3a25ed24f02a6e1629ae1801f3c1af65110898af5efc54dc7888a22ccbe4fc1c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 30.4MB
Sample260730-d2ssgsbb68
SHA256 3a25ed24f02a6e1629ae1801f3c1af65110898af5efc54dc7888a22ccbe4fc1c
MD5 510172200f6d5529e3fdedc84d747d15
SHA1 a82d8c770d8a9bfbe2ea75c95194f6c3da338c6c
SHA512 5b3e58f668acc5d7616a053c76c31210ac99182d082a3df4b9f6938ac1cc26ed38192a3e490e140ab7513415615660aa9fd67b597d54015bdb8bebfc1995cd02
SSDEEP 786432:SujmF/XkCFlUR1OHoXMb8B/sqVtcQT1w4I9aDw46B6Z4dw5GlI:SXZkCEWIcCsacTlBgmy
TLSH
T138673399F1E06D97E9FF023FC494D4068E5EA4FAAFB2489393E8D1320D575E849B9301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe
2260	powershell.exe
2584	powershell.exe
1144	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1144	powershell.exe
2584	powershell.exe

Loads dropped DLL 58 IoCs

pid	Process
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe\""	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe\""	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	discord.com
16	discord.com
17	discord.com
18	discord.com
19	discord.com
1	discord.com
13	discord.com

Looks up external IP address via web service 1 TTPs 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
6	ipapi.co
7	api.ipify.org
8	ipapi.co
1	api.ipify.org
1	ipapi.co

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1640	cmd.exe
1508	cmd.exe
4636	cmd.exe
1152	cmd.exe
592	cmd.exe
2104	cmd.exe
5424	cmd.exe
5832	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3572	netsh.exe
5832	cmd.exe
1868	netsh.exe
1508	cmd.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2260	powershell.exe
2260	powershell.exe
2260	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3396	WMIC.exe
3396	WMIC.exe
3396	WMIC.exe
3396	WMIC.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5996	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeIncreaseQuotaPrivilege	2808	powershell.exe
Token: SeSecurityPrivilege	2808	powershell.exe
Token: SeTakeOwnershipPrivilege	2808	powershell.exe
Token: SeLoadDriverPrivilege	2808	powershell.exe
Token: SeSystemProfilePrivilege	2808	powershell.exe
Token: SeSystemtimePrivilege	2808	powershell.exe
Token: SeProfSingleProcessPrivilege	2808	powershell.exe
Token: SeIncBasePriorityPrivilege	2808	powershell.exe
Token: SeCreatePagefilePrivilege	2808	powershell.exe
Token: SeBackupPrivilege	2808	powershell.exe
Token: SeRestorePrivilege	2808	powershell.exe
Token: SeShutdownPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeSystemEnvironmentPrivilege	2808	powershell.exe
Token: SeRemoteShutdownPrivilege	2808	powershell.exe
Token: SeUndockPrivilege	2808	powershell.exe
Token: SeManageVolumePrivilege	2808	powershell.exe
Token: 33	2808	powershell.exe
Token: 34	2808	powershell.exe
Token: 35	2808	powershell.exe
Token: 36	2808	powershell.exe
Token: SeDebugPrivilege	1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeIncreaseQuotaPrivilege	2260	powershell.exe
Token: SeSecurityPrivilege	2260	powershell.exe
Token: SeTakeOwnershipPrivilege	2260	powershell.exe
Token: SeLoadDriverPrivilege	2260	powershell.exe
Token: SeSystemProfilePrivilege	2260	powershell.exe
