Overview

overview

10

Static

static

10

2026-09-21...om.exe

windows10-2004-x64

8

2026-09-21...om.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 10:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-21_acc0ae249c28eece82909a0c358dadd4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 12.3MB
  • Sample260922-mxvkyscd69
  • SHA256 952863b5c64ee17088b53f14b234e5086229fc343d57f5c9936663640d667d8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 5 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-21_acc0ae249c28eece82909a0c358dadd4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-21_acc0ae249c28eece82909a0c358dadd4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Users\Admin\AppData\Local\Temp\2026-09-21_acc0ae249c28eece82909a0c358dadd4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-21_acc0ae249c28eece82909a0c358dadd4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM msedge.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:876
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x22c,0x230,0x224,0x2a8,0x7ff83edbc188,0x7ff83edbc194,0x7ff83edbc1a0
          4⤵
            PID:2984
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
            4⤵
              PID:3372
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
              4⤵
              • System Time Discovery
              PID:5016
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
              4⤵
                PID:4152
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3048
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:1332
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3528
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:2
                4⤵
                • Uses browser remote debugging
                PID:2224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
                4⤵
                  PID:1928
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
                  4⤵
                    PID:3940
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
                    4⤵
                      PID:1444
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
                      4⤵
                        PID:2436
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
                        4⤵
                          PID:464
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
                          4⤵
                            PID:2568
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
                            4⤵
                              PID:1872
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,3410586361933933140,8995723840475786269,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
                              4⤵
                                PID:4448
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpy_5bj5xf.ps1
                              3⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3508
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "wVvmsdLOEC" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Local\Microsoft\TVGIweyD\wVvmsdLOEC.vbs"" /f"
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2896
                              • C:\Windows\system32\reg.exe
                                reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "wVvmsdLOEC" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Local\Microsoft\TVGIweyD\wVvmsdLOEC.vbs"" /f
                                4⤵
                                • Adds Run key to start application
                                PID:2008
                            • C:\Windows\SYSTEM32\wscript.exe
                              wscript.exe C:\Users\Admin\AppData\Local\Microsoft\TVGIweyD\wVvmsdLOEC.vbs
                              3⤵
                              • Checks computer location settings
                              • Executes a VBScript file via the Windows Script Host.
                              • Suspicious use of WriteProcessMemory
                              PID:5064
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$c = Get-Content 'C:\Users\Admin\AppData\Local\Microsoft\TVGIweyD\wVvmsdLOEC.dat' -Raw; Invoke-Expression $c"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3576
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fhp4sxjg\fhp4sxjg.cmdline"
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2784
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF46.tmp" "c:\Users\Admin\AppData\Local\Temp\fhp4sxjg\CSC26BDCCF4EA246D982D2915B9455D876.TMP"
                                    6⤵
                                      PID:4808
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zv42mrss\zv42mrss.cmdline"
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:532
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB021.tmp" "c:\Users\Admin\AppData\Local\Temp\zv42mrss\CSC45A1AFDD17C74D8DA3D4728E483696D.TMP"
                                      6⤵
                                        PID:3972
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pmc23vm5\pmc23vm5.cmdline"
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2444
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB188.tmp" "c:\Users\Admin\AppData\Local\Temp\pmc23vm5\CSCCF6F70AC6946405389DA8BA941E68E.TMP"
                                        6⤵
                                          PID:5112
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                1⤵
                                  PID:1324

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      3
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Visual Basic

                                      1
                                      T1059.005

                                      Windows Command Shell

                                      1
                                      T1059.003

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Modify Authentication Process

                                      1
                                      T1556

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Defense Evasion

                                      Modify Authentication Process

                                      1
                                      T1556

                                      Modify Registry

                                      1
                                      T1112

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Modify Authentication Process

