Overview

overview

8

Static

static

3

2026-10-13...om.exe

windows10-2004-x64

8

2026-10-13...om.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/10/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 28.1MB
  • Sample261015-vb7mdsav9p
  • SHA256 3099d4945dd6f41f64c2a4cf4badbf6f366a02b2c60ee258be5d2b2142e21118
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 28 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /rl highest"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5728
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /rl highest
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5636
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -NonI -Ex Bypass -C "Add-Type -AssemblyName System.Device;try{$w=New-Object System.Device.Location.GeoCoordinateWatcher( [System.Device.Location.GeoPositionAccuracy]::High);$w.MovementThreshold=0;$w.Start($true);$rd=[DateTime]::UtcNow.AddSeconds(10);while($w.Status -ne 'Ready' -and [DateTime]::UtcNow -lt $rd){Start-Sleep -Milliseconds 300};if($w.Status -ne 'Ready'){exit 1};$bLat=0;$bLon=0;$bAcc=[double]::MaxValue;$dl=[DateTime]::UtcNow.AddSeconds(45);while([DateTime]::UtcNow -lt $dl){ $c=$w.Position.Location; if(!$c.IsUnknown -and $c.HorizontalAccuracy -lt $bAcc){ $bAcc=$c.HorizontalAccuracy;$bLat=$c.Latitude;$bLon=$c.Longitude };if($bAcc -le 20){break};Start-Sleep -Milliseconds 400};if($bAcc -eq [double]::MaxValue){exit 1};Write-Host \"$bLat|$bLon|$bAcc\"}catch{exit 1}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9403 --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9403 http://127.0.0.1:12752/
        3⤵
        • Uses browser remote debugging
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4732
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9403 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\_zx9403\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\_zx9403 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff829f7c728,0x7ff829f7c734,0x7ff829f7c740
          4⤵
            PID:4928
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
            4⤵
              PID:4904
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:11
              4⤵
              • System Time Discovery
              PID:1932
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:13
              4⤵
                PID:3656
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:2328
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:1100
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:460
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:9
                4⤵
                • Uses browser remote debugging
                PID:2592
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:9
                4⤵
                • Uses browser remote debugging
                PID:2228
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
                4⤵
                  PID:3768
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:3752
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:4228
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:5084
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:5264
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:5740
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:2284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:3240
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9403 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:3488
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
                  4⤵
                    PID:3560
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:14
                    4⤵
                      PID:6088
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9403" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,12937521982116851294,8263307451665141762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
                      4⤵
                        PID:2504
                    • C:\Windows\SYSTEM32\netsh.exe
                      netsh wlan show networks mode=bssid
                      3⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:3680
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                      3⤵
                      • Executes a command shell one-liner
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2256
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profiles
                        4⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:3840
                • C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                  C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2572
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                    2⤵
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4796
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /rl highest"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:712
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-13_2f939f1a03076465fbe1148f527af738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /rl highest
                        4⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:2452
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoP -NonI -Ex Bypass -C "Add-Type -AssemblyName System.Device;try{$w=New-Object System.Device.Location.GeoCoordinateWatcher( [System.Device.Location.GeoPositionAccuracy]::High);$w.MovementThreshold=0;$w.Start($true);$rd=[DateTime]::UtcNow.AddSeconds(10);while($w.Status -ne 'Ready' -and [DateTime]::UtcNow -lt $rd){Start-Sleep -Milliseconds 300};if($w.Status -ne 'Ready'){exit 1};$bLat=0;$bLon=0;$bAcc=[double]::MaxValue;$dl=[DateTime]::UtcNow.AddSeconds(45);while([DateTime]::UtcNow -lt $dl){ $c=$w.Position.Location; if(!$c.IsUnknown -and $c.HorizontalAccuracy -lt $bAcc){ $bAcc=$c.HorizontalAccuracy;$bLat=$c.Latitude;$bLon=$c.Longitude };if($bAcc -le 20){break};Start-Sleep -Milliseconds 400};if($bAcc -eq [double]::MaxValue){exit 1};Write-Host \"$bLat|$bLon|$bAcc\"}catch{exit 1}"
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4080
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9507 --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9507 http://127.0.0.1:13454/
                      3⤵
                      • Uses browser remote debugging
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:5964
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9507 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\_zx9507\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\_zx9507 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff829f7c728,0x7ff829f7c734,0x7ff829f7c740
                        4⤵
                          PID:5724
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
                          4⤵
                            PID:4196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
                            4⤵
                            • System Time Discovery
                            PID:5272
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
                            4⤵
                              PID:2208
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
                              4⤵
                              • Uses browser remote debugging
                              PID:4352
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
                              4⤵
                              • Uses browser remote debugging
                              PID:2904
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
                              4⤵
                              • Uses browser remote debugging
                              PID:3384
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
                              4⤵
                              • Uses browser remote debugging
                              PID:2676
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:9
                              4⤵
                              • Uses browser remote debugging
                              PID:1440
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
                              4⤵
                                PID:4784
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4724
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4764
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4488
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4044
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:6076
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4764
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:5232
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9507 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:1232
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:14
                                4⤵
                                  PID:5084
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
                                  4⤵
                                    PID:2236
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9507" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,12890192634461552440,8723456124730239605,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
                                    4⤵
                                      PID:5524
                                  • C:\Windows\SYSTEM32\netsh.exe
                                    netsh wlan show networks mode=bssid
                                    3⤵
                                    • Event Triggered Execution: Netsh Helper DLL
                                    PID:2320
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                    3⤵
                                    • Executes a command shell one-liner
                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3240
                                    • C:\Windows\system32\netsh.exe
                                      netsh wlan show profiles
                                      4⤵
                                      • Event Triggered Execution: Netsh Helper DLL
                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                      PID:1752
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:3556
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                  1⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5520

