Overview

overview

10

Static

static

3

2026-08-04...om.exe

windows10-2004-x64

10

2026-08-04...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 13.6MB
  • Sample260804-175qkaer7x
  • SHA256 632f19ed00fef09c6d7d7445498685c95b8c3ca28d22f181c0352cd3b28862ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Clears Windows event logs 1 TTPs 6 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs
    defense_evasion
  • Launches sc.exe 24 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 62 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 12 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "whoami /user"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Windows\system32\whoami.exe
          whoami /user
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Get-Disk -Number 0 | Select-Object -ExpandProperty SerialNumber""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Get-Disk -Number 0 | Select-Object -ExpandProperty SerialNumber"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop {s}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Windows\system32\sc.exe
          sc stop {s}
          4⤵
          • Launches sc.exe
          PID:5544
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Windows\system32\sc.exe
          sc config {s} start= disabled
          4⤵
          • Launches sc.exe
          PID:3184
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop {s}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5364
        • C:\Windows\system32\sc.exe
          sc stop {s}
          4⤵
          • Launches sc.exe
          PID:4628
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Windows\system32\sc.exe
          sc config {s} start= disabled
          4⤵
          • Launches sc.exe
          PID:692
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop {s}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5864
        • C:\Windows\system32\sc.exe
          sc stop {s}
          4⤵
          • Launches sc.exe
          PID:4188
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1548
        • C:\Windows\system32\sc.exe
          sc config {s} start= disabled
          4⤵
          • Launches sc.exe
          PID:5436
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop {s}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Windows\system32\sc.exe
          sc stop {s}
          4⤵
          • Launches sc.exe
          PID:3144
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Windows\system32\sc.exe
          sc config {s} start= disabled
          4⤵
          • Launches sc.exe
          PID:4320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop {s}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\system32\sc.exe
          sc stop {s}
          4⤵
          • Launches sc.exe
          PID:5344
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5324
        • C:\Windows\system32\sc.exe
          sc config {s} start= disabled
          4⤵
          • Launches sc.exe
          PID:1776
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop {s}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Windows\system32\sc.exe
          sc stop {s}
          4⤵
          • Launches sc.exe
          PID:2092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4372
        • C:\Windows\system32\sc.exe
          sc config {s} start= disabled
          4⤵
          • Launches sc.exe
          PID:4984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
          4⤵
          • Modifies Windows Defender DisableAntiSpyware settings
          PID:5076
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5156
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          PID:1112
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
          4⤵
            PID:4660
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set allprofiles state off
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:1364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h +s "{dst}""
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:3016
          • C:\Windows\system32\attrib.exe
            attrib +h +s "{dst}"
            4⤵
            • Views/modifies file attributes
            PID:5680
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h +s "{dst}""
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\system32\attrib.exe
            attrib +h +s "{dst}"
            4⤵
            • Views/modifies file attributes
            PID:4676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc ONLOGON /ru SYSTEM /f"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3456
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc ONLOGON /ru SYSTEM /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2284
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wevtutil cl {log}"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1276
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl {log}
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:4464
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wevtutil cl {log}"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl {log}
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:1556
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wevtutil cl {log}"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl {log}
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:6080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:4360
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Get-ComputerRestorePoint | Delete-ComputerRestorePoint""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5788
