25918b5db47c759c6645a6859ea04874c91a8958ec6d35b10c7622883e3cf424

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 74.2MB
Sample261026-alap7act7n
SHA256 25918b5db47c759c6645a6859ea04874c91a8958ec6d35b10c7622883e3cf424
MD5 3a97a20c78e6412f486e4e8eb23d05c8
SHA1 46e1010c72d3005d3476eb7db816345bb6215356
SHA512 3edea87585bcd08f1a7e160b1fd57aa195e3754f38ac9e40dcda415b4c1650176c47028120e8d763f99c04ea555260a9a2970eab5bd39cae5f908bc69ade50f8
SSDEEP 1572864:MGKRpV8J6ZrwfSgq3wbTXoqu8voj5RLriPygBbDsPdxe7yDMV8PqK:MGKF/GKdgbT4KQj5RLrgBbDw2i5
TLSH
T12A0833A65B610BFDE41B997CBD1B2E382292B6594728D28F09E45784DE03DF00D3E9C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1612	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe
3216	powershell.exe
3672	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3868	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6076	bound.exe
360	bound.exe

Loads dropped DLL 18 IoCs

pid	Process
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3004	tasklist.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4a9-35.dat	upx
behavioral2/memory/2296-39-0x00007FF99BEB0000-0x00007FF99C514000-memory.dmp	upx
behavioral2/files/0x002400000001c456-42.dat	upx
behavioral2/memory/2296-44-0x00007FF9B3060000-0x00007FF9B3087000-memory.dmp	upx
behavioral2/files/0x000d00000001c4a5-43.dat	upx
behavioral2/files/0x000900000001b869-48.dat	upx
behavioral2/memory/2296-50-0x00007FF9B45E0000-0x00007FF9B45F9000-memory.dmp	upx
behavioral2/files/0x000e00000001c490-51.dat	upx
behavioral2/memory/2296-52-0x00007FF9B3030000-0x00007FF9B305B000-memory.dmp	upx
behavioral2/files/0x000d00000001c494-54.dat	upx
behavioral2/memory/2296-59-0x00007FF9B3020000-0x00007FF9B302F000-memory.dmp	upx
behavioral2/files/0x000e00000001c48f-61.dat	upx
behavioral2/memory/2296-64-0x00007FF9B2FF0000-0x00007FF9B3004000-memory.dmp	upx
behavioral2/files/0x000d00000001c49f-65.dat	upx
behavioral2/files/0x000d00000001c498-57.dat	upx
behavioral2/memory/2296-56-0x00007FF9B3210000-0x00007FF9B321D000-memory.dmp	upx
behavioral2/memory/2296-47-0x00007FF9B4B20000-0x00007FF9B4B2F000-memory.dmp	upx
behavioral2/memory/2296-66-0x00007FF99B970000-0x00007FF99BEA3000-memory.dmp	upx
behavioral2/files/0x000d00000001c495-67.dat	upx
behavioral2/memory/2296-69-0x00007FF9B2F90000-0x00007FF9B2FA9000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ac-70.dat	upx
