Eib7yVmd+ZNcxd12QErtLNam4liTR+n7O7fYRzu:NsjnKPyVQPN1XRnep9EeyVQFN1ErtLNB
TLSH
T185B733D6B2A015EBE6F2443650929B56CE77B42B0361E1CB8750D3603D27FF0A8B5B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution pyinstaller spyware stealer trojan upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4676	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe
5172	powershell.exe
2108	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5172	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
1856	steroidsloud.exe
6036	Built_ayush.exe
4596	Built_ayush.exe
3340	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
4436	steroidsloud.exe
5852	rar.exe

Loads dropped DLL 64 IoCs

pid	Process
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
4596	Built_ayush.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
1096	MicrosoftEdgeUpdate.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe
4436	steroidsloud.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	steroidsloud.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
1	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001c72f-393.dat	upx
behavioral2/memory/1096-396-0x00007FFAA67A0000-0x00007FFAA6C02000-memory.dmp	upx
behavioral2/memory/1096-399-0x00007FFAAFFC0000-0x00007FFAAFFE4000-memory.dmp	upx
behavioral2/memory/1096-402-0x00007FFAAFF90000-0x00007FFAAFFBC000-memory.dmp	upx
behavioral2/memory/1096-401-0x00007FFAB58B0000-0x00007FFAB58C8000-memory.dmp	upx
behavioral2/memory/1096-400-0x00007FFABBB50000-0x00007FFABBB5F000-memory.dmp	upx
behavioral2/memory/1096-408-0x00007FFAAC560000-0x00007FFAAC6D1000-memory.dmp	upx
behavioral2/memory/1096-409-0x00007FFAAFF50000-0x00007FFAAFF69000-memory.dmp	upx
behavioral2/memory/1096-413-0x00007FFAAFE60000-0x00007FFAAFF17000-memory.dmp	upx
behavioral2/memory/1096-417-0x00007FFAAF8F0000-0x00007FFAAF905000-memory.dmp	upx
behavioral2/memory/1096-420-0x00007FFAA9850000-0x00007FFAA9968000-memory.dmp	upx
behavioral2/memory/1096-419-0x00007FFAAFF70000-0x00007FFAAFF8E000-memory.dmp	upx
behavioral2/memory/1096-418-0x00007FFAB67B0000-0x00007FFAB67BD000-memory.dmp	upx
behavioral2/memory/1096-441-0x00007FFAAC560000-0x00007FFAAC6D1000-memory.dmp	upx
behavioral2/memory/1096-415-0x00007FFAA6420000-0x00007FFAA6797000-memory.dmp	upx
behavioral2/memory/1096-414-0x00007FFAAFFC0000-0x00007FFAAFFE4000-memory.dmp	upx
behavioral2/memory/1096-412-0x00007FFAA67A0000-0x00007FFAA6C02000-memory.dmp	upx
behavioral2/memory/1096-411-0x00007FFAAFF20000-0x00007FFAAFF4E000-memory.dmp	upx
behavioral2/memory/1096-410-0x00007FFAB68D0000-0x00007FFAB68DD000-memory.dmp	upx
behavioral2/memory/1096-407-0x00007FFAAFF70000-0x00007FFAAFF8E000-memory.dmp	upx
behavioral2/memory/1096-503-0x00007FFAAFF50000-0x00007FFAAFF69000-memory.dmp	upx
behavioral2/memory/1096-534-0x00007FFAAFF20000-0x00007FFAAFF4E000-memory.dmp	upx
behavioral2/memory/1096-539-0x00007FFAA9850000-0x00007FFAA9968000-memory.dmp	upx
behavioral2/memory/1096-538-0x00007FFAB67B0000-0x00007FFAB67BD000-memory.dmp	upx
behavioral2/memory/1096-537-0x00007FFAAF8F0000-0x00007FFAAF905000-memory.dmp	upx
behavioral2/memory/1096-536-0x00007FFAA6420000-0x00007FFAA6797000-memory.dmp	upx
behavioral2/memory/1096-535-0x00007FFAAFE60000-0x00007FFAAFF17000-memory.dmp	upx
behavioral2/memory/1096-531-0x00007FFAAC560000-0x00007FFAAC6D1000-memory.dmp	upx
behavioral2/memory/1096-525-0x00007FFAA67A0000-0x00007FFAA6C02000-memory.dmp	upx
behavioral2/memory/1096-533-0x00007FFAB68D0000-0x00007FFAB68DD000-memory.dmp	upx
behavioral2/memory/1096-532-0x00007FFAAFF50000-0x00007FFAAFF69000-memory.dmp	upx
behavioral2/memory/1096-530-0x00007FFAAFF70000-0x00007FFAAFF8E000-memory.dmp	upx
behavioral2/memory/1096-529-0x00007FFAAFF90000-0x00007FFAAFFBC000-memory.dmp	upx
behavioral2/memory/1096-528-0x00007FFAB58B0000-0x00007FFAB58C8000-memory.dmp	upx
behavioral2/memory/1096-527-0x00007FFABBB50000-0x00007FFABBB5F000-memory.dmp	upx
behavioral2/memory/1096-526-0x00007FFAAFFC0000-0x00007FFAAFFE4000-memory.dmp	upx

