Overview

overview

10

Static

static

10

2026-07-28...me.exe

windows10-2004-x64

8

2026-07-28...me.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
  • Size 102.5MB
  • Sample260729-blakvs1elc
  • SHA256 9cff81ae89bc4a05247ce9aa9d4bcb713a3017853ce08ae40491e44995d1a3e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6864
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:5080
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\3o6bor.xml /nologo /v:quiet
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6032
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vnmassxl\vnmassxl.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABA7.tmp" "c:\Users\Admin\AppData\Local\Temp\vnmassxl\CSC7D4B850E804C4881A779FB403CAFF5A0.TMP"
            4⤵
              PID:692
      • C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe" --background
        1⤵
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5072
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6412
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4224
          • C:\Windows\System32\net.exe
            net session
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5244
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              4⤵
                PID:3744
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsHealthCheck_4xqep" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe\" --background" /sc onlogon /rl highest /f"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1216
            • C:\Windows\System32\schtasks.exe
              schtasks /create /tn "WindowsHealthCheck_4xqep" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe\" --background" /sc onlogon /rl highest /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:6256
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "getmac"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5868
            • C:\Windows\System32\getmac.exe
              getmac
              3⤵
                PID:6924
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5532
              • C:\Windows\System32\reg.exe
                reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                3⤵
                  PID:2004
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\Description\System" /v "SystemBiosVersion""
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:1444
                • C:\Windows\System32\reg.exe
                  reg query "HKLM\HARDWARE\Description\System" /v "SystemBiosVersion"
                  3⤵
                  • Checks BIOS information in registry
                  PID:1172
            • C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2772
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)""
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:908
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2616
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "net session"
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:6612
                • C:\Windows\system32\net.exe
                  net session
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3256
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 session
                    4⤵
                      PID:6600
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\tr0yja.xml /nologo /v:quiet
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2836
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i1qmmy5f\i1qmmy5f.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2060
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9FF.tmp" "c:\Users\Admin\AppData\Local\Temp\i1qmmy5f\CSCFDD5EEC667B4713B633B03736B3CA2.TMP"
                      4⤵
                        PID:4760
                • C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe" --background
                  1⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:556
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)""
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5620
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -w hidden -c "Add-Type -N W -Na C -M '[DllImport(\"kernel32\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32\")] public static extern bool ShowWindow(IntPtr h,int s);'; [C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5452
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "net session"
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2296
                    • C:\Windows\System32\net.exe
                      net session
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4592
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 session
                        4⤵
                          PID:4848
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsHealthCheck_8bhv3l" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe\" --background" /sc onlogon /rl highest /f"
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:236
                      • C:\Windows\System32\schtasks.exe
                        schtasks /create /tn "WindowsHealthCheck_8bhv3l" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-07-28_56a4e76d7c33c1d6e93a17e286761aa7_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe\" --background" /sc onlogon /rl highest /f
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:2412
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "getmac"
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3200
                      • C:\Windows\System32\getmac.exe
                        getmac
                        3⤵
                          PID:2992
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3120
                        • C:\Windows\System32\reg.exe
                          reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                          3⤵
                            PID:1768
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\Description\System" /v "SystemBiosVersion""
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5736
                          • C:\Windows\System32\reg.exe
                            reg query "HKLM\HARDWARE\Description\System" /v "SystemBiosVersion"
                            3⤵
                            • Checks BIOS information in registry
                            PID:3196

