734ae9fc9b49669f95028384ccda7e3fa6d0105636b5ce54e4540c7871d1cbe7

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 24.9MB
Sample260818-c692wsfa54
SHA256 734ae9fc9b49669f95028384ccda7e3fa6d0105636b5ce54e4540c7871d1cbe7
MD5 f0e5d71820c31c3c86ebbdf5f4a9253d
SHA1 e0370dc1dd150fc307c451198a6fda223f7c78ef
SHA512 7944b0ff326afeae6806031875fa475f40499d46c18e1e363bd4c99ba6085ffbe7ba4ee09ffaf0f03529b5f1f9be4f9cb17e8b4abe8aa10fbef5bf86a3f77157
SSDEEP 393216:OAyJ9yDUk4Qs6tL9eHZPnDenXlAyzajFSfvUr5ue7:OAyJgAk4QveHRinpzajFkvUr5uW
TLSH
T191473328BADB4097D0E6223E1CA3E559D9F07C525760D2DB0360B7A63E2B4D89D3D378
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe
3464	powershell.exe
4576	powershell.exe
5580	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4576	powershell.exe
3408	cmd.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2080	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3408	cmd.exe

Loads dropped DLL 32 IoCs

pid	Process
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
3408	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
1	api.ipify.org

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c53e-142.dat	upx
behavioral2/memory/6124-145-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e5-151.dat	upx
behavioral2/files/0x000c00000001c537-153.dat	upx
behavioral2/memory/6124-156-0x00007FFEB0550000-0x00007FFEB055F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e3-157.dat	upx
behavioral2/memory/6124-160-0x00007FFEAF290000-0x00007FFEAF2AA000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e9-161.dat	upx
behavioral2/files/0x000c00000001c4f2-162.dat	upx
behavioral2/memory/6124-165-0x00007FFEAE350000-0x00007FFEAE3D0000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ed-167.dat	upx
behavioral2/files/0x000d00000001c4e8-177.dat	upx
behavioral2/memory/6124-180-0x00007FFEAE330000-0x00007FFEAE344000-memory.dmp	upx
behavioral2/files/0x000c00000001c536-181.dat	upx
behavioral2/memory/6124-182-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp	upx
behavioral2/memory/6124-183-0x00007FFE9EA00000-0x00007FFE9F031000-memory.dmp	upx
behavioral2/files/0x000c00000001c4ef-184.dat	upx
behavioral2/memory/6124-187-0x00007FFEAF2B0000-0x00007FFEAF2D9000-memory.dmp	upx
behavioral2/memory/6124-188-0x00007FFEA8E10000-0x00007FFEA8E45000-memory.dmp	upx
behavioral2/memory/6124-190-0x00007FFEA2150000-0x00007FFEA22A3000-memory.dmp	upx
behavioral2/files/0x000c00000001c538-189.dat	upx
behavioral2/memory/6124-175-0x00007FFEAFC10000-0x00007FFEAFC1F000-memory.dmp	upx
behavioral2/files/0x000c00000001c4f1-173.dat	upx
behavioral2/memory/6124-172-0x00007FFEAFD00000-0x00007FFEAFD0D000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ec-170.dat	upx
behavioral2/memory/6124-168-0x00007FFEAF240000-0x00007FFEAF25A000-memory.dmp	upx
behavioral2/memory/6124-163-0x00007FFEAF260000-0x00007FFEAF28C000-memory.dmp	upx
behavioral2/memory/6124-154-0x00007FFEAF2B0000-0x00007FFEAF2D9000-memory.dmp	upx
behavioral2/files/0x000c00000001c4ee-192.dat	upx
behavioral2/files/0x000c00000001c551-194.dat	upx
behavioral2/memory/6124-195-0x00007FFEA8D80000-0x00007FFEA8DA6000-memory.dmp	upx
behavioral2/memory/6124-198-0x00007FFE9D590000-0x00007FFE9D71A000-memory.dmp	upx
behavioral2/files/0x000c00000001c53a-199.dat	upx
behavioral2/memory/6124-201-0x00007FFEA83D0000-0x00007FFEA83EB000-memory.dmp	upx
behavioral2/memory/6124-197-0x00007FFEAE350000-0x00007FFEAE3D0000-memory.dmp	upx
behavioral2/files/0x000c00000001c541-203.dat	upx
behavioral2/memory/6124-204-0x00007FFEAECB0000-0x00007FFEAECBD000-memory.dmp	upx
behavioral2/files/0x000c00000001c521-205.dat	upx
behavioral2/memory/6124-209-0x00007FFE9D2D0000-0x00007FFE9D587000-memory.dmp	upx
behavioral2/memory/6124-208-0x00007FFEAFC10000-0x00007FFEAFC1F000-memory.dmp	upx
behavioral2/files/0x000c00000001c522-207.dat	upx
behavioral2/memory/6124-212-0x00007FFEA8330000-0x00007FFEA836A000-memory.dmp	upx
behavioral2/files/0x000c00000001c553-213.dat	upx
behavioral2/memory/6124-211-0x00007FFEAE330000-0x00007FFEAE344000-memory.dmp	upx
behavioral2/memory/6124-215-0x00007FFE9EA00000-0x00007FFE9F031000-memory.dmp	upx
behavioral2/memory/6124-216-0x00007FFE9E880000-0x00007FFE9E93E000-memory.dmp	upx
behavioral2/memory/6124-221-0x00007FFEAD0A0000-0x00007FFEAD0AB000-memory.dmp	upx
behavioral2/memory/6124-224-0x00007FFEA6210000-0x00007FFEA6222000-memory.dmp	upx
behavioral2/files/0x000d00000001c4a4-223.dat	upx
behavioral2/memory/6124-227-0x00007FFEAB6E0000-0x00007FFEAB6EC000-memory.dmp	upx
behavioral2/memory/6124-229-0x00007FFEA8D80000-0x00007FFEA8DA6000-memory.dmp	upx
behavioral2/memory/6124-230-0x00007FFE9D040000-0x00007FFE9D2CC000-memory.dmp	upx
behavioral2/files/0x000d00000001c4db-228.dat	upx
behavioral2/memory/6124-237-0x00007FFEA49C0000-0x00007FFEA49EA000-memory.dmp	upx
behavioral2/memory/6124-239-0x00007FFEA3FF0000-0x00007FFEA401F000-memory.dmp	upx
behavioral2/memory/6124-238-0x00007FFEA83D0000-0x00007FFEA83EB000-memory.dmp	upx
behavioral2/memory/6124-236-0x00007FFE9D590000-0x00007FFE9D71A000-memory.dmp	upx
behavioral2/files/0x000c00000001c540-235.dat	upx
behavioral2/files/0x000c00000001c555-234.dat	upx
behavioral2/files/0x000d00000001c4a3-222.dat	upx
behavioral2/memory/6124-220-0x00007FFEA8E10000-0x00007FFEA8E45000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d7-218.dat	upx
behavioral2/memory/6124-261-0x00007FFE9D2D0000-0x00007FFE9D587000-memory.dmp	upx
behavioral2/memory/6124-288-0x00007FFEA49C0000-0x00007FFEA49EA000-memory.dmp	upx