Drops file in Windows directory 58 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1611196887\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1611196887\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1611196887\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\manifest.fingerprint	msedgewebview2.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3436	WMIC.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e00000001c5c3-13.dat	pyinstaller
behavioral2/files/0x000c00000001c5c7-10.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe
828	cmd.exe
3928	cmd.exe
3396	cmd.exe
2620	cmd.exe
2024	cmd.exe
3432	cmd.exe
4164	cmd.exe
864	cmd.exe
3424	cmd.exe
1580	cmd.exe
6096	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 13 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	steroidsloud.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	steroidsloud.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Built_ayush.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3396	cmd.exe
1232	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2600	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1232	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4596	Built_ayush.exe
4596	Built_ayush.exe
5172	powershell.exe
5172	powershell.exe
1668	powershell.exe
1668	powershell.exe
5172	powershell.exe
1668	powershell.exe
5160	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
596	WMIC.exe
596	WMIC.exe
596	WMIC.exe
596	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2600	WMIC.exe
2600	WMIC.exe
2600	WMIC.exe
2600	WMIC.exe
6084	powershell.exe
6084	powershell.exe
6084	powershell.exe
3104	msedgewebview2.exe
3104	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4276	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	Built_ayush.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeIncreaseQuotaPrivilege	5172	powershell.exe
Token: SeSecurityPrivilege	5172	powershell.exe
Token: SeTakeOwnershipPrivilege	5172	powershell.exe
Token: SeLoadDriverPrivilege	5172	powershell.exe
Token: SeSystemProfilePrivilege	5172	powershell.exe
Token: SeSystemtimePrivilege	5172	powershell.exe
Token: SeProfSingleProcessPrivilege	5172	powershell.exe
Token: SeIncBasePriorityPrivilege	5172	powershell.exe
Token: SeCreatePagefilePrivilege	5172	powershell.exe
Token: SeBackupPrivilege	5172	powershell.exe
Token: SeRestorePrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeSystemEnvironmentPrivilege	5172	powershell.exe
Token: SeRemoteShutdownPrivilege	5172	powershell.exe
Token: SeUndockPrivilege	5172	powershell.exe
Token: SeManageVolumePrivilege	5172	powershell.exe
Token: 33	5172	powershell.exe
Token: 34	5172	powershell.exe
Token: 35	5172	powershell.exe
Token: 36	5172	powershell.exe
Token: SeIncreaseQuotaPrivilege	1668	powershell.exe
Token: SeSecurityPrivilege	1668	powershell.exe
Token: SeTakeOwnershipPrivilege	1668	powershell.exe
Token: SeLoadDriverPrivilege	1668	powershell.exe
Token: SeSystemProfilePrivilege	1668	powershell.exe
Token: SeSystemtimePrivilege	1668	powershell.exe
Token: SeProfSingleProcessPrivilege	1668	powershell.exe
Token: SeIncBasePriorityPrivilege	1668	powershell.exe
Token: SeCreatePagefilePrivilege	1668	powershell.exe
Token: SeBackupPrivilege	1668	powershell.exe
Token: SeRestorePrivilege	1668	powershell.exe
Token: SeShutdownPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeSystemEnvironmentPrivilege	1668	powershell.exe
Token: SeRemoteShutdownPrivilege	1668	powershell.exe
Token: SeUndockPrivilege	1668	powershell.exe
Token: SeManageVolumePrivilege	1668	powershell.exe
Token: 33	1668	powershell.exe
Token: 34	1668	powershell.exe
Token: 35	1668	powershell.exe
Token: 36	1668	powershell.exe
Token: SeDebugPrivilege	4436	steroidsloud.exe
Token: SeIncreaseQuotaPrivilege	5160	WMIC.exe
Token: SeSecurityPrivilege	5160	WMIC.exe
Token: SeTakeOwnershipPrivilege	5160	WMIC.exe
Token: SeLoadDriverPrivilege	5160	WMIC.exe
Token: SeSystemProfilePrivilege	5160	WMIC.exe
Token: SeSystemtimePrivilege	5160	WMIC.exe
Token: SeProfSingleProcessPrivilege	5160	WMIC.exe
Token: SeIncBasePriorityPrivilege	5160	WMIC.exe
Token: SeCreatePagefilePrivilege	5160	WMIC.exe
Token: SeBackupPrivilege	5160	WMIC.exe
Token: SeRestorePrivilege	5160	WMIC.exe
Token: SeShutdownPrivilege	5160	WMIC.exe
Token: SeDebugPrivilege	5160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5160	WMIC.exe
Token: SeRemoteShutdownPrivilege	5160	WMIC.exe
Token: SeUndockPrivilege	5160	WMIC.exe
Token: SeManageVolumePrivilege	5160	WMIC.exe
Token: 33	5160	WMIC.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1856	3500	2026-10-22_be8dd5d8130dd50a27ec8b36d24a7fac_cobalt-strike_elex_glassworm_icedid_njrat.exe	90
PID 3500 wrote to memory of 6036	3500	2026-10-22_be8dd5d8130dd50a27ec8b36d24a7fac_cobalt-strike_elex_glassworm_icedid_njrat.exe	91
PID 6036 wrote to memory of 4596	6036	Built_ayush.exe	92
PID 4596 wrote to memory of 828	4596	Built_ayush.exe	93
PID 4596 wrote to memory of 3340	4596	Built_ayush.exe	95
PID 4596 wrote to memory of 3396	4596	Built_ayush.exe	96
PID 3340 wrote to memory of 1096	3340	MicrosoftEdgeUpdate.exe	98
PID 3396 wrote to memory of 1232	3396	cmd.exe	99
PID 1096 wrote to memory of 864	1096	MicrosoftEdgeUpdate.exe	100
PID 1096 wrote to memory of 3928	1096	MicrosoftEdgeUpdate.exe	101
PID 3928 wrote to memory of 5172	3928	cmd.exe	104
PID 864 wrote to memory of 1668	864	cmd.exe	105
PID 1856 wrote to memory of 4436	1856	steroidsloud.exe	106
PID 4436 wrote to memory of 3424	4436	steroidsloud.exe	108
PID 1096 wrote to memory of 1580	1096	MicrosoftEdgeUpdate.exe	110
PID 3928 wrote to memory of 4676	3928	cmd.exe	112
PID 1580 wrote to memory of 5852	1580	cmd.exe	113
PID 1096 wrote to memory of 2620	1096	MicrosoftEdgeUpdate.exe	114
PID 2620 wrote to memory of 5160	2620	cmd.exe	116
PID 1096 wrote to memory of 2024	1096	MicrosoftEdgeUpdate.exe	118
PID 2024 wrote to memory of 596	2024	cmd.exe	120
PID 1096 wrote to memory of 6096	1096	MicrosoftEdgeUpdate.exe	121
PID 6096 wrote to memory of 3436	6096	cmd.exe	123
PID 1096 wrote to memory of 3432	1096	MicrosoftEdgeUpdate.exe	124
PID 3432 wrote to memory of 2108	3432	cmd.exe	126
PID 1096 wrote to memory of 4164	1096	MicrosoftEdgeUpdate.exe	127
PID 4164 wrote to memory of 2600	4164	cmd.exe	129
PID 1096 wrote to memory of 1980	1096	MicrosoftEdgeUpdate.exe	130
PID 1980 wrote to memory of 6084	1980	cmd.exe	132
PID 4436 wrote to memory of 4276	4436	steroidsloud.exe	133
PID 4276 wrote to memory of 2836	4276	msedgewebview2.exe	134
PID 4276 wrote to memory of 5920	4276	msedgewebview2.exe	135
PID 4276 wrote to memory of 5920	4276	msedgewebview2.exe	135
PID 4276 wrote to memory of 5920	4276	msedgewebview2.exe	135
PID 4276 wrote to memory of 5920	4276	msedgewebview2.exe	135
PID 4276 wrote to memory of 5736	4276	msedgewebview2.exe	136
PID 4276 wrote to memory of 5576	4276	msedgewebview2.exe	137
PID 4276 wrote to memory of 5576	4276	msedgewebview2.exe	137
PID 4276 wrote to memory of 5576	4276	msedgewebview2.exe	137
PID 4276 wrote to memory of 2140	4276	msedgewebview2.exe	138
PID 4276 wrote to memory of 2140	4276	msedgewebview2.exe	138
PID 4276 wrote to memory of 2140	4276	msedgewebview2.exe	138
PID 4276 wrote to memory of 2140	4276	msedgewebview2.exe	138
PID 4276 wrote to memory of 2140	4276	msedgewebview2.exe	138
PID 4276 wrote to memory of 5416	4276	msedgewebview2.exe	141
PID 4276 wrote to memory of 5416	4276	msedgewebview2.exe	141
PID 4276 wrote to memory of 5416	4276	msedgewebview2.exe	141
PID 4276 wrote to memory of 3104	4276	msedgewebview2.exe	142
PID 4276 wrote to memory of 4552	4276	msedgewebview2.exe	143
PID 4276 wrote to memory of 4552	4276	msedgewebview2.exe	143
PID 4276 wrote to memory of 4552	4276	msedgewebview2.exe	143