behavioral2/memory/2296-74-0x00007FF9B2F80000-0x00007FF9B2F8D000-memory.dmp	upx
behavioral2/memory/2296-73-0x00007FF99BEB0000-0x00007FF99C514000-memory.dmp	upx
behavioral2/files/0x000d00000001c497-72.dat	upx
behavioral2/memory/2296-77-0x00007FF9B3060000-0x00007FF9B3087000-memory.dmp	upx
behavioral2/memory/2296-78-0x00007FF9AEB50000-0x00007FF9AEB83000-memory.dmp	upx
behavioral2/files/0x000d00000001c4a7-76.dat	upx
behavioral2/memory/2296-81-0x00007FF9AEA80000-0x00007FF9AEB4E000-memory.dmp	upx
behavioral2/files/0x000d00000001c496-86.dat	upx
behavioral2/files/0x000d00000001c4bc-88.dat	upx
behavioral2/memory/2296-89-0x00007FF9AEA50000-0x00007FF9AEA75000-memory.dmp	upx
behavioral2/memory/2296-91-0x00007FF9AE8D0000-0x00007FF9AEA4F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4bd-96.dat	upx
behavioral2/memory/2296-101-0x00007FF99DE90000-0x00007FF99DF43000-memory.dmp	upx
behavioral2/memory/2296-114-0x00007FF9B3020000-0x00007FF9B302F000-memory.dmp	upx
behavioral2/memory/2296-133-0x00007FF9AEA50000-0x00007FF9AEA75000-memory.dmp	upx
behavioral2/memory/2296-132-0x00007FF9AEA80000-0x00007FF9AEB4E000-memory.dmp	upx
behavioral2/memory/2296-128-0x00007FF99B970000-0x00007FF99BEA3000-memory.dmp	upx
behavioral2/memory/2296-136-0x00007FF9B2FF0000-0x00007FF9B3004000-memory.dmp	upx
behavioral2/memory/2296-134-0x00007FF9AE8D0000-0x00007FF9AEA4F000-memory.dmp	upx
behavioral2/memory/2296-135-0x00007FF99DE90000-0x00007FF99DF43000-memory.dmp	upx
behavioral2/memory/2296-131-0x00007FF9AEB50000-0x00007FF9AEB83000-memory.dmp	upx
behavioral2/memory/2296-130-0x00007FF9B2F80000-0x00007FF9B2F8D000-memory.dmp	upx
behavioral2/memory/2296-129-0x00007FF9B2F90000-0x00007FF9B2FA9000-memory.dmp	upx
behavioral2/memory/2296-127-0x00007FF9B2FF0000-0x00007FF9B3004000-memory.dmp	upx
behavioral2/memory/2296-126-0x00007FF9B3020000-0x00007FF9B302F000-memory.dmp	upx
behavioral2/memory/2296-125-0x00007FF9B3210000-0x00007FF9B321D000-memory.dmp	upx
behavioral2/memory/2296-124-0x00007FF9B3030000-0x00007FF9B305B000-memory.dmp	upx
behavioral2/memory/2296-123-0x00007FF9B45E0000-0x00007FF9B45F9000-memory.dmp	upx
behavioral2/memory/2296-122-0x00007FF9B4B20000-0x00007FF9B4B2F000-memory.dmp	upx
behavioral2/memory/2296-120-0x00007FF99BEB0000-0x00007FF99C514000-memory.dmp	upx
behavioral2/memory/2296-121-0x00007FF9B3060000-0x00007FF9B3087000-memory.dmp	upx

