luna_stealer | 690a1c13a27ee0c20539ddf78b46d60de0c2408b0e5315bab04a25928191d0b4

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 48.3MB
Sample260714-m755fadx2v
SHA256 690a1c13a27ee0c20539ddf78b46d60de0c2408b0e5315bab04a25928191d0b4
MD5 b22b93ddcf529c5efe2499d2d6ad81ea
SHA1 6074fbe492d5c66fe56e263e7462ac11787b3a07
SHA512 639aaaec7de4ecec91f7729d2f2c683114dff24ff84fc9191d0c88422b3240790e6480c31d0c7baf814377298594290299d6a7385611544e5c6b754593aaac09
SSDEEP 393216:poS8ojYJCdQxAUEF3JukXL+9qzT8D7fEUHI6Wjtkzu/CR6Yt:poSnjYIexAfJukb+9q/+7fECIhtQ6Yt
TLSH
T1EBB73368969409F2D1B2247F4757C8015A3BFC52A720EACB6BA47716AD1F5D3C832FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution luna_stealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
stealer luna_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5840	powershell.exe
4740	powershell.exe
1396	powershell.exe
4224	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5288	cmd.exe
5840	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4696	cmd.exe
2416	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5288	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Loads dropped DLL 36 IoCs

pid	Process
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5288	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
1	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5f5-136.dat	upx
behavioral2/memory/5212-139-0x00007FFB467F0000-0x00007FFB46EC0000-memory.dmp	upx
behavioral2/files/0x000d00000001c596-145.dat	upx
behavioral2/files/0x000c00000001c5ef-147.dat	upx
behavioral2/files/0x000d00000001c594-150.dat	upx
behavioral2/files/0x000d00000001c59a-152.dat	upx
behavioral2/memory/5212-156-0x00007FFB5D600000-0x00007FFB5D60F000-memory.dmp	upx
behavioral2/files/0x000d00000001c59e-157.dat	upx
behavioral2/memory/5212-160-0x00007FFB5D590000-0x00007FFB5D5A9000-memory.dmp	upx
behavioral2/files/0x000d00000001c599-163.dat	upx
behavioral2/memory/5212-166-0x00007FFB5D560000-0x00007FFB5D575000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ee-165.dat	upx
behavioral2/memory/5212-162-0x00007FFB5D580000-0x00007FFB5D58D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f8-161.dat	upx
behavioral2/memory/5212-155-0x00007FFB5D5B0000-0x00007FFB5D5DD000-memory.dmp	upx
behavioral2/memory/5212-154-0x00007FFB5D5E0000-0x00007FFB5D5F9000-memory.dmp	upx
behavioral2/memory/5212-153-0x00007FFB5D610000-0x00007FFB5D635000-memory.dmp	upx
behavioral2/memory/5212-168-0x00007FFB462C0000-0x00007FFB467E2000-memory.dmp	upx
behavioral2/files/0x000d00000001c59d-169.dat	upx
behavioral2/files/0x000d00000001c5a2-171.dat	upx
behavioral2/memory/5212-174-0x00007FFB5D540000-0x00007FFB5D54D000-memory.dmp	upx
behavioral2/memory/5212-172-0x00007FFB5D550000-0x00007FFB5D55D000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a0-175.dat	upx
behavioral2/files/0x000c00000001c5f0-177.dat	upx
behavioral2/memory/5212-178-0x00007FFB5D500000-0x00007FFB5D533000-memory.dmp	upx
behavioral2/memory/5212-181-0x00007FFB5D610000-0x00007FFB5D635000-memory.dmp	upx
behavioral2/memory/5212-182-0x00007FFB522B0000-0x00007FFB5237D000-memory.dmp	upx
behavioral2/memory/5212-180-0x00007FFB467F0000-0x00007FFB46EC0000-memory.dmp	upx
behavioral2/files/0x000d00000001c59f-184.dat	upx
behavioral2/memory/5212-187-0x00007FFB5B1F0000-0x00007FFB5B214000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ff-186.dat	upx
behavioral2/files/0x000c00000001c5f2-191.dat	upx
behavioral2/memory/5212-192-0x00007FFB5D4D0000-0x00007FFB5D4EB000-memory.dmp	upx
behavioral2/memory/5212-189-0x00007FFB4CF90000-0x00007FFB4D107000-memory.dmp	upx
behavioral2/files/0x000c00000001c5da-193.dat	upx
behavioral2/files/0x000e00000001c548-195.dat	upx
behavioral2/memory/5212-196-0x00007FFB5B440000-0x00007FFB5B44B000-memory.dmp	upx
behavioral2/files/0x000c00000001c601-198.dat	upx
behavioral2/memory/5212-199-0x00007FFB5D560000-0x00007FFB5D575000-memory.dmp	upx
behavioral2/memory/5212-200-0x00007FFB4F290000-0x00007FFB4F2CF000-memory.dmp	upx
behavioral2/memory/5212-203-0x00007FFB49A10000-0x00007FFB49B2B000-memory.dmp	upx
behavioral2/memory/5212-202-0x00007FFB462C0000-0x00007FFB467E2000-memory.dmp	upx
behavioral2/files/0x000d00000001c588-204.dat	upx
behavioral2/files/0x000d00000001c550-207.dat	upx
behavioral2/files/0x000d00000001c551-211.dat	upx
behavioral2/memory/5212-210-0x00007FFB59950000-0x00007FFB59962000-memory.dmp	upx
behavioral2/memory/5212-209-0x00007FFB5D540000-0x00007FFB5D54D000-memory.dmp	upx
behavioral2/memory/5212-206-0x00007FFB5B430000-0x00007FFB5B43B000-memory.dmp	upx
behavioral2/files/0x000d00000001c58c-213.dat	upx
behavioral2/memory/5212-214-0x00007FFB5D500000-0x00007FFB5D533000-memory.dmp	upx
behavioral2/memory/5212-217-0x00007FFB46030000-0x00007FFB462BF000-memory.dmp	upx
behavioral2/memory/5212-216-0x00007FFB5B1E0000-0x00007FFB5B1EC000-memory.dmp	upx
behavioral2/memory/5212-224-0x00007FFB4CF90000-0x00007FFB4D107000-memory.dmp	upx
behavioral2/memory/5212-229-0x00007FFB4F390000-0x00007FFB4F3BF000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f7-228.dat	upx
behavioral2/memory/5212-225-0x00007FFB53D50000-0x00007FFB53D7A000-memory.dmp	upx
behavioral2/files/0x000c00000001c603-221.dat	upx
behavioral2/memory/5212-223-0x00007FFB5B1F0000-0x00007FFB5B214000-memory.dmp	upx
behavioral2/memory/5212-235-0x00007FFB59630000-0x00007FFB5963C000-memory.dmp	upx
behavioral2/memory/5212-234-0x00007FFB5D4D0000-0x00007FFB5D4EB000-memory.dmp	upx
behavioral2/memory/5212-236-0x00007FFB58CC0000-0x00007FFB58CCB000-memory.dmp	upx
behavioral2/memory/5212-238-0x00007FFB58CB0000-0x00007FFB58CBB000-memory.dmp	upx
behavioral2/memory/5212-237-0x00007FFB4F290000-0x00007FFB4F2CF000-memory.dmp	upx
behavioral2/memory/5212-240-0x00007FFB4F1C0000-0x00007FFB4F1CB000-memory.dmp	upx