C:\Users\Admin\AppData\Local\Temp\2026-10-22_be8dd5d8130dd50a27ec8b36d24a7fac_cobalt-strike_elex_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_be8dd5d8130dd50a27ec8b36d24a7fac_cobalt-strike_elex_glassworm_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\steroidsloud.exe
  "C:\Users\Admin\AppData\Local\Temp\steroidsloud.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\steroidsloud.exe
    "C:\Users\Admin\AppData\Local\Temp\steroidsloud.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:3424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=steroidsloud.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4436.2892.2463371035645046688 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView /prefetch:4 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffaa1815fd8,0x7ffaa1815fe4,0x7ffaa1815ff0
        5⤵
        
        PID:2836
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2500 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62 /prefetch:1
        5⤵
        
        PID:2140
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4052 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView" --webview-exe-name=steroidsloud.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1072 --field-trial-handle=1740,i,10200843791961751052,16787007085585666977,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:3a6f786537441c8685cb94d6eabecde2976e8e62
        5⤵
        
        PID:4552
- C:\Users\Admin\AppData\Local\Temp\Built_ayush.exe
  "C:\Users\Admin\AppData\Local\Temp\Built_ayush.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Built_ayush.exe
    "C:\Users\Admin\AppData\Local\Temp\Built_ayush.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3340
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe'"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        7⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        7⤵
        Deletes Windows Defender Definitions
        
        PID:4676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\rar.exe a -r -hp"gay" "C:\Users\Admin\AppData\Local\Temp\6n8f3.zip" *"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\rar.exe a -r -hp"gay" "C:\Users\Admin\AppData\Local\Temp\6n8f3.zip" *
        7⤵
        Executes dropped EXE
        
        PID:5852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5160
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6096
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        Queries system WMI classes for hardware identifiers
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:2600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6084
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "ping 127.0.0.1 -n 9 > nul & del /f /q + sys.executable + "
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 9
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6n8f3.zip

Path C:\Users\Admin\AppData\Local\Temp\6n8f3.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