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3168	WMIC.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2836	cmd.exe
5656	cmd.exe
5904	cmd.exe
5116	cmd.exe
3884	cmd.exe
6012	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bound.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bound.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bound.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bound.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3216	powershell.exe
3216	powershell.exe
3868	powershell.exe
3868	powershell.exe
3216	powershell.exe
3868	powershell.exe
3868	powershell.exe
3672	powershell.exe
3672	powershell.exe
3168	WMIC.exe
3168	WMIC.exe
3168	WMIC.exe
3168	WMIC.exe
3672	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	3004	tasklist.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeIncreaseQuotaPrivilege	3168	WMIC.exe
Token: SeSecurityPrivilege	3168	WMIC.exe
Token: SeTakeOwnershipPrivilege	3168	WMIC.exe
Token: SeLoadDriverPrivilege	3168	WMIC.exe
Token: SeSystemProfilePrivilege	3168	WMIC.exe
Token: SeSystemtimePrivilege	3168	WMIC.exe
Token: SeProfSingleProcessPrivilege	3168	WMIC.exe
Token: SeIncBasePriorityPrivilege	3168	WMIC.exe
Token: SeCreatePagefilePrivilege	3168	WMIC.exe
Token: SeBackupPrivilege	3168	WMIC.exe
Token: SeRestorePrivilege	3168	WMIC.exe
Token: SeShutdownPrivilege	3168	WMIC.exe
Token: SeDebugPrivilege	3168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3168	WMIC.exe
Token: SeRemoteShutdownPrivilege	3168	WMIC.exe
Token: SeUndockPrivilege	3168	WMIC.exe
Token: SeManageVolumePrivilege	3168	WMIC.exe
Token: 33	3168	WMIC.exe
Token: 34	3168	WMIC.exe
Token: 35	3168	WMIC.exe
Token: 36	3168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3168	WMIC.exe
Token: SeSecurityPrivilege	3168	WMIC.exe
Token: SeTakeOwnershipPrivilege	3168	WMIC.exe
Token: SeLoadDriverPrivilege	3168	WMIC.exe
Token: SeSystemProfilePrivilege	3168	WMIC.exe
Token: SeSystemtimePrivilege	3168	WMIC.exe
Token: SeProfSingleProcessPrivilege	3168	WMIC.exe
Token: SeIncBasePriorityPrivilege	3168	WMIC.exe
Token: SeCreatePagefilePrivilege	3168	WMIC.exe
Token: SeBackupPrivilege	3168	WMIC.exe
Token: SeRestorePrivilege	3168	WMIC.exe
Token: SeShutdownPrivilege	3168	WMIC.exe
Token: SeDebugPrivilege	3168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3168	WMIC.exe
Token: SeRemoteShutdownPrivilege	3168	WMIC.exe
Token: SeUndockPrivilege	3168	WMIC.exe
Token: SeManageVolumePrivilege	3168	WMIC.exe
Token: 33	3168	WMIC.exe
Token: 34	3168	WMIC.exe
Token: 35	3168	WMIC.exe
Token: 36	3168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe
Token: SeCreatePagefilePrivilege	3216	powershell.exe
Token: SeBackupPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeSystemEnvironmentPrivilege	3216	powershell.exe
Token: SeRemoteShutdownPrivilege	3216	powershell.exe
Token: SeUndockPrivilege	3216	powershell.exe
Token: SeManageVolumePrivilege	3216	powershell.exe
Token: 33	3216	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2296	1248	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2296 wrote to memory of 6012	2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 2296 wrote to memory of 2836	2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2836 wrote to memory of 3868	2836	cmd.exe	95
PID 6012 wrote to memory of 3216	6012	cmd.exe	96
PID 2296 wrote to memory of 5904	2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 2296 wrote to memory of 5656	2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 2296 wrote to memory of 5116	2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5116 wrote to memory of 3004	5116	cmd.exe	103
PID 5904 wrote to memory of 3672	5904	cmd.exe	104
PID 2296 wrote to memory of 3884	2296	2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 3884 wrote to memory of 3168	3884	cmd.exe	108
PID 5656 wrote to memory of 6076	5656	cmd.exe	109
PID 6076 wrote to memory of 360	6076	bound.exe	111
PID 2836 wrote to memory of 1612	2836	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-24_3a97a20c78e6412f486e4e8eb23d05c8_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3868
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        C:\Users\Admin\AppData\Local\Temp\bound.exe --agent --riotclient-app-port=49798 --riotclient-auth-token=AnGK_Ss6QMzZHElfMWTgnQ --app-root=C:/Users/Admin/AppData/Local/Temp "--data-root=C:/ProgramData/Riot Games/Metadata" "--update-root=C:/ProgramData/Riot Games/Metadata/bound/Update" "--log-root=C:/Users/Admin/AppData/Local/Riot Games/bound/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/bound" --session-id=b061f0e0-3f33-f140-bcc0-20cd786d9426
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