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4360	cmd.exe
796	cmd.exe
404	cmd.exe
2940	cmd.exe
2508	cmd.exe
4256	cmd.exe
1716	cmd.exe
5844	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4360	cmd.exe
5308	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
248	WMIC.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4576	powershell.exe
4576	powershell.exe
3464	powershell.exe
3464	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2856	WMIC.exe
2856	WMIC.exe
2856	WMIC.exe
2856	WMIC.exe
3360	wmic.exe
3360	wmic.exe
3360	wmic.exe
3360	wmic.exe
248	WMIC.exe
248	WMIC.exe
248	WMIC.exe
248	WMIC.exe
2676	WMIC.exe
2676	WMIC.exe
2676	WMIC.exe
2676	WMIC.exe
8	WMIC.exe
8	WMIC.exe
8	WMIC.exe
8	WMIC.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3316	WMIC.exe
3316	WMIC.exe
3316	WMIC.exe
3316	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe
Token: 34	4576	powershell.exe
Token: 35	4576	powershell.exe
Token: 36	4576	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeIncreaseQuotaPrivilege	3464	powershell.exe
Token: SeSecurityPrivilege	3464	powershell.exe
Token: SeTakeOwnershipPrivilege	3464	powershell.exe
Token: SeLoadDriverPrivilege	3464	powershell.exe
Token: SeSystemProfilePrivilege	3464	powershell.exe
Token: SeSystemtimePrivilege	3464	powershell.exe
Token: SeProfSingleProcessPrivilege	3464	powershell.exe
Token: SeIncBasePriorityPrivilege	3464	powershell.exe
Token: SeCreatePagefilePrivilege	3464	powershell.exe
Token: SeBackupPrivilege	3464	powershell.exe
Token: SeRestorePrivilege	3464	powershell.exe
Token: SeShutdownPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeSystemEnvironmentPrivilege	3464	powershell.exe
Token: SeRemoteShutdownPrivilege	3464	powershell.exe
Token: SeUndockPrivilege	3464	powershell.exe
Token: SeManageVolumePrivilege	3464	powershell.exe
Token: 33	3464	powershell.exe
Token: 34	3464	powershell.exe
Token: 35	3464	powershell.exe
Token: 36	3464	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe
Token: SeManageVolumePrivilege	2368	powershell.exe
Token: 33	2368	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 6124	4512	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 6124 wrote to memory of 3408	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 3408 wrote to memory of 4576	3408	cmd.exe	93
PID 3408 wrote to memory of 3464	3408	cmd.exe	95
PID 3408 wrote to memory of 2368	3408	cmd.exe	96
PID 3408 wrote to memory of 5580	3408	cmd.exe	97
PID 6124 wrote to memory of 5844	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 5844 wrote to memory of 2080	5844	cmd.exe	100
PID 6124 wrote to memory of 4360	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 4360 wrote to memory of 5308	4360	cmd.exe	103
PID 6124 wrote to memory of 796	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 796 wrote to memory of 2856	796	cmd.exe	106
PID 6124 wrote to memory of 3360	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 6124 wrote to memory of 404	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 404 wrote to memory of 248	404	cmd.exe	111
PID 6124 wrote to memory of 2940	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 2940 wrote to memory of 2676	2940	cmd.exe	114
PID 6124 wrote to memory of 2508	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 2508 wrote to memory of 8	2508	cmd.exe	117
PID 6124 wrote to memory of 4256	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 4256 wrote to memory of 4984	4256	cmd.exe	120
PID 6124 wrote to memory of 1716	6124	2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 1716 wrote to memory of 3316	1716	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_f0e5d71820c31c3c86ebbdf5f4a9253d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2856