Built_ayush.exe

Path C:\Users\Admin\AppData\Local\Temp\Built_ayush.exe
Size 15.6MB
SHA256 1712e747c50aad4d760627535d3e81b683f791232ee5db666e6e3e5eb42666e1
MD5 21262950984a1a48be4c334769f45e1b
SHA1 246d20a635042da176016b7885595103ec1a8563
SHA512 54fe4162e54d0d80923fd6617c9cd71f1b1ab39026af25f8c12ca71d35b9b16d23fb6867c191ac3ef190a1319f5a8455a5c4ece2108ab0a044601dbdacbc24f0
SSDEEP 393216:q238j6maZo7wY0ZZL2Vmd6mFNj6sX7jPZssSraep9:q2sjr7whZZyVmdPN2sX7tnep9
TLSH
T1CEF633D6B3A005F7F6F24436505AEA94CE76B01B1705D1CBA359D2901F23BF0B8BA663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007402\setuptools-58.1.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\base_library.zip
Size 858KB
SHA256 a56a9259b0951891d3f0465a795c36073b0720217d934dde5c816fe8236f3407
MD5 adb2e09632059e99c75276c7b1be5ccd
SHA1 a4e6f6a218a5dcffab1ea3f82fbe67a757fec87a
SHA512 f1c44aa47fbc9a7d75933fff1030fe665b2d71c2ec9d41cc764dd4dcf76018371bf6e7fba7645a0649f14c987737e7111f5e588d503ee7532518131de0b7ccb4
SSDEEP 12288:mDVOTfJEndyIl6uBAA4a2YeMNlWyDVw91ShEHYKZ4wqK6:BfJE9ALa2NMNlVDVw9yEHY9wqK6
TLSH
T1E6153A8069911ED7FD05F278815F8E3C069AB33ADB89D543BA4FC2D8BF472E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\blank.aes
Size 55KB
SHA256 4b6fe14273c7e828abb664769c666304550c9fe689355aca67ee2d7095a3b7d2
MD5 3e0e118957d1748aa0a8c00c1e7afb19
SHA1 bd382c535328a36ed615ba3e55ee3ad50c8ea4cf
SHA512 039d21eb0370e06a25580f2bd9fd5bc8615b9820a2d53dfe0c066ffa604633656841b39939c2e24ad3be87f1cfe76a3b81496f7c0f0000f794068d4251de8002
SSDEEP 1536:z2khPmFh7i/XJYnJKIOjnR2mxXFjTsjKJyku8H:z2APmFhKOnhOjbzykPH
TLSH
T1A043D0B415C14F63F709F3F69491C04DFB7E5858EB2FA113E216814D9FAF622981B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d0c2\python310.dll
Size 1.4MB
SHA256 de5b207dee9557a5890b48f285b5620fea84b997936546535d6584e3308353e0
MD5 eafedc49e95f93cc69fa70d11464739a
SHA1 5a7b34a532343079db59040d67bb7a759ffa5824
SHA512 be8cf25fb36ccac7955335706934bdb79cd578b382d51e6f4f36302d356b605beee2b1a38394de630cf2481d8217329979e1fa204577e68bd9f7708b49e9085f
SSDEEP 24576:O1J7rSmizc7q/dRqqG8nQR76uTvfPjbWYREHOfHZj8SjsJA+26:AJCB/lRvRno6eVfUJH
TLSH
T14F653333392A8829D1E27FB55DF1DB134C2E4E82613A859DF8A8CF5F2506A640E1735F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\Crypto\Cipher\_raw_aes.pyd
Size 29KB
SHA256 e55603a1d70ef2df4d15ba6de3cfe819de64a8cd392b91eee5dc4e0d1c705db4
MD5 8e757f3e9877140ba009f75b11e7102e
SHA1 4ef990848803af75d98cb2e152746e96b3b1e51c
SHA512 cc164f1f40c7d4317e0cf44e7abf4bd0e4cc352bd0ec7c7bdbd337119317597c27aa9342f9ac1b788cf738b0e46666def38baa0079b394c078f6c0febedb6ad9
SSDEEP 384:cE3BC/ajA+4TDbPIO8jLkTsLjda0p37usOo8Vd6IHiPKDkAKB5F0gaZ:h3Bb0dbgO8jLkYL3xahoICS4AI2
TLSH
T108D26C79A82C87E2CD46E5B585B6186BF92212354763D5FF438105703C637E8FB3AE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 54f4b557f8613c6dd22bf9cafc790aff3bc603933c5b9459a50ef7f83f98041a
MD5 f9336259e9ddcaa8bfe5f7d1ed6c8b48
SHA1 f269d6c590145ec6fb9d262c3c8711e94d57af4e
SHA512 1c2a5b51b87dfc2d339fb42191a7a6c9127d51783f502aacf5bd10c5267119eb7304f4d8d565439b4b26ebc7d39b87001efedef1c3688b179d6b6b793c7d30bb
SSDEEP 384:x3yeYCan36Gv5g/yqFvDELxZW9YUKs+N:x3yeYCan36GvS/y27ELSYUEN
TLSH
T1A6621984FB5E14B6E1B002BA8893D99AF420B51013530AEF03A09D1E6F657C92B3CDF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\Crypto\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 6a4d53dc80843f6e8d9a6db416cd6cd5214ba5544a128d2076cb4fcf13cd32c8
MD5 0b772b9a587d15dfc1faeeee2ff4040a
SHA1 7364f705de6385d2b969681976f9c7f6f60fa202
SHA512 41bc22ca2866060702432b6b0d46c994e5988a56d4144305330824a0c650d7b02143d60d0608f70839241001e3c3a63ea7feb876ced186a856f3dcfdacb23384
SSDEEP 192:6+ky+rAjMyql0HvLqL/EOTJkKuAcGg9I7:6+5wyqWHvLqLMOk9+
TLSH
T1C0323B89FA9989FAE53A037BC4770B5A7470F2206B9117CF1390211D2CB6BCA763C61C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 fdfad782d811b62e9fe6337630f53ae70be943afe3e5ea203604df3e00f2e7d9
MD5 9ec1a2ebb622ae26b8a0cfc1d3c35d9e
SHA1 c16e2941fb9621bdad7d801c768b581e922c2728
SHA512 a5aecb1e19cd933d6b4d45cab3a49d7e165285ef0bc388655f34dc07626fd505e32a1b8f1b565bf0531b28dd246fef70b829ef6066e509dbe47153a2fa2d55b6
SSDEEP 96:LvfYosF19Az5BFP1IQkANHoLzLnCgXJkMivBmpfEtMpUk7aIo9HoyBp:aIF7P1IuYLnCgXJLi5ef/4t9Hn
TLSH
T10E22F94CFED58CD6F6218279C8A70E1CB1BDB6241BA233CB0371652E5CA77C9A17A584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\VCRUNTIME140_1.dll
Size 36KB
SHA256 1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
MD5 37c372da4b1adb96dc995ecb7e68e465
SHA1 6c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA512 926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6
SSDEEP 384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
TLSH
T19FF24B9467788082E46B95B4C4E3AF27FB38F4615760938F0BA4825D2F637D0E63D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_asyncio.pyd
Size 59KB
SHA256 5e25e2823ed0571cfdbae0b1d1347ae035293f2b0ac454fb8b0388f3600fd4b6
MD5 483bfc095eb82f33f46aefbb21d97012
SHA1 def348a201c9d1434514ca9f5fc7385ca0bd2184
SHA512 fe38b3585fbfaf7465b31fbc124420cfbd1b719ea72a9ae9f24103d056c8fa9ae21c2a7dd3073810222405457beff89bbb688daeced3219351a30992a6721705
SSDEEP 1536:SWbvivBeDp/9rflsqHEY85IM5nxd7SyGb:SWbvaBePrflsqHEP5IM5njW
TLSH
T1EE537B86E28081A1D967A074D8A30F46E771F5904B0443DFA2ACD29E3F6335247FEB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_bz2.pyd
Size 77KB
SHA256 0897e209676f5835f62e5985d7793c884fd91b0cfdfaff893fc05176f2f82095
MD5 a1fbcfbd82de566a6c99d1a7ab2d8a69
SHA1 3e8ba4c925c07f17c7dffab8fbb7b8b8863cad76
SHA512 55679427c041b2311cff4e97672102962f9d831e84f06f05600ecdc3826f6be5046aa541955f57f06e82ee72a4ee36f086da1f664f493fbe4cc0806e925afa04
SSDEEP 1536:szXz7Bgrj7FUHfuwttm8ebvwyBIMtVk7SyNU:oXzVMFOfuIRebvwyBIMtVk8
TLSH
T1B2738C92B3A455B5F45BB27995B10357E371BD0D03A0D3AFB754822F2F03B826C6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_cffi_backend.cp310-win_amd64.pyd
Size 175KB
SHA256 e029cabce12aea3d77f2c8709a0f4be695f3fedd1144c14607b4fcc3b9e9bc3a
MD5 bd4f32abef9b144a79bb2b9d49dcc3e7
SHA1 685cf988a4e7f5b6455938b5435b140129fd8649
SHA512 8e073f6df0a4bed82aff8c3c5ede33f550e7249a7f5ecc33792575b15668424416ec22735da27d46ee07ff4973975d5f072dbc2ccfc0b971513cf524494d8fb5
SSDEEP 3072:y/GKmA40lyA5iS+IXe6YxL0/4zRMWZjpSo9k7nbjP7PFSTL7KC4+bAFbDQf:USA5N3YxL0/4lMWZjwb/TFSTLOiSD
TLSH
T108047D5A329C11B2D6A251388A575B53E3B3B470174197CF0170C6B52F2BBE67ABFB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_ctypes.pyd
Size 116KB
SHA256 9ab1f8cbb50db3d9a00f74447a2275a89ec52d1139fc0a93010e59c412c2c850
MD5 92276f41ff9c856f4dbfa6508614e96c
SHA1 5bc8c3555e3407a3c78385ff2657de3dec55988e
SHA512 9df63ef04ea890dd0d38a26ac64a92392cf0a8d0ad77929727238e9e456450518404c1b6bb40844522fca27761c4e864550aacb96e825c4e4b367a59892a09e7
SSDEEP 3072:zW66GKh4hqyIVQoavMSut/SfrS34ep9x3FIMQPwnJC:C6QKtkSuZSfrSlFLJC
TLSH
T1F7C35B1B2354009AEB67507CC5B35E47DB71B84A572083CF12A4C69E2F63BA36E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_decimal.pyd
Size 242KB
SHA256 2673b0ec0769c2513cfb63d72cbfadd3dd43963d30ddc368c6232dab1f607ee1
MD5 09be0caf0e2bd7bea37a27527cb13c2e
SHA1 e543b614b3d008514979697a458b6d075b62e037
SHA512 5b98fb115e40a03b67a24cb18b2c2549efe8e15e7c1674d00307453ec0550d340cf4ea5bc4eee856acfa53bfd0f138d5cae771399db444091f3b8d2eea6c4cfb
SSDEEP 6144:mqdhOW8XTMJQ3cWvod/fCVJya9qWMa3pLW1A1/h84nHvX:nOW8wJN9R0QgznPX
TLSH
T152346C66A2490CA4DE738034D8975B57FBB278940360D7CF43A4CAA62F577A323BE744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_hashlib.pyd
Size 59KB
SHA256 2e30544d07f1c55d741b03992ea57d1aa519edaaa121e889f301a5b8b6557fe4
MD5 ad6e31dba413be7e082fab3dbafb3ecc
SHA1 f26886c841d1c61fb0da14e20e57e7202eefbacc
SHA512 6401664e5c942d98c6fa955cc2424dfa0c973bd0ac1e515f7640c975bba366af1b3e403ea50e753f837dcd82a04af2ce043e22b15fa9976af7cbb30b3ac80452
SSDEEP 768:8nvx+iVPY7S+NbM2S2uoU1lyZjWv4so5IM5IkzrYiSyvchym:FWPYW+Nbs2uP1UZjWv1o5IM5I4r7Syrm
TLSH
T150536C46E64440A1D57383B8D9930EABE671F5409352A7EF4364C18E2F23BC367BB7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_lzma.pyd
Size 150KB
SHA256 ce72d59a0e96077c9ea3f1fd7b011287248dc8d80fd3c16916a1d9040a9a941f
MD5 a6bee109071bbcf24e4d82498d376f82
SHA1 1babacdfaa60e39e21602908047219d111ed8657
SHA512 8cb2dafd19f212e71fa32cb74dad303af68eaa77a63ccf6d3a6ae82e09ac988f71fe82f8f2858a9c616b06dc42023203fa9f7511fac32023be0bc8392272c336