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4196	PING.EXE
5428	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3884	cmd.exe
4720	netsh.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4196	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5768	WMIC.exe
5768	WMIC.exe
5768	WMIC.exe
5768	WMIC.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2416	powershell.exe
2416	powershell.exe
5840	powershell.exe
5840	powershell.exe
1396	powershell.exe
1396	powershell.exe
4224	powershell.exe
4224	powershell.exe
4740	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeIncreaseQuotaPrivilege	5768	WMIC.exe
Token: SeSecurityPrivilege	5768	WMIC.exe
Token: SeTakeOwnershipPrivilege	5768	WMIC.exe
Token: SeLoadDriverPrivilege	5768	WMIC.exe
Token: SeSystemProfilePrivilege	5768	WMIC.exe
Token: SeSystemtimePrivilege	5768	WMIC.exe
Token: SeProfSingleProcessPrivilege	5768	WMIC.exe
Token: SeIncBasePriorityPrivilege	5768	WMIC.exe
Token: SeCreatePagefilePrivilege	5768	WMIC.exe
Token: SeBackupPrivilege	5768	WMIC.exe
Token: SeRestorePrivilege	5768	WMIC.exe
Token: SeShutdownPrivilege	5768	WMIC.exe
Token: SeDebugPrivilege	5768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5768	WMIC.exe
Token: SeRemoteShutdownPrivilege	5768	WMIC.exe
Token: SeUndockPrivilege	5768	WMIC.exe
Token: SeManageVolumePrivilege	5768	WMIC.exe
Token: 33	5768	WMIC.exe
Token: 34	5768	WMIC.exe
Token: 35	5768	WMIC.exe
Token: 36	5768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5768	WMIC.exe
Token: SeSecurityPrivilege	5768	WMIC.exe
Token: SeTakeOwnershipPrivilege	5768	WMIC.exe
Token: SeLoadDriverPrivilege	5768	WMIC.exe
Token: SeSystemProfilePrivilege	5768	WMIC.exe
Token: SeSystemtimePrivilege	5768	WMIC.exe
Token: SeProfSingleProcessPrivilege	5768	WMIC.exe
Token: SeIncBasePriorityPrivilege	5768	WMIC.exe
Token: SeCreatePagefilePrivilege	5768	WMIC.exe
Token: SeBackupPrivilege	5768	WMIC.exe
Token: SeRestorePrivilege	5768	WMIC.exe
Token: SeShutdownPrivilege	5768	WMIC.exe
Token: SeDebugPrivilege	5768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5768	WMIC.exe
Token: SeRemoteShutdownPrivilege	5768	WMIC.exe
Token: SeUndockPrivilege	5768	WMIC.exe
Token: SeManageVolumePrivilege	5768	WMIC.exe
Token: 33	5768	WMIC.exe
Token: 34	5768	WMIC.exe
Token: 35	5768	WMIC.exe
Token: 36	5768	WMIC.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeIncreaseQuotaPrivilege	5840	powershell.exe
Token: SeSecurityPrivilege	5840	powershell.exe
Token: SeTakeOwnershipPrivilege	5840	powershell.exe
Token: SeLoadDriverPrivilege	5840	powershell.exe
Token: SeSystemProfilePrivilege	5840	powershell.exe
Token: SeSystemtimePrivilege	5840	powershell.exe
Token: SeProfSingleProcessPrivilege	5840	powershell.exe
Token: SeIncBasePriorityPrivilege	5840	powershell.exe
Token: SeCreatePagefilePrivilege	5840	powershell.exe
Token: SeBackupPrivilege	5840	powershell.exe
Token: SeRestorePrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeSystemEnvironmentPrivilege	5840	powershell.exe
Token: SeRemoteShutdownPrivilege	5840	powershell.exe
Token: SeUndockPrivilege	5840	powershell.exe
Token: SeManageVolumePrivilege	5840	powershell.exe
Token: 33	5840	powershell.exe
Token: 34	5840	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 5212	3256	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	87
PID 5212 wrote to memory of 4324	5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4324 wrote to memory of 5768	4324	cmd.exe	91
PID 5212 wrote to memory of 3884	5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 3884 wrote to memory of 4720	3884	cmd.exe	94
PID 5212 wrote to memory of 4696	5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 4696 wrote to memory of 2416	4696	cmd.exe	97
PID 5212 wrote to memory of 5288	5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 5288 wrote to memory of 5840	5288	cmd.exe	100
PID 5288 wrote to memory of 1396	5288	cmd.exe	102
PID 5288 wrote to memory of 4224	5288	cmd.exe	103
PID 5288 wrote to memory of 4740	5288	cmd.exe	104
