Overview

overview

10

Static

static

3

2026-09-09...om.exe

windows10-2004-x64

10

2026-09-09...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 18.2MB
  • Sample260910-a7j6rack61
  • SHA256 9086d70a780317c45b9962504fa710cb69a582dbf5898d58d8aac044237255e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Videos\README_RANSOM.txt

Ransom Note
  • YOUR FILES HAVE BEEN ENCRYPTED All your important files are now locked with strong encryption. Shadow copies have been deleted. Recovery options have been disabled. To decrypt your files you need the private key. Contact the address below and follow instructions. This is an educational demonstration.

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 18 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 22 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2640
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im taskmgr.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4196
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2760
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im msconfig.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2112
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wireshark.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1808
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im fiddler.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4400
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im processhacker.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5032
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mbam.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4080
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im bdagent.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im avp.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4464
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im egui.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\SYSTEM32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4812
      • C:\Windows\System32\Wbem\wmic.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3980
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3336
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2072
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1664
  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-09_05d72e0af86690408bca51ada967adaa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2932
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im taskmgr.exe
        3⤵
        • Kills process with taskkill
        PID:556
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im procmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2612
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im procexp.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4024
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im msconfig.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3312
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im wireshark.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im fiddler.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4548
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im processhacker.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4744
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im mbam.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4088
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im bdagent.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1052
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im avp.exe
        3⤵
        • Kills process with taskkill
        PID:4544
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im egui.exe
        3⤵
        • Kills process with taskkill
        PID:1208
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5104
      • C:\Windows\System32\Wbem\wmic.exe
        wmic shadowcopy delete
        3⤵
          PID:3000
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled No
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4112
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3328

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Direct Volume Access

          1
          T1006

          Indicator Removal

          2
          T1070

          File Deletion

          2
          T1070.004

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Inhibit System Recovery

          3
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\markupsafe-3.0.3.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          _raw_aes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\Crypto\Cipher\_raw_aes.pyd
          • Size 34KB
          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cpuid_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\Crypto\Util\_cpuid_c.pyd
          • Size 10KB
          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\VCRUNTIME140.dll
          • Size 96KB
          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\VCRUNTIME140_1.dll
          • Size 37KB
          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_asyncio.pyd
          • Size 62KB
          • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_bz2.pyd
          • Size 81KB
          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_cffi_backend.cp311-win_amd64.pyd
          • Size 175KB
          • SHA256 0b5c05bf3e9da14c33566d2c546fb7618ac7fc2b89365a66cfb1082ffe3d898d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_ctypes.pyd
          • Size 120KB
          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_decimal.pyd
          • Size 245KB
          • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_hashlib.pyd
          • Size 62KB
          • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_lzma.pyd
          • Size 154KB
          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_multiprocessing.pyd
          • Size 32KB
          • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_overlapped.pyd
          • Size 48KB
          • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_queue.pyd
          • Size 30KB
          • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_socket.pyd
          • Size 76KB
          • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_sqlite3.pyd
          • Size 115KB
          • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\_ssl.pyd
          • Size 155KB
          • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\base_library.zip
          • Size 1.4MB
          • SHA256 5ddb6edc9c268ee5c7b9c7d7d067d4418cda19f6a83a7acaf811ee00b7757d0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _rust.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\cryptography\hazmat\bindings\_rust.pyd
          • Size 9.5MB
          • SHA256 05fefb14b1cb1c90bcccce87e82d205f5f2396977bf911243972790ba2376849
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\libffi-8.dll
          • Size 34KB
          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\libssl-1_1.dll
          • Size 686KB
          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\pyexpat.pyd
          • Size 193KB
          • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\python3.dll
          • Size 64KB
          • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\python311.dll
          • Size 5.5MB
          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythoncom311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\pywin32_system32\pythoncom311.dll
          • Size 665KB
          • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\pywin32_system32\pywintypes311.dll
          • Size 132KB
          • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\select.pyd
          • Size 28KB
          • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\sqlite3.dll
          • Size 1.4MB
          • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\win32\win32api.pyd
          • Size 135KB
          • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32cred.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\win32\win32cred.pyd
          • Size 39KB
          • SHA256 ffa19c9922f39ba70119b2f66cb1403372b7654b0dfc0734817c1614bac8a5b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013882\win32\win32crypt.pyd
          • Size 122KB
          • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          README_RANSOM.txt
          • Path C:\Users\Admin\Videos\README_RANSOM.txt
          • Size 315B
          • SHA256 8b8766fd17a7e38b38a560329f615b73d731b73dcf3bb9c61fdfcce70ff6fca5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          temp_Chrome_Default_cookies.db
          • Path C:\Windows\System32\temp_Chrome_Default_cookies.db
          • Size 20KB
          • SHA256 39b7352d063ed44876347511832bb259516c01fcb576489d1f3357adc0f8ed15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_Chrome_Default_login.db
          • Path C:\Windows\System32\temp_Chrome_Default_login.db
          • Size 40KB
          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_Chrome_Default_web.db
          • Path C:\Windows\System32\temp_Chrome_Default_web.db
          • Size 138KB
          • SHA256 442f386467789b16413f7958f769f14c38679eb213e8744201024e01b68b2a3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_Edge_Default_cookies.db
          • Path C:\Windows\System32\temp_Edge_Default_cookies.db
          • Size 20KB
          • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_Edge_Default_login.db
          • Path C:\Windows\System32\temp_Edge_Default_login.db
          • Size 56KB
          • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_Edge_Default_web.db
          • Path C:\Windows\System32\temp_Edge_Default_web.db
          • Size 224KB
          • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download