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmdkey /list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\W9iCIHOMjKWy\screenshot.png
Size 391KB
SHA256 67ccb5a62b5a4e83b07504d79f86b7e6653a26a7697f19d1e4e6ac3160704c89
MD5 8d5be28edffa2ff75455cd802e7129f3
SHA1 83c1e8b5732423501e5cfc1453698c617f83ff51
SHA512 9959294dddae7af40f4e704b3c9b14ed0f27db191da976641160dd707c566802b12eb6dbe2a02cfd2ad4c01b2d0a12bc782b5127ab5d2671b7d8c4ae2a0da564
SSDEEP 12288:VugDpwoqWd/pQ4CigzAin9RDTyShaiWstOym:VvWoXpLCXzAS9YTRFym
TLSH
T1DC841294047ECBC8CFEF84484319A4607F3665077A8B2B362978A50FCD9543DAC59EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\Cryptodome\Cipher\_raw_aes.pyd
Size 17KB
SHA256 7aec0c745c121c11100e6eeea711b06f3e83e7d503feac39dbaf67271fbac573
MD5 9c461b70894c43c9ddb326335169bdcf
SHA1 2b55b98ea4013f95991521a70eda57c77c0561f0
SHA512 550961f0e9a2c50073e02164b60a669a676f9b16e4a0d45076a6470b34ba57f0efee44f9158b20b5eb4097dfd84e56633f76dbcd3c71dd46b462ec1687318e4d
SSDEEP 384:hLKO4ybrS6X6d0Gtbdc/4xOxmOq4JAQnpvnOIh+s4uZa7gJX8CS:hL/tKvcg4IOqkAMpvxxpMCS
TLSH
T19272AFF5A2BEC8FCC9B560320CA299A9F3217B6B6413031F05D135BE5EB3D541F22A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\Cryptodome\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 ea4d8857bc2c9ec4c9b204629712bcc94ef2f7eb02c3d1db02938e3cc14dc614
MD5 0574e79dea06304e2f13a35df51e9211
SHA1 2adf9945ef2b61ae8c0f3ea512495805e838f368
SHA512 a5fecaf9d74c2bc1ed73f07a8ee418fa9aee5222e6a206e320c0ec089d242c66095c278f7943486bcf905c224724399f510c237aba39fb233f7f1f2ec440a4ab
SSDEEP 192:owXipdrvzmhp8BShP1nmQ2Ia+hyKnhSqwT4RRL4haQDkYj273QJXlEnLU:oGiLl0hP/vLys0q+4gRDZa7gJXW
TLSH
T19C329ED78219E6FCC4B574B718975A94FB323436122A9B2F08CA37BF9CB6A143420774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\Cryptodome\Util\_cpuid_c.pyd
Size 9KB
SHA256 f12f3e99508e424c53089eb3345d3a31eb1a3e75f5df0a0902b3a6fa77b35821
MD5 1ca5fd66f62ec66651b529e921bef5b7
SHA1 d4190528691e89d24dfe39d25b6a85062390f6e0
SHA512 0b20421934ab5de0f27aa9639427070506fecfb58a3502672bcdb4c97fbf30a51b4f75b1b2c9f304480b978bc21597f100a076e631f7e9b4adaa737e647b6c6e
SSDEEP 192:dkaQHLyJVf5DoE+uJL72iD5UR9rGHc/NhkYj273QJXpHzI:qNoVf9L7DD569q81hZa7gJXZI
TLSH
T1B8124CB7937EF2FCC53A54B60D4B4898FA65F83BD112131F01E432FA4CA67526D21661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\PIL\_imaging.cp314-win_amd64.pyd
Size 794KB
SHA256 85299eb42a8d8b38ac8d045226e5a5f1d0396555e8f3dacdf45d94ad51429880
MD5 10cf4a0eca94f16ce5246c7c42556783
SHA1 f6bdd097b6073e9b90e7af82bdf029e3c9dacea0
SHA512 140593e6792a644e5911e1e06515c7ec4e60afe14981523e004b704524855a31bb0ec9fd2bcd32b503b2f18f8b90de14d42247d98fa22b8ea80f8ee4d7ec3058
SSDEEP 24576:VYxBHt37h0INYkxJAMhBYiB/Ez8o2q+b:V037hMkrhhuW60
TLSH
T19C052339AB3E5D16D03675BF1407E6196CB27C943220832C5E94C44AAF19A8FBF35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_bz2.pyd
Size 51KB
SHA256 f3b6866898dcc0edeb3bad6b935974f059cd2a9254603d1f766d892cb3bdb457
MD5 3ffba544fb6b6e9cd661e089101edf6c
SHA1 69650c3a744b47dbbe272daef561ef201298abc4
SHA512 1713a27861e56f258e0beff4651a0bfe05623f2175bb40204680d612c1686938dc7aa3676da9511a2685f37f1bbab7d0f427050c528247dec1d0e93be6a046ae
SSDEEP 1536:+grRnv1oCAhFJdAFJm0OnIp3V17yPs5i9EfIY+8i:HV+C/mhIp3V14V
TLSH
T18A33D0CB0AB48096D7635DB261B0E943FA35ABD3A410979630DD724E0E6B7D1A313369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_ctypes.pyd
Size 67KB
SHA256 f5c39d33d5e626f790e55846021017e8cb06a78315a9b0dcaec96875ea583bdc
MD5 dccfd9009cf8cdd62a2a2d0741a88a79
SHA1 112096a0a02b26c4ad57f47e028176c110815e99
SHA512 725762277f9cd4003f4bea6f6a19c3e51a9dd9f4d79c404e86423b1e02b67d281ba6b5d7e83b4d38d5db572571d845fe3c01a9420f28c112984275caeb24e700