PID 5212 wrote to memory of 5428	5212	2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 5428 wrote to memory of 4196	5428	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /F "C:\Users\Admin\AppData\Local\Temp\2026-07-14_b22b93ddcf529c5efe2499d2d6ad81ea_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
Size 66KB
SHA256 2aa1899de24b9cf33ce47e400f41557bf336ee9f26c3492310cdeb4ad2f02bb4
MD5 240cab697496f8e17bf33c5d161ec957
SHA1 8808387a611f3e351b12d2576d9deb3da3dadc4f
SHA512 778c1892c6d28912f4b4b40c5ce945143eae66cd4719fa2071db8a20a85d91795ad054a72290ed918d783e4061b9edcd46769c6581774aca45f36597dc21cc07
SSDEEP 1536:BRRToHqX7wZ3bSYKsRWLm5x1fyI461XV20z42IT9iMlD0oa:BRRTtr6LSYjWLmpfyB61H47T91V
TLSH
T12263F1ABD5D3DF68CE2724B314572500F606F42217A7DF2F08EB316C1D9AA44F9E1AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\Cryptodome\Cipher\_raw_aes.pyd
Size 17KB
SHA256 1f6adc3ff4fb894821f970a24bb7b7658e79109bed2d0c3a495e0b594800270a
MD5 fbd6eee3db86e78d4549707c1abdb34f
SHA1 8e1e0caf291a1f783247d9e5210ee271e959487a
SHA512 9bd27c0d9e77e00c26bfbca2e2097379ed45cb4d7abc47af56d85cca6afa643e081526ade1f8ff663f3dae425b854bac5d7713109b33603bd35e02e6a349c833
SSDEEP 384:hYKO4ybrS6X6d0Gtbdc/4xOxmOq4JAQnpvnOIh+s4uZa7gJX8CS:hY/tKvcg4IOqkAMpvxxpMCS
TLSH
T1FB72AFF5A2BEC8BCC9B560320CA299A9F3217B6B6413031F05D135BE5EB3D541F22A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\Cryptodome\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 af9b383b067dd7ee8d0796a1e95f5c7f30efc25be5cd646e8c0e2a86b6ecf3a0
MD5 f1ddec2fb6f8582db90bee6fac6b4640
SHA1 458e56694673d70d1d7f19d01275c1cc91c3e724
SHA512 0ed3808c2b41353107b51df87ead3cb9a66f517d209d791251896a0e7a7edfcfeb247dd25513c33d88b6f4918d0d188cb046bd91d461d2cbd1b1a7279abb2ce3
SSDEEP 192:owYipdrvzmhp8BShP1nmQ2Ia+hyKnhSqwT4RRL4haQDkYj273QJXlEnLU:o9iLl0hP/vLys0q+4gRDZa7gJXW
TLSH
T19F329ED78219E6FCC4B574B718975A94FB323436122A9B2F08CA37BF9CB6A143420774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\Cryptodome\Util\_cpuid_c.pyd
Size 9KB
SHA256 6bf9f292aae102b5d36387b97a18ee05407f857e31d40d77b635e8dffbc40bc4
MD5 18f6c2e330e702f22d6589e79872aa06
SHA1 8c2eac53e39625a4ee5f9589cc67ab8e833bc9ae
SHA512 763e1ca2695462a9fe40ca38435b708e67242e4056bab952b8ec896b83ef8c7904801292f6e475630c256ec430f4c8344d2024c7ee8c384e7e61f271ccbd288b
SSDEEP 192:dkRQHLyJVf5DoE+uJL72iD5UR9rGHc/NhkYj273QJXpHzI:qCoVf9L7DD569q81hZa7gJXZI
TLSH
T1CD124CB7937EF2FCC53A54B60D4B4898FA65F83BD112131F01E432FA4CA67526D21661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\PIL\_imaging.cp312-win_amd64.pyd
Size 795KB
SHA256 38f5b7feae1a9714d50c534869fc059e92fd9af03097e271486eadf2a5105ce1
MD5 e1897aa88d59e53d30db6227ad825876
SHA1 d3f19a391788cd9577300eb7c2be111eb42c5179
SHA512 e8dea8f747bef34cbd9a38172bd32a0c731ff14be9c04fda579af087ad836c602040f809c79d2939872d61dbb31ea59bea5fba31f2d1c8e9ab8c64271072ef6a
SSDEEP 24576:A/bgT2jfK2vfFUDQjZqGYh3SZm98RZ2Rf:QjHvtUkahiwWZmf
TLSH
T1680523080DA3DBABC6555D7B0C533A3031F2A8042D66599A9B7839F3F098753DDACAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\VCRUNTIME140_1.dll
Size 48KB
SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
MD5 7e668ab8a78bd0118b94978d154c85bc
SHA1 dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA512 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
SSDEEP 768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
TLSH
T1F6236CD593785082D49BA9B08197DE17BE3CFA924B50928F0BA1D15C2F637D0A73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_bz2.pyd
Size 48KB
SHA256 106201d8f7fe4428d8aaca20374049bfb68bed66aeaf553d28dd7b75af09aa04
MD5 132d4b75bcd5976276523d25fad6c8eb
SHA1 ea07f538c1ce47db24a25017248e7b25a2f7f74e
SHA512 6fd144e87901c6c509dcb68b3d4c1a0936b44f0aa9057d077aa08f3d4c4bc3dac52e2cb367f8edca76c9e2fc23b383fe34f8bf5362dfaf8a7ba6e6c360f5de6d
SSDEEP 1536://onT0xi3xXtfwYf5CVW3Bd7IGCVwU7SyixL7://k538e5CIRlIGCVwUO7
TLSH
T10723D0A70AA86C34DC778DB230D1C81AD970B6979911C79B3159E1A84FB13813FA32B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_ctypes.pyd
Size 59KB
SHA256 efe186611c7b7c77bd3bc64be47fc435c4e090b8c1d866d813333aa6d4a57a36
MD5 3d5350637276346bfdf606ac1d89538f