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 93ee657517bd5c234cc95b880e9f7ec5ebefe7fc3fa600bd646deea3f0539687
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            3o6bor.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\3o6bor.xml
                            • Size 1001B
                            • SHA256 397dd45fb2e7bcfaa9fd9bdaaaf6e0fe22c51e64d233495ba08d1b4b668a1f88
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RESABA7.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RESABA7.tmp
                            • Size 1KB
                            • SHA256 43f3f3f3a86879725d1400e638b689542e05b86c5236e37d25a8cd002de5ff67
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RESB9FF.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RESB9FF.tmp
                            • Size 1KB
                            • SHA256 0d2bac3c2c02a57916a94b7346d6ae1670b7f7289ebb3619823536e7254c88c4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_rjeyeqzt.ji3.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rjeyeqzt.ji3.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            i1qmmy5f.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\i1qmmy5f\i1qmmy5f.dll
                            • Size 4KB
                            • SHA256 6807c432200ad126116a31553eef5fa40e297a30ece391befc60e049b286f6b6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            i1qmmy5f.pdb
                            • Path C:\Users\Admin\AppData\Local\Temp\i1qmmy5f\i1qmmy5f.pdb
                            • Size 13KB
                            • SHA256 a9a0724351f8168982205fdf79be4128cd830f2a6314e2d2f857fb8b3d6f6dd6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            isbirligi_debug.log
                            • Path C:\Users\Admin\AppData\Local\Temp\isbirligi_debug.log
                            • Size 154B
                            • SHA256 4229fcf3f539eba967cea323c9232ee222de9bcaa044364893937778344a3fb2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            isbirligi_debug.log
                            • Path C:\Users\Admin\AppData\Local\Temp\isbirligi_debug.log
                            • Size 363B
                            • SHA256 70e249b410d9c0c4da127bc957ab725ef90786b098f843cbe83aa5b70ec9c324
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            isbirligi_debug.log
                            • Path C:\Users\Admin\AppData\Local\Temp\isbirligi_debug.log
                            • Size 469B
                            • SHA256 00ccfbc896de9f5aed0c2e172f0290f357884f70fe35b9d516a1ada374c2a356
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            vnmassxl.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\vnmassxl\vnmassxl.dll
                            • Size 4KB
                            • SHA256 7acf865738fa0d165aa5ae062dd9fa826afccf51f266e0c597ed744514fe0276
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            vnmassxl.pdb
                            • Path C:\Users\Admin\AppData\Local\Temp\vnmassxl\vnmassxl.pdb
                            • Size 13KB
                            • SHA256 140d3fc86a54226408b0ac80d1028aa99fedb41653666a45b9d5b436482f0e0d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CSCFDD5EEC667B4713B633B03736B3CA2.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\i1qmmy5f\CSCFDD5EEC667B4713B633B03736B3CA2.TMP
                            • Size 652B
                            • SHA256 746901e5543397424a2b3b54bdb8c931ed804048605d57f2bfe6b257e808cf56
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            i1qmmy5f.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\i1qmmy5f\i1qmmy5f.cmdline
                            • Size 779B
                            • SHA256 c53e92fdf03098ff204c0764bec3b6e09da40f9fb413ae043ac02bcb00760abc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            CSC7D4B850E804C4881A779FB403CAFF5A0.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\vnmassxl\CSC7D4B850E804C4881A779FB403CAFF5A0.TMP
                            • Size 652B
                            • SHA256 1e8d987ebe1746559c629e63c78a6e089bc4586d3775ea3ff05e05b75aab0361
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            vnmassxl.0.cs
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\vnmassxl\vnmassxl.0.cs
                            • Size 1KB
                            • SHA256 c769d67edc64b2b56e3c3b84d0a535a70e5625b3c795503432e22c9c835a29e3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            vnmassxl.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\vnmassxl\vnmassxl.cmdline
                            • Size 779B
                            • SHA256 b5cef1d4215c15d12817bbb246df09c36bbb931e98e4ca08b4e49c277534878b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/2836-66-0x000002A087720000-0x000002A087728000-memory.dmp
                            Download

                            memory/6032-17-0x000001D6581A0000-0x000001D658500000-memory.dmp
                            Download

                            memory/6032-9-0x000001D63D500000-0x000001D63D51A000-memory.dmp
                            Download

                            memory/6032-10-0x000001D657850000-0x000001D6579AA000-memory.dmp
                            Download

                            memory/6032-32-0x000001D63D550000-0x000001D63D558000-memory.dmp
                            Download

                            memory/6032-11-0x000001D63ED30000-0x000001D63ED60000-memory.dmp
                            Download

                            memory/6032-15-0x000001D657E40000-0x000001D657FBC000-memory.dmp
                            Download

                            memory/6032-16-0x000001D657AB0000-0x000001D657B16000-memory.dmp
                            Download

                            memory/6032-14-0x000001D63F120000-0x000001D63F164000-memory.dmp
                            Download

                            memory/6032-8-0x000001D63D050000-0x000001D63D08E000-memory.dmp
                            Download

                            memory/6032-13-0x000001D657BE0000-0x000001D657D02000-memory.dmp
                            Download

                            memory/6864-3-0x0000026375520000-0x0000026375542000-memory.dmp
                            Download