SSDEEP 1536:IGsidR9UsG6C+QTu1a4Q+3JnzwjGBPLjyIpGPiWyPs5i90fIYHD:I/IPG6/85+Z8jGtLuIpGPi1S
TLSH
T1F063E0CE427D9191F7531630B2F4DC93FE385BD364621B6E30E991AA09AB3C2A707265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_hashlib.pyd
Size 38KB
SHA256 26d9d20a3c7bbc62b2a430e4df19bd83335b17cda45da4adcac6bc3e00c731f5
MD5 05c0cd12d66b1f2a14beb8a9a5eb4cdb
SHA1 e092c523de83ce281a410b89f9c421bbb66b1409
SHA512 7a4873d1b0d04bdd648a870411b2dc0ca1b1f667e895d097aab355039af95c64630a30639f4b56de79107c4e59a7fe802ed5d2a24dff758637852a7ea4b92245
SSDEEP 768:OFzCaLH2eWtTkvVE9k6p2vZ+5EApaBIpDIAOyPsSvPuBL2Ip4NTxf1ml9dHH7LM:0CHPp2vMuBIpDIAOyPs5i9nfIbHHnM
TLSH
T12C03AFC64638D012FBA3A9B172E0DDC2FE34A7A3545257BB30E9A2D51E633C0D727265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_lzma.pyd
Size 88KB
SHA256 4341f36a310038d57a789dc16ef7323c9016ed24c954d05f07b1a69ae3aed70d
MD5 e3f9d2a7cde2bfdb0d8fb2c578b6eac7
SHA1 7ed8f1465964d5f8c65949fe9851d2af9b702a99
SHA512 764a0721caea76977b5ade2b6b36fbaf5dbacc6049dfdb53f6135a8ffe169d31a66645bbf5b1b88def2551dd19ffa36112a8dfbcd83f29b001204c19d2bc372a
SSDEEP 1536:NbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTpC3dIpI1ihyPs5i9OQfIY29:IORuGFt/HkG/G4J3b4GwTpCtIpI1iLx1
TLSH
T1FA9302DBC7F88063FE636D3071F5CA82793557EB622687A314DE71520E223C5A3A3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_queue.pyd
Size 28KB
SHA256 94c97f4d6e22c1de3c3f2fde590eed1b9a8968e0d094a5d68676ba48a7de6194
MD5 e515e43892aeadebb9520e1fddf8eed8
SHA1 9423659a1720aabdf10bae04ac427b355c990748
SHA512 e93127fd331f947960da280ba3de3b6994d3abcecfa692771a110a3bccec8e11ae3945eafd8aaf70ae4367aa1e647a149abb3c9a1b04ea8bfbe45b1f54a72d2d
SSDEEP 768:b2YI3si/fuHLEHTtpCPIpRUA3yPsSvPuBL2Ip4uTxf1mlRaXN61k:bpH/PIpRUA3yPs5i9ufIYNh
TLSH
T170D29ED64678C026FA32AE7162F4DD83FA357BD36810876730EDA1AA0E633D1D317265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_socket.pyd
Size 46KB
SHA256 b289c0795f859042c5d9c285d1344f294e1948c7974fe6cab4fbfef8f3dff483
MD5 a492b1eb2e3e773e2878ac0583106c71
SHA1 faaff400d02fa3d453a30fd9eb04b282efe49071
SHA512 04d17591a2ffad2acd806cf02584eb9fa666813e3a4ab6e25028f0c4c353c5284acb64faf30f210fd84054337e029d1dcbcc09d41a144ec595b655af7c7ec332
SSDEEP 768:WlRvR/zcKTGGtU7gujesZiZJx2u/Y6dlwWIefwptq2IpGw1YtnyPsSvPuBL2Ip4Y:uvRYKTGooe4ifT/hdlw+fqq2IpGw1Anh
TLSH
T1B823BFE70268E056EAB39F7262A4D9C3F6B87FA310565727309DA1960E733C19B05329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_sqlite3.pyd
Size 61KB
SHA256 02cf182b7192f87087ee2db0fc9afe248261de0946888c451dcc5467c4bb323a
MD5 8b893dd490ba82830f03ab4ef0af1258
SHA1 eb850744d511a9ca9280aba793dced488d0bf7f8
SHA512 4614b3cd890869f4b79359b5711ca89ab48384b325cdf350bbdbc9217bacbb6a2143ac5f0a1f27a4ad84a14af07608df3417758647a6fe1c43041eaa6a80ac33
SSDEEP 1536:BBtb9E25fsDSAIL3fY1zQceb4xwcD9Ja/jZIpDQlWyPs5i9NbfIkFy:ntb9fsDxCfY1Bo4RD98lIpDQlV8P
TLSH
T14053E1C6837890A6E6B69D7190E4D956FD3627F39034867328F674A10EE73839702238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_ssl.pyd
Size 69KB
SHA256 a8c98340192d0b7c7361796a8368facff0fe0fdca29404fe9505371ca1c47707
MD5 9af9842fc0f7dc0a968b2922fa35ec11
SHA1 329c112d4f5a13f38b4386b516ea38e8aed8d3b8
SHA512 7bda8da7bce8959afbf8ac6259f1d8d31367fd31c3f030981a5e92c981d682212a109497f99a0dde0733c6e3384c9be6cb0aead4f3a7975a5e2f03468ab47d84
SSDEEP 1536:k0REJRkC9CxzEXZHwdBxHGrWY/groNukG7vIp37S03yPs5i9wfILFq:52J2gCxzEpqBtGrWY/grIVG7Ip37S1c
TLSH
T11063E0DB8938A026FE716A3191E4CC43B971E2D3A449872F34D9B3E616133D0E757768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_uuid.pyd
Size 27KB
SHA256 fbfd7fe8583b346ba20b174b2510c0830237f5092bdf9fc26da9d6b25b018385
MD5 0dd6191e9e0ba13adcd0cbb43acd54ba
SHA1 b15512cb9ae680a0f45d0c630ca03292fe65548a
SHA512 4e3f7d428ff6b760752da5c216249b9bac42ea9e87712e2944176c4e00c04e866f88a99618ba8a3cd856935b16a655a8d4afe19c7396001c68a6c2a3046872a9