Token: SeSystemtimePrivilege	2260	powershell.exe
Token: SeProfSingleProcessPrivilege	2260	powershell.exe
Token: SeIncBasePriorityPrivilege	2260	powershell.exe
Token: SeCreatePagefilePrivilege	2260	powershell.exe
Token: SeBackupPrivilege	2260	powershell.exe
Token: SeRestorePrivilege	2260	powershell.exe
Token: SeShutdownPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeSystemEnvironmentPrivilege	2260	powershell.exe
Token: SeRemoteShutdownPrivilege	2260	powershell.exe
Token: SeUndockPrivilege	2260	powershell.exe
Token: SeManageVolumePrivilege	2260	powershell.exe
Token: 33	2260	powershell.exe
Token: 34	2260	powershell.exe
Token: 35	2260	powershell.exe
Token: 36	2260	powershell.exe
Token: SeIncreaseQuotaPrivilege	1144	powershell.exe
Token: SeSecurityPrivilege	1144	powershell.exe
Token: SeTakeOwnershipPrivilege	1144	powershell.exe
Token: SeLoadDriverPrivilege	1144	powershell.exe
Token: SeSystemProfilePrivilege	1144	powershell.exe
Token: SeSystemtimePrivilege	1144	powershell.exe
Token: SeProfSingleProcessPrivilege	1144	powershell.exe
Token: SeIncBasePriorityPrivilege	1144	powershell.exe
Token: SeCreatePagefilePrivilege	1144	powershell.exe
Token: SeBackupPrivilege	1144	powershell.exe
Token: SeRestorePrivilege	1144	powershell.exe
Token: SeShutdownPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeSystemEnvironmentPrivilege	1144	powershell.exe
Token: SeRemoteShutdownPrivilege	1144	powershell.exe
Token: SeUndockPrivilege	1144	powershell.exe
Token: SeManageVolumePrivilege	1144	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3192	msiexec.exe
1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1824	1172	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 1824 wrote to memory of 4636	1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 4636 wrote to memory of 2808	4636	cmd.exe	93
PID 480 wrote to memory of 1088	480	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 1088 wrote to memory of 1152	1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 1152 wrote to memory of 2260	1152	cmd.exe	100
PID 1824 wrote to memory of 592	1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 592 wrote to memory of 1144	592	cmd.exe	103
PID 1088 wrote to memory of 2104	1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 2104 wrote to memory of 2584	2104	cmd.exe	106
PID 1088 wrote to memory of 5424	1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 5424 wrote to memory of 3396	5424	cmd.exe	112
PID 1088 wrote to memory of 5832	1088	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 5832 wrote to memory of 1868	5832	cmd.exe	115
PID 1824 wrote to memory of 1640	1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 1640 wrote to memory of 5996	1640	cmd.exe	118
PID 1824 wrote to memory of 1508	1824	2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 1508 wrote to memory of 3572	1508	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '$env:USERPROFILE\Downloads'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '$env:USERPROFILE\Downloads'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3572

