116a7bbe25ff2bb79a7775abcad3082acf7ba67ecee9d418c639bd74cc9a6d04

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.7MB
Sample261023-y1gdaade69
SHA256 116a7bbe25ff2bb79a7775abcad3082acf7ba67ecee9d418c639bd74cc9a6d04
MD5 cce29239c77b609458aa7ed0abc5f864
SHA1 48d7612be3cba8233cd1ed26123e65e18a2f78fe
SHA512 cb03a771668f54c52bd8da7672e861257e2de8847f0c304a7a9ab2d49c784e878980e07c9ac2e607a43e59fcb1124135c681adc3711f1b693071adb5deea27c3
SSDEEP 98304:gxBEbbyXVuPICDtPfeE/joXxPKzA0xZRdp3zi5u5D41fopr26/Y1C/aYLUwTg+of:gTEbGXVIICteEroXxCzlxZV3Gu5D4S26
TLSH
T132562310FBA41DFAFAEBC43996259165C1A3F82147E0C6CF169C86162E376E02EF571C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence pyinstaller

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4176	powershell.exe
1740	powershell.exe
2620	powershell.exe
1068	powershell.exe
3372	powershell.exe
5976	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	dwaawa.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	dwaawa.exe

Executes dropped EXE 10 IoCs

pid	Process
2348	clip.exe
5996	dwaawa.exe
4584	dwaawa.exe
420	svchost.exe
5588	dwaawa.exe
5444	dwaawa.exe
2224	svchost.exe
3804	clip.exe
5024	clppth.exe
4612	clppth.exe

Loads dropped DLL 64 IoCs

pid	Process
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
3804	clip.exe
4612	clppth.exe
4612	clppth.exe
4612	clppth.exe
4612	clppth.exe
4612	clppth.exe
4612	clppth.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4476	cmd.exe
5888	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateX64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwaawa.exe"	dwaawa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\CLPPTH = "C:\\Users\\Admin\\AppData\\Roaming\\CLPPTH\\clppth.exe"	clip.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
9	api.ipify.org
10	api.ipify.org