SSDEEP 768:1615cUIpIwgyPsSvPuBL2Ip4BwTxf1mlRaXV6K/:1615cUIpIwgyPs5i9GfIYVz
TLSH
T1BDD26D8A9A748043FE5397B0D1B2DE43FA39BBD3191187AB316991850E533C1E31B39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_wmi.pyd
Size 30KB
SHA256 06de81ad9c4742f2a63a33bb72f0d5d6950fffe560026d91f12b4e57d246a63c
MD5 1ff3b8a4df57d0437c686241311647d1
SHA1 1ef0b37393364908f522635258dc1085a3923fbe
SHA512 c1d9cd36ea74bb1ebf03c85f4352143d08f07c5b231bfec0c18692a9b5c9810140f838bd496c161022dba7d622d33e8f1d2b803dff6f1270feaba3625d11998b
SSDEEP 768:/+So74TudMdaHYbpLTdIp3igVyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:GSoUfcYdTdIp3igVyPs5i9FfIYEq
TLSH
T19EE29ED7453C812AEA73DE7192E8DCC7FA3877E710154B6A349992E50E273D1E303269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_zstd.pyd
Size 176KB
SHA256 63953c318a82fe08b727794e6ab2d9e8833f2dd109f6aa65ee4e82c019904b1f
MD5 b403bd203d477f21594c6920c1be7c55
SHA1 03c3687d4c64158b572d6d84d2cb30f62a79e900
SHA512 68d3b68a8dae9c7052993afbbc8c457a783c4a601644019a818b12273a1e1a30a4db9f4be3f974dbdfe270b4e79cadc8efd988246361a9415e5c56b393bf41dd
SSDEEP 3072:M9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpBcU97IpIMz9TH:gqtPIR0vx+m/n4q6Z7rcUOtH
TLSH
T1A40412D41068102DF5C3B9B23598DACF6AB883D7644C5FB770B8B2920A73B91AF52374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\base_library.zip
Size 1.3MB
SHA256 fb190a5f015abbf63c6688ff5b946de8271cb1a4b8205c4fd328bba0ef711cfa
MD5 e5db81c48e3f26154565736ddaf52fb5
SHA1 1eba07069a69e749aaab9d14fdbecdab163c48d0
SHA512 bdc02267580070fb4bf76f831dde55c79f8ae24e50cacdc15965d47d158676dcbf9da8d5a017c828af2d1efb8babd901c592b924d6afc36c7d1b3740c171dbf7
SSDEEP 24576:qdJ4D7iQeOdP2m2dfBYvDZmRZML4OlbuuUFe:qd7/5YvYRduUFe
TLSH
T1A9552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\charset_normalizer\cd.cp314-win_amd64.pyd
Size 52KB
SHA256 e453484cfe995a276a2342c231fcdbed75da95d8c86270ac1f3fd6509014627e
MD5 13140e6b848d46ce6a9ef67512df6adc
SHA1 76a9c5e099554c032ff81f8adf386c2c821ddc8d
SHA512 fd690cf7f2a1d239652c436c519cf214e4989a41cb8dffe43d37dccc377a33b943279ecf5d1527ba682838539b4c96c0f87e9b0360b1c59317aacb9e935f3305
SSDEEP 768:JgsSFFVAizO5oZMRQK+6e7y5hmka1hFcnZg0NZttxqFApAEiBJnjli4e8pG:JSCGpZMz+F7k0hFEZKApAEiBJnZdo
TLSH
T19033F1870979A1B8CD11E0F72AE1508FFE153659612B2B1F10F0177B9FEFA957C212A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\charset_normalizer\md.cp314-win_amd64.pyd
Size 61KB
SHA256 95b12eb1764132a556cb225ae617e1747fbccbcf06cdc67f127f70126b41ca07
MD5 8a9ffdfd59033f9ad2bfc2f217bde202
SHA1 55a7fd34fe0ffa22ccbb3ac31d6ecab0ae8e35ed
SHA512 3c22d7134dbd78d55f7a75356eccc7b29ee3a316dbd0cb19af53ebb068f1e861b8e34f48b02316c3b14d20ad1c70e7b7637b47dc433502ef01b1b498e88c4272
SSDEEP 1536:gV4eB1+jZ9wJhohpK0B3ycj8G+ayEFHEb3TKs:gVNB1sAOpK0BPjeg9q
TLSH
T1AA53011C955FB974EC1ADD33A66719859928B871F1A23B2F56A42A8FCC3F1D02B130C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\psutil\_psutil_windows.pyd
Size 32KB
SHA256 41d9772a6fe770665846185b083fd2591871e9af74b42150fb398f273dd03e01
MD5 e30320b55ca789d45ddae48bba1834f3
SHA1 588ca3c8053dc6771ac0eda7bf228ec2d4a3bddc
SHA512 eba3609f39a58cbcc443ddabfe3c62bdcc10517815a0174235d4a826fd099507d712f1b0658d1dc3bebd6a717bc69af8f96bc23b7b740bcfd1f5c1228ad1233b
SSDEEP 768:6YU5FhhiJBW2uvTwJ+874UVXaEAZz/ESjhsfojUpH:6YqhhiJVuvsjVpXAdco8
TLSH
T152E2F2C3E227B774CEAB7C331A5712685B89F0372698571B047990377D23AB6BC20852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\python3.DLL
Size 72KB
SHA256 6c45910e7c82617ca6360820de861699cc99f9efee434df290aa4c6e38f39886
MD5 2de7979a521cf55306e48163bfd527bd
SHA1 e36a5745ec9b1487833a1dead2940a9fdab29a4e