C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_510172200f6d5529e3fdedc84d747d15_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '$env:USERPROFILE\Downloads'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '$env:USERPROFILE\Downloads'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of SetWindowsHookEx
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\PIL\_imaging.cp313-win_amd64.pyd
Size 2.4MB
SHA256 11b767175caa89e296d45d3dc029c9f299db5be5dcccc815baef97534937d762
MD5 95accce0dea4faff63820b2c85cdd40e
SHA1 6808b982af4851ae8e3c947bba04afd370075138
SHA512 9f1ea09aaccc922a20081842b9cb3da888e7514ff2de76b81b3c460a8ea52ab3174e81f2e5c905a4c85e652dee5ba99f2ae7086eb9404392b927cf2a2fd2c81c
SSDEEP 49152:ooMFfLnlJAkKlWW4OqewcH4eaQ/ooiVq0lqKD1yq/:o6SczaQNiVqs1T
TLSH
T1F2B56B06E5E19599C6B28034CDAA9112E3B1B80D17F187F77684A7F93F23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_bz2.pyd
Size 84KB
SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
MD5 057325e89b4db46e6b18a52d1a691caa
SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
TLSH
T15D839E86F79567F2F45B81B686C103A7E771BA91031093AFF258C2552F03F816E6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_ctypes.pyd
Size 131KB
SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
MD5 2185849bc0423f6641ee30804f475478
SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee
SSDEEP 3072:gt2Y/2//P+H9SUNn8LBBhc5Nvf/FH3ofTvaZIDyPn3f2:gst/GH9SUCBIf/FH3ITire
TLSH
T1BDD36C0B775840AADAA78174C533AF47EBB1B453165053CF02A8C69A2F637D7AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_hashlib.pyd
Size 63KB
SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
MD5 cf4120bad9a7f77993dd7a95568d83d7
SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6
SSDEEP 1536:jLDxflFwY9XDhWjLTNwjg40nEdIDvI/7yo47Q9LfIi7K:jJ92AT63Nag40nEdIDvI/EF
TLSH
T1BE538C44A29480A6CA6742B4CAE39F87F6B1F2425740ABDF0354C1CD1F237C3D6BA75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_lzma.pyd
Size 155KB
SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
MD5 3e73bc69efb418e76d38be5857a77027
SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
TLSH
T128F35B86A394F0E5F7728C78D6624F57E7F5781A0320928A01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_queue.pyd
Size 33KB
SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
MD5 59c05030e47bde800ad937ccb98802d8
SHA1 f7b830029a9371b4e500c1548597beb8fbc1864f
SHA512 4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d
SSDEEP 768:AkTQ6rDvtxZID9UiiQ+Eyobo+Y7N2Ip4SCxf1mljr8VMj:AqhTtxZID9Ui77yo47Q93fI38VMj
TLSH
T10CF27ECA66584147D5A3C9B0C5A2EE53F579B7935B0187DF2054C28D1F233C2A73A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_socket.pyd
Size 82KB
SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
MD5 69c4a9a654cf6d1684b73a431949b333
SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16
SSDEEP 1536:quV3gvWHQdMq3ORCnOypTAQlyJ+9+nztYwsFF6t7lCuZIDywN7yo47Q9EfIb5:quVQvcQTqypTAQlyJs+nztYtF6ntZIDv
TLSH
T17F836B01A69041FAEBA3C1B5C2679E23FB74F5C11395975F00A6C55A1F333C2AF3AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_ssl.pyd
Size 178KB
SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
MD5 ce19076f6b62292ed66fd06e5ba67bba
SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143
SSDEEP 3072:A20jYjQ80NV96LE2fU6CosjLEmMPi1ba+VRJNI7IM/H9o/PCrXuII4oFIDL7Riz:500rklqU6CoJ9PijTT4o8W
TLSH
T134047C47B5805AF7D913E4F9C2234903EBB0F155331157DE48D6EA890F03B4AAE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_wmi.pyd
Size 39KB
SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
MD5 e3213cf44340d7b4cb65f7231a65e3a4
SHA1 815e5809a01905ecaa463f6827f657c11b95d243
SHA512 d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a
SSDEEP 768:/oEkKVVgWOZbY7Ect6PlFIDLiTQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/oE9vjk0EctcFIDLi07yo47Q98fIW44w
TLSH