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-ComputerRestorePoint | Delete-ComputerRestorePoint"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im {proc}
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5180
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im {proc}
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1536
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6124
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im {proc}
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4572
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
          3⤵
          • Executes a command shell one-liner
          PID:3120
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im {proc}
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
          3⤵
          • Executes a command shell one-liner
          PID:4532
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im {proc}
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
          3⤵
          • Executes a command shell one-liner
          PID:4652
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im {proc}
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:6080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
          3⤵
          • Executes a command shell one-liner
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:2148
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:5952
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "whoami /user"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2960
          • C:\Windows\system32\whoami.exe
            whoami /user
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5224
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Get-Disk -Number 0 | Select-Object -ExpandProperty SerialNumber""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4180
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-Disk -Number 0 | Select-Object -ExpandProperty SerialNumber"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2736
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop {s}"
          3⤵
          • Executes a command shell one-liner
          PID:4324
          • C:\Windows\system32\sc.exe
            sc stop {s}
            4⤵
            • Launches sc.exe
            PID:5468
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
          3⤵
          • Executes a command shell one-liner
          PID:1000
          • C:\Windows\system32\sc.exe
            sc config {s} start= disabled
            4⤵
            • Launches sc.exe
            PID:2452
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop {s}"
          3⤵
          • Executes a command shell one-liner
          PID:5680
          • C:\Windows\system32\sc.exe
            sc stop {s}
            4⤵
            • Launches sc.exe
            PID:3436
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
          3⤵
          • Executes a command shell one-liner
          PID:3048
          • C:\Windows\system32\sc.exe
            sc config {s} start= disabled
            4⤵
            • Launches sc.exe
            PID:4376
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop {s}"
          3⤵
          • Executes a command shell one-liner
          PID:3156
          • C:\Windows\system32\sc.exe
            sc stop {s}
            4⤵
            • Launches sc.exe
            PID:2252
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
          3⤵
          • Executes a command shell one-liner
          PID:4236
          • C:\Windows\system32\sc.exe
            sc config {s} start= disabled
            4⤵
            • Launches sc.exe
            PID:2772
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop {s}"
          3⤵
          • Executes a command shell one-liner
          PID:2512
          • C:\Windows\system32\sc.exe
            sc stop {s}
            4⤵
            • Launches sc.exe
            PID:1240
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
          3⤵
          • Executes a command shell one-liner
          PID:5516
          • C:\Windows\system32\sc.exe
            sc config {s} start= disabled
            4⤵
            • Launches sc.exe
            PID:3816
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop {s}"
          3⤵
          • Executes a command shell one-liner
          PID:2728
          • C:\Windows\system32\sc.exe
            sc stop {s}
            4⤵
            • Launches sc.exe
            PID:3364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
          3⤵
          • Executes a command shell one-liner
          PID:248
          • C:\Windows\system32\sc.exe
            sc config {s} start= disabled
            4⤵
            • Launches sc.exe
            PID:2780
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop {s}"
          3⤵
          • Executes a command shell one-liner
          PID:4204
          • C:\Windows\system32\sc.exe
            sc stop {s}
            4⤵
            • Launches sc.exe
            PID:3028
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config {s} start= disabled"
          3⤵
          • Executes a command shell one-liner
          PID:4780
          • C:\Windows\system32\sc.exe
            sc config {s} start= disabled
            4⤵
            • Launches sc.exe
            PID:4568
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
          3⤵
          • Executes a command shell one-liner
          PID:1952
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
            4⤵
            • Modifies Windows Defender DisableAntiSpyware settings
            PID:3624
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"
          3⤵
          • Executes a command shell one-liner