SHA1 158d3e56bcf28b356aba1f701c48a63ee0bdb455
SHA512 e9678684271b8e646a0473e3271970773fca027b25a5e64cf411670c05e1b54e4e8fbe4696b809712302c562f6b935ca67d43721a982191393939740a8a59f52
SSDEEP 1536:ZbK/YBHE2gCtX+/9zyeoVIkwLMzKep8z+IGLPAt7SyWxU:ZGAK2ghtGIk6MeeGyIGLPAtz
TLSH
T13153F1D3521DAC52DD0B8FB325C1856AFD303AA747A1CBC5314AC266AF367416B933B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_hashlib.pyd
Size 35KB
SHA256 1716302664a2d820d9e3561beb168efdbe7a9890a576d97a2709b84b3ff6bed1
MD5 81cc9d563b8f531699bad64960bbde00
SHA1 2e416f013a3352076ebf03939588378246f228f1
SHA512 c334e5564a5d39e4f4b34f36fd834cfe305c8eb221477f371714db0a66cba9bc594db9d943423bf2d9b96933bbb6d8b6aa1cb4b8dd01cd94fe2c16090cfa3878
SSDEEP 768:61KW7574DsajR20fnfPHz8HLP8pfbnIGOINg5YiSyvIAMxkE3n1:SKW7hq00fnTQEbnIGOINy7Sy+xzn1
TLSH
T163F2C0E383B4A82ACD33DC7235C5C925FE3176875940C3DB328D516A4F623426FA5276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_lzma.pyd
Size 85KB
SHA256 ded1987cfb3becbdf39682efc2ae68d588fc2960c79929bcfd4c5b228d7c5487
MD5 9cfb6865b9ec86850d7f3645129cb438
SHA1 9d63cbe4fde0a11da4df3094a6bc048a47f8920f
SHA512 03f88d083915f3ab29494e5958a7c07f32651c771058a05f6eaa65c4c020a869eb8a881945d7146b9a57a5ea3bbbbe7946f0d01156e276df16850fc8531b3c8f
SSDEEP 1536:cSQY6vZR307kwHMn3NsbM5PlvQzSqoSdPN1uruZkU2D90nGt4pcgIGZ1rA7SyTx7:NQY6nEZe3NsbI1QzSwlaugudNIGZ1rAP
TLSH
T1398302EA85E07851E94A2C7739E5C526FE70B9831FA14EC2735CC5AB4BB27427EE0170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_queue.pyd
Size 26KB
SHA256 f245251705ba34d3c64083373636869bc4828e81003aa9cc410305f9464247c4
MD5 b32a341a78f78278b59897aab626e185
SHA1 cf122e70f15ff14b875c0eede2c81b7275c5847b
SHA512 0b404f8a1add2dd312f2995517ddb40c4c9bc140fda75ffdf4b8970f6f501793578623d371ad42d50d2d82fc65d2ee9ed738454d5050c808f01c9ec8067d19f8
SSDEEP 768:Gzh/iDHAPcpqyIGQUNz5YiSyvHAMxkEJ5YSv:ShiDHAP5yIGQUN97SyPx/Y+
TLSH
T1ADC29EE342B4AC29CD238D7134D59524FE35B9935A4183D7728CC1798F22781AFE63B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_socket.pyd
Size 44KB
SHA256 7805a356a0a9680baceb4c135ea1bf8460b91720cd53c9ee894f7d065ade6fce
MD5 d2ce1572015d3dc222014305df125c5e
SHA1 6c197c5d85be53dfe7aa69d4ca93a74561394af4
SHA512 47843fcf80015b047163038c6155fba3981f1898b0a6dbf5e1dade78bd6533b87d9f34ded5797c84d982a4e58f3932d8791da2a35f13585b122b659b760e17ef
SSDEEP 768:d1X8HEfobVbgwsIZsQD182/q2vQttkmnIzPnzTpwOgIGLwgBT5YiSyvvBAMxkEn:nXz0gwsGsQD1ZbmiSOgIGLwgBd7SyZxL
TLSH
T13613E1E3D128A468D5368DB271D58934FA36F6C7D940839723DCA2438F36382AD853F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_sqlite3.pyd
Size 57KB
SHA256 a2a7a77077a20d50eb631b9c524f1cf490cf1bf6a14b6ce793339e4d332ccd30
MD5 c5a1ff3db87d9c960083bfe6557ef175
SHA1 6c5278eddfefc46b0507cd1d9a73d75da5af2fa2
SHA512 0a9396356258983df60d882a3f90fed5c5b1c23d31f87fdc2332fc9f766e3a41c5695e54b9d60768114ecfbc63af26ec8303edd583ba74bfe1b9f0e858a3a519
SSDEEP 1536:j5ovI/e3wTAiHXhchuXbLfbmmKTnjBChRDLHKVIGOQQm7Syxx2e:j5fXAcew9KTjBCh1kIGOQQml
TLSH
T1D743D0A7C511982CCC36ACB03DC496259A747D134BC0C7C73199927A4F5A7C17ABB3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_ssl.pyd
Size 65KB
SHA256 ee63c2e9d0ccfc096432a2dbad6d846de1da59516e854626bf31e40a640c14d5
MD5 32311b1b48279ca0d01ec3f71dd950cc
SHA1 351fbe867e1c0ef9b6861d5b06e985462fc5cc93
SHA512 57595fa9088fa0ae418ea8cad3175ddbd47ca46a8e43498df603a85589a561a042cf920428b40727b077c8c251addfb142625baa1428cb0884505f507198e549
SSDEEP 1536:PRuyAdinkEweTTDWPnQfNnPAdu8LfPXrBIGC777m7Synx5:ZF9fEo58DPXdIGC77yN
TLSH
T1E963F177C2649D3ECD13ACB474E85435FA70725B8A60C2C7724DA2B59F697822F420BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_uuid.pyd
Size 24KB
SHA256 bb418e91e543c998d11f9e65fd2a4899b09407ff386e059a88fe2a16aed2556b
MD5 3c8737723a903b08d5d718336900fd8c
SHA1 2ad2d0d50f6b52291e59503222b665b1823b0838
SHA512 1d974ec1c96e884f30f4925cc9a03fb5af78687a267dec0d1582b5d7561d251fb733cf733e0cc00faee86f0fef6f73d36a348f3461c6d34b0238a75f69320d10
SSDEEP 384:lrfwHnEWGQiAQVIGZwJXHQIYiSy1pCQ4XAM+o/8E9VF0NyqzJSj:dQnEIHQVIGZw95YiSyv8AMxkEqw
TLSH