T1AC036C8AE6680046EA67DA75C5A2DE43F934B7D35711938F329586990F233C0E73E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\base_library.zip
Size 1.3MB
SHA256 02a914408655668f6f15b629179441fbcd1009c7d878cec9684490f0397b3c65
MD5 c36f7b48d2f628fce2795d39ac04b024
SHA1 a1cf5daf87db1c3a8e64660802f15f957ac60201
SHA512 f84d80cac4b55dced5ab47636f1b02b8eca57e218ac86a6796cc6d8c21ab95207e886ca9ec924c14edf4da6eb38b01c5ed8aeee0cd8a82231460ec62ed0edfe5
SSDEEP 12288:CPL+DciWBngdjdTmuOBa80201jwCVRDVoioSYB7bW7WpbtYzGNcT1Ti2cPPdxhY9:egdZmzO7WpWSeT1T5cPPdxhYgJEn3
TLSH
T14F550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\certifi\cacert.pem
Size 280KB
SHA256 9102e6a3644a071ba6cdbd4a53698f291c4a64b18450a08bc046548b6db5cc8b
MD5 64c9f8888c14aa49beb3f82634193c7a
SHA1 fec7b8c0a17c1c555fd33baee53678f31b7645ee
SHA512 60d1043f7c1205d3efe03a00d68451cd075cc6abb19f2186a081206bd01a83ee6da521070bc655606f9df18e6208ac94ab41902610f2cb24f3b33d28c523b209
SSDEEP 6144:3nB8fRRiplkXURrVADwYCuCCgT/QRSRqNb7d84u5Nahry:XiRiLWURrIdRWavdX08M
TLSH
T182546D964F2A9C052C9FE1C1CA9B1357DD3A027B99FEF0F139462448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 76c8700ffc983bbec07468e354039b21e25e49e7c19f43d7343994c90d4bb7bf
MD5 52f4d871306079913ecd8d53eb9ecd05
SHA1 fca56e0ea208691082a04198b3b517739669f001
SHA512 4bb9d4161675b6f66c1eadf996de57ba916497c92e6ed42d0a09dbfe97b243d5b3e9772f942c2b03fa75c2f305ca1584bd9b36d5ec226dcdb2efc3261809dea1
SSDEEP 192:Yxl1qJ2Y1L9K2l/ijGaAXbiuUoccgta96:YxPqJ22KMKTuicgoc
TLSH
T10A22071DFA6598E6E9064134C6374E4BB075BB11070277CF83B0D5692FA23E7BA38742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 e9c308245fe01d33ef92c7026115a0a930fd865fbe1bfcefa91e76c6aa32a0b3
MD5 21e82ad181c636e1cf6c24610e2af08f
SHA1 64f73187472d99632c8579aac30fa03b20ba232b
SHA512 8b87a5ecd21a299a3a9a9a06e2c2aa94942b44280c8eecfdc2b92fbd660344f78a48d41df7859a2f733243a0bfce59cfcd16d25fdd6dc16279b17ee19ebd4484
SSDEEP 3072:K4tSDm8F9XBLHekD43XSlT1/04bbvb71Gn:uu3XSk27
TLSH
T1CCC32917629500B7C96352B9CCB36817D7E1B4510B3213CF05A4C7AA6F03BEABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\python3.DLL
Size 70KB
SHA256 4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638
MD5 98b008be9834bfc362b4c2eef4e8cdb9
SHA1 a4a50ced1329c3986e3c1576f089b25aff5ffdf2
SHA512 d594ffd7d44d4d862475711973df87b08fb63a900ddfd87c7771ad27f0cc71e5fbdce92da4d4ad5856fe3cfb803257ce0b71cd8dc24ca5c421ddb1b9b44c7881
SSDEEP 1536:fotssyKcunV8P2ZIDy0Q7yo47Q9dfITzp:AtssyKlZIDy0QGh
TLSH
T121633CC25B57F8A2D6F669FC78DDD9CE242B02CC57258C9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\python313.dll
Size 5.8MB
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
TLSH
T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\pywin32_system32\pythoncom313.dll
Size 674KB
SHA256 e312c8edb2d43a014daddfa984a805e6b5f933c60777e7b527332e682d9b1813
MD5 1dd15961f90f3522710752121f8e8c60
SHA1 b1ca2dfecbb30f052c8c6f21ec5923473d2fdd37
SHA512 365ac92aaa6606042cfb26867d4c0d857c6e5e5b07e157bac2bb0bfe462cf50b8bf0b05b13ab534fa300954cd9814f5b5e7ad92fbd66d00320973d28198311d5
SSDEEP 6144:glRt8GzfBD/pyglbRvfP9Gs1z7p9uKhARdOWDjTcLStzqq3EVJ2pdrbcpaD3FCJN:glRtJf5/r1f9BR7LbWTTYqg2pdPcUhx
TLSH
T13EE44B56B3D50A91F62AA1BECD138B03D3A2B4511B42A7CF02A0C76E5F673D5373A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\pywin32_system32\pywintypes313.dll
Size 132KB
SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
MD5 f7fa93a0bc20b155e9b141b6705870f0
SHA1 72c6bf418a55806e86cf67b3d363a385ae9cfca6
SHA512 3d8b7ae0303020e6fed0066f08eb30ae437541de0918528561e50f923cd42654a6453f59e610f11c4676022552ce09fa63a8fc8b1e13b5a3a8de0378d54c5b2e
SSDEEP 3072:F54SfEA3X4IiyNHpFBiuQdY/r06YrfNaQQDElr4ohgmF+M90X3:j9TH4IiyNH7BodY/rk7NaY4wgs+M90H
TLSH
T19FD34A47374644DAE966E37D8C771E02D3A2B0100711E3CF06A5C2AB6F63BD66D3B646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\select.pyd
