a64332827add01bb5551064a6307300cd9894ea55b2f9b244fa481f60c97f90f

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 15.6MB
Sample261016-2qlrssxy6n
SHA256 a64332827add01bb5551064a6307300cd9894ea55b2f9b244fa481f60c97f90f
MD5 1348bbaa0c1cbe7dec0a6376f00dbc40
SHA1 48e1c26030097c7d97877323a1209cbaf3b1b2b0
SHA512 b6feaa5dcba7fbe811922a13d5ec630cd865a38441958aaa9adad36917afe7e930eaeed16671de4abf832baaaeffef0773d57e6abdeaa95db7781f48c1e412fb
SSDEEP 393216:4qnCL8uCMhHTodRGkXMvz5m5ZvOSaxIW3A2dZ:jCVCu0LhXMb5y9axBz
TLSH
T13CF633D9E3D458E4F9F3B7394A535668B362BC000721E6DF06F44B963DA36A11938E23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4024	chromelevator.exe

Loads dropped DLL 36 IoCs

pid	Process
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
11	api.gofile.io

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
9	api.ipify.org

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
4308	WMIC.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3836	tasklist.exe

Queries system WMI classes for hardware identifiers 2 TTPs 7 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2464	WMIC.exe
4560	WMIC.exe
5888	WMIC.exe
4308	WMIC.exe
464	WMIC.exe
3372	WMIC.exe
2228	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe
860	cmd.exe
2144	cmd.exe
256	cmd.exe
4272	cmd.exe
1492	cmd.exe
1452	cmd.exe
1100	cmd.exe
1680	cmd.exe
5828	cmd.exe
5972	cmd.exe
2868	cmd.exe
616	cmd.exe
1192	cmd.exe
2604	cmd.exe
3000	cmd.exe
2560	cmd.exe
5016	cmd.exe
4044	cmd.exe
1260	cmd.exe
5100	cmd.exe
4320	cmd.exe
3708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 28 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2144	cmd.exe
6072	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6128	chrome.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3960	WMIC.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
5712	taskkill.exe
1160	taskkill.exe
3108	taskkill.exe
4284	taskkill.exe
6004	taskkill.exe
5972	taskkill.exe
5620	taskkill.exe
3324	taskkill.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
2228	WMIC.exe
2228	WMIC.exe
2228	WMIC.exe
2228	WMIC.exe
2464	WMIC.exe
2464	WMIC.exe
2464	WMIC.exe
2464	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
4768	WMIC.exe
4768	WMIC.exe
4768	WMIC.exe
4768	WMIC.exe
5156	WMIC.exe
5156	WMIC.exe
5156	WMIC.exe
5156	WMIC.exe
5888	WMIC.exe
5888	WMIC.exe
5888	WMIC.exe
5888	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
4308	WMIC.exe
4308	WMIC.exe
4308	WMIC.exe
4308	WMIC.exe
464	WMIC.exe
464	WMIC.exe
464	WMIC.exe
464	WMIC.exe
3372	WMIC.exe
3372	WMIC.exe
3372	WMIC.exe
3372	WMIC.exe
3908	WMIC.exe
3908	WMIC.exe
3908	WMIC.exe
3908	WMIC.exe
5228	WMIC.exe
5228	WMIC.exe
5228	WMIC.exe
5228	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	6004	taskkill.exe
Token: SeDebugPrivilege	5972	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2228	WMIC.exe
Token: SeSecurityPrivilege	2228	WMIC.exe
Token: SeTakeOwnershipPrivilege	2228	WMIC.exe
Token: SeLoadDriverPrivilege	2228	WMIC.exe
Token: SeSystemProfilePrivilege	2228	WMIC.exe
Token: SeSystemtimePrivilege	2228	WMIC.exe
Token: SeProfSingleProcessPrivilege	2228	WMIC.exe
Token: SeIncBasePriorityPrivilege	2228	WMIC.exe
Token: SeCreatePagefilePrivilege	2228	WMIC.exe
Token: SeBackupPrivilege	2228	WMIC.exe