T1ECB27E86DA605C51EC27CAB1A4D54F1AE975FB825B9083CB330CC1591F613837AFA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\_wmi.pyd
Size 28KB
SHA256 0e14629b21d8541d92c6ca9318216b02141d86c129c4b86c97ecb5e44a5b6236
MD5 cfb849b01e9b4fc8b186b4a659fafe47
SHA1 69021853ee738ec9d78d00c364d86b91c959b1a9
SHA512 f3dc662124cb3e9829462fb58392961c43512229f4d00a3839f3f4fd52bc303067084c8b63d006e324d4781be3041d642e1493bb7e128b10a20fc33d02b1084e
SSDEEP 768:nWw1HQYXj+pMUbIGCi9lx5YiSyvzAMxkEaFy:nWMpUbIGCi9h7Syrx+g
TLSH
T11ED28EA28270EC29DC639CB234D4993AFE31BA535940C3DB3169526E4F753817B973B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\base_library.zip
Size 1.3MB
SHA256 c95ffd4e8396dc2510d41fe8bdcb7d60af1ddb05c7d4faa211fa4da56bcc4838
MD5 2526ad7b19df38fb314fda980133463a
SHA1 c85c3d1b7d7d0e0c2d52fc9daa24dfdec2a253d6
SHA512 39d755dbbee2c603595ddcba1bfe5b7f3e953e1e0d564507b576bb0bba1db59216a87623b25f0f853f1563ce2e8c66080c203b400b16c4b075e20518156e08b9
SSDEEP 12288:YOmgR5gyMGm4HtzJYTq+zYgEkA1qJuAdw0P6dY4aYcOw3gC0ttcY+bDD9wV+S:YHCuwtJp0P6dY4aYcOsCttcY+Xk+S
TLSH
T1F855D681B692A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\certifi\cacert.pem
Size 228KB
SHA256 bbc7e9c01d7551bb8a159b5dedd989b8ee3ce105aff522b68eb1b01bf854cab0
MD5 53724ebe755e8c9505a580b59a6fa5d1
SHA1 d277cde9a92feb6689b565025f5610576a67540b
SHA512 cd7cecdfd755693b99b7eaac14418fc639f7cb32bb0e9414e6eaa57c4992e2874ac39e40335a1049bcd7bb0d61b8ebffe9d5395aeecbc163359887582ae4b5a1
SSDEEP 6144:0plSRrqADwYCuCRT/QRSRqNb7c4u59hrB:0LSRrHnRWav309n
TLSH
T1AC347C954F2A9C092C9FF1C1CA9B1357DD3E027A99FEF0F1290A2408D24622A57FDD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\charset_normalizer\cd.cp312-win_amd64.pyd
Size 9KB
SHA256 d0d551ab9a09d48a76141e2a675b26c3f311db69adb554f72d7edeb05c337f04
MD5 b77b53fca554d8cc970ebeec5b89da1e
SHA1 c177bbf0f7bde2634fa62df0a47e1750bc31d7a5
SHA512 39c8c22111a0434b5eedcec928a865905ce5e0bd4bcc1bff5f6cfbc664568b5513a9281be720e57d86a575404a22f318ec89bb0fe3c042ac74627bafe97f85c5
SSDEEP 96:wYxj8huR61+I604MdFAe/WLdYBLALuC0eboWZj9/okYBbPJBj34lVhXg246ae7sz:gqEDFOCBLvioux/okYj273QJXpHUX5
TLSH
T17B124AE3D23FE2FDC4295D720687885AF732F622624A132F01D9217E9CF7B215621B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\libcrypto-3.dll
Size 1.6MB
SHA256 b1a3a3d090fcc0263bdc508efe7b818cecd34ea43c38e90e42cd9f40e36b7243
MD5 33f448cbb24a96e2a13cf3cf4c280904
SHA1 95fa1c731c18d8094d861c5958018c4d74fbef18
SHA512 a7c84464e1a26df4fe2c88f006b1d0523d894c04831347cc4005778cade15521d13bd40a5b269698b5b76d5514f5d21dbefad954c69f055a1940aaf4d1f29035
SSDEEP 49152:nMyDwbv70aKbP1zkLO5YHLA1CPwDvt3uFlDCZ:vwbv77KbPaqYHLA1CPwDvt3uFlDCZ
TLSH
T1E875121414BF780BF749A4789F34D8AA8D5E2712B708DFE12D6E8E280C19D0E95BD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\libffi-8.dll
Size 29KB
SHA256 a7ac89b42d203ad40bad636ad610cf9f6da02128e5a20b8b4420530a35a4fb29
MD5 bb1feaa818eba7757ada3d06f5c57557
SHA1 f2de5f06dc6884166de165d34ef2b029bb0acf8b
SHA512 95dd1f0c482b0b0190e561bc08fe58db39fd8bb879a2dec0cabd40d78773161eb76441a9b1230399e3add602685d0617c092fff8bf0ab6903b537a9382782a97
SSDEEP 768:Op/6aepjG56w24Up3p45YiSyvkIPxWEqG:MA154spK7SytPxF
TLSH
T18CD2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\libssl-3.dll
Size 223KB
SHA256 8f559bd71d0d422a2d44ffb9f489bd0a9764b31b6c8e265809d9f483fe75399d
MD5 be89dde1ed204a5e32cd9f0b2cd8cb0f
SHA1 053fd1853482b2f7c7c62bd947852992e84bb899
SHA512 7dbdc1417661845b85582f0b63c6f0d84e66e5d29aad404b9c87270f6552f7babc9736340effebdee7573816e735b306c430f2ea122c06ed806de1669d2b3b30
SSDEEP 3072:/FfmvsqWLSCMT+MyN6Qp2oZqpN+/fvrqknqbf6CjaBGkfPkZAK1ck2kBVfLwOmFd:/FevsT9JN+vyH1nqLr3CPrYBBRcd
TLSH
T1FC2402A2712F8823CC17EEB6DBF860E5D76D770A6F06C8663723C90CBB6091C665C255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\psutil\_psutil_windows.pyd
Size 32KB
SHA256 6bedc0c2aef20f159cf83cb3c00f324274c56a87fccd6d43ab781fcfa443c16a
MD5 12a954fd8bd87c0878945229e7f12d96
SHA1 9b9b79fefb3cea5fb20dfca3aec86ccfdc155b34
SHA512 54eb02623acab7d09167b8f34c29895f50d9ab66e5350c490be633f173f5f7ba91cbc3f498752f56b89cd234cad0a1dcccf6d9549783eecb6497cf99e9808b09
SSDEEP 768:VYU5FhhiJBW2uvTwJ+874UVXaEAZz/ESjhsfojUpH:VYqhhiJVuvsjVpXAdco8
TLSH
T114E2F2C3E227B774CEAB6C331A5712685B89F0372698571B047990377D23AB6BC20C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\python3.DLL
Size 66KB
SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
MD5 77896345d4e1c406eeff011f7a920873
SHA1 ee8cdd531418cfd05c1a6792382d895ac347216f
SHA512 3e98b1b605d70244b42a13a219f9e124944da199a88ad4302308c801685b0c45a037a76ded319d08dbf55639591404665befe2091f0f4206a9472fee58d55c22
SSDEEP 768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
TLSH
T173637112BB54F8A3DBFA66FC39D199CD542B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\python312.dll
Size 1.7MB
SHA256 888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538
MD5 552ef97cdbebf443304b7514bb50e950
SHA1 8d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc
SHA512 c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325
SSDEEP 49152:eTBxkJIkNEakpCPK1JQyHi3p70PHY6/g7:YeFNlUsK1ij31WYUW
TLSH
T14F8533361DAE8C27DDA5A4F25B95AC07711E8240160ACCC4EEF1C2C79F9F9195123BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\pywin32_system32\pywintypes312.dll
Size 62KB
SHA256 77c6d74e3bc091f4f876736df5f7cb9d655993163ada8ee9cb95d433423d664e
MD5 fdfbe26ea79ceae4f3bc08d7828b6c98
SHA1 a44ffa796045464ebb48f703b8bc22e263ac3060
SHA512 8fb76d2edffa130fd86582545329c574a5dc6ff6c544cd8b91c71f3654520d4711f24d01feb93f0f68d5123ac1e72a6eb3ab10ddf7df2ea539b656a4a3ebef1e
SSDEEP 768:+hyOld6DdTJnwA9YNcXC9ubX+ICGBrFV4rx7HT0pqr542YhyEZOVP4alv1Rj01Yw:+h6fnT2cguT+V6rT4rJHTFr54Thy84q
TLSH
T13C538C526E17DC9FCA1BE3372C89442190C7A255474DFBE296D7C2E3E0EA3D22C2A517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\select.pyd
Size 25KB
SHA256 ef6e08124edbaf86b601e63ee9d5ac3496ffed69df986214aa1c99bdc4ed48f8
MD5 f53e1a6e53effdd1affee84059381a36
SHA1 58ad1ba526761a80dc8be6a76efab56a4fc9a160
SHA512 94b6675f2bcc1c86f9c9626be3d47251fefba957dc9a241cafe2a28d354003cba17446ba5e8c1f9bc279fd8a1979fa1294992645725872329a63cf6fdc806319
SSDEEP 768:vnyukFaypXM5IGQGNf5YiSyvTcAMxkEMrX:vnGAaM5IGQGNR7Syb6xuX
TLSH
T1D0C2AEA346A46C28D827CDB334C85939FE31BD978940C7E731A9926A4F223427B97375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\sqlite3.dll
Size 622KB
SHA256 2ccf5efd8c86f6573192ef0953391311695490b138ce6c654165770768c4fe81
MD5 273a98a2cb7fca958111aea4389eda20
SHA1 2d2e8586a595030d7507964e6b83ef1f300bff5d
SHA512 561b969846789b3315447bb7853a52373c55572cbd1c7311cafb8d84af0f6e275bf8a09c9c0d4fb66119e4c873ef427f748672efead6e089f0d537768d118f3a
SSDEEP 12288:3evMEHnoed8VDT4Rc+iHsLG56RY+hPQHAnxeIglZsk2F24ZHL2Ubsi2UTwYqmH:38oy8x4Rl1dRnxeDlZxsl2MsD0w9mH
TLSH
T1B2D423E3B02F5C9CF5F28C76E193B891C91A6929EEB105C3FA5CD71A5E29A40CC56390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\unicodedata.pyd
Size 295KB
SHA256 72b60de42287a309f28430beb9d6a3eb9f129745009ff6de0039a9bd37c027d0
MD5 2060ba9f82062efb4dfb6bf20f8b156d
SHA1 84c02f0a10ca72895ebf0a8877711fe0f21830ce
SHA512 45882afa8d6df90180975f7a678f8e33863a4c40f1696db14fc516fb6162030faef803f759fb0754f64a499046dbff2f8e6ec6c20e2cf1f2270da4a13c5c3a0b
SSDEEP 6144:HtX6biS7ltWh4BvaEyS+KPUR30JlSEwV7hqoUnJG4qKOF6J:HZLS5YiyEFPPl3yqrJG4V06J
TLSH
T1A95423A69C345820DC23EE3811CB8A5DDF75A80FC854C2DFA1B6320E673EFD62E95516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32562\win32\win32crypt.pyd
Size 52KB
SHA256 209484c0771dbdc0776e787605219ac42ca290c4a000572dfbafead0e621f479
MD5 51c9979d122018639396dc8d9d498975
SHA1 5906d4df89bffa48a27b6badd35aaa9cda691792
SHA512 c9ae568293a8dec180c5b593833473fd0c743c9a764023e2052374d65a91fe1662049b61d319838b1034ccb8a203d478ddafd219c6828920f6f9268313c21e8c
SSDEEP 1536:aI+ifHwgkXHDcyerxtKeis0Z5ELHfdgam:ZpfH6XHRuKeis0feWa
TLSH
T11233CF153D5B5EBED8D3F3B35C00184AE5927A0ED71A2F910482D35268EA6F10C6A57B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_np1ceeoo.hlu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_np1ceeoo.hlu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2416-251-0x0000019BB72C0000-0x0000019BB72E2000-memory.dmp