SSDEEP 3072:rD6xBrqs+vs0H0q8bnpbVZbXsAI0znfo9mNoJ5vSpxpBIMe19cc:rD63rcRLCV+qwYOJ50Pk
TLSH
T142E33A96A394F0E6F7228C78D6624F57D7F578090310929A02CC876D2B1FB759E2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_multiprocessing.pyd
Size 29KB
SHA256 2c1bc1c4827f61bc4282c2c60bb5c921eb91f6e487422e662cb54f5d1510baa6
MD5 429673c64ccfefdfb3f3c9e0fb4402ab
SHA1 d96b83d6a76397d56ad3ec09e8b3c10d7932c309
SHA512 db19034fe1b133c79e7db5b568ccb0328bb0e2d3a1dde5443bf5dffa19a1eddce4a0d647810804312daa0f02e3206f8d5af5f40f551037a58b8343d45569e88a
SSDEEP 768:J2ZtYyJmJxGp9Ao5dUpIMRtIFYiSyvQ/hkGJ:8LYzJsp6o5dUpIMRtIF7SyaJ
TLSH
T176D26D43AA541896E833C63594E34F19E931F6464750C7DF2258C29E1F723823AAAB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_overlapped.pyd
Size 44KB
SHA256 20c94846417ee3ca43daa5fae61595ad7e52645657fda5effe64800fe335ff0d
MD5 bf3e86152b52d3f0e73d0767cde63f9f
SHA1 3863c480a2d9a24288d63f83fa2586664ec813a2
SHA512 8643f94ece38246769ff9ba87a249b8afde137cf193ff4d452937197ce576816c1ce044c4ad2951bc5535cc3acf1b27e9f2be043b8175c5a2ca2190b05dc0235
SSDEEP 768:JAM30iXUtee0Vb47XTTClsXFOPRcqdc5U9IMst0YiSyvrVhVI:JAM3hRxcqd19IMst07SyTFI
TLSH
T1A6237C42275400DADA7B827C94635F13EA7078A14312D39FA16CC64E1F723D17BBA3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_queue.pyd
Size 26KB
SHA256 8e7e758150ea066299a956f268c3eb04bc800e9f3395402cd407c486844a9595
MD5 8dd33fe76645636520c5d976b8a2b6fc
SHA1 12988ddd52cbb0ce0f3b96ce19a1827b237ed5f7
SHA512 e7b4b5662ebd8efb2e4b6f47eb2021afacd52b100db2df66331ca79a4fb2149cac621d5f18ab8ab9cfadbd677274db798ebad9b1d3e46e29f4c92828fd88c187
SSDEEP 384:vfqkQfdUCUFYS9F6Xg6rEGSSVYptTDbFIM7UoIYiSy1pCQW3hL8:sdUC+F6rEGSSVYTFIM7UxYiSyvQho
TLSH
T1A4C27EC2EB681896D073C53054E25E15FE71FA929711C3DF3229C26E2F23782367D66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_socket.pyd
Size 73KB
SHA256 130de3506471878031aecc4c9d38355a4719edd3786f27262a724efc287a47b9
MD5 c5378bac8c03d7ef46305ee8394560f5
SHA1 2aa7bc90c0ec4d21113b8aa6709569d59fadd329
SHA512 1ecb88c62a9daad93ec85f137440e782dcc40d7f1598b5809ab41bf86a5c97224e2361c0e738c1387c6376f2f24d284583fd001c4e1324d72d6989d0b84bf856
SSDEEP 1536:0mtvsZWgzruIAl9/s+S+pByXc/+lvFIMQwY7Sy3:z5IJzrAl9/sT+pB8c/SvFIMQwYJ
TLSH
T1C0734A12A69051BAE2738079C1635F23FB70F491179593CF1264DA6E1F237829E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_ssl.pyd
Size 152KB
SHA256 5a4c78adedf0bcb5fc422faac619b4c7b57e3d7ba4f2d47a98c1fb81a503b6b7
MD5 9d810454bc451ff440ec95de36088909
SHA1 8c890b934a2d84c548a09461ca1e783810f075be
SHA512 0800666f848faec976366dbfd2c65e7b7e1d8375d5d9e7d019bf364a1f480216c271c3bcf994dbab19290d336cf691cd8235e636f3dbc4d2a77f4760871c19ed
SSDEEP 3072:l9Y1GpXg28PqCBWZxVkc85nu9ekFc8j8V+AOXLkdWXxZIIkjIIBIMt7LU:l9Y0BgdqCETavu9L6V+RrIo
TLSH
T1E4E37C47F24419A7E813E4BDC6630A02EBB5F045231197CE49D6C68A4F13B46AF7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_uuid.pyd
Size 20KB
SHA256 b7fd172339478adaa5f4060eb760f905a2af55ce7e017b57de61ee09dcb09750
MD5 6cfc03bc247a7b8c3c38f1841319f348
SHA1 c28cf20c3e1839cff5dce35a9ffd20aa4ac2a2cf
SHA512 bd123566a104568e2ec407b35446cb07c660035a77a1e11a8d8d90518c1a83b6815bf694676fa003b074126dcd0594457195f835df7bc828df1195db6584d23b
SSDEEP 384:VvEaNKFDyRTxXK5BIMewkHIYiSy1pCQ1DvfehLC:VTNK4R9XK5BIMewHYiSyv1mhm
TLSH
T191A24C56DF600C91ED274270A4D14A0BEA71BA969B6183DF331CC1592F927C336BA37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\base_library.zip
Size 858KB
SHA256 c8651f8b076b56ac998117db18118c9b736cdb6a3081a61a3f7a3d5c8e98af55
MD5 05b6afa981790fe52f451f002a7056df
SHA1 56906c5d141e7ea9bcc4b28816d0ef4d16ee9979
SHA512 005970db8183d056ce94aadf39b4969fb906df56c6c537bc67621f636349c934e7007b79c9357c520d479151cfa127783b13e1830969871842347c85f24e3791
SSDEEP 12288:iOMNGwqzyd2fJE/Vw9yJEHYKXSexTIl6uBSA4a2YyWyuC:dMNGwqHfJE/Vw9WEHYbSLa2xVuC
TLSH
T15C153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
TLSH
T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
TLSH
T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\psutil\_psutil_windows.cp310-win_amd64.pyd
Size 67KB
SHA256 be9701a1c3e48599d8c22c2c371d5493e9a97fa5063022c110842ecb886214e3
MD5 6e04a1d41b0897878583702d398bdc88
SHA1 33f396728c57505b0b897b547c692a9cf8959a36
SHA512 f9fc5d2c480fb7edcad9490925b75007523adecdd0400adaaab888d12f1e67abfd614a142e38a93ba3b42de2e466f1aa0f48625e76bbe3868b9c308b0bdf4d66
SSDEEP 1536:0wy3Ddmq9owPqaeMIBKwYx4cae5gFW8T:iNeMIBKwYx4cae5gFW
TLSH
T141631946B36910F4D91A823D9AB35A23E9B2F062132693DF45A0C65E0F26FD7637DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\pyexpat.pyd
Size 189KB
SHA256 4d0f50757a4d9abe249bd7ebea35243d4897911a72de213ddb6c6945fef49e06
MD5 8b9855e1b442b22984dc07a8c6d9d2ed
SHA1 2e708fbf1344731bca3c603763e409190c019d7f
SHA512 59ca1cbc51a0b9857e921e769587b021bc3f157d8680bb8f7d7f99deb90405db92051e9be8891399379d918afc5d8cb36123297d748c5265ae0855613b277809
SSDEEP 3072:7nQ4xikRdMcLkEI0YULfRVCAdfaYXySx2aQzMad42xy+YqNgrKqNrEqNTqNkypFd:7Q4b3MokE9VRUAdfaYXHQzM+Dy+UrZMj
TLSH
T19D145B5771A6C0EBD8538038D6D68B0BDAB2B8A5439087CF12D4E77D5F27B523E28319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\python310.dll
Size 4.2MB
SHA256 8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e
MD5 a1185bef38fdba5e3fe6a71f93a9d142
SHA1 e2b40f5e518ad000002b239a84c153fdc35df4eb
SHA512 cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4
SSDEEP 49152:kAz5zjppNAQdRnpoFPN7RhvPSUrRBthux243ahuxZplZTJycg7gpP7Bz5AIu35H8:9NPNE1NJpGgk7J3uJHsMraSSFP+4j
TLSH
T17C267B26A36401A4D9B79477C527864BCBF1BC402F24D34E41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\pywin32_system32\pythoncom310.dll
Size 664KB
SHA256 60a4171cec80b5c26dbe9491a816959ccf28c52eaa1f687390384bdc5e0189d0
MD5 b3e1ab8ae6970cf9e3680e7238e89c7d
SHA1 c09f093d46eca224781f677967809ea79428d81e
SHA512 d28fb46fb5a55e7799d41f22cbf6f621becc2c8974466fff409b1a8fd0914bc071d2d26c3348f8ba99e39d00a6c3a49e8c1999b06922e589853f0b4101d48c29
SSDEEP 6144:XluZEylgmKDgo2F/aJZ3qEP6NEAfuHLfqJsfex+pd5VTH66t:XluZTgmKsjFCJZJPAkfqJsfex+pdDGA
TLSH
T173E44B5AB3E50691F63AA1BDCD138B12D2A2B4611751A7CF02A0C76E4F673D1373EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\pywin32_system32\pywintypes310.dll
Size 132KB
SHA256 d14a89c503599be257b733cafdd66ff8d0e77bc657360dee921d40374820c415
MD5 1a65885264738c5df2875e54536a02a3
SHA1 610381be859cf4dbe576c769de118caa35b6be8b
SHA512 8ebc9287a7d2e75e375737b6e7618d101610234b5b84acc165062f24b0281bc08d5dc9223afa5cf5ce72ac52ad68cff7d53dd949afb68897111ace39fb14264b
SSDEEP 3072:p7TS4GZvM/JeSJX1IzEAY/rZ6Yrbl64RgzXnaQRzyug:pX9GZvkJeSJX1eEAY/rPc4RgznaIz
TLSH
T11DD33947374684CAE936937ECC671A02D3A2B0110715E3CF06A1C29B5F63BE66E3B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\select.pyd
Size 25KB
SHA256 cb643556c2dcdb957137b25c8a33855067e0d07547e547587c9886238253bfe5
MD5 63ede3c60ee921074647ec0278e6aa45
SHA1 a02c42d3849ad8c03ce60f2fd1797b1901441f26
SHA512 d0babc48b0e470abdafad6205cc0824eec66dbb5bff771cee6d99a0577373a2de2ffab93e86c42c7642e49999a03546f94e7630d3c58db2cff8f26debc67fcad
SSDEEP 384:dPjk/7e12hwheCnHqJYBsVRXFIM7Gh+IYiSy1pCQyvUhD:NUC2hwhjHqWYVFIM7GdYiSyvdhD
TLSH
T1ECC28F86AB505C82E4338571A5E28F06FD35B6A18720C2DF7369C26D2F12782337F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\unicodedata.pyd
Size 1.1MB
SHA256 09e1d1e9190160959696aeddb0324667fef39f338edc28f49b5f518b92f27f5f
MD5 d67ac58da9e60e5b7ef3745fdda74f7d
SHA1 092faa0a13f99fd05c63395ee8ee9aa2bb1ca478
SHA512 9d510135e4106fef0640565e73d438b4398f7aa65a36e3ea21d8241f07fec7a23e721e8696b3605147e5ce5365684e84e8145001201a19d7537e8f61b20cf32c
SSDEEP 12288:ZrlBMmuZ63N5QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uOK4:JlBueZV0m81MMREtV6Vo4uYOK4
TLSH
T15A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\win32\win32api.pyd
Size 134KB
SHA256 24040005bb9c9407f539aaa085e1495d047788ed1e6c51d163ebe0277e582563
MD5 259dd0b19b3546e278ac2115078bae5c
SHA1 f4858834273be8b361cfd3cf0339df68fa0f434c
SHA512 3af7d640a68c4898dd2147fb6e4bb3bd5e0e85dfaa6d364f1876a2fca126e3142f08bc8ec3ad98f76d84635f69b36880f472e68356ee8d9bc01182b82680b3ae
SSDEEP 3072:Pwno5FuGTG18xRn0nOSrzlRVlhLaN/PlD9qTmGxRDLpb82g/e:PwoLG1aeO+lRVsPvq/9d3
TLSH
T10FD31883B39410D6D86AA2BCD5674F13E772B8240321A7CF0A70C58A1F63BD97E39795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dbs4hp5g.b10.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbs4hp5g.b10.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