Token: SeRestorePrivilege	2228	WMIC.exe
Token: SeShutdownPrivilege	2228	WMIC.exe
Token: SeDebugPrivilege	2228	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2228	WMIC.exe
Token: SeRemoteShutdownPrivilege	2228	WMIC.exe
Token: SeUndockPrivilege	2228	WMIC.exe
Token: SeManageVolumePrivilege	2228	WMIC.exe
Token: 33	2228	WMIC.exe
Token: 34	2228	WMIC.exe
Token: 35	2228	WMIC.exe
Token: 36	2228	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2228	WMIC.exe
Token: SeSecurityPrivilege	2228	WMIC.exe
Token: SeTakeOwnershipPrivilege	2228	WMIC.exe
Token: SeLoadDriverPrivilege	2228	WMIC.exe
Token: SeSystemProfilePrivilege	2228	WMIC.exe
Token: SeSystemtimePrivilege	2228	WMIC.exe
Token: SeProfSingleProcessPrivilege	2228	WMIC.exe
Token: SeIncBasePriorityPrivilege	2228	WMIC.exe
Token: SeCreatePagefilePrivilege	2228	WMIC.exe
Token: SeBackupPrivilege	2228	WMIC.exe
Token: SeRestorePrivilege	2228	WMIC.exe
Token: SeShutdownPrivilege	2228	WMIC.exe
Token: SeDebugPrivilege	2228	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2228	WMIC.exe
Token: SeRemoteShutdownPrivilege	2228	WMIC.exe
Token: SeUndockPrivilege	2228	WMIC.exe
Token: SeManageVolumePrivilege	2228	WMIC.exe
Token: 33	2228	WMIC.exe
Token: 34	2228	WMIC.exe
Token: 35	2228	WMIC.exe
Token: 36	2228	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2464	WMIC.exe
Token: SeSecurityPrivilege	2464	WMIC.exe
Token: SeTakeOwnershipPrivilege	2464	WMIC.exe
Token: SeLoadDriverPrivilege	2464	WMIC.exe
Token: SeSystemProfilePrivilege	2464	WMIC.exe
Token: SeSystemtimePrivilege	2464	WMIC.exe
Token: SeProfSingleProcessPrivilege	2464	WMIC.exe
Token: SeIncBasePriorityPrivilege	2464	WMIC.exe
Token: SeCreatePagefilePrivilege	2464	WMIC.exe
Token: SeBackupPrivilege	2464	WMIC.exe
Token: SeRestorePrivilege	2464	WMIC.exe
Token: SeShutdownPrivilege	2464	WMIC.exe
Token: SeDebugPrivilege	2464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2464	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4956	3184	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4956 wrote to memory of 1452	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 1452 wrote to memory of 5620	1452	cmd.exe	93
PID 4956 wrote to memory of 1192	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 1192 wrote to memory of 3324	1192	cmd.exe	96
PID 4956 wrote to memory of 4320	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 4320 wrote to memory of 5712	4320	cmd.exe	99
PID 4956 wrote to memory of 256	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 256 wrote to memory of 1160	256	cmd.exe	102
PID 4956 wrote to memory of 1100	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 1100 wrote to memory of 3108	1100	cmd.exe	105
PID 4956 wrote to memory of 4272	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 4272 wrote to memory of 4284	4272	cmd.exe	108
PID 4956 wrote to memory of 2604	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 2604 wrote to memory of 6004	2604	cmd.exe	111
PID 4956 wrote to memory of 1680	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 1680 wrote to memory of 5972	1680	cmd.exe	114
PID 4956 wrote to memory of 4024	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 4024 wrote to memory of 1880	4024	chromelevator.exe	117
PID 4024 wrote to memory of 1880	4024	chromelevator.exe	117