Download

memory/5212-217-0x00007FFB46030000-0x00007FFB462BF000-memory.dmp

Download

memory/5212-242-0x00007FFB5B430000-0x00007FFB5B43B000-memory.dmp

Download

memory/5212-192-0x00007FFB5D4D0000-0x00007FFB5D4EB000-memory.dmp

Download

memory/5212-189-0x00007FFB4CF90000-0x00007FFB4D107000-memory.dmp

Download

memory/5212-180-0x00007FFB467F0000-0x00007FFB46EC0000-memory.dmp

Download

memory/5212-182-0x00007FFB522B0000-0x00007FFB5237D000-memory.dmp

Download

memory/5212-196-0x00007FFB5B440000-0x00007FFB5B44B000-memory.dmp

Download

memory/5212-181-0x00007FFB5D610000-0x00007FFB5D635000-memory.dmp

Download

memory/5212-199-0x00007FFB5D560000-0x00007FFB5D575000-memory.dmp

Download

memory/5212-200-0x00007FFB4F290000-0x00007FFB4F2CF000-memory.dmp

Download

memory/5212-203-0x00007FFB49A10000-0x00007FFB49B2B000-memory.dmp

Download

memory/5212-202-0x00007FFB462C0000-0x00007FFB467E2000-memory.dmp

Download

memory/5212-178-0x00007FFB5D500000-0x00007FFB5D533000-memory.dmp

Download

memory/5212-172-0x00007FFB5D550000-0x00007FFB5D55D000-memory.dmp

Download

memory/5212-174-0x00007FFB5D540000-0x00007FFB5D54D000-memory.dmp

Download

memory/5212-210-0x00007FFB59950000-0x00007FFB59962000-memory.dmp

Download

memory/5212-209-0x00007FFB5D540000-0x00007FFB5D54D000-memory.dmp

Download

memory/5212-206-0x00007FFB5B430000-0x00007FFB5B43B000-memory.dmp

Download

memory/5212-168-0x00007FFB462C0000-0x00007FFB467E2000-memory.dmp

Download

memory/5212-214-0x00007FFB5D500000-0x00007FFB5D533000-memory.dmp

Download

memory/5212-153-0x00007FFB5D610000-0x00007FFB5D635000-memory.dmp

Download

memory/5212-216-0x00007FFB5B1E0000-0x00007FFB5B1EC000-memory.dmp

Download

memory/5212-154-0x00007FFB5D5E0000-0x00007FFB5D5F9000-memory.dmp

Download

memory/5212-224-0x00007FFB4CF90000-0x00007FFB4D107000-memory.dmp

Download

memory/5212-155-0x00007FFB5D5B0000-0x00007FFB5D5DD000-memory.dmp

Download

memory/5212-229-0x00007FFB4F390000-0x00007FFB4F3BF000-memory.dmp

Download

memory/5212-162-0x00007FFB5D580000-0x00007FFB5D58D000-memory.dmp

Download

memory/5212-225-0x00007FFB53D50000-0x00007FFB53D7A000-memory.dmp

Download

memory/5212-166-0x00007FFB5D560000-0x00007FFB5D575000-memory.dmp

Download

memory/5212-160-0x00007FFB5D590000-0x00007FFB5D5A9000-memory.dmp

Download

memory/5212-223-0x00007FFB5B1F0000-0x00007FFB5B214000-memory.dmp

Download

memory/5212-235-0x00007FFB59630000-0x00007FFB5963C000-memory.dmp

Download

memory/5212-234-0x00007FFB5D4D0000-0x00007FFB5D4EB000-memory.dmp

Download

memory/5212-236-0x00007FFB58CC0000-0x00007FFB58CCB000-memory.dmp

Download

memory/5212-238-0x00007FFB58CB0000-0x00007FFB58CBB000-memory.dmp

Download

memory/5212-237-0x00007FFB4F290000-0x00007FFB4F2CF000-memory.dmp

Download

memory/5212-240-0x00007FFB4F1C0000-0x00007FFB4F1CB000-memory.dmp

Download

memory/5212-239-0x00007FFB49A10000-0x00007FFB49B2B000-memory.dmp

Download

memory/5212-243-0x00007FFB58C10000-0x00007FFB58C1C000-memory.dmp