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e00000001c584-46.dat	pyinstaller
behavioral2/files/0x000c00000001c59f-61.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	clip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	clip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	clppth.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	clppth.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
2620	powershell.exe
2620	powershell.exe
2620	powershell.exe
5444	dwaawa.exe
5444	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
5444	dwaawa.exe
5444	dwaawa.exe
4176	powershell.exe
4176	powershell.exe
4584	dwaawa.exe
4584	dwaawa.exe
4176	powershell.exe
5444	dwaawa.exe
5444	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
5976	powershell.exe
5976	powershell.exe
5976	powershell.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe
4584	dwaawa.exe
4584	dwaawa.exe
5444	dwaawa.exe
5444	dwaawa.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	dwaawa.exe
Token: SeLockMemoryPrivilege	420	svchost.exe
Token: SeLockMemoryPrivilege	420	svchost.exe
Token: SeDebugPrivilege	5444	dwaawa.exe
Token: SeLockMemoryPrivilege	2224	svchost.exe
Token: SeLockMemoryPrivilege	2224	svchost.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeIncreaseQuotaPrivilege	2620	powershell.exe
Token: SeSecurityPrivilege	2620	powershell.exe
Token: SeTakeOwnershipPrivilege	2620	powershell.exe
Token: SeLoadDriverPrivilege	2620	powershell.exe
Token: SeSystemProfilePrivilege	2620	powershell.exe
Token: SeSystemtimePrivilege	2620	powershell.exe
Token: SeProfSingleProcessPrivilege	2620	powershell.exe
Token: SeIncBasePriorityPrivilege	2620	powershell.exe
Token: SeCreatePagefilePrivilege	2620	powershell.exe
Token: SeBackupPrivilege	2620	powershell.exe
Token: SeRestorePrivilege	2620	powershell.exe
Token: SeShutdownPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeSystemEnvironmentPrivilege	2620	powershell.exe
Token: SeRemoteShutdownPrivilege	2620	powershell.exe
Token: SeUndockPrivilege	2620	powershell.exe
Token: SeManageVolumePrivilege	2620	powershell.exe
Token: 33	2620	powershell.exe
Token: 34	2620	powershell.exe
Token: 35	2620	powershell.exe
Token: 36	2620	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeIncreaseQuotaPrivilege	1068	powershell.exe
Token: SeSecurityPrivilege	1068	powershell.exe
Token: SeTakeOwnershipPrivilege	1068	powershell.exe
Token: SeLoadDriverPrivilege	1068	powershell.exe
Token: SeSystemProfilePrivilege	1068	powershell.exe
Token: SeSystemtimePrivilege	1068	powershell.exe
Token: SeProfSingleProcessPrivilege	1068	powershell.exe
Token: SeIncBasePriorityPrivilege	1068	powershell.exe
Token: SeCreatePagefilePrivilege	1068	powershell.exe
Token: SeBackupPrivilege	1068	powershell.exe
Token: SeRestorePrivilege	1068	powershell.exe
Token: SeShutdownPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeSystemEnvironmentPrivilege	1068	powershell.exe
Token: SeRemoteShutdownPrivilege	1068	powershell.exe
Token: SeUndockPrivilege	1068	powershell.exe
Token: SeManageVolumePrivilege	1068	powershell.exe
Token: 33	1068	powershell.exe
Token: 34	1068	powershell.exe
Token: 35	1068	powershell.exe
Token: 36	1068	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeIncreaseQuotaPrivilege	4176	powershell.exe
Token: SeSecurityPrivilege	4176	powershell.exe
Token: SeTakeOwnershipPrivilege	4176	powershell.exe
Token: SeLoadDriverPrivilege	4176	powershell.exe
Token: SeSystemProfilePrivilege	4176	powershell.exe
Token: SeSystemtimePrivilege	4176	powershell.exe
Token: SeProfSingleProcessPrivilege	4176	powershell.exe
Token: SeIncBasePriorityPrivilege	4176	powershell.exe
Token: SeCreatePagefilePrivilege	4176	powershell.exe
Token: SeBackupPrivilege	4176	powershell.exe
Token: SeRestorePrivilege	4176	powershell.exe
Token: SeShutdownPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
420	svchost.exe
2224	svchost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 1840	5724	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 1840 wrote to memory of 2348	1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 1840 wrote to memory of 5996	1840	2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 5996 wrote to memory of 4584	5996	dwaawa.exe	93
PID 4584 wrote to memory of 420	4584	dwaawa.exe	94
PID 5588 wrote to memory of 5444	5588	dwaawa.exe	98
PID 5444 wrote to memory of 2224	5444	dwaawa.exe	99
PID 2348 wrote to memory of 3804	2348	clip.exe	101
PID 3804 wrote to memory of 4476	3804	clip.exe	102
PID 4476 wrote to memory of 2620	4476	cmd.exe	104
PID 4476 wrote to memory of 1068	4476	cmd.exe	106
PID 4476 wrote to memory of 4176	4476	cmd.exe	107
PID 5024 wrote to memory of 4612	5024	clppth.exe	110
PID 4612 wrote to memory of 5888	4612	clppth.exe	111
PID 5888 wrote to memory of 3372	5888	cmd.exe	113
PID 5888 wrote to memory of 5976	5888	cmd.exe	114
PID 5888 wrote to memory of 1740	5888	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\clip.exe
    "C:\Users\Admin\AppData\Local\Temp\clip.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\clip.exe
      "C:\Users\Admin\AppData\Local\Temp\clip.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:3804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local"& powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
- - C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
    "C:\Users\Admin\AppData\Local\Temp\dwaawa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
      "C:\Users\Admin\AppData\Local\Temp\dwaawa.exe"
      4⤵
      Executes a file named after a Windows system binary
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe --config C:\Users\Admin\AppData\Local\Temp\config.json
        5⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:420

C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
  C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe --config C:\Users\Admin\AppData\Local\Temp\config.json
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2224