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      1
                                      T1059

                                      Windows Command Shell

                                      1
                                      T1059.003

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Netsh Helper DLL

                                      1
                                      T1546.007

                                      Modify Authentication Process

                                      1
                                      T1556

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Netsh Helper DLL

                                      1
                                      T1546.007

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Defense Evasion

                                      Modify Authentication Process

                                      1
                                      T1556

                                      Modify Registry

                                      1
                                      T1112

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Modify Authentication Process

                                      1
                                      T1556

                                      Steal Web Session Cookie

                                      1
                                      T1539

                                      Unsecured Credentials

                                      1
                                      T1552

                                      Credentials In Files

                                      1
                                      T1552.001

                                      Discovery

                                      Browser Information Discovery

                                      1
                                      T1217

                                      Query Registry

                                      2
                                      T1012

                                      System Information Discovery

                                      1
                                      T1082

                                      System Network Configuration Discovery

                                      3
                                      T1016

                                      Internet Connection Discovery

                                      1
                                      T1016.001

                                      Wi-Fi Discovery

                                      1
                                      T1016.002

                                      System Time Discovery

                                      1
                                      T1124

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      1
                                      T1005

                                      Command and Control

                                      Web Service

                                      1
                                      T1102

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      _imagingtk.pyi
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\PIL\_imagingtk.pyi
                                      • Size 66B
                                      • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      VCRUNTIME140.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\VCRUNTIME140.dll
                                      • Size 174KB
                                      • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      VCRUNTIME140_1.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\VCRUNTIME140_1.dll
                                      • Size 48KB
                                      • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _bz2.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_bz2.pyd
                                      • Size 86KB
                                      • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _cffi_backend.cp314-win_amd64.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_cffi_backend.cp314-win_amd64.pyd
                                      • Size 177KB
                                      • SHA256 9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _ctypes.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_ctypes.pyd
                                      • Size 139KB
                                      • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _hashlib.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_hashlib.pyd
                                      • Size 67KB
                                      • SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _lzma.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_lzma.pyd
                                      • Size 157KB
                                      • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _queue.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_queue.pyd
                                      • Size 35KB
                                      • SHA256 2fd8668f52b34d0e71ae48784bd2e7d35e5d99df6f641edb0fc279235a187c8e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _socket.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_socket.pyd
                                      • Size 85KB
                                      • SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _ssl.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_ssl.pyd
                                      • Size 186KB
                                      • SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _wmi.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_wmi.pyd
                                      • Size 39KB
                                      • SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _zstd.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\_zstd.pyd
                                      • Size 491KB
                                      • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      base_library.zip
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\base_library.zip
                                      • Size 1.3MB
                                      • SHA256 8f8d4d5060a5ba79dcd505a9d604e37d123421f4f57603f41ee730367538d068
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _rust.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\cryptography\hazmat\bindings\_rust.pyd
                                      • Size 9.4MB
                                      • SHA256 1d4332a447cab13dec8e3a533ad579e0e562b79e40822c931f33769758fc7156
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libcrypto-3.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\libcrypto-3.dll
                                      • Size 6.0MB
                                      • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libffi-8.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\libffi-8.dll
                                      • Size 38KB
                                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libssl-3.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\libssl-3.dll
                                      • Size 1.3MB
                                      • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      INSTALLER
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\psutil-7.2.2.dist-info\INSTALLER
                                      • Size 4B
                                      • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      _psutil_windows.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\psutil\_psutil_windows.pyd
                                      • Size 69KB
                                      • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      python3.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\python3.dll
                                      • Size 72KB
                                      • SHA256 6c45910e7c82617ca6360820de861699cc99f9efee434df290aa4c6e38f39886
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      python314.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\python314.dll
                                      • Size 6.5MB
