Overview

overview

10

Static

static

10

2026-08-09...lc.exe

windows10-2004-x64

10

2026-08-09...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_42857593471f48f72b2a783aa8ef909c_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 417KB
  • Sample260809-ynbbhacq71
  • SHA256 f6834159d26e90db83e5014efb20de8745c037e65d533f48c598c62e28cda517
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Renames multiple (559) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Adds policy Run key to start application 2 TTPs 8 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 32 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_42857593471f48f72b2a783aa8ef909c_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_42857593471f48f72b2a783aa8ef909c_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Disables RegEdit via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableIntrusionPreventionSystem $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -HighThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -SevereThreatDefaultAction 6
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4296
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:3136
    • C:\Windows\System32\wbadmin.exe
      "C:\Windows\System32\wbadmin.exe" delete systemstatebackup -keepVersions:0
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:2368
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4100
  • C:\Users\Public\svchost.exe
    C:\Users\Public\svchost.exe
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Disables RegEdit via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Checks computer location settings
    • Executes dropped EXE
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableIntrusionPreventionSystem $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -HighThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -SevereThreatDefaultAction 6
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:6176
    • C:\Windows\System32\wbadmin.exe
      "C:\Windows\System32\wbadmin.exe" delete systemstatebackup -keepVersions:0
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:6248

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        5
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        3
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        3
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        background.png.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.BLWZ
        • Size 126KB
        • SHA256 1c8c7c7ebc57608534ce2b67be01733a06f78b560026924c3a3aa7779d4cf608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        device.png.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.BLWZ
        • Size 43KB
        • SHA256 27cc45c3526271a4aecb02dbf36431a25142b73eee86f1bb52f171f9133836ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        overlay.png.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.BLWZ
        • Size 28KB
        • SHA256 6981697935394fb233c84157ba0df69485ea6f33868711664b5fe131dbe3f5a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        superbar.png.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.BLWZ
        • Size 38KB
        • SHA256 e556ae319922594fe2cb871d6ecaa13da22176060e988537b7da61433774e16f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        background.png.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.BLWZ
        • Size 126KB
        • SHA256 347810acfbcebe5e28d1688e99764c475dc3f598365d13be97841459aada6e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        watermark.png.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.BLWZ
        • Size 28KB
        • SHA256 90acf54e2201fb0bd132b981eeaf0765593f7b312d61f7748a927caa885c2a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        folder.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.BLWZ
        • Size 52KB
        • SHA256 c7e133a4e291ade663b1c61613f5567b0d87120d4c78a3880d180b00c337e5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        netfol.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.BLWZ
        • Size 28KB
        • SHA256 1e06245eeed3a857dcb23100a08eff7dffae804182c6e9af629347e9f0f236bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pictures.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.BLWZ
        • Size 81KB
        • SHA256 7dc3d207966e23de1e987ab0e7604d3bb0e0ebd91e7973e2841badf9f07a7de8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ringtones.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.BLWZ
        • Size 50KB
        • SHA256 79b1b81296698638d05b3c3d4035c2ed4db4150908f42ac4e5f48e9c7627c097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.BLWZ
        • Size 66KB
        • SHA256 b6b88bf5dbb71c21037a42a33b8599037f5418e0e554ba895c53f65af7e47b13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sync.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.BLWZ
        • Size 48KB
        • SHA256 cc9acbe658ab3a2ea1a717248bc1e6bb2aac823e283bfd20b742043551a4d5f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmp.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.BLWZ
        • Size 110KB
        • SHA256 040b58a6772dede8f19cf7dd80e4a8c45984c6664d874b7713f3957e01fecf48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        folder.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.BLWZ
        • Size 52KB
        • SHA256 b51858aa67fecd6de59b4f58cfa70504fc2e347d03abd31ef121fa74daa1f53f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        print_pref.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.BLWZ
        • Size 56KB
        • SHA256 8bf71befa8f12e18a152621f56396fdd8298f7e2edf1aafcb3fc5884c9f249e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        print_property.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.BLWZ
        • Size 58KB
        • SHA256 e1b8ace60a90ab183005f54a2c56490bb0e6af1983ab984ffe63ac36a09cb81b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        print_queue.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.BLWZ
        • Size 56KB
        • SHA256 eb2dbb1dd656458fb461a63cc426ba5144587d73fd2f43daabf7999499bb8d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scan_.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.BLWZ
        • Size 59KB
        • SHA256 e7127a707b2c3f59b896cc83b12b630ac11e21fda12313945ab0efd5a4ab494f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scan_property.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.BLWZ
        • Size 65KB
        • SHA256 cf833f3f5b7672778cfb7e1bb6d03d335fc30a12c125432ddd381d72115e2cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scan_settings.ico.BLWZ
        • Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.BLWZ
        • Size 62KB
        • SHA256 690cea71f734dc06e804550543c214f546d387a32d4e41926e85af50015b1d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WelcomeScan.jpg.BLWZ
        • Path C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.BLWZ
        • Size 504KB
        • SHA256 61006a9d3c9215444cae30cdadb2559d9fd21481e7df43bd085dd2347bc81761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ActivitiesCache.db
        • Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
        • Size 1024KB
        • SHA256 e75ae6c7d4c4ad5baf3517b828ebdcd21faa53da3c41d6e57400039d0c444b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ActivitiesCache.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db.BLWZ
        • Size 1.0MB
        • SHA256 427c26e9fa4242f8c4591fd9a4b2e5e1ec503584a5756eb218276fed64279911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cversions.3.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.BLWZ
        • Size 16KB
        • SHA256 03ee980449de12761df770629c77459f42b4bb8ab676168bb62bb55b8d6e5ba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.BLWZ
        • Size 93KB
        • SHA256 fd2e860b9928feda91b87f116b23bd5919db51c5efa20fe354a75ff651c2f707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000f.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000f.db.BLWZ
        • Size 85KB
        • SHA256 a0391da1b5bc65017f92819012390c0e131f57fd21841322a80a2275818a3eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thumbcache_1280.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.BLWZ
        • Size 48B
        • SHA256 0d2c41dece4a3da70d584c260411fb6adab4e677049731089ae37cb71842b356
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_16.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.BLWZ
        • Size 48B
        • SHA256 92bb051b802081527421164f597c1071de4cc65d2b1d9302f0712f1d710b28bb
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_1920.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.BLWZ
        • Size 48B
        • SHA256 6f4429b4f69a4948eeca6af319185356ca2caa8a274205bf35a24f3fdd2083e8
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_256.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.BLWZ
        • Size 48B
        • SHA256 bbd751a7b1f8f7b0c21346a805fc8a0ea099c4a8a6c57c38b774caf6fd55348e
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_2560.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.BLWZ
        • Size 48B
        • SHA256 0b2e7e43a618d40cf9fd43babfcc7824d05fb4bdbc8ab328d0bf091f4461d1ec
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_32.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.BLWZ
        • Size 48B
        • SHA256 b4a914eb22639794dd7892be5045f933d7ec9005292e079d31c9bc0613482edf
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_48.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.BLWZ
        • Size 48B
        • SHA256 f63eace8f54b3dd11bfa51eca087e1b384bd20a0b25ebb1950915ca9d28b9d5e
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_768.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.BLWZ
        • Size 48B
        • SHA256 c5aa944c1efe8d58872ea28ea3f497ee45b7b54b89745620f736cb192f0c4218
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_96.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.BLWZ
        • Size 48B
        • SHA256 ae1c9297857292eaac286bdc6385dd3ae1a158444f36f1c2c06454f5bb123d54
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_custom_stream.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.BLWZ
        • Size 48B
        • SHA256 b85c2d6297d6f90b74ef8e608ae6110a5a58918b722c5697f7fad85df7fe3244
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_exif.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.BLWZ
        • Size 48B
        • SHA256 f6d5806772c28df1188023aab994f4a6235636b859b0f903ca68e8fab4ee32ee
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_idx.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.BLWZ
        • Size 7KB
        • SHA256 704ae2eb443872ed95f459bb65f00c3504d65659fb045671b7dc0b6ae907d114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thumbcache_sr.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.BLWZ
        • Size 48B
        • SHA256 68c6e62308f2c74a32112a3608481fdb24e8679fe87b30d61782f49bd9ca6e98
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_wide.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.BLWZ
        • Size 48B
        • SHA256 d1036817a5d6f6f7e52b8514198106cc600798f726ac50f329f5a629ad4bba45
        • MD5 SHA1 SHA512
        Submit Download

