bb5a213d778fdbd73c6443c77c567adda96c36dd55349d7d133aaff6b2b6feab

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 7.1MB
Sample260723-w2lnaace63
SHA256 bb5a213d778fdbd73c6443c77c567adda96c36dd55349d7d133aaff6b2b6feab
MD5 5716564d94d62e71196c43e504185022
SHA1 8feebe84937cd9bf3ab17038e7f6fc36318e32e8
SHA512 696a9579bb791ac3341429d4629922b905cfa0f885f1949c9d932c61570e82189e0ba23b88b951fed09368af71d3b6a32400d401817c1d2792c4ced54d1c4d2a
SSDEEP 196608:gR2ewgsurHMuhHToAUPNfGU5vXvcL8dIaZ+:g2uJhHTodRGkX0glA
TLSH
T10F76336AB2C159F8FD73E23C96634214E7B67C454731C4DB03D886527E375F02A3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3356	powershell.exe
7076	powershell.exe
3304	powershell.exe
3424	powershell.exe
4240	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 4 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3356	powershell.exe
7076	powershell.exe
3304	powershell.exe
3424	powershell.exe

Loads dropped DLL 6 IoCs

pid	Process
4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3424	powershell.exe
3356	powershell.exe
7076	powershell.exe
3304	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6708	cmd.exe
6316	cmd.exe
5308	cmd.exe
5020	cmd.exe
4692	cmd.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
7076	powershell.exe
7076	powershell.exe
7076	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	7076	powershell.exe
Token: SeIncreaseQuotaPrivilege	7076	powershell.exe
Token: SeSecurityPrivilege	7076	powershell.exe
Token: SeTakeOwnershipPrivilege	7076	powershell.exe
Token: SeLoadDriverPrivilege	7076	powershell.exe
Token: SeSystemProfilePrivilege	7076	powershell.exe
Token: SeSystemtimePrivilege	7076	powershell.exe
Token: SeProfSingleProcessPrivilege	7076	powershell.exe
Token: SeIncBasePriorityPrivilege	7076	powershell.exe
Token: SeCreatePagefilePrivilege	7076	powershell.exe
Token: SeBackupPrivilege	7076	powershell.exe
Token: SeRestorePrivilege	7076	powershell.exe
Token: SeShutdownPrivilege	7076	powershell.exe
Token: SeDebugPrivilege	7076	powershell.exe
Token: SeSystemEnvironmentPrivilege	7076	powershell.exe
Token: SeRemoteShutdownPrivilege	7076	powershell.exe
Token: SeUndockPrivilege	7076	powershell.exe
Token: SeManageVolumePrivilege	7076	powershell.exe
Token: 33	7076	powershell.exe
Token: 34	7076	powershell.exe
Token: 35	7076	powershell.exe
Token: 36	7076	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeIncreaseQuotaPrivilege	3304	powershell.exe
Token: SeSecurityPrivilege	3304	powershell.exe
Token: SeTakeOwnershipPrivilege	3304	powershell.exe
Token: SeLoadDriverPrivilege	3304	powershell.exe
Token: SeSystemProfilePrivilege	3304	powershell.exe
Token: SeSystemtimePrivilege	3304	powershell.exe
Token: SeProfSingleProcessPrivilege	3304	powershell.exe
Token: SeIncBasePriorityPrivilege	3304	powershell.exe
Token: SeCreatePagefilePrivilege	3304	powershell.exe
Token: SeBackupPrivilege	3304	powershell.exe
Token: SeRestorePrivilege	3304	powershell.exe
Token: SeShutdownPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeSystemEnvironmentPrivilege	3304	powershell.exe
Token: SeRemoteShutdownPrivilege	3304	powershell.exe
Token: SeUndockPrivilege	3304	powershell.exe
Token: SeManageVolumePrivilege	3304	powershell.exe
Token: 33	3304	powershell.exe
Token: 34	3304	powershell.exe
Token: 35	3304	powershell.exe
Token: 36	3304	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeIncreaseQuotaPrivilege	3424	powershell.exe
Token: SeSecurityPrivilege	3424	powershell.exe
Token: SeTakeOwnershipPrivilege	3424	powershell.exe
Token: SeLoadDriverPrivilege	3424	powershell.exe
Token: SeSystemProfilePrivilege	3424	powershell.exe
Token: SeSystemtimePrivilege	3424	powershell.exe
Token: SeProfSingleProcessPrivilege	3424	powershell.exe
Token: SeIncBasePriorityPrivilege	3424	powershell.exe
Token: SeCreatePagefilePrivilege	3424	powershell.exe
Token: SeBackupPrivilege	3424	powershell.exe
Token: SeRestorePrivilege	3424	powershell.exe
Token: SeShutdownPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeSystemEnvironmentPrivilege	3424	powershell.exe
