edd1b8df7634a080287cb27975259afa7be21811c2f6e33487ca79bf5d9b97bf

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 6.8MB
Sample260730-ejezcabd36
SHA256 edd1b8df7634a080287cb27975259afa7be21811c2f6e33487ca79bf5d9b97bf
MD5 08bbf37bd0db054e4f12e1f28da3bf9b
SHA1 9b2678668905d79441a480618182c94085f871d6
SHA512 ce3cc1e5e088e0ac39acb73fb130568a37299e3aa9a4ef568e375a332de7ce75667f96a46e9e120154832d6bc4a4231a4212514ed66da8873993183803f16372
SSDEEP 98304:lyznxTPkALGl1W903AE4V4QKUUyJl6bxGvwxiVIRFngXw5i5LmLyHaSvPUMNBS:A1kFl1W903eV4QK993iObMGuLmGHrP
TLSH
T14A763384E3B54AF6F863813E4293C544EA72741B07B891CB93A9CA553F333D25A3AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation pyinstaller ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (245) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4012	netsh.exe
4324	netsh.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Loads dropped DLL 16 IoCs

pid	Process
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI13842\\virus.py\""	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI45322\\virus.py\""	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	F:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	C:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	F:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\winlogon.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\lsass.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\services.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\csrss.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\winlogon.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\lsass.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\services.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\csrss.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\explorer.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000100000000002b-999.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4812	cmd.exe
3792	cmd.exe
968	cmd.exe
4284	cmd.exe
1028	cmd.exe
1304	cmd.exe
1880	cmd.exe
1332	cmd.exe
2996	cmd.exe
3772	cmd.exe
1128	cmd.exe
3740	cmd.exe
64	cmd.exe
784	cmd.exe
640	cmd.exe
3068	cmd.exe
4616	cmd.exe
1448	cmd.exe
3036	cmd.exe
3888	cmd.exe
1520	cmd.exe
3616	cmd.exe
2036	cmd.exe
4424	cmd.exe
5036	cmd.exe
2300	cmd.exe
1960	cmd.exe
1976	cmd.exe
2160	cmd.exe
2676	cmd.exe
4360	cmd.exe
1968	cmd.exe
4344	cmd.exe
2104	cmd.exe
3708	cmd.exe
4204	cmd.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
3832	net.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
828	vssadmin.exe
1428	vssadmin.exe