        thumbcache_wide_alternate.db.BLWZ
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.BLWZ
        • Size 48B
        • SHA256 c84cad073ee30f6542d3437d4aafd724561b0f61f4934aca3bfbb7f83df95c9e
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 948B
        • SHA256 e6a6c0f51e4e254cf1f2518e6c8c7e6ed51f175aacc96e5fc355d45ae514a012
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-08-09_42857593471f48f72b2a783aa8ef909c_cobalt-strike_icedid_njrat_satacom_stealc.exe.BLWZ
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_42857593471f48f72b2a783aa8ef909c_cobalt-strike_icedid_njrat_satacom_stealc.exe.BLWZ
        • Size 417KB
        • SHA256 74f7be339b01ec4b4dcc3048450b4553c494c5621566729c2374c3223c8bb4a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_tcu0fcdm.zs5.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcu0fcdm.zs5.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cversions.2.db.BLWZ
        • Path C:\Users\All Users\Microsoft\Windows\Caches\cversions.2.db.BLWZ
        • Size 16KB
        • SHA256 41736918b86d7fc18ee4423d3601226708bb10a9f0ef15d038f31c8d89fa6e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.BLWZ
        • Path C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.BLWZ
        • Size 289KB
        • SHA256 9e790918919156317a23464950980d3b5988549ff63aadbb2cac21924d54a4a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.BLWZ
        • Path C:\Users\All Users\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.BLWZ
        • Size 622KB
        • SHA256 b24dbd3d64ce853580485f30b71bb3be78ee3d8f6441b84f744a6e49c7cede6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        enc_list.txt
        • Path C:\Users\Public\enc_list.txt
        • Size 6KB
        • SHA256 51e1d3bfd648ca8549e509449958ffd8376498d0f1b813b004a09b04e77ebb85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Public\svchost.exe
        • Size 417KB
        • SHA256 f6834159d26e90db83e5014efb20de8745c037e65d533f48c598c62e28cda517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4296-131-0x00000261FC1A0000-0x00000261FC1B0000-memory.dmp
        Download

        memory/4296-251-0x00000261FE850000-0x00000261FE872000-memory.dmp
        Download

        memory/4296-136-0x00000261FC1A0000-0x00000261FC1B0000-memory.dmp
        Download