                                      • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      pywintypes314.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\pywintypes314.dll
                                      • Size 133KB
                                      • SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      select.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\select.pyd
                                      • Size 32KB
                                      • SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Lorem ipsum.txt
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                      • Size 1KB
                                      • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      unicodedata.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\unicodedata.pyd
                                      • Size 741KB
                                      • SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      win32api.pyd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI000003642\win32\win32api.pyd
                                      • Size 136KB
                                      • SHA256 9004920e2c7863c34d0b3c4183ab3e1482475817cfb64f4f198e1fdd43f48f4e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      WHEEL
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a0c2\pywin32-312.dist-info\WHEEL
                                      • Size 101B
                                      • SHA256 8e1c6b44fded7447e6eeda01d57edd979c7a7f46eee93bded9c5b021d91b2fc5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      License.txt
                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000a0c2\pywin32-312.dist-info\licenses\win32\License.txt
                                      • Size 1KB
                                      • SHA256 a74d826efb242db087b850348e20abbfd591b51e2081f2048735290913872924
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      __PSScriptPolicyTest_2svinfuo.bjo.psm1
                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2svinfuo.bjo.psm1
                                      • Size 60B
                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Crashpad\settings.dat
                                      • Size 40B
                                      • SHA256 c705e99e6465a0b4ef8345ee7514664c81655bb2cd0412e41da42212644e4f92
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      temp-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Code Cache\js\index-dir\temp-index
                                      • Size 72B
                                      • SHA256 8665f3abc150ecda78becb7844b428cb5894088279f07cf8921f919af0f2f1c7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Code Cache\js\index-dir\the-real-index
                                      • Size 48B
                                      • SHA256 4a57ec37585633822428e27f4b5877872e400c21bfe66ba24210dfdfb0aa2863
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      490f2099-fe2f-4786-9d0d-75672592586b.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Network\490f2099-fe2f-4786-9d0d-75672592586b.tmp
                                      • Size 827B
                                      • SHA256 f1b1d8490d7a3c5686f9534c89532b04e2bbb40335e50db0f81ce79718d60e94
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      SCT Auditing Pending Reports
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Network\SCT Auditing Pending Reports
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      temp-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Service Worker\ScriptCache\index-dir\temp-index
                                      • Size 96B
                                      • SHA256 6cdee8cbbe091704e2dd0c3ec2abc17f38bf68984692070bc2e0b6191d2b8449
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                      • Size 72B
                                      • SHA256 f8b2262e297a02cb0da45914f9aa2d5d25ceda94ad8ad2592620dc6c2f453f33
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Shared Dictionary\cache\index
                                      • Size 24B
                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      MANIFEST-000001
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Site Characteristics Database\MANIFEST-000001
                                      • Size 41B
                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      CURRENT
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Default\Sync Data\LevelDB\CURRENT
                                      • Size 16B
                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\Local State
                                      • Size 1KB
                                      • SHA256 26defe10c18241570c631b230864fba1838915d75b3b855e72275fef2cf73d41
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      data_0
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\ShaderCache\data_0
                                      • Size 8KB
                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      data_1
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\ShaderCache\data_1
                                      • Size 264KB
                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      data_2
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\ShaderCache\data_2
                                      • Size 8KB
                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      data_3
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\ShaderCache\data_3
                                      • Size 8KB
                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      e6f09f47-baea-4c73-8baa-3f9d1c146ae6.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\e6f09f47-baea-4c73-8baa-3f9d1c146ae6.tmp
                                      • Size 3KB
                                      • SHA256 7814dd792e9a497cfd9638ae1be544993a180fb1ebe580500345a1c63c883d72
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      a0521627-6a78-435f-905f-39c658a1c49e.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9403\extensions_crx_cache\a0521627-6a78-435f-905f-39c658a1c49e.tmp
                                      • Size 13B
                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      2f040681-a8dd-4625-b191-35ebeb7fcd8f.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\2f040681-a8dd-4625-b191-35ebeb7fcd8f.tmp
                                      • Size 3KB
                                      • SHA256 21832ba9d66afc5c5910d8260907f1db5ad65d6d706ec7e2e7ac621d71a1e7fe
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      02e3d284-62ea-4c9f-ac46-9c03ed8d57a7.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\02e3d284-62ea-4c9f-ac46-9c03ed8d57a7.tmp
                                      • Size 6B
                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      temp-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Code Cache\js\index-dir\temp-index
                                      • Size 72B
                                      • SHA256 f736190521e885aff50131e2ae9183e7b328eefae352dda98ba3bc3b8a36bdb6
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Code Cache\js\index-dir\the-real-index
                                      • Size 48B
                                      • SHA256 b3f2bf993393d0bac4dc8d9415cc34494f046d10bde2a86c842525ed8a363052
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      0364afa5-2ba9-4661-9923-66e87860a5de.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Network\0364afa5-2ba9-4661-9923-66e87860a5de.tmp
                                      • Size 59B
                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      4cb013792b196a35_0
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Service Worker\ScriptCache\4cb013792b196a35_0
                                      • Size 10KB
                                      • SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      temp-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Service Worker\ScriptCache\index-dir\temp-index
                                      • Size 96B
                                      • SHA256 68938cc8afd330294f3e25d7b8fc36be00959157267f37b62de380205f4e0baa