Kills process with taskkill 30 IoCs

defense_evasion

pid	Process
4540	taskkill.exe
3444	taskkill.exe
3788	taskkill.exe
3504	taskkill.exe
1664	taskkill.exe
2252	taskkill.exe
3008	taskkill.exe
4388	taskkill.exe
3972	taskkill.exe
1968	taskkill.exe
4848	taskkill.exe
2412	taskkill.exe
4176	taskkill.exe
4056	taskkill.exe
4744	taskkill.exe
4236	taskkill.exe
4588	taskkill.exe
4044	taskkill.exe
2052	taskkill.exe
3440	taskkill.exe
5016	taskkill.exe
4700	taskkill.exe
4828	taskkill.exe
1140	taskkill.exe
1536	taskkill.exe
3804	taskkill.exe
3148	taskkill.exe
4396	taskkill.exe
1048	taskkill.exe
1740	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4300	schtasks.exe
5116	schtasks.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	3804	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	3444	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeBackupPrivilege	4936	vssvc.exe
Token: SeRestorePrivilege	4936	vssvc.exe
Token: SeAuditPrivilege	4936	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 5096	1384	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	86
PID 5096 wrote to memory of 3036	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	87
PID 3036 wrote to memory of 4300	3036	cmd.exe	89
PID 4532 wrote to memory of 4684	4532	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 5096 wrote to memory of 2104	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4684 wrote to memory of 3708	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 2104 wrote to memory of 3788	2104	cmd.exe	98
PID 3708 wrote to memory of 5116	3708	cmd.exe	99
PID 5096 wrote to memory of 1304	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 1304 wrote to memory of 1740	1304	cmd.exe	104
PID 5096 wrote to memory of 4812	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 4812 wrote to memory of 2052	4812	cmd.exe	107
PID 5096 wrote to memory of 1880	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 4684 wrote to memory of 784	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 1880 wrote to memory of 4828	1880	cmd.exe	112
PID 784 wrote to memory of 4056	784	cmd.exe	113
PID 5096 wrote to memory of 3888	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 4684 wrote to memory of 1520	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 3888 wrote to memory of 3804	3888	cmd.exe	118
PID 1520 wrote to memory of 3148	1520	cmd.exe	119
PID 5096 wrote to memory of 640	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 4684 wrote to memory of 3068	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 640 wrote to memory of 1140	640	cmd.exe	124
PID 3068 wrote to memory of 1536	3068	cmd.exe	125
PID 5096 wrote to memory of 1960	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 4684 wrote to memory of 4344	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 1960 wrote to memory of 3504	1960	cmd.exe	130
PID 4344 wrote to memory of 3972	4344	cmd.exe	131
PID 5096 wrote to memory of 1028	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 4684 wrote to memory of 1976	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 1028 wrote to memory of 1664	1028	cmd.exe	136
PID 1976 wrote to memory of 4744	1976	cmd.exe	190
PID 5096 wrote to memory of 3616	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	138
PID 4684 wrote to memory of 4204	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 3616 wrote to memory of 1968	3616	cmd.exe	192
PID 4204 wrote to memory of 4396	4204	cmd.exe	143
PID 5096 wrote to memory of 4616	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 4684 wrote to memory of 3792	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 4616 wrote to memory of 3440	4616	cmd.exe	148
PID 5096 wrote to memory of 1128	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 3792 wrote to memory of 4236	3792	cmd.exe	151
PID 1128 wrote to memory of 1048	1128	cmd.exe	152
PID 4684 wrote to memory of 3740	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	153
PID 5096 wrote to memory of 2036	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	155
PID 3740 wrote to memory of 4848	3740	cmd.exe	157
PID 2036 wrote to memory of 4588	2036	cmd.exe	158
PID 4684 wrote to memory of 4424	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	159
PID 5096 wrote to memory of 1332	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	161
PID 4424 wrote to memory of 2412	4424	cmd.exe	163
PID 1332 wrote to memory of 4176	1332	cmd.exe	164
PID 4684 wrote to memory of 2676	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	165
PID 5096 wrote to memory of 4360	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	167
PID 2676 wrote to memory of 4700	2676	cmd.exe	169
PID 4684 wrote to memory of 968	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	170
PID 4360 wrote to memory of 4540	4360	cmd.exe	172
PID 968 wrote to memory of 5016	968	cmd.exe	173
PID 5096 wrote to memory of 64	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	174
PID 4684 wrote to memory of 1448	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	176
PID 64 wrote to memory of 3008	64	cmd.exe	178
PID 1448 wrote to memory of 4388	1448	cmd.exe	179
PID 5096 wrote to memory of 5036	5096	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	180
PID 4684 wrote to memory of 3772	4684	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	182
PID 5036 wrote to memory of 4012	5036	cmd.exe	184
PID 3772 wrote to memory of 2252	3772	cmd.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI13842\virus.py" /sc onlogon /f >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI13842\virus.py" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avast* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avast*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avg* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avg*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avira* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avira*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *bitdefender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *bitdefender*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *kaspersky* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *kaspersky*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *norton* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *norton*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *mcafee* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *mcafee*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *trend* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *trend*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *symantec* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *symantec*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *windows defender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *windows defender*
      4⤵
      Kills process with taskkill
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *malwarebytes* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *malwarebytes*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *eset* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *eset*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *sophos* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *sophos*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *panda* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *panda*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *comodo* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *comodo*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2996
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net view > C:\net_share.txt 2>nul
    3⤵
    PID:300

C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI45322\virus.py" /sc onlogon /f >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI45322\virus.py" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avast* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avast*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avg* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avg*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avira* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avira*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *bitdefender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *bitdefender*
      4⤵
      Kills process with taskkill
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *kaspersky* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *kaspersky*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *norton* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *norton*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *mcafee* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *mcafee*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *trend* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *trend*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *symantec* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *symantec*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *windows defender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *windows defender*
      4⤵
      Kills process with taskkill
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *malwarebytes* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *malwarebytes*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *eset* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *eset*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *sophos* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *sophos*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *panda* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *panda*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *comodo* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *comodo*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1968
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4284
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net view > C:\net_share.txt 2>nul
    3⤵
    PID:4948
  - - C:\Windows\system32\net.exe
      net view
      4⤵
      Discovers systems in the same network
      PID:3832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