                                      1
                                      T1556

                                      Steal Web Session Cookie

                                      1
                                      T1539

                                      Unsecured Credentials

                                      3
                                      T1552

                                      Credentials In Files

                                      3
                                      T1552.001

                                      Discovery

                                      Browser Information Discovery

                                      1
                                      T1217

                                      Query Registry

                                      3
                                      T1012

                                      System Information Discovery

                                      4
                                      T1082

                                      System Network Configuration Discovery

                                      1
                                      T1016

                                      Internet Connection Discovery

                                      1
                                      T1016.001

                                      System Time Discovery

                                      1
                                      T1124

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      2
                                      T1005

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      Msedge - Default.txt
                                      • Path C:\Users\Admin\AppData\Local\Bunny\History\Msedge - Default.txt
                                      • Size 58B
                                      • SHA256 93278e434ba0ffdcd48367d83a957238953e732814e914d7aea316e22c5bbc27
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      cookies_temp_1971.db
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_1971.db
                                      • Size 20KB
                                      • SHA256 e85be05f52c9c073776836c7f1f924dcb6bc466a92d47a32dadd2b9e7ad69f89
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      credit_cards.db
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                                      • Size 138KB
                                      • SHA256 6451885d2f7c2b820275e7a4f1545c88406d6745d83fd5e2e2f748f152cb989f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      passwords.db
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                                      • Size 40KB
                                      • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                      • Size 280B
                                      • SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                      • Size 280B
                                      • SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Edge Profile.ico
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                      • Size 70KB
                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SCT Auditing Pending Reports
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\the-real-index
                                      • Size 1KB
                                      • SHA256 7a15f84e23ecffb9df42177cbb985922fdc24e59ce658216f2b727c0191937aa
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index~RFe589371.TMP
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\the-real-index~RFe589371.TMP
                                      • Size 1KB
                                      • SHA256 07f34ae3cfd7c5f896469665ad352f48d5313e79e0f297b20de58ef08b640412
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      cookies_temp_8259.db
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_8259.db
                                      • Size 20KB
                                      • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      credit_cards.db
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\credit_cards.db
                                      • Size 224KB
                                      • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      passwords.db
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                                      • Size 56KB
                                      • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                      • Size 8KB
                                      • SHA256 ef36f46ad8979680fd1a72bf0ddae5836a4d78066b1b20eb8ae28a933c7e52f4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                      • Size 9KB
                                      • SHA256 86bb1149c98f866d1c931c5c84d0f2342ba366976f9107a74ef79c682b0c5a22
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                      • Size 2KB
                                      • SHA256 aaf0da5ae2d9e8517eccf3545b7f0db2b162f1359a9a0323b74a2b924f1eb291
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      25062ffa-0451-46fa-99b1-d18edad162f2.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\25062ffa-0451-46fa-99b1-d18edad162f2.tmp
                                      • Size 10KB
                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _chacha20.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Cipher\_chacha20.pyd
                                      • Size 13KB
                                      • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _raw_aes.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Cipher\_raw_aes.pyd
                                      • Size 34KB
                                      • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _raw_aesni.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Cipher\_raw_aesni.pyd
                                      • Size 15KB
                                      • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _raw_des3.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Cipher\_raw_des3.pyd
                                      • Size 51KB
                                      • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _BLAKE2s.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Hash\_BLAKE2s.pyd
                                      • Size 13KB
                                      • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _poly1305.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Hash\_poly1305.pyd
                                      • Size 13KB
                                      • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _cpuid_c.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\Crypto\Util\_cpuid_c.pyd
                                      • Size 10KB
                                      • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      VCRUNTIME140.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\VCRUNTIME140.dll
                                      • Size 96KB
                                      • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      VCRUNTIME140_1.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\VCRUNTIME140_1.dll
                                      • Size 37KB
                                      • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _asyncio.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_asyncio.pyd
                                      • Size 62KB
                                      • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _bz2.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_bz2.pyd
                                      • Size 81KB
                                      • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _ctypes.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_ctypes.pyd