SHA512 6df1dccae7abc906116aa3889e18058db6358c9a7c32ebd493b0dd0a9241eeaba2be71542a1c14a5d3da22d0b9e9c1a0bb9c5a586efc878cb1190b3b4d8148cb
SSDEEP 768:vQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIL:+bTrnXngXMRAIpG0pyPs5i9rfIYc3
TLSH
T11D735E5E6B54F8A2D6B669FC78D199CE242B12FC4F2984DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\python314.dll
Size 1.9MB
SHA256 d67ddac422054665259870831fb21b7554ce28342a7182577fd023195c18f3c9
MD5 5b667154f2add7209588a8967b2601bf
SHA1 30bb40a8003492efdf23af64ca9d05b8a0d1ed51
SHA512 a8eca388863e5004aee3e2a7b9fb75954dceca19f3275ef0ca29647ec7f3780c0a2bc4387ac684df0b53f8df8e7afc02a50fa682a19db7590310daeca9269c99
SSDEEP 49152:2MCmLUyTYfI5G88b/os3YgFFHbW+t83Nk/++PUlDYOK7:7XUI5PgD96+t8y+Lnk
TLSH
T1E9953370742A91FFC3D3B47A0BE1F95792BF2210A1AB65A4A670D1D7064A6099F3F70C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\pywin32_system32\pywintypes314.dll
Size 62KB
SHA256 7eaea406ac0275d5316a15d2d3d0bdab7ec29720edb07d138bb9cf35d3e5cb92
MD5 94df432865f95a0acd2cd4d568dfe555
SHA1 4fa318b857d859b7cda10183a5bce56b4b3b0de8
SHA512 4d7d45fc7b4cddcce3ed2d595052952cf13f44dfd6c5d217229c2e9e1c332a98e0a5d9b6f51731c2f448400e18cc2dde1993e2bd18d74e3a510bc952dd63c812
SSDEEP 1536:v8xX6ROKyJO+4n6rvZUdPTzIa5Xow84q:WX6ArRO6DZUdPTsaNor4
TLSH
T144536C427D97CDEFCA1BE3332C99141494D39265470AEBE1D9D7C0A3E4FA3926C2A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\select.pyd
Size 28KB
SHA256 c9923469e700f95f4d314912c7490f5192ede75bebd1a617dbea6e203a6f7c65
MD5 86e5aad70b4452da69e0cf37dacc6df1
SHA1 263b900191b87071feec0659a6a4429eaaeed9bd
SHA512 62a36c3b01f333f17bbf166745b630e0fa84ac978ad4a14854f5ed649dd7497b2d36da38dd05106ab84c9c2e757e1e753e64255611bb492a7a98e38c6a94dc19
SSDEEP 768:igmk8qSPSNp9TDIpRGALyPsSvPuBL2Ip4j5Txf1mlRaX16m:iWN1TDIpRGALyPs5i9jLfIY1N
TLSH
T1A8D29ED74678C05BFE62997162E0DDC3FD347BE36408876B30A9B2960EA73C19716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\sqlite3.dll
Size 663KB
SHA256 831b76218cbc41214a7b5e7b57811d6ad6a566dad9e196498e45b5c10aa221d7
MD5 a956fdd30e7115cabcc8e299321a416e
SHA1 67016eabd36015824ec87e1fad35a7db488448c0
SHA512 0da235d1b5ec20cd79d966b251102b06d87cc82c8fe18a42e6bedb6c822281bfb341cc7c9015e9d3fbaebfb7063c059d02b73c48d9c53d6cab646b47ee5f08de
SSDEEP 12288:wk+lfQj6CGecriX5Ozz2bI1uekpl5bx1+AHSktSSLF/l3/h2RAXq/A:w1ojbGec2X5Ozn1u335SAHSktv9QGXqY
TLSH
T144E423E6593BD005F9F2A871D0D2E5C2E930621FDCF809EBA4C8E6563CEE662F611135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\unicodedata.pyd
Size 277KB
SHA256 80b2858ad498d4760a96d3f54c134eac7d66b973075ff6b0d996da873414370a
MD5 9feb15b7026a25fd381147b11b162587
SHA1 146d3dbb82b16284fcdc80004963983b9654404f
SHA512 5baad3e1e2a890826e44bc6407fa954a55b81d81fcc9af458977323e2812975919262a015cd3eb69d12b07eac99f998cbab91fa585f928dca8343515bff62ffe
SSDEEP 6144:YKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKtvQS:JO74tNsT3reDqtzNx9KiMvXgKxQS
TLSH
T1985423EDA68CD2A2FFB3BA7392C1C102AB3575E36854432760D8546A6CB7347C35B358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\win32\win32crypt.pyd
Size 52KB
SHA256 fd5e21f77f27fb20f7461f9efe331a995132f69c4716461d8575030bd9f8576e
MD5 f887fb52ad58bf2999c049f3995fe343
SHA1 0bb56d6e27addb9750979706e1fe75fd9cf92d7f
SHA512 458e93fff0715fb4243fab118c55143c5854d50c8106bdab4e64752550c40a4489c9ce73793f9eacf3787982616009c4e28e85e9f512b20ad5c87d2ac7da58ca
SSDEEP 768:kLlYds12tD3GtWTKHs5FxSJ4ZJWh3OmAuDo5cn1i+qEyxAxvRpBVPa/W9rM+EiHH:tk2tD3EyKHS0iZ2/oO6NO9Za/
TLSH
T1DB33BF00360B5DAFDCE7F3738C805419E0D2A95A972A6FA25843D1FA34F91E14C6D2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wltvfrhy.w5s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wltvfrhy.w5s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3464-295-0x000001C8DE150000-0x000001C8DE202000-memory.dmp