          PID:3332
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
            4⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:4492
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f"
          3⤵
          • Executes a command shell one-liner
          PID:5176
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
            4⤵
              PID:5728
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
            3⤵
            • Executes a command shell one-liner
            PID:5968
            • C:\Windows\system32\netsh.exe
              netsh advfirewall set allprofiles state off
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3392
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "{dst}""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:2228
            • C:\Windows\system32\attrib.exe
              attrib +h +s "{dst}"
              4⤵
              • Views/modifies file attributes
              PID:4872
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "{dst}""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:692
            • C:\Windows\system32\attrib.exe
              attrib +h +s "{dst}"
              4⤵
              • Views/modifies file attributes
              PID:2856
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc ONLOGON /ru SYSTEM /f"
            3⤵
            • Executes a command shell one-liner
            PID:4504
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c85c113d8a12c90e8f3c2225a3478b1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc ONLOGON /ru SYSTEM /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5748
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wevtutil cl {log}"
            3⤵
            • Executes a command shell one-liner
            PID:4956
            • C:\Windows\system32\wevtutil.exe
              wevtutil cl {log}
              4⤵
              • Clears Windows event logs
              PID:6008
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wevtutil cl {log}"
            3⤵
            • Executes a command shell one-liner
            PID:900
            • C:\Windows\system32\wevtutil.exe
              wevtutil cl {log}
              4⤵
              • Clears Windows event logs
              PID:5292
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wevtutil cl {log}"
            3⤵
            • Executes a command shell one-liner
            PID:5496
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:6080
              • C:\Windows\system32\wevtutil.exe
                wevtutil cl {log}
                4⤵
                • Clears Windows event logs
                PID:1088
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
              3⤵
              • Executes a command shell one-liner
              PID:2452
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:4376
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command "Get-ComputerRestorePoint | Delete-ComputerRestorePoint""
              3⤵
              • Executes a command shell one-liner
              PID:5952
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Get-ComputerRestorePoint | Delete-ComputerRestorePoint"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1240
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
              3⤵
              • Executes a command shell one-liner
              PID:1076
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im {proc}
                4⤵
                • Kills process with taskkill
                PID:4128
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
              3⤵
              • Executes a command shell one-liner
              PID:4932
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im {proc}
                4⤵
                • Kills process with taskkill
                PID:2548
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
              3⤵
              • Executes a command shell one-liner
              PID:4212
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im {proc}
                4⤵
                • Kills process with taskkill
                PID:4600
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
              3⤵
              • Executes a command shell one-liner
              PID:5208
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im {proc}
                4⤵
                • Kills process with taskkill
                PID:4732
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
              3⤵
              • Executes a command shell one-liner
              PID:2628
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im {proc}
                4⤵
                • Kills process with taskkill
                PID:2912
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im {proc}"
              3⤵
              • Executes a command shell one-liner
              PID:1264
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                4⤵
                  PID:5468
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im {proc}
                  4⤵
                  • Kills process with taskkill
                  PID:5664
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                3⤵
                • Executes a command shell one-liner
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:1088
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  4⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:1680
          • C:\Windows\system32\SecurityHealthService.exe
            C:\Windows\system32\SecurityHealthService.exe
            1⤵
            • Modifies data under HKEY_USERS
            • Modifies registry class
            PID:780