brndlog.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt
Size 6KB
SHA256 f21082ff2b42ad1d8df9ce1822945865a5f0c2de2ede85a29da8e8ecd7fc74df
MD5 a25382cf360f98b1caf2ee94216032ed
SHA1 152e0341f57fcd2349d60facfb9380cb580f8c4e
SHA512 1c79dbc5cf600a4cc20d7ef9e7808e8fca931d971a492dab38663af19532a685d42a322f43c30c1bc5ca58793969a5a2004610739209a7cf2377a55ec584f48f
SSDEEP 192:PF+HAenk/Yo0fxQRkoV5n+PQn92sDuNQ82jgV1:oHAekxr5n+on9FDG12jO1
TLSH
T17CD15C7658B4D9AE4715A28E33324C615AA84CF4A538B3C0BB31E5E3D33C3E98DAD05D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppErrorWhite.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png
Size 8KB
SHA256 5d2542702e368a54ec168175404051e812fa386b6ad405f0db5bac55fbfba2ed
MD5 970a5b1c4aba9b383ec2759fefae2ed2
SHA1 46f711bd1196fc6569f546b4cadcdc5c1fa0017c
SHA512 2bd0cb2fc233f6405d05a06fc9e9ab39ee27c94154ff90420e67dbc9461bf87de90f3c265a8a42c5a8d3962ff9463021e419409fc07343ab4a694154d4dde889
SSDEEP 192:Pib2+4pe/zvZ70ZGjOBcRupVcu/5E4JAd6lSG/ULWHH:qb2szvIb1J/5EilSG//HH
TLSH
T10302C085ADCCB09D86A09A906B567CBD2C11B1573C207DCB328DAF54B12656DA02FD87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppWhite.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png
Size 2KB
SHA256 7334f9f57c32fea569aa01a14a5eafbfd52297b4bb8319c40ebe91f03dfe7239
MD5 7ddb57c13c0d68f7600a88f331d541d5
SHA1 3f5742c02569321534870fb4ba6fc11b514285fb
SHA512 ac2a3ff516baf7a766f64837e32f81d222a3e7300cd50774cec05af853d049e1ec6e412f5cd1e6986615338e17c1f2da6d9f7bf1cd94f56a1e2bc9825d56d63b
TLSH
T18B5119DD8504E7B7BCC6341929ECE2994E1E16EC1867166379B063472804E951CA1AAF
MD5 SHA1 SHA512 TLSH