Download

memory/4576-249-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-241-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-247-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-260-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-245-0x0000020454EB0000-0x0000020454ED2000-memory.dmp

Download

memory/4576-259-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-263-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-248-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-242-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-246-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-255-0x0000020455000000-0x000002045500A000-memory.dmp

Download

memory/4576-250-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-258-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-254-0x0000020454F40000-0x0000020454FF2000-memory.dmp

Download

memory/4576-257-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/4576-240-0x00007FFE9C81F000-0x00007FFE9C820000-memory.dmp

Download

memory/4576-253-0x0000020454F20000-0x0000020454F3E000-memory.dmp

Download

memory/4576-256-0x00007FFE9C690000-0x00007FFE9D034000-memory.dmp

Download

memory/6124-238-0x00007FFEA83D0000-0x00007FFEA83EB000-memory.dmp

Download

memory/6124-264-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp

Download

memory/6124-229-0x00007FFEA8D80000-0x00007FFEA8DA6000-memory.dmp

Download

memory/6124-230-0x00007FFE9D040000-0x00007FFE9D2CC000-memory.dmp

Download

memory/6124-224-0x00007FFEA6210000-0x00007FFEA6222000-memory.dmp

Download

memory/6124-221-0x00007FFEAD0A0000-0x00007FFEAD0AB000-memory.dmp

Download

memory/6124-237-0x00007FFEA49C0000-0x00007FFEA49EA000-memory.dmp

Download

memory/6124-239-0x00007FFEA3FF0000-0x00007FFEA401F000-memory.dmp

Download

memory/6124-216-0x00007FFE9E880000-0x00007FFE9E93E000-memory.dmp

Download

memory/6124-215-0x00007FFE9EA00000-0x00007FFE9F031000-memory.dmp

Download

memory/6124-236-0x00007FFE9D590000-0x00007FFE9D71A000-memory.dmp

Download

memory/6124-211-0x00007FFEAE330000-0x00007FFEAE344000-memory.dmp

Download

memory/6124-212-0x00007FFEA8330000-0x00007FFEA836A000-memory.dmp

Download

memory/6124-208-0x00007FFEAFC10000-0x00007FFEAFC1F000-memory.dmp

Download

memory/6124-209-0x00007FFE9D2D0000-0x00007FFE9D587000-memory.dmp

Download

memory/6124-204-0x00007FFEAECB0000-0x00007FFEAECBD000-memory.dmp

Download

memory/6124-220-0x00007FFEA8E10000-0x00007FFEA8E45000-memory.dmp

Download

memory/6124-197-0x00007FFEAE350000-0x00007FFEAE3D0000-memory.dmp

Download

memory/6124-201-0x00007FFEA83D0000-0x00007FFEA83EB000-memory.dmp

Download

memory/6124-198-0x00007FFE9D590000-0x00007FFE9D71A000-memory.dmp

Download

memory/6124-195-0x00007FFEA8D80000-0x00007FFEA8DA6000-memory.dmp

Download

memory/6124-154-0x00007FFEAF2B0000-0x00007FFEAF2D9000-memory.dmp

Download

memory/6124-163-0x00007FFEAF260000-0x00007FFEAF28C000-memory.dmp

Download

memory/6124-168-0x00007FFEAF240000-0x00007FFEAF25A000-memory.dmp

Download

memory/6124-172-0x00007FFEAFD00000-0x00007FFEAFD0D000-memory.dmp

Download

memory/6124-175-0x00007FFEAFC10000-0x00007FFEAFC1F000-memory.dmp

Download

memory/6124-190-0x00007FFEA2150000-0x00007FFEA22A3000-memory.dmp

Download

memory/6124-188-0x00007FFEA8E10000-0x00007FFEA8E45000-memory.dmp

Download

memory/6124-187-0x00007FFEAF2B0000-0x00007FFEAF2D9000-memory.dmp

Download

memory/6124-183-0x00007FFE9EA00000-0x00007FFE9F031000-memory.dmp