PID 4024 wrote to memory of 5836	4024	chromelevator.exe	120
PID 4024 wrote to memory of 5836	4024	chromelevator.exe	120
PID 4956 wrote to memory of 1116	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 4956 wrote to memory of 1116	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 1116 wrote to memory of 2476	1116	chrome.exe	122
PID 1116 wrote to memory of 6108	1116	chrome.exe	126
PID 1116 wrote to memory of 6128	1116	chrome.exe	125
PID 1116 wrote to memory of 6108	1116	chrome.exe	126
PID 1116 wrote to memory of 5756	1116	chrome.exe	127
PID 1116 wrote to memory of 5756	1116	chrome.exe	127
PID 1116 wrote to memory of 4324	1116	chrome.exe	128
PID 1116 wrote to memory of 916	1116	chrome.exe	129
PID 1116 wrote to memory of 4324	1116	chrome.exe	128
PID 1116 wrote to memory of 916	1116	chrome.exe	129
PID 1116 wrote to memory of 3712	1116	chrome.exe	130
PID 1116 wrote to memory of 3712	1116	chrome.exe	130
PID 1116 wrote to memory of 3924	1116	chrome.exe	131
PID 1116 wrote to memory of 3924	1116	chrome.exe	131
PID 1116 wrote to memory of 4364	1116	chrome.exe	132
PID 1116 wrote to memory of 4364	1116	chrome.exe	132
PID 4956 wrote to memory of 4456	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 4956 wrote to memory of 4456	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 4456 wrote to memory of 4140	4456	chrome.exe	134
PID 4956 wrote to memory of 3000	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 3000 wrote to memory of 2228	3000	cmd.exe	139
PID 4956 wrote to memory of 5828	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 5828 wrote to memory of 2464	5828	cmd.exe	142
PID 4956 wrote to memory of 2560	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 2560 wrote to memory of 4560	2560	cmd.exe	145
PID 4956 wrote to memory of 5016	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 5016 wrote to memory of 4768	5016	cmd.exe	148
PID 4956 wrote to memory of 5972	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 5972 wrote to memory of 5156	5972	cmd.exe	151
PID 4956 wrote to memory of 4044	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 4044 wrote to memory of 5888	4044	cmd.exe	154
PID 4956 wrote to memory of 2868	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	155
PID 2868 wrote to memory of 3960	2868	cmd.exe	157
PID 4956 wrote to memory of 3708	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	158
PID 3708 wrote to memory of 2556	3708	cmd.exe	160
PID 4956 wrote to memory of 1260	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	161
PID 1260 wrote to memory of 4308	1260	cmd.exe	163
PID 4956 wrote to memory of 5100	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	164
PID 5100 wrote to memory of 464	5100	cmd.exe	166
PID 4956 wrote to memory of 1492	4956	2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_1348bbaa0c1cbe7dec0a6376f00dbc40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    C:\Users\Admin\AppData\Local\Temp\chromelevator.exe -v -f -k -o C:\Users\Admin\AppData\Local\Temp\chromelevator_1792190848 all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffaf052c728,0x7ffaf052c734,0x7ffaf052c740
      4⤵
      PID:2476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,9551796846768536089,2162526671352604731,524288 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