Submit Download

AutoPlayOptIn.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png
Size 9KB
SHA256 b952decf0d09c4fd33b7689e50d1ac5f0125083668c75f47640f0b04dd6f8686
MD5 554cfee0ecb57bf737a06a3206b15879
SHA1 c2fad1f66c0ffa511f749a81bb77d847d278e786
SHA512 06c7a92e4e651ab6f5b4199a9d173dc723e900cab78d780b8d801bd5d3ef68430180c12c07f7af9b91bfbf503207b0d8631bf5f12c39b811960017e02b23f0a8
SSDEEP 192:GV5vqDzkcG4U1KfUHJ8r9RJ/XEFaLQPZQu8ThoDe7mG04Trn2N+73rzMxtFk6:GnSDzkXOHr9Hjk5K7mG04Lbx6
TLSH
T142229081F7890ABD429859499DE67BECD1AE0465CF463B108F5AC9ADD3823E0C543D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ElevatedAppBlue.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png
Size 7KB
SHA256 c702223a67173d4e62f273617ece44f96021584338edcd1847eaf5b925b6e89f
MD5 7f046dd18f926467dbd4957fca561460
SHA1 8fd527710ebc99fce2a1ee13bd5be32003fec4b7
SHA512 7403ec52061fbcc25c4989ae8fb55d0d790257fbc4e6fa407bf038406db28e65c5340f4728b2c7c0e5499082919870b5c2c0e911a27542541040d612f82a1892
SSDEEP 192:Ln+FaS3yVxJj+eN/pYsZZDOzTqQwETNpJ3HYE6wAMzbK2p:Ln+j3yVxJxM4czTqQxpJWLY
TLSH
T186E1AF263CFD0BD17EC442A29C77E2283A5D4BE9A5CE610F079442EF261AA5C57D0C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ElevatedAppWhite.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png
Size 4KB
SHA256 3f62357091993b907a1194cd3b01a49da5ae3ba6b78a4cbc50c2a07554afb703
MD5 d2f7ac8231d01cbcec94572bb110b1d6
SHA1 4809f80e130a5e4db3e6c2d63698a30d129f10d5
SHA512 02ce39d06cc4275532d94b63e10fe71f6e45508457ae540e5ef56b3990e795d71df3fad71cc0af4141619ab6545cab0d5ce3d1c74c113a77c4fe70bcb59c2308
SSDEEP 96:8o+gNnaN89+N0GhgRSm/cF6Y0hYJH9miOT/z5AkU0W:8o+gN6s+mGhI1/I0hYJH9m1AkU0W
TLSH
T154A18EFA71B1285665C5CD733F4A0D16B8F94FA84077A78A6B9239D433B8011305F588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KFMLockedFileToast.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png
Size 10KB
SHA256 346ef33e9190e610edb26e56983bac5b88031b346365330c7c68c4142922b7bd
MD5 ad403952276b178191c552037b0ac0bf
SHA1 cc7ac8222755463cb499e5f9d198d5556db0a62a
SHA512 a54919c11fda5c3577ccbff84f3a9b43df9d6cdd1d7c08032db6fe5a34fb4d05c1bf99498be1bcf9365cd6542ef9d4af60b08dd39373df05b3ec7704e9f3de21
SSDEEP 192:CWfDYXALHzwDmSFOZ7YEo3i22aUclnK4Lq4ZrSZ1I1xylDeVjINMxeD1ERRTyG87:BYwjzymt7Yf3xjHlnzS1I1xUujINye6m
TLSH
T14522C0702886AC6CF26445EE599005638FCD7DBE730C72AC2CCA7D49916E92FC092763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaCritical.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png
Size 8KB
SHA256 3a9f24a022000a353f44c79b25c55ebb2f41f493d663aae5f11da89453201cd4
MD5 5b450497305dbcd3312e33bf362df44e
SHA1 5717acd85e1eaf0daca061774761ebc26c96ae18
SHA512 fa0eba09b2e5ba70e9a27359803a92217d912fe272a43dbacb2c83700f0f3820de14a9dee1d1cecd10cbc260d99dce6eb90cc90bc9cebf29290f16c08072d37a
SSDEEP 192:zbDta06bk/9RU2xiCTXrR56zg5Y6uGVyvUbHJh/S5PChfS5nG92:zbRaLWRUOiCTl5SOY6n1HneRu2
TLSH
T16702AFCAEDE09EFA128E92023C64424E491F46C5E1B75710B7D18DF1706F3D26A8B7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaError.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png
Size 9KB
SHA256 40e458d3ffa07d21f625fc4556b39921ed3c79eb044b2de1332e83c501496837
MD5 fab3f572cfcfdbfd4cd9c0ecc69d3408
SHA1 c357bcc096fb3af03d4b006a8c67ad9679e1b292
SHA512 7800795140a25653435ded19710a01b79ea2f641a8a677b910fb92063dba90c7f06c4f82657b1ffdacb91abc8d6d5534656bca79a7d980b28bb4a53f512fbd2c
SSDEEP 192:xGJocTaYaYWSoAuYkSZTfeglWl7I44QRElCNI2lNLJjF1SDYXs5LR:xGcYaYWSMiTfeCj+vNR9Poj5F
TLSH
T18512BFDA3346B900298BE5C68C14F6676EE51F2235C9DE94661C64CAC4C05D90F59BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaNearing.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png
Size 7KB
SHA256 f5e273ce1b52a181c24f740bf9a5e4c006c39e6b1517dc66fb74ce0f5e4418d3
MD5 ed8d1260c45180a7549ce7128fd7f5d8
SHA1 e6f695565979700d173e1f664f1d90c30cc422fc
SHA512 1fa2ba36ff59cc8425bfa2b6b89606efda9b7c6ff8a73fef9d804b7dd28671b52f0283baf3df318173abaa7adfb11119ccda04187f413cd8a5a77cab9928d94e
SSDEEP 192:k4GstOd0FANVW+F3lU5nObs7m9j5wahpPViLdNcDRsHhGR:LGrd7W+F1kObbHhpPEY9sHh8
TLSH
T156F1AF030E87A498E70038365F1C2D6DCD633BED7356894DA57DC1365CABD2EA24945B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Warning.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png
Size 2KB
SHA256 377ed0452543efb12f6470550bf2e51330acb300a0cb8865b4178adb5f266e83
MD5 a51cc830df9bffcfc4c9ffefa64881db
SHA1 98710092882216d208bf5664c93be2f665a89a49
SHA512 de742f65d5b868f555b8864fcf7e396e2132bee28f9f0cfec8b8ac593b46eb717eea0c0790cb8091b963eb858307ea731be55819fd4e944db68a94a800217659
TLSH
T1B7511A903D86B4C62281F5B358B01082CFBF84A86B19358A546952EF19FA3F8DED005B
MD5 SHA1 SHA512 TLSH