                                      • Size 120KB
                                      • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _decimal.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_decimal.pyd
                                      • Size 245KB
                                      • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _hashlib.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_hashlib.pyd
                                      • Size 62KB
                                      • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _lzma.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_lzma.pyd
                                      • Size 154KB
                                      • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _multiprocessing.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_multiprocessing.pyd
                                      • Size 32KB
                                      • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _overlapped.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_overlapped.pyd
                                      • Size 48KB
                                      • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _queue.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_queue.pyd
                                      • Size 30KB
                                      • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _socket.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_socket.pyd
                                      • Size 76KB
                                      • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _sqlite3.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_sqlite3.pyd
                                      • Size 115KB
                                      • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _ssl.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\_ssl.pyd
                                      • Size 155KB
                                      • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      base_library.zip
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\base_library.zip
                                      • Size 1.4MB
                                      • SHA256 0afbd78f6c69a511a9aeaafd5300727354c488f5e372bb99da2cf95effa0279c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      cacert.pem
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\certifi\cacert.pem
                                      • Size 234KB
                                      • SHA256 9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      cd.cp311-win_amd64.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\charset_normalizer\cd.cp311-win_amd64.pyd
                                      • Size 113KB
                                      • SHA256 ac9465bbf4a1698015cf306bed26a101677010d89acdd10f7f63dedbaf271798
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      md.cp311-win_amd64.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\charset_normalizer\md.cp311-win_amd64.pyd
                                      • Size 195KB
                                      • SHA256 f398758fbce16b001e0799c1698d2a623751b8dd4e9ff0d6f4845ea6270f672f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libcrypto-1_1.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\libcrypto-1_1.dll
                                      • Size 3.3MB
                                      • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libffi-8.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\libffi-8.dll
                                      • Size 34KB
                                      • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libssl-1_1.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\libssl-1_1.dll
                                      • Size 686KB
                                      • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pyexpat.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\pyexpat.pyd
                                      • Size 193KB
                                      • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      python311.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\python311.dll
                                      • Size 5.5MB
                                      • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pywintypes311.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\pywin32_system32\pywintypes311.dll
                                      • Size 132KB
                                      • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      select.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\select.pyd
                                      • Size 28KB
                                      • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      sqlite3.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\sqlite3.dll
                                      • Size 1.4MB
                                      • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      unicodedata.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\unicodedata.pyd
                                      • Size 1.1MB
                                      • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      win32crypt.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c842\win32\win32crypt.pyd
                                      • Size 122KB
                                      • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      __PSScriptPolicyTest_rc3etnje.p52.ps1
                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rc3etnje.p52.ps1
                                      • Size 60B
                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ad969544-fe05-4d31-86bc-33c9e2827104.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\ad969544-fe05-4d31-86bc-33c9e2827104.tmp
                                      • Size 1B
                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      f0b3c1f7-f747-4779-807a-0822d0ff84b1.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3168_1225845042\f0b3c1f7-f747-4779-807a-0822d0ff84b1.tmp
                                      • Size 157KB
                                      • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      [85.203.46.201][XX]11-51-24-22-09-26.zip
                                      • Path C:\Users\Admin\AppData\Local\[85.203.46.201][XX]11-51-24-22-09-26.zip
                                      • Size 588KB
                                      • SHA256 2a1c37b20fecb5c5a5cffaa47f3945131d2f78825181f7ebfcca92b7324d9d68
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      key4_temp.db
                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\key4_temp.db
                                      • Size 288KB
                                      • SHA256 7ecffe6e922f1b0538d09328a2d557e2abe98bdf67053b6a84f24b8224f9adf1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      memory/3508-547-0x000002F0A89E0000-0x000002F0A8A02000-memory.dmp
                                      Download

                                      memory/3508-553-0x000002F0A8B10000-0x000002F0A8C5E000-memory.dmp
                                      Download

                                      memory/3576-585-0x0000027799970000-0x0000027799978000-memory.dmp
                                      Download

                                      memory/3576-593-0x00000277999B0000-0x00000277999B8000-memory.dmp
                                      Download

                                      memory/3576-601-0x0000027799E50000-0x0000027799E58000-memory.dmp
                                      Download