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                      • Size 72B
                                      • SHA256 652e3d3742174d5ab415337451c896d88707c2976029381c319e8daa143d89b5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
                                      • Size 1KB
                                      • SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
                                      • Size 2KB
                                      • SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
                                      • Size 3KB
                                      • SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
                                      • Size 1KB
                                      • SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
                                      • Size 1KB
                                      • SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
                                      • Size 1KB
                                      • SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
                                      • Size 1KB
                                      • SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
                                      • Size 1KB
                                      • SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
                                      • Size 2KB
                                      • SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      128.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\128.png
                                      • Size 5KB
                                      • SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      192.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\192.png
                                      • Size 2KB
                                      • SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      256.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\256.png
                                      • Size 12KB
                                      • SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\32.png
                                      • Size 1KB
                                      • SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\48.png
                                      • Size 2KB
                                      • SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\64.png
                                      • Size 3KB
                                      • SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      96.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_1744197672\Icons\96.png
                                      • Size 3KB
                                      • SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      128.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\128.png
                                      • Size 2KB
                                      • SHA256 3a45652c64d2a35cad427fc4541ab36ac42f11425f2d996edc38a6498d98bae8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      192.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\192.png
                                      • Size 1KB
                                      • SHA256 56b7a8100c9fd352d2c25b6a9c9a05b47950cf5f84d07ab014a0b7cd2850e5a5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      256.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\256.png
                                      • Size 4KB
                                      • SHA256 55d89ccdc27b413cc831f5496b0caf3ec390bc19270ec3294a5d2d38dec42c24
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\32.png
                                      • Size 960B
                                      • SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\48.png
                                      • Size 1KB
                                      • SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\64.png
                                      • Size 1KB
                                      • SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      96.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_2106977082\Icons\96.png
                                      • Size 1KB
                                      • SHA256 84a6d2571ed487aec05288f204c16ef239a740d2dfb105bf781c6708b938cf00
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      128.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\128.png
                                      • Size 8KB
                                      • SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      192.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\192.png
                                      • Size 5KB
                                      • SHA256 cca43d465fed69867dfec3ee1faa43fe3cfc4fb118e3762f9f4f318856f2664e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      256.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\256.png
                                      • Size 20KB
                                      • SHA256 ba50637a9a54c98264373add3ad0514b06e6ae59524a3f7a4552f556d1afb78f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\32.png
                                      • Size 1KB
                                      • SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\48.png
                                      • Size 2KB
                                      • SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\64.png
                                      • Size 3KB
                                      • SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      96.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_371524161\Icons\96.png
                                      • Size 5KB
                                      • SHA256 a5c76c56766d79ac0e66fbbf57806501919a63913fb224b0965041ec3645f9e0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      128.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\128.png
                                      • Size 1KB
                                      • SHA256 a57ffe3b3cd0a1bafe37e36daa89d2f9afb9446423cba25df883ab0f9aa8293a
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      192.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\192.png
                                      • Size 1KB
                                      • SHA256 f25ab19c435c2cb43e7d86b9bf58f46ec8af6228bc4511d4c5cb9d23e1cc4c04
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      256.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\256.png
                                      • Size 4KB
                                      • SHA256 dee5357bd2992efefb04ed8bbb64dbf7becd768d75dff17dcb2b335c4fd2a903
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      32.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\32.png
                                      • Size 952B
                                      • SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      48.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\48.png
                                      • Size 1KB
                                      • SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      64.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\64.png
                                      • Size 1KB
                                      • SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      96.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Default\Web Applications\Temp\scoped_dir5964_614465793\Icons\96.png
                                      • Size 1KB
                                      • SHA256 f2b25026f9dde3d50479d07494efff95f79c2bfa6c7eff6867051a951d38f9e0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Temp\_zx9507\Local State
                                      • Size 1KB
                                      • SHA256 31be5a951758a16a6f24e40c66e5e48e956094eb4d78000fd7496ad73bd2fcbe
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/1612-1231-0x000002AD72890000-0x000002AD728A2000-memory.dmp
                                      Download

                                      memory/1612-1102-0x000002AD72460000-0x000002AD72482000-memory.dmp
                                      Download