Download

memory/6124-182-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp

Download

memory/6124-261-0x00007FFE9D2D0000-0x00007FFE9D587000-memory.dmp

Download

memory/6124-180-0x00007FFEAE330000-0x00007FFEAE344000-memory.dmp

Download

memory/6124-165-0x00007FFEAE350000-0x00007FFEAE3D0000-memory.dmp

Download

memory/6124-288-0x00007FFEA49C0000-0x00007FFEA49EA000-memory.dmp

Download

memory/6124-290-0x00007FFEA8330000-0x00007FFEA836A000-memory.dmp

Download

memory/6124-283-0x00007FFE9E880000-0x00007FFE9E93E000-memory.dmp

Download

memory/6124-227-0x00007FFEAB6E0000-0x00007FFEAB6EC000-memory.dmp

Download

memory/6124-289-0x00007FFEA3FF0000-0x00007FFEA401F000-memory.dmp

Download

memory/6124-287-0x00007FFE9D040000-0x00007FFE9D2CC000-memory.dmp

Download

memory/6124-160-0x00007FFEAF290000-0x00007FFEAF2AA000-memory.dmp

Download

memory/6124-156-0x00007FFEB0550000-0x00007FFEB055F000-memory.dmp

Download

memory/6124-334-0x00007FFEA8E10000-0x00007FFEA8E45000-memory.dmp

Download

memory/6124-333-0x00007FFE9EA00000-0x00007FFE9F031000-memory.dmp

Download

memory/6124-337-0x00007FFE9D590000-0x00007FFE9D71A000-memory.dmp

Download

memory/6124-346-0x00007FFE9D040000-0x00007FFE9D2CC000-memory.dmp

Download

memory/6124-335-0x00007FFEA2150000-0x00007FFEA22A3000-memory.dmp

Download

memory/6124-323-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp

Download

memory/6124-145-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp

Download

memory/6124-358-0x00007FFE9F040000-0x00007FFE9F74F000-memory.dmp

Download

memory/6124-371-0x00007FFEA8D80000-0x00007FFEA8DA6000-memory.dmp

Download

memory/6124-379-0x00007FFEA6210000-0x00007FFEA6222000-memory.dmp

Download

memory/6124-383-0x00007FFEA3FF0000-0x00007FFEA401F000-memory.dmp

Download

memory/6124-381-0x00007FFE9D040000-0x00007FFE9D2CC000-memory.dmp

Download

memory/6124-382-0x00007FFEA49C0000-0x00007FFEA49EA000-memory.dmp

Download

memory/6124-380-0x00007FFEAB6E0000-0x00007FFEAB6EC000-memory.dmp

Download

memory/6124-375-0x00007FFE9D2D0000-0x00007FFE9D587000-memory.dmp

Download

memory/6124-372-0x00007FFE9D590000-0x00007FFE9D71A000-memory.dmp

Download

memory/6124-378-0x00007FFEAD0A0000-0x00007FFEAD0AB000-memory.dmp

Download

memory/6124-377-0x00007FFE9E880000-0x00007FFE9E93E000-memory.dmp

Download

memory/6124-376-0x00007FFEA8330000-0x00007FFEA836A000-memory.dmp

Download

memory/6124-374-0x00007FFEAECB0000-0x00007FFEAECBD000-memory.dmp

Download

memory/6124-373-0x00007FFEA83D0000-0x00007FFEA83EB000-memory.dmp

Download

memory/6124-370-0x00007FFEA2150000-0x00007FFEA22A3000-memory.dmp

Download

memory/6124-368-0x00007FFE9EA00000-0x00007FFE9F031000-memory.dmp

Download

memory/6124-369-0x00007FFEA8E10000-0x00007FFEA8E45000-memory.dmp

Download

memory/6124-367-0x00007FFEAE330000-0x00007FFEAE344000-memory.dmp

Download

memory/6124-366-0x00007FFEAFC10000-0x00007FFEAFC1F000-memory.dmp

Download

memory/6124-364-0x00007FFEAF240000-0x00007FFEAF25A000-memory.dmp

Download

memory/6124-363-0x00007FFEAE350000-0x00007FFEAE3D0000-memory.dmp

Download

memory/6124-361-0x00007FFEAF290000-0x00007FFEAF2AA000-memory.dmp

Download

memory/6124-360-0x00007FFEB0550000-0x00007FFEB055F000-memory.dmp

Download

memory/6124-359-0x00007FFEAF2B0000-0x00007FFEAF2D9000-memory.dmp

Download

memory/6124-365-0x00007FFEAFD00000-0x00007FFEAFD0D000-memory.dmp

Download

memory/6124-362-0x00007FFEAF260000-0x00007FFEAF28C000-memory.dmp

Download