machine.cfg

Path C:\ProgramData\Riot Games\machine.cfg
Size 39B
SHA256 6a57c6dd04773988364a6479de11472a98aa742f4252af138e25011df9a7704f
MD5 2559d7cc69274b58b7a9dc6215704f36
SHA1 398286c67f4f2789a479f20f86bb26d768f6ccc1
SHA512 e76b6585cac2b9cbfb3c00720d91b6794138c9acee89722febdd7b0cfdea1a1cf50a834da6adefc7030f1ab92959a9ea93f56253a2719bcec550a914330f8da2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_bz2.pyd
Size 50KB
SHA256 fe14d1af436b07370607c6798c3eb15fc439837cc9cbe7cbc3271b07c9ed55b6
MD5 94309558eb827e8315d0f201bbe7f2b1
SHA1 b0a511995528860239b595774a1912e8f1220c42
SHA512 1163da89470b4f4f11786961d2b24a0c01939a174415fac8321f402d85c067572f18d7a8f43ec8abdcc6f14dc76f780ec36004ac34593988240f6a7642e60365
SSDEEP 1536:3TvumeSe2uD4e4elWrlkIDLVzZ7yo47Q9M/fITjNO:jvxeSeVd4elsGIDLVzZkY1O
TLSH
T18A33D0CA83BA8057EF9369B191E0E8DBFE353BD39814421A3099B59A1E537C1C71133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_ctypes.pyd
Size 64KB
SHA256 0712d9412ea0d276c9a726765c072e00146f5aea853818d177b1a5b425839641
MD5 fc40d41aff12417142c0256e536b4a1a
SHA1 237157d6af4ec643c4d8480cf3d332951a791cc1
SHA512 b7625a5325a5b184b1733931dc3857ea5c118d85a506875dcb6b195c2372723b9c6cf80e4688c0fc1383ea063c9d831dd4c0e10ec429dd0f363aa678b1c99f6b
SSDEEP 1536:gAADR3OqwGETEepRgi29lY68KULvIDyPI37yo47Q9efITKE2:gpDVCGMEmgRJUzIDyPI33f2
TLSH
T15153D0C249698027EB238FB1A2D2C9C7B9387B639120467A51E522715B577E4F337328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_hashlib.pyd
Size 36KB
SHA256 60d239d691eb3e31d99848ba9167b5797c897b2896fa5605e61f5bce08e9cb11
MD5 933a6a12d695c7d91ef78a936ab229c7
SHA1 ff16c267921ed4dd7f2a129df675a2bc6a52be2a
SHA512 fd5416529061851e90aba6782e1550d9c48d0b10d39f52bd3ff984fbb88d0c06ee54675108508aad819d49362fb6ba74e9d3ad6dd0f3aa17654a07cae6ae099a
SSDEEP 768:gITuxGTp+IEoJJf0IPHpPbIDvI+FQ+Eyobo+Y7N2Ip4D6Cxf1mlY6C7Ep:gI2GwoJyW9bIDvI+27yo47Q9LfIi7K
TLSH
T14DF2CFCA55399116CA9375F152E9ED82FD3877F398048BAF308D52590EA33D1EB06239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_lzma.pyd
Size 87KB
SHA256 491b8a4f143c7a505e7c36a2279e84aca902e65a1e28aa6d50bcc37dbf6b5334
MD5 042ac1b18a7f6fff8ed09ec9efa9e724
SHA1 643f3dca141f8fea4609b50907e910be960ce38a
SHA512 940a44363d385e4e9fa23c06cf6d013d2585424e6a174e2afbdaa5a0cd21836a5df438859eff45a3b6e70e47322d8c8c5fa5d83315be34cfd6769e8fc2084a21
SSDEEP 1536:qE29OZvi4bwTlI+rWNp+UavAZauaND+cJyBvNMRq/2ID01497yo47Q9gfIbvFFZ:SMviSJj+Jea7RytGvID0149p5f
TLSH
T1A19302C5DFB48017D991DDB196E0DA82B4B4B3EB5C70D88F30AA95A60D533D0E748B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_queue.pyd
Size 27KB
SHA256 65ad239871835a3823401647b2dad935075b4e33a5913fd12d7f2a02b6c49d82
MD5 1073d3147f0d6a1880b78a5a5695fc70
SHA1 d97b690c490a51182e9757c15d14dfefd840e746
SHA512 45d046d2e702447aa00bada25d76fe17c3a4c8822ac62739fe820e9eac66c5262323d66ad90cddde31dd01ecd6db0128cd96950e9857c9c5c59524027c75255f
SSDEEP 768:Xe8XPAViS8QvpusID9UupQ+Eyobo+Y7N2Ip4SCxf1mljr8VMj:zgvQsID9Uui7yo47Q93fI38VMj
TLSH
T155D29ECA45B98052DE93AEB052E0EAC2BD3C77E39400865F70D9916B0F633D1E31633A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_socket.pyd
Size 45KB
SHA256 2a6b686817b640dcabc58e60289d9ace9ace3e4bc217d78953439549cee65a8a
MD5 fcfdf8cd83a8d506a4483a72eb57026c