Token: SeRemoteShutdownPrivilege	3424	powershell.exe
Token: SeUndockPrivilege	3424	powershell.exe
Token: SeManageVolumePrivilege	3424	powershell.exe
Token: 33	3424	powershell.exe
Token: 34	3424	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 4136	5708	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4136 wrote to memory of 6316	4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 6316 wrote to memory of 7076	6316	cmd.exe	93
PID 4136 wrote to memory of 5308	4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 5308 wrote to memory of 3304	5308	cmd.exe	97
PID 4136 wrote to memory of 5020	4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 5020 wrote to memory of 3424	5020	cmd.exe	100
PID 4136 wrote to memory of 4692	4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 4692 wrote to memory of 3356	4692	cmd.exe	103
PID 4136 wrote to memory of 6708	4136	2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 6708 wrote to memory of 4240	6708	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-23_5716564d94d62e71196c43e504185022_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'D:\Hacks' -ErrorAction SilentlyContinue"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'D:\Hacks' -ErrorAction SilentlyContinue
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f593a5bc18c609f44f0ab9d2d72046b7ff5d2841494193e5ef06bbd8028cfb5d
MD5 69f19c63d57747dd202a1435a52e62bb
SHA1 37fed3f373ef2608be0f6ecfba2285a9af04c58b
SHA512 9a6e458a9d6f5af2d75cafddb571d7bd86f244ba0146cdedfe057bf2f9dc56012141f5ab646f933d0306f052579f49c030c03b9562828ca86166bdf2eb616749
TLSH
T19D216837B3DD8624CC9A413A10CDAD1036B6CBDB40DECE5B7B85E655A43F699CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c6a1659e18eba1741f3574149032e24f6cbafb4310b75562086ea94232c4215
MD5 bd4dbb5eb019e83af79dbe558dcb3520
SHA1 c9bc068287ca189bc6f52aaa9c4f0f5b07e347c5
SHA512 d009af05bd03ea22014f100c4255f71bfe979974e75d89cd76881cfd1b0e90d906ee05333529974d4efec82ef44416826128b4b5b6bcb87f954d0813ca8c6378
TLSH
T184219837B3CC8614C89A003A10CDAC0036B6CBCB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
MD5 dcd0d48e287a2fa1fc2c2116c1997c88
SHA1 aa1c4035e6666763d1ccd82b32b9541f4b42b1be
SHA512 b4af5e7ff27bffe7527094d4187b934df549bcd1f31df3853c1ff317f47e60165682f740ee3279f573d5ea8adfd586aee37095800fcb77aa348011284ce99859
TLSH
T18C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\base_library.zip
Size 1.3MB
SHA256 75aa735f6e01364c12eb156c0e5327a0c4d25c612a3fb131ffedd322e7edc4d5
MD5 0af2cfcabd634ff539339741f4ea4fc1
SHA1 be4b1d1aa2bf29f6e22929833ceea4b924393aba
SHA512 012160fb153f5a9e379da795a31600523f7fe89ec4bb683923b9d9c2b38a1fe554c1297b93dbcce1ebf3de4cff99db124da7fa04137d95145b1533775585aa17
SSDEEP 12288:epHbP1dmrGK8lJGUmmRF4Ns/ss2/Hzrmn9ynVTVihlyixmpvQXMHYo9WiM:obP1dmr8lJGUpl12/Hz69yht9lM
TLSH
T12555D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ww2kro4q.5bx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ww2kro4q.5bx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/7076-37-0x00000212FF3E0000-0x00000212FF3EA000-memory.dmp

Download

memory/7076-42-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-36-0x00000212FF6D0000-0x00000212FF782000-memory.dmp

Download

memory/7076-38-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-39-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-40-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-41-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-35-0x00000212FF3C0000-0x00000212FF3DE000-memory.dmp

Download

memory/7076-43-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-45-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-46-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-32-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-31-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-28-0x00000212FF330000-0x00000212FF352000-memory.dmp

Download

memory/7076-27-0x00007FFB27C30000-0x00007FFB285D4000-memory.dmp

Download

memory/7076-26-0x00007FFB27DBF000-0x00007FFB27DC0000-memory.dmp

Download