Download

memory/5212-187-0x00007FFB5B1F0000-0x00007FFB5B214000-memory.dmp

Download

memory/5212-156-0x00007FFB5D600000-0x00007FFB5D60F000-memory.dmp

Download

memory/5212-304-0x00007FFB462C0000-0x00007FFB467E2000-memory.dmp

Download

memory/5212-139-0x00007FFB467F0000-0x00007FFB46EC0000-memory.dmp

Download

memory/5212-305-0x00007FFB5D550000-0x00007FFB5D55D000-memory.dmp

Download

memory/5212-306-0x00007FFB5D540000-0x00007FFB5D54D000-memory.dmp

Download

memory/5212-264-0x00007FFB46030000-0x00007FFB462BF000-memory.dmp

Download

memory/5212-270-0x00007FFB53D50000-0x00007FFB53D7A000-memory.dmp

Download

memory/5212-276-0x00007FFB4F390000-0x00007FFB4F3BF000-memory.dmp

Download

memory/5212-294-0x00007FFB5D560000-0x00007FFB5D575000-memory.dmp

Download

memory/5212-291-0x00007FFB5D5B0000-0x00007FFB5D5DD000-memory.dmp

Download

memory/5212-289-0x00007FFB5D600000-0x00007FFB5D60F000-memory.dmp

Download

memory/5212-288-0x00007FFB5D610000-0x00007FFB5D635000-memory.dmp

Download

memory/5212-287-0x00007FFB467F0000-0x00007FFB46EC0000-memory.dmp

Download

memory/5212-293-0x00007FFB5D580000-0x00007FFB5D58D000-memory.dmp

Download

memory/5212-292-0x00007FFB5D590000-0x00007FFB5D5A9000-memory.dmp

Download

memory/5212-290-0x00007FFB5D5E0000-0x00007FFB5D5F9000-memory.dmp

Download

memory/5212-313-0x00007FFB4F290000-0x00007FFB4F2CF000-memory.dmp

Download

memory/5212-310-0x00007FFB4CF90000-0x00007FFB4D107000-memory.dmp

Download

memory/5212-318-0x00007FFB46030000-0x00007FFB462BF000-memory.dmp

Download

memory/5212-336-0x00007FFB4F390000-0x00007FFB4F3BF000-memory.dmp

Download

memory/5212-326-0x00007FFB53D50000-0x00007FFB53D7A000-memory.dmp

Download

memory/5212-314-0x00007FFB49A10000-0x00007FFB49B2B000-memory.dmp

Download

memory/5212-341-0x00007FFB58C10000-0x00007FFB58C1C000-memory.dmp

Download

memory/5212-340-0x00007FFB4F1C0000-0x00007FFB4F1CB000-memory.dmp

Download

memory/5212-339-0x00007FFB58CB0000-0x00007FFB58CBB000-memory.dmp

Download

memory/5212-338-0x00007FFB58CC0000-0x00007FFB58CCB000-memory.dmp

Download

memory/5212-337-0x00007FFB59630000-0x00007FFB5963C000-memory.dmp

Download

memory/5212-317-0x00007FFB5B1E0000-0x00007FFB5B1EC000-memory.dmp

Download

memory/5212-316-0x00007FFB59950000-0x00007FFB59962000-memory.dmp

Download

memory/5212-315-0x00007FFB5B430000-0x00007FFB5B43B000-memory.dmp

Download

memory/5212-312-0x00007FFB5B440000-0x00007FFB5B44B000-memory.dmp

Download

memory/5212-311-0x00007FFB5D4D0000-0x00007FFB5D4EB000-memory.dmp

Download

memory/5212-309-0x00007FFB5B1F0000-0x00007FFB5B214000-memory.dmp

Download

memory/5212-308-0x00007FFB522B0000-0x00007FFB5237D000-memory.dmp

Download

memory/5212-307-0x00007FFB5D500000-0x00007FFB5D533000-memory.dmp

Download

memory/5840-260-0x000001D5A51B0000-0x000001D5A51BA000-memory.dmp

Download

memory/5840-259-0x000001D5A50F0000-0x000001D5A51A2000-memory.dmp

Download

memory/5840-258-0x000001D5A50D0000-0x000001D5A50EE000-memory.dmp

Download