Submit Download

alertIcon.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png
Size 718B
SHA256 dc862cf19e95f618a1dac0de2dee3c19bb0c27ffe30e9a8d3eccb261e5e4f29d
MD5 cc9297d4a3451411fdbedc3bea6e56f6
SHA1 f8e28c94c63539c8231cc39f1641e432ec6fd8f8
SHA512 fa693de40dff41eaf73e29c2ba635db24ab07946a18a6905f94ba151e1658fd63c32551dfb4687a9255e169dbc84c2f7772ed2b02c7b2964d8650792530185eb
TLSH
T1960110B60E6D9D66D10A873B6BE42AFD9D0D8AD04112188BB901C59A8DCE5ED3C92126
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
Size 652B
SHA256 e44c4d1cd6b08db0bc4a21c8967af71c8c428b281c241601ca025251a4a770c2
MD5 8c0b1e2f8c953c04ffb4eddac2b0c1ab
SHA1 ba019087b98b1b23b76a57fb49d36b07d8c2dde5
SHA512 2c71b1a10a3235a51776c4d31a55ff46e39a2488b0569dd51fb8395627ec3bbb7619c416e7e6a73e4ddf6edb7809d5832356fd8e6b11a45ac8d6f0687813de1a
TLSH
T1DBF08343B6821146EB82C226D098456C8124438C07C70A5C2C3408AACABD4FBDD4DFF6
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
Size 662B
SHA256 628d3af8b4d79bdf7e3f5885ef418c4782ec03599564d75bd168c9aac283be55
MD5 a94ca393822d19070d4bdc47255c855c
SHA1 ae241e9cee1293005f46c6d3b4806a77fcd4b819
SHA512 2ce4b3fe0e47e92f3ed51b8f24e265419fc4ef25dd926a3278e5d988da499955c4fea55d1673ee4bc7f3202064d29d530d6843ecf2aa41f9a8c8300d96f11422
TLSH
T1BE01C88C0CF0F84D9015633B1E790762C3E66363EE9112126908C5B60352C7CF11EC90
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
Size 871B
SHA256 29e897b6f8257b8b121dc6ba3ca8bd28ac1377058c1d1c98c43675eb8dc46757
MD5 1ea78d3767a1ee61edabf020d90989b5
SHA1 e7d7c091cbd0de69e58094a099570c3c891afbcd
SHA512 c68e25513255fa1ea97fe1c4690c655763d6fd122221cfb870518016e4b24702a94865ebb1f238f3f2f84f8533e3a873ab56a96a7f91c433592732b3a0763e5d
TLSH
T16B11EBDC35CA452BF08CD9CD5901164322D2733C21D03BD8195AF136912C5FD4C1475A
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
Size 800B
SHA256 9e425f859ea93ad126d709419035f6d745fadd69956800d1aff158e194c98009
MD5 588ad1442a57c048db018e8c17615795
SHA1 cafaf83fbc6f3d6a28d757d47ac2f8a28bb43624
SHA512 edc852a17d3233dce96fd27a5a0800a359e0e248e53507c0d8c6f83e3b4f46b8e662647341b6cfd660fd7f76a119647e340c3466cbac8e483535dcf392f29354
TLSH
T1CA01CA0FE1BC37345010F2730C68845374C4480ADEE15805F1B21B551A86914EF1CCF7
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
Size 3KB
SHA256 c13599f6ed12630e71fe5ff5968d5c6d47fb11f36a52d36d6cba8a29bdf17a97
MD5 9ba89aad1df78e5076cc17576f5277d6
SHA1 3bc18de54ef088521299fee239695b40080154ed
SHA512 8acf8247a308716ac7a6cb5f88b855a0dfe8cdeade2eefc0b5fd1a5f2b728da250afafbee75753608fbc21d39d30a9c5473a2804a425ab46f12c771a7a39214e
TLSH
T103716CAFB1F65A9E3A305BE67232C91CAD3C006F5CEE77747C7C1805920482B01B94A9
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png
Size 652B
SHA256 8336101e064ba418e02551563c94bbee0ed6b5b9037725301fa62471e27b1cb2
MD5 f71a395f18e430120a9537fc2e0cd4c0
SHA1 947049534a99d51bf8e5dc64e7c3c819d91f17bd
SHA512 66b20a32553f6485577183a2a7b8d1bc902a5895d22b66db162e8525c1af3fdb57065ae7cf9dc5c2d469da14aa75791e97d1c5f2c7a800627c3eb47862af018d
TLSH
T177F08399B030083C28CBA857228E21DC7447323A8956C78E9012F2B5353B8086663AD5
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png
Size 848B
SHA256 2d6ad1dd2a4eb9ce826ebaa53bb9410860ae99de2bd58e939da5c2ee2a4ba09a
MD5 b98efa1abcccb3656b384ff330e47585
SHA1 5ca7dc84c8cd91d72f64a065ffb27df0fc953265
SHA512 eb2b15285424325905a419bff12c3a50e5b645802fc9b52f5a4fe455c925c970480bcd4aa77a72cbdd35f6bae6e259622ae435783f4aee3287aca2238ba0aa81
TLSH
T12B01DAFE216C90E04C9547B446A3F57CB8AEA4F00E315312FB1845430A28FF524942AB
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png
Size 990B
SHA256 7616e2aec76c1d336d1622708f9bf64f0b40565d7a74f0940e975638092fbe49
MD5 1724a995503aaccc2b771d2498a4ea6b
SHA1 d8592231bba626bb14b7a390b875db8c9853c976
SHA512 bb2cbabaeca5c8729694ba411326af912630b4131e82ba1adc4cddff3acf3d6671a97592eb7d48d3b3e3d61f94d82e99facb7c06a90339df8ed763e6740d19a8
TLSH
T1B711C80F2480C560A4FE7903C53D8E115B7960D4C89018D8AA005BEF4575384E8AAE16
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-150.png.corrupted