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                2
                T1569

                Service Execution

                2
                T1569.002

                Windows Management Instrumentation

                1
                T1047

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                5
                T1543

                Windows Service

                5
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                5
                T1543

                Windows Service

                5
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Hide Artifacts

                2
                T1564

                Hidden Files and Directories

                2
                T1564.001

                Impair Defenses

                4
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Disable or Modify Tools

                2
                T1562.001

                Indicator Removal

                3
                T1070

                Clear Windows Event Logs

                1
                T1070.001

                File Deletion

                2
                T1070.004

                Modify Registry

                3
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Query Registry

                1
                T1012

                System Network Configuration Discovery

                1
                T1016

                Wi-Fi Discovery

                1
                T1016.002

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Inhibit System Recovery

                2
                T1490

                Service Stop

                2
                T1489

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                _raw_aes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\Crypto\Cipher\_raw_aes.pyd
                • Size 34KB
                • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _raw_aesni.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\Crypto\Cipher\_raw_aesni.pyd
                • Size 15KB
                • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _modexp.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\Crypto\Math\_modexp.pyd
                • Size 30KB
                • SHA256 fc122c8e0a1c236c2a0b20009ed710602545577ba34a9fafed71eb84e56a2e76
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _cpuid_c.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\Crypto\Util\_cpuid_c.pyd
                • Size 10KB
                • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_bz2.pyd
                • Size 86KB
                • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_ctypes.pyd
                • Size 139KB
                • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_hashlib.pyd
                • Size 67KB
                • SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_lzma.pyd
                • Size 157KB
                • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_socket.pyd
                • Size 85KB
                • SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                auto.tcl
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tcl_data\auto.tcl
                • Size 21KB
                • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cp1252.enc
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tcl_data\encoding\cp1252.enc
                • Size 1KB
                • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                init.tcl
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tcl_data\init.tcl
                • Size 25KB
                • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                package.tcl
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tcl_data\package.tcl
                • Size 23KB
                • SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tclIndex
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tcl_data\tclIndex
                • Size 7KB
                • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tm.tcl
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tcl_data\tm.tcl
                • Size 11KB
                • SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tk.tcl
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tk_data\tk.tcl
                • Size 23KB
                • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _tkinter.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_tkinter.pyd
                • Size 67KB
                • SHA256 14f0b750f800ed529a06052369428f75f204005be1633400c9fe0ca544d82f85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _uuid.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_uuid.pyd
                • Size 27KB
                • SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_wmi.pyd
                • Size 39KB
                • SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _zstd.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\_zstd.pyd
                • Size 491KB
                • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\base_library.zip
                • Size 1.3MB
                • SHA256 63a1cb2760a37666d3778a976dbf72f2392fafaf16c31b310b4fa12adfdc0b22
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _psutil_windows.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\psutil\_psutil_windows.pyd
                • Size 69KB
                • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.DLL
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\python3.DLL
                • Size 72KB
                • SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python314.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\python314.dll
                • Size 6.5MB
                • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pywintypes314.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\pywin32_system32\pywintypes314.dll
                • Size 133KB
                • SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tcl86t.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\tcl86t.dll
                • Size 1.8MB
                • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msgcat-1.6.1.tm
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\tcl8\8.5\msgcat-1.6.1.tm
                • Size 34KB
                • SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tk86t.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\tk86t.dll
                • Size 1.5MB
                • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ucrtbase.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\ucrtbase.dll
                • Size 1.3MB
                • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\unicodedata.pyd
                • Size 740KB
                • SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                win32event.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\win32\win32event.pyd
                • Size 29KB
                • SHA256 f16242b661c20f510ea13fa3dcac5bd332bccb4d135ef2ab497b3f3f3398c389
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                zlib1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI47362\zlib1.dll
                • Size 142KB
                • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_p1nlx5y1.wql.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p1nlx5y1.wql.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1240-2198-0x000002F1789B0000-0x000002F178A62000-memory.dmp
                Download

                memory/2196-2177-0x00000229ACBD0000-0x00000229ACBD6000-memory.dmp
                Download

                memory/2196-2172-0x00000229AC8B0000-0x00000229AC962000-memory.dmp
                Download

                memory/2196-2175-0x00000229ACC00000-0x00000229ACC1C000-memory.dmp
                Download

                memory/2196-2176-0x00000229ACBC0000-0x00000229ACBC8000-memory.dmp
                Download

                memory/2196-2178-0x00000229ACC20000-0x00000229ACC2A000-memory.dmp
                Download

                memory/4368-1102-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1093-0x00000208C5900000-0x00000208C590A000-memory.dmp
                Download

                memory/4368-1092-0x00000208C5530000-0x00000208C55E2000-memory.dmp
                Download

                memory/4368-1107-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1088-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1105-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1104-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1103-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1087-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1086-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1082-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1091-0x00000208C5510000-0x00000208C552E000-memory.dmp
                Download

                memory/4368-1085-0x00000208AD030000-0x00000208AD052000-memory.dmp
                Download

                memory/4368-1081-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1080-0x00007FFF23A8F000-0x00007FFF23A90000-memory.dmp
                Download

                memory/4368-1101-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1100-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1099-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1098-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1097-0x00000208C5A70000-0x00000208C5A7A000-memory.dmp
                Download

                memory/4368-1096-0x00000208C5A60000-0x00000208C5A6A000-memory.dmp
                Download

                memory/4368-1095-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-2182-0x00007FFF23900000-0x00007FFF242A4000-memory.dmp
                Download

                memory/4368-1094-0x00000208C5A80000-0x00000208C5A9E000-memory.dmp
                Download