steroidsloud.exe

Path C:\Users\Admin\AppData\Local\Temp\steroidsloud.exe
Size 30.5MB
SHA256 8d6240b8d14fc76c9bb88769bba1f4184bf31e70cabde10eb928dfb25bbf5888
MD5 0f622f1c334a9f85053be7f8952db003
SHA1 449c13fe0e944aef0ebb013bdc1dd9db83beba3d
SHA512 9a6f9e45935b31db82193d2a65665b9c4f33fe66721de4eb389b668d37d12aead5c9f6ade02329e978dc2eb65fc7441056a838f565725a602756265b9c10a78d
SSDEEP 786432:3ib7yVmd+ZNcxd12QErtLNam4liTR+n7O7fYRz17BdDxqPec:3eyVQFN1ErtLNamzdEOgpnxqPec
TLSH
T1086733C9B56415E9E5F3483945928B57CE677C7A07B5A9DB8B10C3203C2BFF068B0B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00434dc8-bd91-4c8c-823e-85b88d4cb113.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\00434dc8-bd91-4c8c-823e-85b88d4cb113.tmp
Size 2KB
SHA256 686e6ed167c98c0f202c3e7cdb2dc0d2253756cda6c9c928401915b2bf301ef2
MD5 0544361bcf5d7823a2d7953896f8b5fa
SHA1 ca0a8cfc56bbcbee1fc186c487ffba4f49295aa6
SHA512 29a114cdf7d51b89a7a37427bd60e208ab7479afba3a8f33302f351ba10f8fafe240af1f286bf6535de8a429158ee5dbceb3fb348c60cab2dfbd6a131865e0c1
TLSH
T1C25175736C98EB37A5E28A087ACA3E13CF755266ADB21F15E9ED0B0D00D795D1341C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8b7a8641-e3a1-4eb0-ab44-9aa22530ba81.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\8b7a8641-e3a1-4eb0-ab44-9aa22530ba81.tmp
Size 3KB
SHA256 bf8e56c74dc90a99d08c544b46c2568527b03c7c6fa8a4724499775938e0d76b
MD5 0214151fdb9803a887b067aabd5e0995
SHA1 3e214f4829fefe056fe47bea0d36a69197fd2b57
SHA512 776555a39af00b1fecbf4d992173e1176fa4b40165310c2a9fbda69be0e7757b22c5548e4fc3eaec0b4644afad5a69f0974c7f580ad3144e88d6dc21b59b69bf
TLSH
T12D71986669B9A9275DF2DA0479C63B03AB654123A8E23F99D9FD0F0D01D768D0341C17
MD5 SHA1 SHA512 TLSH

Submit Download

916ccf5d-684f-437b-94b3-9c3df092467b.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\916ccf5d-684f-437b-94b3-9c3df092467b.tmp
Size 3KB
SHA256 b85661d6dc02270bc4bcf67feadcb63350dc7afa54a46959abacc587140dc810
MD5 8d13dc11fe00dbf51d1e38670e7280b3
SHA1 4c6bc597b23fa77295214629df34746a142667f1
SHA512 69bf8a48ef6306781c7f69cb87b19a9fab75370ce055d182e1d0f15784242c6c0a1bb9a2f895e07124fa109a3564ce7651971ce29bc227a340d70cb7c3aecc1c
TLSH
T13761857669B8EA3B59E2DA04B9C63B02ABA55127E8E13F59D9ED0F0D00D768C1341C16
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c042cf8f207073c717ce965d0bbd254ce63ef2e81daa312f6c152304bc85fa2c
MD5 01317c8063d7755f0a9e44521fff5272
SHA1 c700226c8f0f8049d82d8cfa64b52944b0a19f85
SHA512 9ff957c8d6be2e263cdee259e9ad67e23db0fed9ad745b3a8dd0595ac1ac226947b2f9bcd50f84fdd9256f2409a15795784220d0f9f6abe38ee5c145929f2724
TLSH
T1A0D00410D7454014D5511031111455004701D431405F13110C31150CF4C1D441111101
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 27a2328209b03b4ab38a3b6fb66b5665ccee131349fb8c9484290c52da39a4fb
MD5 0dd06bd005d955b46cefc8a35cd932ac
SHA1 5572aad9d43017d9aa2f7d71e8b55cababdc8d08
SHA512 dbe769b8a00907eb01d876a1b839f32d2ce6dbb1b0cffd9981e2570f1276fd7062f09fee42441794c32246612c9f4d96fb675b30f65d7d2cc79d21fe2369121c
TLSH
T1D2D0121277424138C4202033110275080901D12B804E41015C399A1DFA848941A12442
MD5 SHA1 SHA512 TLSH

Submit Download

4c6bf142-5350-406f-b553-3b64ae08e927.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\4c6bf142-5350-406f-b553-3b64ae08e927.tmp
Size 5KB
SHA256 4b0d76ccefc8199490ec1738096084476ef678b631069d6ff5dd2dc254b3db82
MD5 f94e53d81f81dfbec6949a9f30a1940c
SHA1 caab38dfc306e4208107670bac4bfb9b5e81cd1b
SHA512 4d314a95a852ac0eb53485a4560e8818aee78920f9542bcbf347c22218584e61701d086083b6f50a7444c77cf9dc96d7ec2f82c05c5197655babf97fbb6fc9dc
SSDEEP 96:st25WOX0CLb35h16ZZs7/x+6MhmuecmjenK+gOB28XMZCB:st2scJX3+sV+FijpoBG8
TLSH
T16CB1A7025E68797B4CC7E159BE757F52E2F5107135E01A58FBF9875C08EA9DC120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d4d2f677-4b8a-4db6-9257-8d5e0882b9dd.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Network\d4d2f677-4b8a-4db6-9257-8d5e0882b9dd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

fb62f0ba-0bdd-48e1-a809-9ca743a4601b.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Default\fb62f0ba-0bdd-48e1-a809-9ca743a4601b.tmp
Size 4KB
SHA256 e05addbedf6d5196168b17218dc90754cb4705de31439697bf7255a1e490175a
MD5 35ad95792b0738c78307e5689b0d88d6
SHA1 093e27f7f467333d1252c0d95fc5efad638250d9
SHA512 a25b22a6215be9f7454956ddba1ba069397bf2d7e7dac2d39a0f8882068aa60500191500de8002e567739a243c8c13af3dfe6b7fc36746fa9e8b889c2e53492d
SSDEEP 96:r25WOX0CL/d3616ZZs7/x+6MhmuecmjenK+guI28XMZCB:r2scJp3jsV+FijpcIG8
TLSH
T1AFA1B6026E287A7B4CC6E11D7E757F42E2F5117135E52A58FBF98B5C08DA9CC221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\Local State
Size 1KB
SHA256 c946eb8fcd46dbf73cecc7984ff80c600788aba7a938c9a1e72d7939b43b9442
MD5 64023021075debceaed32d85acbad1ae
SHA1 ffad60910cf5bf1590b7ea9a27afe8bcb27fb330
SHA512 1e7677a96eff7d90316d88c27e55311adaeb4140e6cb04ac9f1e63221b663be23de1dc41a97f7525784f1935f940035948f63ba8cf07ab61557ce781b1fce7c2
TLSH
T10D2135F299EC9F33B8959609339676075F21526B85B20E04F5EE8B0E01E354D562AC36
MD5 SHA1 SHA512 TLSH

Submit Download

aecd54c1-7f75-45cd-b838-8c042c75f73f.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9nos7ydu\EBWebView\aecd54c1-7f75-45cd-b838-8c042c75f73f.tmp
Size 16KB
SHA256 f72f592d3613c2f7fb3f0a993556baee74fd6805ccfcb4118d86873ce575484c
MD5 9c7f9544d336848acd17156158d523f3
SHA1 f281ef3b29af3f0d1a609f75de5b28e889ad48bd
SHA512 69cc503996ce3916111ef2dc284d7926758a811527969f049a113f03b00527eda804d629a4fcfaa3f64f174c27a767c0cacc3df066962ba0a6606325df6e17ed
SSDEEP 384:e+OBqImmJvGBLx3NaFMJFNNBSeiW8x+dg6r4:bcvGtlNUZ+nM
TLSH
T1EC729D7A5CA59B273CE7C6457B8A7787CBA0535384D16BD8DCEDAF0E415B88D0312C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
Size 5.9MB
SHA256 01769038703441e1b95f1f3ed530cc4f8ee904b286f0a1a532d525a008c47049
MD5 ee04f2b0896900a4024aa689f80b8493
SHA1 2641b91a21e8b3523fac545ea4e629c35c51340f
SHA512 3acde4ff9a348ed1e21ed531c2b66c561a4c76fb4bc3641319f75a6df5542f9783a3cbca5d373d0d1f9a56b516ae4220fe7f3850932e1e7ca4e7ad87924a0044
SSDEEP 98304:2gvWlli65sn6Wfz7pnxCMJk1JTxuZ3zEgyOFRynV+2jF+krDbUpnqycGM:2JXDOYMJeJT44xnV+2x+COn7cJ
TLSH
T1A256331673A804EAE5F3923CCD628956DDB27C041370D6DF0290872A3F27AE54D7AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_121926220\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1611196887\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-418-0x00007FFAB67B0000-0x00007FFAB67BD000-memory.dmp

Download

memory/1096-528-0x00007FFAB58B0000-0x00007FFAB58C8000-memory.dmp

Download

memory/1096-401-0x00007FFAB58B0000-0x00007FFAB58C8000-memory.dmp

Download

memory/1096-407-0x00007FFAAFF70000-0x00007FFAAFF8E000-memory.dmp

Download

memory/1096-410-0x00007FFAB68D0000-0x00007FFAB68DD000-memory.dmp

Download

memory/1096-411-0x00007FFAAFF20000-0x00007FFAAFF4E000-memory.dmp

Download

memory/1096-412-0x00007FFAA67A0000-0x00007FFAA6C02000-memory.dmp

Download

memory/1096-400-0x00007FFABBB50000-0x00007FFABBB5F000-memory.dmp

Download

memory/1096-414-0x00007FFAAFFC0000-0x00007FFAAFFE4000-memory.dmp

Download

memory/1096-415-0x00007FFAA6420000-0x00007FFAA6797000-memory.dmp

Download

memory/1096-503-0x00007FFAAFF50000-0x00007FFAAFF69000-memory.dmp

Download

memory/1096-416-0x000002CED23D0000-0x000002CED2747000-memory.dmp

Download

memory/1096-402-0x00007FFAAFF90000-0x00007FFAAFFBC000-memory.dmp

Download

memory/1096-408-0x00007FFAAC560000-0x00007FFAAC6D1000-memory.dmp

Download

memory/1096-441-0x00007FFAAC560000-0x00007FFAAC6D1000-memory.dmp

Download

memory/1096-399-0x00007FFAAFFC0000-0x00007FFAAFFE4000-memory.dmp

Download

memory/1096-409-0x00007FFAAFF50000-0x00007FFAAFF69000-memory.dmp

Download

memory/1096-413-0x00007FFAAFE60000-0x00007FFAAFF17000-memory.dmp

Download

memory/1096-396-0x00007FFAA67A0000-0x00007FFAA6C02000-memory.dmp

Download

memory/1096-419-0x00007FFAAFF70000-0x00007FFAAFF8E000-memory.dmp

Download

memory/1096-420-0x00007FFAA9850000-0x00007FFAA9968000-memory.dmp

Download

memory/1096-417-0x00007FFAAF8F0000-0x00007FFAAF905000-memory.dmp

Download

memory/1096-534-0x00007FFAAFF20000-0x00007FFAAFF4E000-memory.dmp

Download

memory/1096-539-0x00007FFAA9850000-0x00007FFAA9968000-memory.dmp

Download

memory/1096-538-0x00007FFAB67B0000-0x00007FFAB67BD000-memory.dmp

Download

memory/1096-537-0x00007FFAAF8F0000-0x00007FFAAF905000-memory.dmp

Download

memory/1096-536-0x00007FFAA6420000-0x00007FFAA6797000-memory.dmp

Download

memory/1096-535-0x00007FFAAFE60000-0x00007FFAAFF17000-memory.dmp

Download

memory/1096-531-0x00007FFAAC560000-0x00007FFAAC6D1000-memory.dmp

Download

memory/1096-525-0x00007FFAA67A0000-0x00007FFAA6C02000-memory.dmp

Download

memory/1096-533-0x00007FFAB68D0000-0x00007FFAB68DD000-memory.dmp

Download

memory/1096-532-0x00007FFAAFF50000-0x00007FFAAFF69000-memory.dmp

Download

memory/1096-530-0x00007FFAAFF70000-0x00007FFAAFF8E000-memory.dmp

Download

memory/1096-529-0x00007FFAAFF90000-0x00007FFAAFFBC000-memory.dmp

Download

memory/1096-526-0x00007FFAAFFC0000-0x00007FFAAFFE4000-memory.dmp

Download

memory/1096-527-0x00007FFABBB50000-0x00007FFABBB5F000-memory.dmp

Download

memory/2140-712-0x0000018339C20000-0x0000018339CC7000-memory.dmp

Download

memory/2140-650-0x00007FFAC5D10000-0x00007FFAC5D11000-memory.dmp

Download

memory/3104-974-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-965-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-969-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-971-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-972-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-973-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-963-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3104-970-0x000001FDB4B40000-0x000001FDB4B41000-memory.dmp

Download

memory/3500-6-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/3500-5-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/3500-0-0x00007FFAA63EF000-0x00007FFAA63F0000-memory.dmp

Download

memory/3500-1-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/3500-2-0x0000000000710000-0x0000000003530000-memory.dmp

Download

memory/3500-162-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/4436-505-0x000001C93ECF0000-0x000001C93ECF8000-memory.dmp

Download

memory/4436-495-0x000001C93EBF0000-0x000001C93EBFA000-memory.dmp

Download

memory/4436-498-0x000001C93ECD0000-0x000001C93ECEA000-memory.dmp

Download

memory/4436-990-0x000001C93CBE0000-0x000001C93CCF1000-memory.dmp

Download

memory/4436-500-0x000001C93ECC0000-0x000001C93ECC8000-memory.dmp

Download

memory/4436-501-0x000001C93ED00000-0x000001C93ED08000-memory.dmp

Download

memory/4436-690-0x000001C93CBE0000-0x000001C93CCF1000-memory.dmp

Download

memory/4436-499-0x000001C93ECB0000-0x000001C93ECB8000-memory.dmp

Download

memory/4436-540-0x000001C93CBE0000-0x000001C93CCF1000-memory.dmp

Download

memory/4436-497-0x000001C958860000-0x000001C9588D4000-memory.dmp

Download

memory/4436-502-0x000001C9596D0000-0x000001C959C8A000-memory.dmp

Download

memory/4436-522-0x000001C959210000-0x000001C959218000-memory.dmp

Download

memory/4436-519-0x000001C93ECF0000-0x000001C93ECFE000-memory.dmp

Download

memory/4436-518-0x000001C9592C0000-0x000001C959362000-memory.dmp

Download

memory/4436-496-0x00007FFAAC530000-0x00007FFAAC53A000-memory.dmp

Download

memory/4436-504-0x000001C93ECF0000-0x000001C93ECF8000-memory.dmp

Download

memory/4436-506-0x000001C93ECF0000-0x000001C93ECF8000-memory.dmp

Download

memory/5172-423-0x0000022BB8B50000-0x0000022BB8B72000-memory.dmp

Download

memory/5172-456-0x0000022BB8B40000-0x0000022BB8B4A000-memory.dmp

Download

memory/5172-429-0x0000022BB8D10000-0x0000022BB8DC2000-memory.dmp

Download

memory/5172-428-0x0000022BB8BC0000-0x0000022BB8BDE000-memory.dmp

Download

memory/5416-780-0x00007FFAC6CA0000-0x00007FFAC6CA1000-memory.dmp

Download

memory/5416-781-0x00007FFAC5920000-0x00007FFAC5921000-memory.dmp

Download

memory/5920-564-0x00007FFAC5D10000-0x00007FFAC5D11000-memory.dmp

Download

memory/5920-691-0x0000027DC8C40000-0x0000027DC8CE7000-memory.dmp

Download