SHA1 74428908c0068c3de2f4281aba16c13cdd28be04
SHA512 3b63e08370fa76ca8c81fc7639492367d250d507f0fb7e0e582078997ba2fa246c48eeaa9faed866dface4fcb08319096a83048dc333ad4be21947f5146b1768
SSDEEP 768:tVO07RbhED2LEIuo4OCYvmDrzbKXh4sSpuu7QptTnIDywjmRQ+Eyobo+Y7N2Ip4f:vPkD2LEIuo4EsAtSplKTnIDywjma7yo7
TLSH
T1C123D0DA86FC905AF6429BB212E4D990FB34BB939840C71F30E6516B4C537C0E71627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_sqlite3.pyd
Size 59KB
SHA256 cc17586da3a099b45644ce76cd53ffcb3f5836e9db213152e3a880569c50ca7a
MD5 1e16d084725d9b79f17ccb1996df7410
SHA1 3c49ba7b3acf317eedaa7c75319f1b39f91b79ba
SHA512 4932f891e386792a03f6340ac7c9fe9dfd52e6f4a948951520c24b5f6204b26e3fc9455658e52efdce188a98c1e0f33d86493547dad47517ffafb9bb2c088549
SSDEEP 1536:EsbxuYH/ubG5c+D4aBRYjia2DaaAUaF6IDvQDF7yo47Q9e0fIbF/:HbUYH/MoZDB/DpAUaoIDvQDFqZ
TLSH
T11053E1C949BC4049EE53AFB292E1F5C2FD74E7D394778F5F6097A2290E92340A305366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_ssl.pyd
Size 68KB
SHA256 e07199062e32fb086f8cb35c36239f1bdfe15ea10f72864fed1953dc0c2dd61c
MD5 0a56191c7fb0ae4f75de0859aeba458f
SHA1 6b1c4d1906bea388c6690fe93f12013db959a4f9
SHA512 014b18a33f7ed88f4c326a7981ec670c197d1fba54f7e050c64fe409551cdc89e8fc3ce7205cd8f45cc548c6982e00049e03ea2aeb2360b1c85ce9beb1aa8410
SSDEEP 1536:/DX4Y6/mp7lYpRHoQXN9cEpPCtsYEb7whNW6CZuTMIDL7odb7yo47Q9BfIUjC:bp1lYp57Nnp6nEb7wh3CEgIDL7oZiz
TLSH
T1E563E1DE8468D563CE52EDB042E4DE82BE38B7E39850C22F30C557A91E773E1530667A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\_wmi.pyd
Size 30KB
SHA256 b3e87affddf79349933d3095f44f80b0e2179fe651fa4592869c4c0c01fd36fe
MD5 c2ede7f81c0807df2fd4f46876925d4d
SHA1 b78cbb319add5678b0f56bc74b553ea0b4de71fd
SHA512 f83e8491e3c2c529b7659d3b96ae47622e289b1364d28acb60db3b03a20ebdee6d2b65a3910656c414b6cc520176586dcded94ab84d19be2bcfb09c807c711ce
SSDEEP 768:/fIi2GqkkJXzrpl7IIDLiOmQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/fIicX77IIDLiOn7yo47Q98fIW44D8rr
TLSH
T136E29FDB853C9166EE93AE7162E5DD82F834BBD39411461B30DA63EA0D673C0E316339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\base_library.zip
Size 1.3MB
SHA256 34702cad07aff92fc0e416ac26853c96d669fcfa616fbeccb73e0e9068568c49
MD5 0b4525ca38b97680b83a120ac2c8d727
SHA1 b491ac7a15506b810e81ea9691c318f37e57e478
SHA512 0aec7ebc80da1897de9596fde687da7043c4a69499e85b8547e5e4572efaf92e4a6df189215df430a7742c373d2bb5917984c9ca6e5ef43515abb00503117af5
SSDEEP 12288:m6RjZXtLJpWcYati2cPPdxhY/+djdT8UW7WpfuOBa80201jwCVRDVoioSYBZL+D+:DLJZ5cPPdxhYmdZW7WpfzPVSeT1W0
TLSH
T192550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\blank.aes
Size 88KB
SHA256 0a68b91807d8ff0db7bbe7825d800825ca33e9e8fb83271eee319ba446d218a7
MD5 54e44c9655ece49e6e5c3dea6fa9aece
SHA1 0946ea9d3eea5c361fea033fb1a1b06d5af484c0
SHA512 cfb74b10c141f8f7164b6f90b721eb8069a2efa118aef3b5c2da81d4f110391d4c9cb3b3920b0bd515921e82009552626d5d15476c8f0e2e568e66aca4a73bd4
SSDEEP 1536:892W0lKg3Y5gVqFnsqA6XOuVnCgEUEx2t74A2Vm4RDlhLxNRZ3eTVX4l3oReiJ:TFmMq2qA+HSUt7v2VmsRZ3eBW3oN
TLSH
T1CF93D0932089567AFF98F27A50D358A8836FA760EB419F13350F23250FD65F78A8170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\blank.aes
Size 88KB
SHA256 0caba742d22bf619aa543af5a298b04993a476c1481a3779a5ca8e91f9a42a79
MD5 f20fc34e5b0444fd10c05ec1a92c606e
SHA1 54427e5e6f0a3a7afb5fe73680c82626082d7f94
SHA512 26f0b2483f43d5a3d50586743ea4c592820b12c292c90308f2dfdd874e628ddd5049658567329c9744bfe6b6be77a05f670e0c91e3907f5bab13cbf3edad4093
SSDEEP 1536:Ue2WNQc021dBXf4wo3crZnPwwMQ7bWeGclcuP+PR+RLzWsAE6IYIBxpB:mWZ17P4wosCDQ7RzcNPARLiHEBbpB
TLSH
T1A493028EC53CC408877119765A6D662D627C35822F61BEADEFA78C4432727CF081EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\libcrypto-3.dll
Size 1.6MB
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
SSDEEP 49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
TLSH
T11775131424BF680BF69AAC788E708E2A896A1731B31CDFB32D6DDD184C18D1E59F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\libssl-3.dll
Size 221KB
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
SSDEEP 6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
TLSH
T1DD2401933E2FD83AC803AD76AE7492D2D26C37424702DE66370BC9A97B75E4D617C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\python313.dll
Size 1.8MB
SHA256 4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e
MD5 2a4aad7818d527bbea76e9e81077cc21
SHA1 4db3b39874c01bf3ba1ab8659957bbc28aab1ab2
SHA512 d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68
SSDEEP 49152:sCVE4q6qI1HNZYzIUJQTNOT9ZhXzXFWnJaeiZkYxaKE:sduqi5xOZZxzVRe6bI
TLSH
T1D0853333ADCE45F3D5DB56B193DBEF111D2EAA43911D42C5D890EA930E87620172BB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\select.pyd
Size 26KB
SHA256 8e2c5b74031b80a20bd16c149a389e60b3845d9719d97e030c42e9718cc08937
MD5 fbb31cb3990b267f9c5fb02d1aa21229
SHA1 cdae1c90d80c81927edb533fb5850c6efd541812
SHA512 af71f8be59d062cb4d095772e30ba63d0fef1e8285d549d7638c009cd67a2610f6d07e486e75f3eb1d94d8dc349d92b996f3ef83bd1d1c3617ac801d571be439
SSDEEP 768:IaWKrKpYrmID9GuOQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:DlrprmID9Gu/7yo47Q9S+fIir
TLSH
T1A4C2BFCE067C9257DE63AAB141E0DD92FD38B7835914828F30DDA1BA0D533D1A31A37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\sqlite3.dll
Size 645KB
SHA256 85b1d4d0b7db01ecb9b8c6b1b68ab122e0807eaa607551ba08849fdd957b889a
MD5 a7a7f5664333083d7270b6f6373c18b2
SHA1 f8b7729e18c1dad2974514fc685aaa05ed3ff513
SHA512 cd9a0d4a55a58f18ce565f1525339e84f22496b6264f1fa235310ff6fa3531a0b24fe6e90bdf21b8f9ef2556e726480fe3bd7e69d737f5a580d6bd3e0b8d799f
SSDEEP 12288:BpZ29aLlU2+a9Li5EMtSJS3mIgwgPlXtovn7RY/AWHAGPxVNpxQ+ch:/vipaE5gNOvlYIGAAith
TLSH
T1AEE423E31ABA4E0CE9F260709BC624D2A424336265F96AEFF55453FC2E9FAD1D1B0144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12482\unicodedata.pyd
Size 261KB
SHA256 bc52593f047cba026641ebd758133551289dcca17817c836cbb006d4529d7aa7
MD5 48a942c3930a1fee7d4404989171f5fb
SHA1 b6ea31aedbc3d17136b7c7015f687020dd8723d4
SHA512 dcea8380f7c7a38cc827bd685cd76ac4d3dc2635f42675f5afaa8ab9e07fb72fc5f6e6fc246bb82f88bf8459caa09f4a0dd6c0d145e245986cfd15d0a49d1c59
SSDEEP 6144:eFHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khEnELU8Z:etJlyHwqSBqpNsKUuntFJhMF9HC8VEx
TLSH
T1AF4412C3E194D62AF71BE8F0C3B98CA6D47F77829701C26A261C93991F2637A424173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wvhqqbyy.0fa.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wvhqqbyy.0fa.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2296-129-0x00007FF9B2F90000-0x00007FF9B2FA9000-memory.dmp

Download

memory/2296-50-0x00007FF9B45E0000-0x00007FF9B45F9000-memory.dmp

Download

memory/2296-78-0x00007FF9AEB50000-0x00007FF9AEB83000-memory.dmp

Download

memory/2296-64-0x00007FF9B2FF0000-0x00007FF9B3004000-memory.dmp

Download

memory/2296-81-0x00007FF9AEA80000-0x00007FF9AEB4E000-memory.dmp

Download

memory/2296-73-0x00007FF99BEB0000-0x00007FF99C514000-memory.dmp

Download

memory/2296-59-0x00007FF9B3020000-0x00007FF9B302F000-memory.dmp

Download

memory/2296-52-0x00007FF9B3030000-0x00007FF9B305B000-memory.dmp

Download

memory/2296-74-0x00007FF9B2F80000-0x00007FF9B2F8D000-memory.dmp

Download

memory/2296-89-0x00007FF9AEA50000-0x00007FF9AEA75000-memory.dmp

Download

memory/2296-91-0x00007FF9AE8D0000-0x00007FF9AEA4F000-memory.dmp

Download

memory/2296-69-0x00007FF9B2F90000-0x00007FF9B2FA9000-memory.dmp

Download

memory/2296-66-0x00007FF99B970000-0x00007FF99BEA3000-memory.dmp

Download

memory/2296-39-0x00007FF99BEB0000-0x00007FF99C514000-memory.dmp

Download

memory/2296-101-0x00007FF99DE90000-0x00007FF99DF43000-memory.dmp

Download

memory/2296-44-0x00007FF9B3060000-0x00007FF9B3087000-memory.dmp

Download

memory/2296-47-0x00007FF9B4B20000-0x00007FF9B4B2F000-memory.dmp

Download

memory/2296-121-0x00007FF9B3060000-0x00007FF9B3087000-memory.dmp

Download

memory/2296-114-0x00007FF9B3020000-0x00007FF9B302F000-memory.dmp

Download

memory/2296-77-0x00007FF9B3060000-0x00007FF9B3087000-memory.dmp

Download

memory/2296-133-0x00007FF9AEA50000-0x00007FF9AEA75000-memory.dmp

Download

memory/2296-132-0x00007FF9AEA80000-0x00007FF9AEB4E000-memory.dmp

Download

memory/2296-128-0x00007FF99B970000-0x00007FF99BEA3000-memory.dmp

Download

memory/2296-136-0x00007FF9B2FF0000-0x00007FF9B3004000-memory.dmp

Download

memory/2296-134-0x00007FF9AE8D0000-0x00007FF9AEA4F000-memory.dmp

Download

memory/2296-135-0x00007FF99DE90000-0x00007FF99DF43000-memory.dmp

Download

memory/2296-131-0x00007FF9AEB50000-0x00007FF9AEB83000-memory.dmp

Download

memory/2296-130-0x00007FF9B2F80000-0x00007FF9B2F8D000-memory.dmp

Download

memory/2296-56-0x00007FF9B3210000-0x00007FF9B321D000-memory.dmp

Download

memory/2296-127-0x00007FF9B2FF0000-0x00007FF9B3004000-memory.dmp

Download

memory/2296-126-0x00007FF9B3020000-0x00007FF9B302F000-memory.dmp

Download

memory/2296-125-0x00007FF9B3210000-0x00007FF9B321D000-memory.dmp

Download

memory/2296-124-0x00007FF9B3030000-0x00007FF9B305B000-memory.dmp

Download

memory/2296-123-0x00007FF9B45E0000-0x00007FF9B45F9000-memory.dmp

Download

memory/2296-122-0x00007FF9B4B20000-0x00007FF9B4B2F000-memory.dmp

Download

memory/2296-120-0x00007FF99BEB0000-0x00007FF99C514000-memory.dmp

Download

memory/3216-111-0x0000014CF48E0000-0x0000014CF48EA000-memory.dmp

Download

memory/3216-106-0x0000014CF4B00000-0x0000014CF4B1E000-memory.dmp

Download

memory/3216-107-0x0000014CF4B20000-0x0000014CF4BD2000-memory.dmp

Download

memory/3868-99-0x0000021BB60F0000-0x0000021BB6112000-memory.dmp

Download