C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
  C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local"& powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gb2312.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000013a02\_tcl_data\encoding\gb2312.enc
Size 83KB
SHA256 546392237f47d71cee1daa1aae287d94d93216a1fabd648b50f59ddce7e8ae35
MD5 9a60e5d1ab841db3324d584f1b84f619
SHA1 bccc899015b688d5c426bc791c2fcde3a03a3eb5
SHA512 e9f42b65a8dfb157d1d3336a94a83d372227baa10a82eb0c6b6fb5601aa352a576fa3cdfd71edf74a2285abca3b1d3172bb4b393c05b3b4ab141aaf04b10f426
SSDEEP 384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
TLSH
T19B830860C35ACDC0DB0D165BE0DB77932A367C7297C415A4623BF8858A378DD6C8C6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\VCRUNTIME140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
TLSH
T14C936B4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6866A5F67BE05E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_bz2.pyd
Size 78KB
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8
SSDEEP 1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
TLSH
T12B738D52B36459F6F06BA27955704347E771BD0D0390C3BFB698426B2F13B916C7832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_ctypes.pyd
Size 117KB
SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
MD5 79f339753dc8954b8eb45fe70910937e
SHA1 3ad1bf9872dc779f32795988eb85c81fe47b3dd4
SHA512 21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753
SSDEEP 3072:SHcKPoHQUCFN1KQDCVPJGltBfrShpl7PFIABPI:ShP0ChjCxJGl3frSVzo
TLSH
T1A8C34A1B635400EAEA63407CC5B35E87DB71B859172183DF02A4C69E2F637E26E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_decimal.pyd
Size 241KB
SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
MD5 1cdd7239fc63b7c8a2e2bc0a08d9ea76
SHA1 85ef6f43ba1343b30a223c48442a8b4f5254d5b0
SHA512 ba4e19e122f83d477cc4be5e0dea184dafba2f438a587dd4f0ef038abd40cb9cdc1986ee69c34bac3af9cf2347bea137feea3b82e02cca1a7720d735cea7acda
SSDEEP 6144:xJADMQRl2npdNqRb8o+wmxYk29qWMa3pLW1ALH+4t4g3:IDMQ2Nqi02/U/+g3
TLSH
T134346C56A2490DA4DE73807899974B57F7B278940360D2CF43A4CAA73F537A323BE748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_hashlib.pyd
Size 57KB
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2
SSDEEP 768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
TLSH
T1BC434B0A964000A1D97781BCD9A39F57FAB1F290631197EF9368C1CE2F537C316BAB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_lzma.pyd
Size 149KB
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635
SSDEEP 3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
TLSH
T1ECE33A86A394F4E6F3228C78D6624F57D7F578190310929A02CC876D2B1FB75992F327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_socket.pyd
Size 72KB
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e
SSDEEP 1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
TLSH
T147735A11A79051FAE673817AC1635F23F7B0F480139593CF4664DA6E1F63782AE3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\_ssl.pyd
Size 152KB
SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
MD5 11c5008e0ba2caa8adf7452f0aaafd1e
SHA1 764b33b749e3da9e716b8a853b63b2f7711fcc7c
SHA512 fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd
SSDEEP 3072:wYb/EGIexVYBgWHaCJaLuJ3TE8sOGH70NmHh4kwooSLteSdo9QBIAM73:wY7jIexVYKUazuJMOADtho9QO
TLSH
T1D0E37C47F24429B7E827E4BDC2634902EBB5F045231187DE49D5C68A0F13B46AE7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\base_library.zip
Size 858KB
SHA256 3f77a153c2ea45aba0a77dbb3334175dfee3e4e786104654e7523522e6ca4b33
MD5 07ac39d18c0936ca5ead1f207d5f7ebf
SHA1 3f25fb8668d2c8a31101e5135c486c63651793d3
SHA512 12671af82c2975047e5c91e513d60f76ebd97ade011033da0bed9be50caa425735181f19d055e8d30c07d79fabce5265107b6c50055c57edb8b18ffce6dde54e
SSDEEP 12288:USOln+WyJVw9sfJEgQN/A4a2YfVghgPIy6uB8oLV:un+VJVw9sfJEgQN/La2AVghE8K
TLSH
T19F15398069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF076E00955A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
TLSH
T1A1267C22A35401A4DAB78477C5278747DBF2FC552F20D34A41A4BAD92F73BA316EE702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\select.pyd
Size 25KB
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012
SSDEEP 384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
TLSH
T1DDC26E46EB505CC2E8238171B5E1CF06FE31B6514761C1EF7268C2692F57B8231BEB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000165c2\unicodedata.pyd
Size 1.1MB
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef
SSDEEP 12288:t0lBMmuZ63N6QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uUs:ilBuVZV0m81MMREtV6Vo4uYUs
TLSH
T162355909B9C24EE2E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A74EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000176c2\VCRUNTIME140_1.dll
Size 36KB
SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
MD5 7667b0883de4667ec87c3b75bed84d84
SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
TLSH
T172F24A8167788096E46B95B0C4A35F27FB38F9616750938F0BA4825D2F637D0F63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000176c2\base_library.zip
Size 858KB
SHA256 67176877a7b6b917875ffe1bc4e3d2f817e377f60c55ab7ce4c00c6c4953c601
MD5 137abaf476c6b2d1caab508cf7962df3
SHA1 b88312f1544bffaae362cf0c7b27b4e6ef8e13f2
SHA512 d92a418ab1e34eef10e77de9165918fb65f9547204b61f435db1a6d6c1d34833fcc71d9c4fa3fb211f73a335651771cb37c4722ded97fcda16fada301f0e28fb
SSDEEP 12288:EWy0QNLnSVghghSTEA4a2YjAIy6uBKfJEYVw92oo:EV0QNLnSVghQLa2JKfJEYVw92R
TLSH
T11F15398069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF076E00955A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000176c2\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000176c2\python3.dll
Size 60KB
SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
MD5 a5471f05fd616b0f8e582211ea470a15
SHA1 cb5f8bf048dc4fc58f80bdfd2e04570dbef4730e
SHA512 e87d06778201615b129dcf4e8b4059399128276eb87102b5c3a64b6e92714f6b0d5bde5df4413cc1b66d33a77d7a3912eaa1035f73565dbfd62280d09d46abff
SSDEEP 768:ek8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqe:ekwewnvtjnsfwGFIAB0hy
TLSH
T1F9535C529B54FDA2DAF6A5FC38D1998D242B12CC972984ECB478D3D30E5A310A127F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000176c2\pywin32_system32\pywintypes310.dll
Size 132KB
SHA256 d14a89c503599be257b733cafdd66ff8d0e77bc657360dee921d40374820c415
MD5 1a65885264738c5df2875e54536a02a3
SHA1 610381be859cf4dbe576c769de118caa35b6be8b
SHA512 8ebc9287a7d2e75e375737b6e7618d101610234b5b84acc165062f24b0281bc08d5dc9223afa5cf5ce72ac52ad68cff7d53dd949afb68897111ace39fb14264b
SSDEEP 3072:p7TS4GZvM/JeSJX1IzEAY/rZ6Yrbl64RgzXnaQRzyug:pX9GZvkJeSJX1eEAY/rPc4RgznaIz
TLSH
T11DD33947374684CAE936937ECC671A02D3A2B0110715E3CF06A1C29B5F63BE66E3B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000176c2\win32\win32api.pyd
Size 134KB
SHA256 24040005bb9c9407f539aaa085e1495d047788ed1e6c51d163ebe0277e582563
MD5 259dd0b19b3546e278ac2115078bae5c
SHA1 f4858834273be8b361cfd3cf0339df68fa0f434c
SHA512 3af7d640a68c4898dd2147fb6e4bb3bd5e0e85dfaa6d364f1876a2fca126e3142f08bc8ec3ad98f76d84635f69b36880f472e68356ee8d9bc01182b82680b3ae
SSDEEP 3072:Pwno5FuGTG18xRn0nOSrzlRVlhLaN/PlD9qTmGxRDLpb82g/e:PwoLG1aeO+lRVsPvq/9d3
TLSH
T10FD31883B39410D6D86AA2BCD5674F13E772B8240321A7CF0A70C58A1F63BD97E39795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3cekfo1h.axr.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3cekfo1h.axr.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

clip.exe

Path C:\Users\Admin\AppData\Local\Temp\clip.exe
Size 8.5MB
SHA256 c8148089c4cbcd22d3d58d9fd571da37f00603155c1d66370212d980270891c4
MD5 3a7fe59a5ebc6a230a02b00734e82b12
SHA1 a5190a5ab413ba0c179bf64e2abadfd6b9c2eeba
SHA512 818d438db37e8a69bfbaf68d08aebc13f3ba84c72afdaa0dfaa8d740c1c09d9d8d1cc738264e00908d766f9e25eff207d7f524b237bce5cdbe16df7c0003c19d
SSDEEP 196608:NXEbGXV58kgqHICteEroXxCzlxZV3Gu5D4S267y7sEGPt2CS3mUwTqqbjz:NXEdqHInEroX414S2DDqcGUweq/z
TLSH
T18C963385FFA90CB9F59F913899A0952681E3B83047D881DB1FAC49212D772E5EFF0709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwaawa.exe

Path C:\Users\Admin\AppData\Local\Temp\dwaawa.exe
Size 9.1MB
SHA256 90449fc394c1b433c98c8df8e3b5d8cf4199a6dd29ffd900566c0f61ef922fa7
MD5 3466af9037c3e4f64d62748a78ba96b2
SHA1 3f951aa833e23be12729810869078c4dce889493
SHA512 823e8d22eeaad1f2aca88ffd40fe96c4ce1cc920a78f1fa55379a5c38fd7f0b94e08f28f335ed2b14f579498a989362fb314bc8b8e0705a3f8f91b2831f2e13c
SSDEEP 196608:qY9663WA3B3XrLDEBrIe4UTr48+/OlEbGXwhSICteEroXM/zlxZV3Gu5D4S261Ce:qGFXrLDWjrf+/4ENhSInEroXY14S2cIj
TLSH
T1C3A63350F3F811F9EA97853A8D7A8161D2A270014BA4C1CF22CDC55A3F77BE0AD79B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-297-0x000001E968E60000-0x000001E968E80000-memory.dmp

Download

memory/2620-1078-0x000001D17BF20000-0x000001D17BFD2000-memory.dmp

Download

memory/2620-1074-0x000001D17BD30000-0x000001D17BD52000-memory.dmp

Download

memory/2620-1077-0x000001D17BF00000-0x000001D17BF1E000-memory.dmp

Download

memory/2620-1079-0x000001D17BFE0000-0x000001D17BFEA000-memory.dmp

Download

memory/3372-2033-0x000001AB2ECA0000-0x000001AB2ED52000-memory.dmp

Download

memory/3804-1090-0x0000015381380000-0x00000153814FB000-memory.dmp

Download

memory/3804-2039-0x0000015381380000-0x00000153814FB000-memory.dmp

Download