Size 31KB
SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
MD5 2663e22900ab5791c6687a264473ae1e
SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
TLSH
T1CBE27C8F6A785087EA93C6B181A2DE43FC39B793861182CF30A5D59D0E537C1B73A359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\unicodedata.pyd
Size 694KB
SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
MD5 c0b4c55ce3711af914b2015f707e4452
SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
TLSH
T185E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\win32\win32api.pyd
Size 132KB
SHA256 b80722e54741563e72e264ca33e1900ee49c927c475e54ef8f94c3eac9032465
MD5 d42a79a170c86721f723fe960eb5d923
SHA1 eaf8519e229409e634b5fabc42b90202739f2d9a
SHA512 bb9a1c302226bf67c11ac062e04f7cb927e776903101526b625cf7cb778c1c524f57793827cd0e549c7b2d48b162947f2e9e1a70d8aeb49fe14577b6e96bd250
SSDEEP 3072:9QmxBqwukucyF9S18lRVFhLaNzvV5697NUbmArvfA1fAx4:7LqwnBiS6lRVgvIU3vfafS
TLSH
T1BFD30783B39410C6D86AA6BCC5775B23D772B8240B61A7CF0A60C18A1F237E97D7D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32clipboard.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\win32\win32clipboard.pyd
Size 28KB
SHA256 955996e5867c1bf34e10838d462b413986e0911a9ffc3484076a03ac945fadc7
MD5 338fbc0132645fc513ffe8018729e110
SHA1 b3fa42a2f5630f2ae85bd66d6455c433d827db73
SHA512 5e251c55dfe395940d770d5d88c63d7613f82442b7c2386b5ad82ffbc7828fd98e5ba34e70e32978115f8c99d884788989efb90dec74b90750c371b03d0c25dd
SSDEEP 384:mdnrGlQb8jTgOVOgcQr9/MUR1qljB3DvxIbM8i5Ei:oIo99QR/fR1Y1pI4x
TLSH
T1CDD2F8D2B2CC59EEF657823C85275F17C966B834176063CF02A2C8A90E276C5763EB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\win32\win32event.pyd
Size 28KB
SHA256 b70d2aebb12d2a0c8d100f37e109319407cf025fc406ef23d13c1b5ddb64370a
MD5 8e6044148632ed663f339c8e8a787373
SHA1 b965143d7259a9afb1fd97229342dca772ea46e3
SHA512 03f55ea3915519502b676d9bba76a9a95baff534d288bbd7d8e4d73e9adb39df456fc24fa3f5c2531d816ce0e4a06617dde569ce2bccdd8db44a32910e572c79
SSDEEP 768:FaWut7Goxs5Llg+Ebc/jhfWddbcrM8g2YEb9yeiKfUe:F8Rc/jhfWddbco8g2YEb9yeiKfUe
TLSH
T179D2D7C733646095E96AD13DC8561F07E2B2B53003A1A3DF0262D55A1F732E57A39F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qa0iskhe.c34.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qa0iskhe.c34.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-332-0x0000014030080000-0x00000140301AF000-memory.dmp

Download

memory/2260-328-0x00000213759A0000-0x0000021375ACF000-memory.dmp

Download

memory/2584-336-0x0000015BFEDF0000-0x0000015BFEF1F000-memory.dmp

Download

memory/2808-182-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-279-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-181-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-179-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-183-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-190-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-249-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-270-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-273-0x000001D775970000-0x000001D77598E000-memory.dmp

Download

memory/2808-180-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-275-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-274-0x000001D775E60000-0x000001D775F12000-memory.dmp

Download

memory/2808-296-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-309-0x000001D775960000-0x000001D77596A000-memory.dmp

Download

memory/2808-317-0x000001D775AD0000-0x000001D775BFF000-memory.dmp

Download

memory/2808-318-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-178-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-177-0x000001D75D8D0000-0x000001D75D8F2000-memory.dmp

Download

memory/2808-176-0x00007FFD8C590000-0x00007FFD8CF34000-memory.dmp

Download

memory/2808-173-0x00007FFD8C71F000-0x00007FFD8C720000-memory.dmp

Download