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.corrupted
Size 591B
SHA256 ce80cad8e576a6dd86b2d2bc984cd019fdf78c27364ef6fa72b3a996f181729d
MD5 18694aa0c95d822b9dcbe4be37b5c87c
SHA1 25cc1b53042bd22c212714badd87c0770f236bec
SHA512 dee94e19f5ca9ca0a6809e68c96ae9d9b0ceae744c6881dab4421b27ecc7ab4373b2a7434ce0c0efc66d211612a4493e0d962ecb7664b7eb7233b857665150cc
TLSH
T1ACF047D64156C0982123A7826FDC384191E54F6BB3CB1C97B2416307886479AC279168
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png
Size 803B
SHA256 edb1d0039ccd89d1282539433288b83630c594f1617434734af1b6230a41c32e
MD5 78735a4d3e4edb45181dc1cefd6aac3e
SHA1 695dece07b392516c6fc0ef7b81005f84523c135
SHA512 1e61d2078c50a204c57296ca135c4227509da35bf5e8cc1d62264d71331b7e55af08e3a43d4c3122aecb4c78046e8bb055c4a95cfb96f2b13b7ff2ed51985f6f
TLSH
T19301C544CBA085D010DE333623923428BCBC4B91CBB45600AAF82CD9D20009FDE9F4DA
MD5 SHA1 SHA512 TLSH

Submit Download

0.2.filtertrie.intermediate.txt.corrupted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d90550d8-c724-4988-8bb0-7eed78ac4d77}\0.2.filtertrie.intermediate.txt.corrupted
Size 5B
SHA256 ce8f5d7b5b8b17beee08e495758c6616d6dfa860a3a613dab7aecddec1cdb79b
MD5 d45868b784f7c3e180adf0222ac25c63
SHA1 52d36ffc41fc4565926965db23a2a9a0cb5bb5aa
SHA512 d9356dae14dcffbdd2991198b340dca7aab2c285facce6967a6db621a95fb3d65e1f042910c2f1088aba312c33b6ad552bf677284908c7d4d623d5618bd652ce
MD5 SHA1 SHA512