      4⤵
      System Time Discovery
      PID:6128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,11686990836753249520,17468976611508176809,262144 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
      4⤵
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,5116935388636039620,5634813522220543420,524288 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
      4⤵
      PID:5756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,16669679212647991420,9196818030023956192,2097152 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,17631849242763776743,317509875877340175,2097152 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3884,i,16123451780404796978,11417371212530534745,2097152 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:1
      4⤵
      PID:3712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3916,i,14345911283659803568,4888233223448058308,2097152 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:9
      4⤵
      PID:3924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4676,i,5744342123089869501,17710144794122468976,2097152 --field-trial-handle=2448,i,15772194030749447347,5832022846546441133,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
      4⤵
      PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-3c68f54804b70004"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-3c68f54804b70004 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-3c68f54804b70004\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-3c68f54804b70004 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaf052c728,0x7ffaf052c734,0x7ffaf052c740
      4⤵
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic diskdrive get serialnumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get processorid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get processorid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetEnabled=true" get macaddress"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetEnabled=true" get macaddress
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption,Version,BuildNumber,OSArchitecture,InstallDate,LastBootUpTime,SerialNumber /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption,Version,BuildNumber,OSArchitecture,InstallDate,LastBootUpTime,SerialNumber /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get Name,NumberOfCores,NumberOfLogicalProcessors,MaxClockSpeed,Manufacturer,ProcessorId,SocketDesignation,L2CacheSize,L3CacheSize /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Name,NumberOfCores,NumberOfLogicalProcessors,MaxClockSpeed,Manufacturer,ProcessorId,SocketDesignation,L2CacheSize,L3CacheSize /format:list
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get Name,AdapterRAM,DriverVersion,VideoProcessor,CurrentHorizontalResolution,CurrentVerticalResolution,CurrentRefreshRate /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name,AdapterRAM,DriverVersion,VideoProcessor,CurrentHorizontalResolution,CurrentVerticalResolution,CurrentRefreshRate /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic memorychip get Capacity,Speed,Manufacturer,PartNumber,SerialNumber,DeviceLocator /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic memorychip get Capacity,Speed,Manufacturer,PartNumber,SerialNumber,DeviceLocator /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic baseboard get Manufacturer,Product,SerialNumber,Version,SKU /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get Manufacturer,Product,SerialNumber,Version,SKU /format:list
      4⤵
      Uses WMI to collect hardware manufacturer information
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get Manufacturer,Name,Version,SerialNumber,ReleaseDate /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get Manufacturer,Name,Version,SerialNumber,ReleaseDate /format:list
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic diskdrive get Model,SerialNumber,Size,MediaType,InterfaceType /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:1492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get Model,SerialNumber,Size,MediaType,InterfaceType /format:list
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetEnabled=true" get Name,MACAddress,Speed,AdapterType /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:2776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetEnabled=true" get Name,MACAddress,Speed,AdapterType /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:list"
    3⤵
    - Executes a command shell one-liner
    PID:860
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2144
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    PID:616
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Discovers running processes
      PID:3836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.tmpWkCQ88PJpI\cookies.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 fce14c5d3f4bdd16e622c422913ca4a931f83fcf71c1db49a14153cb09801b8d
MD5 4abc73645b5065649f4685b8efb8209c
SHA1 8b2a326f8c807c380e9aa5ba52d27503691db6b1
SHA512 1f6c49544afb3a974fb88d5374b74c159f03c2602c158d41891fc6b71cf7767ce3c14b9e27ddf926004a2f63f234cc49a372e384848c3337670730e59f3051d6
SSDEEP 192:KImw2Q1Wl2xhxCQFom1vrOM0sElTPqUVTPngeAtLQy:KI12vl8bVpvATTqcThAtLj
TLSH
T1AC522A89FDA44579E47B80BCC837491EAABAB1503362A78F0350C19A1CB37D1763E6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Cipher\_raw_aes.pyd
Size 36KB
SHA256 122538e845c945d8efd86a092dd78727fc18e2d74ea1b2a00a9f1b8e8cefd2ea
MD5 6c0348522ad4b23ae508e0cb6fd90f65
SHA1 4531a2c47ac2bcc0012b6623d25e35697ddc4640
SHA512 5857e029fa1b1a35efbf1a277c68dcf1ce44d3b7a719dab8413ada342b575632cb07dadd88c3dcf6594ed7fc53cb3ff3aa0c14e1b6561424d4728ae22ec266e2
SSDEEP 768:KMk9MKzJslFrBs2RDMuQ4gNkxtxte57S4j990th9VPn:tkErmRuQ4gNkxtxte57S430r9R
TLSH
T105F23925B1FE0756EE605F72EE038C4BE6B07921B351F53B62B102AC30171AED4BB566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 2f43949960c3c05666fc7331d2aad383a32eb0d95caad2e074f9bf496bc95c52
MD5 3dfa66e19fb335e07c6008ee87fe4a0e
SHA1 0a21ee66dcebdfb3277e8b69dd428518aaf06d8b
SHA512 8b9ade968a21d0e89d9c985553b553a8a1df391324b1f8761f3fc4cb3d7612f1a04551891014ccf5cc2dad60a3db6f9c6a4cdfccd7b1689ac821b98f1359b447
SSDEEP 384:rvSB2D+832XZiOLkIRnX8yz2YUJUIKBaslz6A:rv02D+A2XPJVaYUJ+lT
TLSH
T116623B4DF24614BCE616C1B6CC63160AE0767610176176EF5330E16D1EB37C276AEBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Cipher\_raw_des3.pyd
Size 52KB
SHA256 0c00eea6332ffd22c2ac320c145b1f7768f0a8bd702e21202cc2da4c8e1cb666
MD5 adf101d48f4fc0f782fdfe882ec43e9d
SHA1 8bccbe4da7bf60625804768e35ad54b846e20baa
SHA512 d6db49c1a6304eac63944b71cb6cc8355cab94abe03f101172be8073d7c028c813c0c22066eb08545d1c7dffbb93fc1d792c1949d716a18eb5ded3800142d6e3
SSDEEP 192:qRh3inDsuFOU2RtSvvVtkFYdteBZMakV/tECPslheUm1zBAArQ37ri1dR9fEk2xS:qRh3eDsFExEZgVFEC+rZ1aTA3w
TLSH
T18F332113F76401EAD07D4B3404DB0B65AAABA0A622B347A71F65556C6EF33E13D72EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 1ab22ebb94a00085adf407d1d3ea2fdade798bf917292617f4121f1b711797fb
MD5 9306f20cc85e53e295e2e424e4f3cbab
SHA1 41c73ee38dc526b1a7cd7e4da8563ef2172e5f69
SHA512 0f505e02f95819647c1b3668225a8c515f9b16ba6303baa9922f2800c1cc816ea0b66bcdc0fff72176ce4cf480b894de63bbd9977794f04955a43245259df62b
SSDEEP 192:4bX+bwq20Aw6NAo9pRWRUac3CXFmgeASb+:BUq2002usyMYAa
TLSH
T1DB523915F6A044FEE86BC2F884734E0DA3757A10679167CF1321A29A1C337E2A1BF6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Hash\_SHA1.pyd
Size 18KB
SHA256 9be017329a06c9c3872cc064337bcc9e81a4f1d8d6fe5871c9a321d631f918a7
MD5 ea4283890c7c0cb61a0ade6e0418bff9
SHA1 3a0e4434fa5216c11d6ec4e197bed7835f13e59f
SHA512 cf5e929fbf73dc7ac51f632fc7fcb27863a3a7b9ed1dcbbca981f3727bade0b06da0a94f7062fa5eca81d4866559d3fc8b0993bade1d41411c113011694e4182
SSDEEP 384:Ai5+Dmg6AT7VbfdY3ho4s6uk7leKu7dnAmAA:/5g6s7FVGWkuk7leKiA
TLSH
T1C0823A58FEA6A4BDE93DC878C123492FA375BA228361A34F03E6159D0C173D61D3972C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Hash\_SHA256.pyd
Size 22KB
SHA256 58d484074ed7097a1869adecf7cdbdae7ecd846cd77d408ec787ffc952e96836
MD5 32bf57fa0998e9e45b0f9fb29784712e
SHA1 7eeb46832c489e91d17a75ecd54ca24c1a8137b6
SHA512 a1b9ba4b8e88cc867158a500b50808bc24eb6172c93bc1d438cb55b8b9101cc85825cd2435c826fd01f3906c55d9ff8c64fd07e10851715c675c72948ffc6674
SSDEEP 384:PMk971MB96nqUc7tYkJMOoKtDg3x8O2AN:Lu6qvJYkJMsg3FTN
TLSH
T163A23A18EF758979F09B2075862254ED313AF72923BC72FB432115089E737EDAE29742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 95dd43cac1261e71dbd411cb2c08cc01a81b746009ef2cadcacb4018fea79e81
MD5 ecf6384e49c66f948825b6519c7685db
SHA1 10e2410e342d74ccc2a17e88cf52f24c1a71ed9e
SHA512 994a2169285b1671944dca3a37fc45365eb7c82363a4e0ccafd495721889cbe91354a33ec7f683d3336c40a7b7de4e5cf430a1c2dd045da79508f34c217cd78f
SSDEEP 192:xnZluowiOQNS/1F6i8mXIjFLgSWigeAR:dubiOTD/XIjF8SWqA
TLSH
T1D522070CFE6249EAD96581B8C4674E4AB17ABB101723B38F0330663F1EE67C76126B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 78a36278c5dcc118ef2c78fe6af52c96665f86f03689a744abbdc9673e118444
MD5 2b4ae4835728fadf2470b7e55bf928cd
SHA1 806e020facdf38d4ccaa7eecc4c5e1a52d0181cc
SHA512 e4eb4c3ff5569b878b39885dd01fa5e3d5b1dbaf5454098fb4c1a2ff9412d1d8323e5fc51355c535a9d8a8ade483fe510bc90d4114889088ec3a17252926015d
SSDEEP 96:jEIvyQOoBlOo6oVb3mTTh+NrkPBcZJRUESdIaC8/klSlDR/8kEAi+28gVoAp84tm:3OslOo53Ie/qrC8UUWDArgeAp84o4e
TLSH
T18822E84CFE6609EAD9568175C4231E0AF176B7202722738F5375A23A1EE63CB6136741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_hashlib.pyd
Size 67KB
SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
MD5 72b2f8cdf8d6b1dbbdd4e0c0bacf849e
SHA1 54d10c68abecefa52f866bd13779544616c6b286
SHA512 827bd7f6aaad7184b3bce810d027055e15818208c8b167ef467bfb21d83103ff24f6d90fe0a500297a93d66d5cddd41eb1cb632f124171b042506a417d5eb15c
SSDEEP 1536:gksa/wmb96DB9qWptC8SBIWOIuytH/9SfIW44z4r:gHH9qWptClBIWOIBW4IQ
TLSH
T1B3639E0AB6944194D9A78175C9A39F53F9F1F28217206BEF4268C0CD2F233C3A77A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_queue.pyd
Size 32KB
SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
MD5 6ffc75670dfed859cc7ca266bcc89816
SHA1 5a39c3fd8fb398234611b91a5da260547442da52
SHA512 d26d74232dce6c6e57c92a0cfae605bbef7036dd848a04ca8b267aeee1aa12b1b06813746466ce186c363b3c89034424ee64681399b8d00f4d4e997abfef475b
SSDEEP 768:eVzlP6rT1wyzklIWQUFOytxJEKrLy2Ip44Cxf1mljr8VMSU:eTST1lzklIWQU4ytH/9pfI38VMJ
TLSH
T164E29FCAAE644047E563CA70C2E7EE93F935B7935601879F2065C18E1F237C1E726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_socket.pyd
Size 83KB
SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
MD5 0106ee3f61a54d922190b3a01c81a453
SHA1 420bd90297b2df30f00813e4ee17177fa0c77c3b
SHA512 393bb603efa2f1fb783f2a9b898911af0882ff5919c2b3cf615845a349662b7b64d276398187b11f2c5c07a022459dd8d8b41c0ce331bc31c5f088056da7083c
SSDEEP 1536:BdcydNg46ARGrwISALqwXV9/s+S+pzgMX49IEuDQ6JnlIWLwhmytH/9hjCfIbp:B6ydCA0c6qwXV9/sT+pzgV9IbDTJnlIR
TLSH
T193835A10A6A051FAEB63D075C2639F63FBB4B6C12395935F1092C65E1F33782AE39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_sqlite3.pyd
Size 123KB
SHA256 64b51df2805c58b023a875e8ae3be7ac7f61ef664f32ca6c90f6315da47ef0bc
MD5 ae09223d32af003b20889bd66a95b963
SHA1 e379a3da6add577aaf75f994629046358147c872
SHA512 02665bce35025502659c0ffb28135c1f28e9f2405c2097d9d14399ee105b5f48ee2ce3bef0af4f8f4869ef3a4a71a52460ef5ab518bf37cdcaa083b066cc129d
SSDEEP 3072:x6do0MLJqhPqauH7Ceq45yqqdhOBIWOQJf:xm4UpqauH+Y5OhOT
TLSH
T1D6C33A6B635800AAE5B75278C1734A03EBB5F562133153CF41A0C68A1F377C66F3AB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_ssl.pyd
Size 175KB
SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
MD5 ed9242721197fd84231b38e6b42f3f55
SHA1 4333b9d43a120a6528f63cdba798c8153e8bfdfa
SHA512 9b4b94f6bf927c07e2e63bc6ee6140ec090c3063dee920d609dc49cb5ce30653ca2e32f4d6f700969082b79b836a276aa1c2fb17cf53f02c2d4f207a1f0d3552
SSDEEP 3072:l+59j9Gd6wNsBjj903ff6X32RP0o/aC6osf87vOifHZHmziXpIWC7Cz:l+v9Gd6BtGPf6X3fUaC+2Xp
TLSH
T1F2048D47B5841AB7D813E4F9C2234903DBB1F155331257DE48D6E6890F03B4AAEBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\_wmi.pyd
Size 39KB
SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
MD5 c7427027acbd9a0076b598fc71ee45a5
SHA1 cc2ab52f295e588f8bc99f23cc25467d7bfd9732
SHA512 e9ea1748c317b8439425306d44593a1210c552bd28cdbb20df2bf8e18041ea76d1c666e5fd2cc03268d48b5982f01de71136a079f083f4a62cab06d91fd114f4
SSDEEP 768:iEkKOex+l0WgNQqDpIWCiWOytxJEKrLy2Ip44oTxf1mltPRVQgM:iE9OtyNQqDpIWCiJytH/94UfIZReF
TLSH
T1DB037D89E6A80046EA63DBB5C9A6CE53F471B7D35B11D38F365582990F233C0E739329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\base_library.zip
Size 1.3MB
SHA256 719b8d02acd722235487d475e87877816ff7588615c67c475249b006e32df746
MD5 5bd9a2db2982afca94909bacd37f7d42
SHA1 fff424d2cee4e7ae66e1ccef7480b438a5ec1da0
SHA512 ef6471b47dfae938589e22c74bdb84054caf012e576f43cdce276377de1688711e90e2603d2340b2b0edaf92f7a1c7275427eb76e7903f3faa1b83671da034a5
SSDEEP 12288:nRy/sU8lJGUmMrmn9ouHbP1dmBNN9W6p5ynVTVihlyixmpvQXMHYx2/Hd2:nIx8lJGUr69vbP1dml9xehE2/Ho
TLSH
T11955D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\charset_normalizer\cd.cp312-win_amd64.pyd
Size 113KB
SHA256 2bdbc0805f85565d76f8d6166e451bfafa6d5490b06b36c9f423cd0102b4f149
MD5 cb0ac741f806ea3a125aa835581ccbc9
SHA1 f34b3185f71e146d5d30c4d59b906d105c500cdd
SHA512 32200492cdcaac9512e47014c817f28b46a096199d74a1f9961b2903ac8d5d218856c23bbab84600050d1ada35d85daee45fb0fd894adbb1f84bdca952fe27ff
SSDEEP 3072:1UJg/VQjcmGF1nFedeA4nw3toSSpv3BQRZc9rt:1k2e4tF1nFed7EitoSSpfMc9r
TLSH
T1C3B34C13B2E00097E96791B488737A23EBF2B0121B116BDF52A0C5563F53DE67ABD742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\charset_normalizer\md.cp312-win_amd64.pyd
Size 203KB
SHA256 b08be5d29125f39a92e22d0abe4b9160753f7a790fffd07258319a8e16394afa
MD5 4ec3983b56120d2c8fca948702bebfef
SHA1 e3c348615915cfc0c9e6abd6b5d911af09b86a07
SHA512 bf49691cce6bac4caab4a9a1e5f30fdef37429d38cac57a6e3bece53d27c104a32d7f19a33b5f2416ff9b27f138f2ed0d5bc37696ba28ff767022099fcedde4c
SSDEEP 3072:Qipl2ZTOJ3ii7Jg3kxq7ci6mRkJk20jl5u0ukeL+j3WPENAjx:QiMe8Qi6Cky5XyPEN
TLSH
T1EB144B56A2A4108BFD67A0788873A533F7F370116B1179DF0A50C6653F23ED9B2BE285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\python3.DLL
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\select.pyd
Size 32KB
SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
MD5 74b93bc6c37d47011f92024f060c6784
SHA1 0e9cd2e881ad58818fc75b1fda765841995a92dd
SHA512 7c92a9c3d676ebf5211b93c7e44cbc77e17925d2ccaba97aa9b52d3fb4050e746ea4a86e82f9553717ddeffade3aaf518563a442578899bc05d65cac57031b58
SSDEEP 768:gFOLHfEDnlIWQGiOytxJEKrLy2Ip4MTxf1mltPRVugwH:gFOL/EDnlIWQG9ytH/9gfIZRsXH
TLSH
T146E27D8AAB245087F963CA7186A2CE43F939B7E3471146CF30A5D2991E237C1B73A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\sqlite3.dll
Size 1.5MB
SHA256 8daa45684bf6688fca28d956b2e8942f2fa98f656675ce68e6d61dd869848a7a
MD5 8748951063b31a52634ac22d77072b1f
SHA1 486538dec4bbee6e4133de679b95a6d22c2184b3
SHA512 f71a8afcb65cee6d44842c8270805db77eaa1f943c4bcb9b8c7dbf030ad4ed84c7fea2277c581da1deb5fd7e93ae33f683e1d367180e681dd47dad51bcc29666
SSDEEP 24576:R5NomuyEciwLghc4NFU68guPx/ns2h6RNbc4eOL88TG04MIXTbjlsWA:wJjNx8guPx/s5R2s88TfUbju
TLSH
T10A759C4BF2B801ADD0A7C1B9C51B570BEBB174051B74A7DB5190CA692F23FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000c702\unicodedata.pyd
Size 1.1MB
SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
MD5 24921918fa1451e9424881aa2867b175
SHA1 799de1d302eaa9622d2367bb2df5b71a98fca9a5
SHA512 3c44cff1efe1b0484d9ae9cac5576b737253eca9a4e86a7fcd534fc563e2a705c23d9fd9ca0eb41f61729622a532ecefc25c12b4c95dd3290ebcb3286519fecd
SSDEEP 12288:4SfHdcM6hbwCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99Ffcivk:4SfXVCjfk7bPNfv42BN6yzUivk
TLSH
T140355BC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Crashpad\settings.dat
Size 40B
SHA256 6c22a8a164ac79a3bc16b3e9ff00dc367f8517a90250b383694d70cc02ad7507
MD5 357c89a70448cb2d5aef0e08c57a150f
SHA1 a19ae04a78c897210629f8979f10fb25a0d9fb8d
SHA512 c6b5f764d41f2884cf0bae421fb7be281b1371b0b33215aaaebbf29d9a0593318a38d41a3e7335976b5c8f8126ed0605eef930a5f3c267f50b630e827585b070
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\rookie-abe-udd-2beeb758d5ca558d\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download