Submit Download

AppCache134231794814346052.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134231794814346052.txt
Size 77KB
SHA256 c4012d150ef4a47c080666c25e2bbef85bdb3fb1f4f5ccf1ef8eba002a8dc806
MD5 e134091f6bd9d8aea9863a1507befce5
SHA1 50120831539be03c9d65d38f48e5c62248a094e9
SHA512 5a15aac1d6dad37793c46b91d8e413486ec75a5bbab774949592913170eac4968096128bfbc4a4d21dad6a9a1866913fa24b34589ad5e61d70526fabc79e854c
SSDEEP 1536:UXmm5uj2+NsZ3V6CPoHG570IejsMgW655b1VLCLHHs3Vlt3VyZpi1GYudicfu:U28a2ySVZPJ7qjWHx6cVDVy21HuEcm
TLSH
T187737D0DA49DEF8D5D1C3A96939380DED2296F24130A70A4470D7A8F79D878E42FD39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134231794814346052.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134231794814346052.txt
Size 77KB
SHA256 98aad8de7aa6f5f68c698676d6154ac45aa747ee0af38d996091b09c27fd67f8
MD5 8968bae912d02d06a9186a331edc9f79
SHA1 51da1bb3386281309c54c2bbef40fd42e3b8c60f
SHA512 aaccddeca3c051afe78c85b33b533866f1b8f1b0ff146226d8084b90118357b727bfc9908214b65a86e91dae9e8a345c97c58a513c7e620b8759b583a46461d4
SSDEEP 768:7zMLVYPmpN/xLyC7g9451v3pfLJR0YC/sYbHT7xtsb+YsYIbIdmhRwyCDR8faAO8:3mjBFmYZ+oKim/SAJUeVJpK6J
TLSH
T19C737D7373E07048DEA587DFC295C87E134DA859DBD620F207A765DAAF38B841AE5023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_bz2.pyd
Size 82KB
SHA256 403e76fe18515a5ea3227cf5f919aa2f32ac3233853c9fb71627f2251c554d09
MD5 28ede9ce9484f078ac4e52592a8704c7
SHA1 bcf8d6fe9f42a68563b6ce964bdc615c119992d0
SHA512 8c372f9f6c4d27f7ca9028c6034c17deb6e98cfef690733465c1b44bd212f363625d9c768f8e0bd4c781ddde34ee4316256203ed18fa709d120f56df3cca108b
SSDEEP 1536:7/Uez7qlMjca6uPZLPYMPHn3m8bhztpIVCVC7SyhJDxhy:4ezGC4TM/3RbhhpIVCVCXpy
TLSH
T13D83AEA2F6A096B5F41B927A96B14393E331FE49035093EFF68483172F02F913C6535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_ctypes.pyd
Size 120KB
SHA256 e28d4e46e5d10b5fdcf0292f91e8fd767e33473116247cd5d577e4554d7a4c0c
MD5 22c4892caf560a3ee28cf7f210711f9e
SHA1 b30520fadd882b667ecef3b4e5c05dc92e08b95a
SHA512 edb86b3694fff0b05318decf7fc42c20c348c1523892cce7b89cc9c5ab62925261d4dd72d9f46c9b2bda5ac1e6b53060b8701318b064a286e84f817813960b19
SSDEEP 3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
TLSH
T1C3C35B1B23541099EB67807CC5B35E17DBB1B859172087CF02A4CA9E2F637A36E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_decimal.pyd
Size 247KB
SHA256 6cd52b65e11839f417b212ba5a39f182b0151a711ebc7629dc260b532391db72
MD5 baaa9067639597e63b55794a757ddeff
SHA1 e8dd6b03ebef0b0a709e6cccff0e9f33c5142304
SHA512 7995c3b818764ad88db82148ea0ce560a0bbe9594ca333671b4c5e5c949f5932210edbd63d4a0e0dc2daf24737b99318e3d5daaee32a5478399a6aa1b9ee3719
SSDEEP 6144:cjz3B48pj9aOtoQdpJOsoTiSi9qWM53pLW1Atp6tQh7:i94uj9afQVrom0bUQh7
TLSH
T155446C56A2490CA0DE778478D8979B47EBB278950360C3CF43A4CAA72F577A327BD344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_hashlib.pyd
Size 63KB
SHA256 21d59958e2ad1b944c4811a71e88de08c05c5ca07945192ab93da5065fac8926
MD5 c888ecc8298c36d498ff8919cebdb4e6
SHA1 f904e1832b9d9614fa1b8f23853b3e8c878d649d
SHA512 7161065608f34d6de32f2c70b7485c4ee38cd3a41ef68a1beacee78e4c5b525d0c1347f148862cf59abd9a4ad0026c2c2939736f4fc4c93e6393b3b53aa7c377
SSDEEP 1536:jfKlbLgy209/MkZy6n23JZlnvy7OjZophIVOIi7SyMrxZR1:7Khgy+XZla7OjSphIVOIiKR1
TLSH
T172536C06F65544A8C97B81B9D9A34F57EAF2F1001B509BDF4368C18D2F233C396B6B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_lzma.pyd
Size 155KB
SHA256 ad0440ca6998e18f5cc917d088af3fea2c0ff0febce2b5e2b6c0f1370f6e87b1
MD5 d386b7c4dcf589e026abfc7196cf1c4c
SHA1 c07ce47ce0e69d233c5bdd0bcac507057d04b2d4
SHA512 78d79e2379761b054df1f9fd8c5b7de5c16b99af2d2de16a3d0ac5cb3f0bd522257579a49e91218b972a273db4981f046609fdcf2f31cf074724d544dac7d6c8
SSDEEP 3072:cNltLBrdV/REWa/g7Lznf49mNoiUMApqlpIVZ1SXW:cNltPpREgAYOicMI
TLSH
T1D0F33992A394F4D5F3228C78D6664F27D7F678490310929A02CCC36D2B2FB759A2E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_socket.pyd
Size 77KB
SHA256 301c47c4016dac27811f04f4d7232f24852ef7675e9a4500f0601703ed8f06af
MD5 2c0ec225e35a0377ac1d0777631bffe4
SHA1 7e5d81a06ff8317af52284aedccac6ebace5c390
SHA512 aea9d34d9e93622b01e702defd437d397f0e7642bc5f9829754d59860b345bbde2dd6d7fe21cc1d0397ff0a9db4ecfe7c38b649d33c5c6f0ead233cb201a73e0
SSDEEP 1536:YJlhpHrTT9r3ujE9/s+S+pzpCoiTFVf7p9IVLwg7SyLxU:Y7hpL13ujE9/sT+pz4oYFVTp9IVLwgo
TLSH
T176735B12A29060A9D273C07AC1635F23EB74F4C117D5A7CF5260C96E5F23782AE7ABD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\base_library.zip
Size 1.4MB
SHA256 257dea7ca2396f2a3ac4760d353248512f6f76ccd6e0e48b1705be959d67e423
MD5 58fe56947a111997711741c2e48617b9
SHA1 2e30a6cb119e9bc9641f4697aeb7dae6d411c0b8
SHA512 2190d3eb127f5c84596f86954f7f0d7252a28e8352e119dfff4c9cd5856f15795b84a303be03b28eb2b4617751cb458937345309a54efa0b164e6ae24acb8c91
SSDEEP 24576:VvHHWeIPAdYf9TN3cnz/bucEvUFigiQR5pqfRru0iwhw:V6QR5pqfRkF
TLSH
T1A86509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\python311.dll
Size 5.5MB
SHA256 53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a
MD5 65e381a0b1bc05f71c139b0c7a5b8eb2
SHA1 7c4a3adf21ebcee5405288fc81fc4be75019d472
SHA512 4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39
SSDEEP 98304:CdT9zf0+IXY3qd4biqm46oWHrMGYPtA81:CdT9zflIXgq/epGWAs
TLSH
T18F467C22B26594A0C97B8076EA2F8647D7B27C505F20CB0B5164B7992F33B531EEF346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\select.pyd
Size 29KB
SHA256 8a9a103bc417dede9f6946d9033487c410937e1761d93c358c1600b82f0a711f
MD5 8472d39b9ee6051c961021d664c7447e
SHA1 b284e3566889359576d43e2e0e99d4acf068e4fb
SHA512 309f1ec491d9c39f4b319e7ce1abdedf11924301e4582d122e261e948705fb71a453fec34f63df9f9abe7f8cc2063a56cd2c2935418ab54be5596aadc2e90ad3
SSDEEP 768:neUeJhHq2GD9IVQGA5YiSyv3g+AMxkEdC:neUeJhK2GD9IVQGS7SyfgMxRC
TLSH
T1BDD29F976F545C89E823C572A8E64E16EA35B6A24710C2DF3354C16C1F327C27BBB364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\unicodedata.pyd
Size 1.1MB
SHA256 1a965c1904da88989468852fdc749b520cce46617b9190163c8df19345b59560
MD5 57f8f40cf955561a5044ddffa4f2e144
SHA1 19218025bcae076529e49dde8c74f12e1b779279
SHA512 db2a7a32e0b5bf0684a8c4d57a1d7df411d8eb1bc3828f44c95235dd3af40e50a198427350161dff2e79c07a82ef98e1536e0e013030a15bdf1116154f1d8338
SSDEEP 12288:C3kYbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1Ji:CUYbM40IDJcjEwPgPOG6Xyd461Ji
TLSH
T121355BC9BB828D66D87B31B944D2212F1361C273475B233BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsSystemHelper.exe

Path F:\WindowsSystemHelper.exe
Size 6.8MB
SHA256 edd1b8df7634a080287cb27975259afa7be21811c2f6e33487ca79bf5d9b97bf
MD5 08bbf37bd0db054e4f12e1f28da3bf9b
SHA1 9b2678668905d79441a480618182c94085f871d6
SHA512 ce3cc1e5e088e0ac39acb73fb130568a37299e3aa9a4ef568e375a332de7ce75667f96a46e9e120154832d6bc4a4231a4212514ed66da8873993183803f16372
SSDEEP 98304:lyznxTPkALGl1W903AE4V4QKUUyJl6bxGvwxiVIRFngXw5i5LmLyHaSvPUMNBS:A1kFl1W903eV4QK993iObMGuLmGHrP
TLSH
T14A763384E3B54AF6F863813E4293C544EA72741B07B891CB93A9CA553F333D25A3AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path F:\autorun.inf
Size 35B
SHA256 693e4c15c88802a709cbb0674b531214dabab27bb1228a9c7f589aa6b99e23eb
MD5 3e99474a6dd273ad433f05f6823de42e
SHA1 896a7106645c97cf14f3d39c115277fdc94de039
SHA512 de1b238b859fb9d3cb873dd5123adcc5eb90867c41e1871aae9bcce5d842aa25784fc53181205e2958382d9d863ae9d029011f41e4de204588edea0b0cca9764
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads