luna_stealer | d7d29963cac27925b87c05d73610e09ab4f2cdb5c961ce5c6b50e71d4f2e7f16

Analysis

max time kernel
151s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 57.4MB
Sample261016-behynafw4k
SHA256 d7d29963cac27925b87c05d73610e09ab4f2cdb5c961ce5c6b50e71d4f2e7f16
MD5 e76019f863d1f2476165666366f24b92
SHA1 bb0bf650579c3d3bdbeb0d4b7bf583ba6bea7afb
SHA512 a391806077d80a472f96cd24d9d8a980dd34761e17f70851ade96b5f97bb009345b1fc443bd4309ae34aa3a12210eed8138fbc6aec95e940a7c23aba0da46911
SSDEEP 786432:CO9gAkQ5LcyQVjgcFGW/7/XM1jzVnPhvlfMwA:zgseBz/bXMx5MwA
TLSH
T1F7D73351B7A918A6F8EA12399CB3D496A1913BE50370CDFF4B494B803B7F5E4193CB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution luna_stealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
stealer luna_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4428	powershell.exe
4532	powershell.exe
240	powershell.exe
2936	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2936	powershell.exe
4484	cmd.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5564	cmd.exe
3152	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4484	cmd.exe

Loads dropped DLL 34 IoCs

pid	Process
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4484	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	api.ipify.org
1	api.ipify.org

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001c68c-180.dat	upx
behavioral2/memory/1836-183-0x00007FFCCBC10000-0x00007FFCCC320000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ed-189.dat	upx
behavioral2/files/0x000b00000001c63c-191.dat	upx
behavioral2/memory/1836-194-0x00007FFCE0FD0000-0x00007FFCE0FDF000-memory.dmp	upx
behavioral2/memory/1836-192-0x00007FFCDCB70000-0x00007FFCDCB99000-memory.dmp	upx
behavioral2/files/0x000c00000001c5eb-195.dat	upx
behavioral2/files/0x000c00000001c5f1-197.dat	upx
behavioral2/memory/1836-198-0x00007FFCE0EB0000-0x00007FFCE0ECA000-memory.dmp	upx
behavioral2/memory/1836-201-0x00007FFCDCB40000-0x00007FFCDCB6C000-memory.dmp	upx
behavioral2/files/0x000c00000001c5fa-200.dat	upx
behavioral2/memory/1836-203-0x00007FFCD5B20000-0x00007FFCD5BA0000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f5-204.dat	upx
behavioral2/memory/1836-206-0x00007FFCDD160000-0x00007FFCDD17A000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f4-207.dat	upx
behavioral2/memory/1836-209-0x00007FFCDF0F0000-0x00007FFCDF0FD000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f9-210.dat	upx
behavioral2/files/0x000c00000001c5f0-215.dat	upx
behavioral2/memory/1836-218-0x00007FFCDC210000-0x00007FFCDC224000-memory.dmp	upx
behavioral2/files/0x000b00000001c63b-217.dat	upx
behavioral2/memory/1836-213-0x00007FFCDDA60000-0x00007FFCDDA6F000-memory.dmp	upx
behavioral2/memory/1836-221-0x00007FFCC9E50000-0x00007FFCCA44C000-memory.dmp	upx
behavioral2/memory/1836-220-0x00007FFCCBC10000-0x00007FFCCC320000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f7-222.dat	upx
behavioral2/memory/1836-226-0x00007FFCD35E0000-0x00007FFCD3615000-memory.dmp	upx
behavioral2/files/0x000b00000001c63d-227.dat	upx
behavioral2/memory/1836-228-0x00007FFCD0B80000-0x00007FFCD0CCD000-memory.dmp	upx
behavioral2/memory/1836-225-0x00007FFCDCB70000-0x00007FFCDCB99000-memory.dmp	upx
behavioral2/memory/1836-233-0x00007FFCD5AF0000-0x00007FFCD5B16000-memory.dmp	upx
behavioral2/files/0x000b00000001c695-234.dat	upx
behavioral2/memory/1836-235-0x00007FFCCE930000-0x00007FFCCEABA000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f6-231.dat	upx
behavioral2/files/0x000b00000001c689-236.dat	upx
behavioral2/memory/1836-238-0x00007FFCD2B70000-0x00007FFCD2B8B000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ea-239.dat	upx
behavioral2/memory/1836-242-0x00007FFCCF7B0000-0x00007FFCCF88A000-memory.dmp	upx
behavioral2/files/0x000b00000001c68f-241.dat	upx
behavioral2/memory/1836-245-0x00007FFCDBF10000-0x00007FFCDBF1D000-memory.dmp	upx
behavioral2/memory/1836-244-0x00007FFCDDA60000-0x00007FFCDDA6F000-memory.dmp	upx
behavioral2/files/0x000b00000001c62b-246.dat	upx
behavioral2/memory/1836-250-0x00007FFCDB970000-0x00007FFCDB97B000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ae-251.dat	upx
behavioral2/files/0x000b00000001c697-254.dat	upx
behavioral2/memory/1836-253-0x00007FFCD2990000-0x00007FFCD29CF000-memory.dmp	upx
behavioral2/memory/1836-257-0x00007FFCCBB50000-0x00007FFCCBC0D000-memory.dmp	upx
behavioral2/memory/1836-256-0x00007FFCD35E0000-0x00007FFCD3615000-memory.dmp	upx
behavioral2/memory/1836-252-0x00007FFCC9E50000-0x00007FFCCA44C000-memory.dmp	upx
behavioral2/memory/1836-249-0x00007FFCDC210000-0x00007FFCDC224000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ec-258.dat	upx
behavioral2/memory/1836-261-0x00007FFCD0B40000-0x00007FFCD0B76000-memory.dmp	upx
behavioral2/files/0x000c00000001c5b5-263.dat	upx
behavioral2/memory/1836-266-0x00007FFCD5AF0000-0x00007FFCD5B16000-memory.dmp	upx
behavioral2/files/0x000c00000001c5b6-268.dat	upx
behavioral2/memory/1836-271-0x00007FFCD4C40000-0x00007FFCD4C4C000-memory.dmp	upx
behavioral2/memory/1836-270-0x00007FFCCE930000-0x00007FFCCEABA000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e2-272.dat	upx
behavioral2/memory/1836-273-0x00007FFCC9BC0000-0x00007FFCC9E4C000-memory.dmp	upx
behavioral2/memory/1836-267-0x00007FFCD2B50000-0x00007FFCD2B61000-memory.dmp	upx
behavioral2/memory/1836-276-0x00007FFCCF780000-0x00007FFCCF7AA000-memory.dmp	upx
behavioral2/memory/1836-278-0x00007FFCCF750000-0x00007FFCCF77F000-memory.dmp	upx
behavioral2/memory/1836-275-0x00007FFCD2B70000-0x00007FFCD2B8B000-memory.dmp	upx
behavioral2/memory/1836-313-0x00007FFCD2990000-0x00007FFCD29CF000-memory.dmp	upx
behavioral2/memory/1836-326-0x00007FFCCBB50000-0x00007FFCCBC0D000-memory.dmp	upx
behavioral2/memory/1836-343-0x00007FFCD0B40000-0x00007FFCD0B76000-memory.dmp	upx

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2612	WMIC.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3912	cmd.exe
5448	cmd.exe
464	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3912	cmd.exe
5724	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
464	cmd.exe
5772	netsh.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5724	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2612	WMIC.exe
2612	WMIC.exe
2612	WMIC.exe
2612	WMIC.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3152	powershell.exe
3152	powershell.exe
3152	powershell.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2936	powershell.exe
2936	powershell.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
4532	powershell.exe
4532	powershell.exe
4532	powershell.exe
240	powershell.exe
240	powershell.exe
240	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: 36	2612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: 36	2612	WMIC.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeIncreaseQuotaPrivilege	2936	powershell.exe
Token: SeSecurityPrivilege	2936	powershell.exe
Token: SeTakeOwnershipPrivilege	2936	powershell.exe
Token: SeLoadDriverPrivilege	2936	powershell.exe
Token: SeSystemProfilePrivilege	2936	powershell.exe
Token: SeSystemtimePrivilege	2936	powershell.exe
Token: SeProfSingleProcessPrivilege	2936	powershell.exe
Token: SeIncBasePriorityPrivilege	2936	powershell.exe
Token: SeCreatePagefilePrivilege	2936	powershell.exe
Token: SeBackupPrivilege	2936	powershell.exe
Token: SeRestorePrivilege	2936	powershell.exe
Token: SeShutdownPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeSystemEnvironmentPrivilege	2936	powershell.exe
Token: SeRemoteShutdownPrivilege	2936	powershell.exe
Token: SeUndockPrivilege	2936	powershell.exe
Token: SeManageVolumePrivilege	2936	powershell.exe
Token: 33	2936	powershell.exe
Token: 34	2936	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5364 wrote to memory of 1836	5364	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 1836 wrote to memory of 5448	1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 5448 wrote to memory of 2612	5448	cmd.exe	93
PID 1836 wrote to memory of 464	1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 464 wrote to memory of 5772	464	cmd.exe	96
PID 1836 wrote to memory of 5564	1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 5564 wrote to memory of 3152	5564	cmd.exe	99
PID 1836 wrote to memory of 4484	1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 4484 wrote to memory of 2936	4484	cmd.exe	102
PID 4484 wrote to memory of 4428	4484	cmd.exe	104
PID 4484 wrote to memory of 4532	4484	cmd.exe	105
PID 4484 wrote to memory of 240	4484	cmd.exe	106
PID 1836 wrote to memory of 3912	1836	2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 3912 wrote to memory of 5724	3912	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Users\Admin\AppData\Local\Temp\2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /F "C:\Users\Admin\AppData\Local\Temp\2026-10-15_e76019f863d1f2476165666366f24b92_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 65KB
SHA256 fc0947e5a831d1e6ff6f3c481bd05ff8af27512657c1b86b22a491056732f624
MD5 2592dd00fb6e515184ef9216a588158a
SHA1 af4524e813491dbb498e32c5e013f211367df298
SHA512 7b7843572edc3290aaddfcc74ec76e83aa8b5b0f4069119551c50ef118acf2f2305c6ec934fc39b457d29c175ce1b29e0634bc4070dae7072f06cb4bd7d04212
SSDEEP 1536:kjLPJwgEfzjHFoSVlyvIMImWhULFxZVaQRoEK2HGVIRqzd9ld:kj9BEfzjaSGUoLnaFEKASAqzd9
TLSH
T1EB5302F9BD97BC3FC42858B44F4A6908A1567502996C0B0F0CEA913A8F7B790ED3F141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\Cryptodome\Cipher\_raw_aes.pyd
Size 18KB
SHA256 1fddca220064cb5446108ebea2474b22514face3ed6edd8c293724fd36a68333
MD5 03e4064cc37956e222511c969f5a2c7c
SHA1 272e0abc7a8613ffe72b17de7ac74f78badc3102
SHA512 daceb3db5a47f4cf5d9f6067976b98e6bb3a8ac247043a5f5809db9fe9b9ff3c94be3c064e15e6dc6465ad38e0f36f77cf822f7d2695cd6b8d720114bbf78d75
SSDEEP 384:KI0iKYmWedZQnCb5g0Fp9MzVECN7aOZa7gJX2:KIAtcCb5FMz2CN/pG
TLSH
T1F182C0E7F2B9D2F9C2E5CCB212A6CA947711BB077552232F05E1207F6DB5B603931990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\Cryptodome\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 c650ef0594416d9a074b0947c492333d8b1567ca62b729b05642a65dfd64fd5a
MD5 2688232f36e47997b549a8038d0fba48
SHA1 06529454dcd2a694674a013150e673c68ec7f3b7
SHA512 1c34367ecb0586fe1a5f0650f1eb2ef392148a44e42872d1b1b276a344cccbd644e3d8fa87d42f4e53abe76f71badc76536e1a4132ef885554426194a9375883
SSDEEP 192:spZd0CrWWuE8EXdrArlnNNVvUSyZM4feDHH2kkYj273QJXlEnP:PEuEnX+RXVvD4oWkZa7gJX6
TLSH
T181328EEBC22FA6FCC551847205578C94F770742721295B5F08D826FE0CF63606A38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\Cryptodome\Util\_cpuid_c.pyd
Size 10KB
SHA256 d4a2285c0a24e570edbf8b608b6c92c870f06c64cf35e5c6218b4c89bcf8704f
MD5 90ac89e8a4e47cba9edfc02c20e16f43
SHA1 ea2203a012552816ae5ce8e3a7b7d6f75c7c3d80
SHA512 f0a0e6ae3341f930acb99485ce69515fd2ca996bb62a92dfda09212cf9b3b4b20587bfe53d4d9c4a80ac45ddb726d22bfa916ea4014158c4986bb740d49f914f
SSDEEP 192:snZluowiOQNS/1F6i8mXIoFLgSWigeAR:WubiOTD/XIoF8SWqA
TLSH
T14B22070CFE6249EAD96581B9C4674E4AB17ABB101723B38F0330562E1EE67C76126B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\PIL\_imaging.cp314-win_amd64.pyd
Size 794KB
SHA256 e0716f4252d855821aa7ca008cb47fd5cf1d85145755fae0bc60c637630b3fe3
MD5 0dcac3113740b09c7d31bc69a211b3c3
SHA1 51f1b5aa95c9ab8977b755d70e0cfe91078ca34f
SHA512 d9d74b670010077e4a532549bcaa7a769e7000731638791e4e02724d44d0fb4c7424ba2a387a007486b1ba93752134ffebffcf078f29424b27d1fdb8576894e2
SSDEEP 24576:UYxBHt37h0INYkxJAMhBYiB/Ez8o2q+b:U037hMkrhhuW60
TLSH
T146052339AB3E5D16D03675BF1407E6196CB27C943220832C5E94C44AAF19A8FBF35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_brotli.cp314-win_amd64.pyd
Size 287KB
SHA256 d0fbae29f10241d5e7a93ed006de2653a98de0102429c3a6abb7f1ecd9bf2cb2
MD5 db32990e469739c173dd02ec4ce3c005
SHA1 90e25208e2fc66dadfcb4e0307063fe53a45b36f
SHA512 85be4aa5d954e3d4fad9e2663499bfa8423d9457760ab61224d0a78d14694e22792129bc7719f808874f250c07993a2075be1a378eb3609b93de51d3e55ef090
SSDEEP 6144:6FfzcY3YLeYOz99mZK/Lu5LbfHDz9Zv5rf8uk:61zcY3Y2zoK/LYb/f9Zv54
TLSH
T1415423DE586E811DE48056B78CB0359AEB3A54D698BF8B8F1DD3E58ACECC1053791E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_bz2.pyd
Size 51KB
SHA256 ed2620cd1ec341584aa21858687182739480173ad72a22d5cad6903c02e0d922
MD5 abc49acc593201b2a5b341094f6fb4bd
SHA1 3b5163b53da3a7a86c4e70b789ded1f1bb9d5fcd
SHA512 f93cd5001bba94568b907c988c1ddc2f48477b4d15fe622505ed3ca04fd202c71c51edabc3229d0c197d7612497280c85b3ca0ee9b870f8323407f3e65201dc5
SSDEEP 768:Sp9UbRjquqzvesSrbxi6HNd5GRHptvIE3VWsRyb2Zegc2Ip4eTxf1mlRaXa6R:14uAvejS3vIE3VWGyb2QS9+fIYa+
TLSH
T15133D0D28478C059DF6365B1A1E8CA81FF39A7D7849AC766309EB1950E133C2AB42376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_cffi_backend.cp314-win_amd64.pyd
Size 71KB
SHA256 67e45ef75e8ef29f517a14f4f66bae12376782c02ce65dc567c952d5b2e41f55
MD5 22578a3a10a59da0c19f242a242cafca
SHA1 f8b6ac6b13a8e72f27a13a52842b674327df2952
SHA512 63d93c03f00403e896133ab912c0cdf6c0c4f97dfe267100ed182e96294485f0f5662b54f53222d251d9e9c901c5ec0cf4078f3cd1caa6f8493b42b0b52ac751
SSDEEP 1536:i8R6JxceNisvSvcAu4cqOyJwZhO1oFMovrxbhH7EOMS:XRoi3vcACKwZhTFbv1b17S
TLSH
T14163023B6275F6F0CC103BB2402446C09577260F6027DF7F46E48E7E9EBA2762994B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_ctypes.pyd
Size 67KB
SHA256 fdd830dda80d48dfbb3ad4ff56e3fb1ca4c2697a868ad837ebd55699701bebae
MD5 56f447bcc2a0b675cbc84e7c91985b04
SHA1 2f9cf0f3b35760e87e42b45fec61eb5dc509d702
SHA512 aa8798455c21185779d010af9b580db99d683ea30b927f52d713f8f3920e5806e22ea8145164de569ca12e66a3eade9f7d84135f0860fe3d650c55f942c80628
SSDEEP 1536:ybsbmBbLGANJWgjKREWRRiTlJ4LzIEGPJLyb2QS9lYfILoZ:PYbSA6+dSITlyHIEGPJCsC
TLSH
T18063F145402DA25FEF276D72E2E5DE53BE39BBD39919572B20DC91FA4B133C0AB01221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_hashlib.pyd
Size 38KB
SHA256 bcd9edf5c840df630cd2248690659aa3f52021e25cdc37ed09ad4bae654e6029
MD5 19c66b57eee224b1a438447192795b9d
SHA1 26381421af44bd1e7fc69d2b4a909460a296d963
SHA512 4e77d1ca7c8e952a4ea106e90461eb6dcd05b5678098dc2babb02f79ef249dde490924d7fcbd0878861fd89988f6d18985528bc7fab49a85ed19a8dcae97c3f9
SSDEEP 768:9FzCaLH2eWtTkvVE9k6p2v/fS4pqpIEDILMyb2Zegc2Ip4/Txf1mlIJ/lgz:LCHPp2v/fCpIEDILMyb2QS9FfIk/w
TLSH
T1EA03BFC6497CD123EB63A971B2F0D9C2FE3877E39482476770E9A1C60E533C09726229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_lzma.pyd
Size 88KB
SHA256 e0398ac51df1cc96cc476c3c722c38d90fc27b448b2af2d3b79f9348898e0ab8
MD5 477a2ce37f6523fbed4d40112a5224f9
SHA1 f25678c72844dd42038900256bf3902a12ebf51c
SHA512 88443b19b0456d1640bbfefb679f061cfaba964b45bbb2c78514826c8fd5a4fd97e2ca42567cdf5370c90098bb5c4377680b231d804818a3b24cdd606d008557
SSDEEP 1536:6bCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwT9MlIEI1Jryb2QS9kfIbH3vH:3ORuGFt/HkG/G4J3b4GwTQIEI1JiaT7z
TLSH
T1079302D7C7B88162EF93397072F9C6427D3593D78626439320EFB1560E623C4A3A2675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_queue.pyd
Size 28KB
SHA256 5de0439ac71cb9888ae25433fa360e479b3a6e3aebca55106b10edbb9cdfbcdd
MD5 395cedfc979cee59a0520b751feb3229
SHA1 6367917cca8bba62810f1e0ca1dc4ffeee36ebea
SHA512 d65b33390f45fe7995c8b0f26d19157935815815fc22578dded63604311b0ac71acf06ab3e2f3df05cc011d87f62e850a249e9b03b705c20940637acf8997731
SSDEEP 768:L2YI3si/fuHLOiNNgpCnIERUL7yb2Zegc2Ip4KCTxf1ml6Z+7UOFgI7:LpHqiNlnIERUL7yb2QS9KafIL5t7
TLSH
T12AD29FD6427C902BFA62BD71A1E4DD82FD35BBD36811C71B30ED916A0E573C19312275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_socket.pyd
Size 46KB
SHA256 caf14ef54adc3f4e2b5102a0f81c9167f7d03d7b88091715db806938d92a58b7
MD5 acd7c355a487da07be20cbbc7366cef2
SHA1 38b0826bb7432a41f83f4c9442ae907cf99634e0
SHA512 06ca0395d765f30ef4bed3880a42f0d3051153134a8fb4ff420f7a7f0daa691a335a9310a4bd8bf1762ed38388858d90e41d0e5f92317e7bc07c4f5cb238d7b1
SSDEEP 768:ftxHNsJgrvA+zGJ6Sz835gmyDhFjSp8ip9qFIEGwWYtGyb2Zegc2Ip4IgTxf1mlM:GUkIg1FGp8gqFIEGwWAGyb2QS9IsfILQ
TLSH
T18B23D0E7813C816AFAB2ADB051E5E987F939ABD31812D757309DC16A1D633C2DB02364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_sqlite3.pyd
Size 61KB
SHA256 d97b7012d5a3660c139428c41108d8ad4f61689bc08fa2f77f1a71aea1ff791b
MD5 c11a77e3ba45f4200efa1e3434842708
SHA1 3abeeeb4abc011fc4a652907b3ad3d64e73daf11
SHA512 323976f75daaf220099ce1f1470d26cf7dc7324c2273db0c3a372e5404605ab1f13e0d72f489e7bcfa4e60fa4aa6f5479dfac3c4a10a9825696e160f78964518
SSDEEP 1536:i/xxSi9/1wTZl7HdWbknLeZHJRIEDQG3yb2QS9jfIbH5vGV:ox3/1wn9WBIEDQGGPTa
TLSH
T18553E0D7427C8105EBD3EC72A1ECC9A1FA3957D3192592BB208D13B71A133C1AB6721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_ssl.pyd
Size 70KB
SHA256 c3112ac26d43e04fab0876150bef7370f2f1937b279159a064be3575f730c920
MD5 026575e093a012e6138da80ec8a0d4c4
SHA1 17326cc6393f9eb0846a52a565566d0ad947bb78
SHA512 c6ce1f59e593c8cd40f92a3d63233f71b775b99e83543b71733b97f726f58aee6a7c5f31ae5474986e0452d546401d60fd5fcc1903f514bb07d4a6b4b24fb273
SSDEEP 1536:6iIgcDzxhzH+yPByzumP7gpyJ0rRWKikGm5DiXzjRIE3750Nyb2QS9cfIbH4vGh:CjDz3ayPo7gpqA9RiD1IE375vuTT
TLSH
T1DC63E1D315B8C177F9A265F1A294CE86BD306BE7A4528277746991FB0DB3390E302385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_uuid.pyd
Size 27KB
SHA256 7e2cdd954b44b1be1fac1c354f774dab5f5becfce59688e62338427b125c62bf
MD5 95c21bb568ebfcf746c742c6fd2b513a
SHA1 5c5cc0120bc6df6309ec2828fc7f8c2efc75bd1f
SHA512 3c83bcbaa6faebce7d6a4b002be74f09632cec0f33f4b3af48709ff27d0aac52452a334f659183c61b18d62c11be7947556aabefe43d1fd1622be6d7fffc0c11
SSDEEP 768:0N15ckIEIwtmyb2Zegc2Ip4CTxf1mlIJhlg4x:0N15ckIEIwEyb2QS9afIkh5
TLSH
T171D28DCA9A788057FA5386B0D0F2DF43B979B7E35A11475B3166D1860E133C1B31B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_wmi.pyd
Size 30KB
SHA256 809156eb94ab9b664ddbb9bb3abbfef82157c5f464469cf1f41cc136f4b17303
MD5 5c14fdbe0b9b17f2db71a7507df45bbf
SHA1 cfaa914b3b3f1286d323299ef76d93380edae908
SHA512 b61681648f09c941dd03bddb95d63f8bde435771f2d4e9538471c4665fd1dc43c3674bf5a6250fd51f1eea6c6820cad3a60fc8c3564c3cd082409714501be9ae
SSDEEP 768:5+So74TudMdaHYKppLTlIE3irhyb2Zegc2Ip4dOTxf1mlIJHlgMX:MSoUfcYKPTlIE3irhyb2QS9ofIkHt
TLSH
T173E2AFD6457C922BFEA3AE71A2E8DD83F6357BE34416466730D992D60D233C1A302279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\_zstd.pyd
Size 176KB
SHA256 67b8d391a49a3532617f0865b13e9127963a768c9fdd9389d6220cef4acbb3c0
MD5 537938d91d30a74b09dec12cfebe86eb
SHA1 b923a619f1612a240a94598e8a24996289db2292
SHA512 f0b47f297bfd43c52fb783a4058959d9f37469042ef67073a695a09a4ba87fcb4df4b7393b21158f31c4c56241e034ad2b9fd0e74bfae7b82634a1b21971df87
SSDEEP 3072:j9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpehsyIEIMYkXS:xqtPIR0vx+m/n4q6Z7suz
TLSH
T1F104128440AC516DE1C376B17598DACB2A7C47B368481FB3B0BDA1930AB3B90BF553B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\base_library.zip
Size 1.3MB
SHA256 6f6dd5cfe29eddda57eccda8767ffcef9c82b1df58c131130a3b5b5dafe6d261
MD5 79680c9faf6d740623f1fc9200c6e488
SHA1 348c94af03555f43ec81450aa5e59d58fcf4216c
SHA512 618908e4589c2dbbcdc947a0e388922fafb2c782af0fbc9f82b626b5f094050a4dbb7a7aa7a3cee5ecbf398b55d31032c6c536b150fae00d21fcff0e4250a355
SSDEEP 24576:rDZ/aRZSNuUFwQeOdP2m2dfuYtV3lblLJpd1:rURcuUFw/mY3d1
TLSH
T1E6552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\charset_normalizer\cd.cp314-win_amd64.pyd
Size 9KB
SHA256 fef3bac1260cf932494af7c2a5ce7893c6a39c6987b428a83e82de40b821d360
MD5 670e0e19b351c805a81ff84c1aeca3fe
SHA1 383f262ee7dfd6005f8dd31f280842981915405d
SHA512 ab56af290d68da565d453c992fe9bb87f7eca6bea74a86e4753f73a7df7b4e7bf2cec444acfb7d7f0a9972127204d288df96c811c64c9ac5b1b598d74bf69a40
SSDEEP 192:urgHGz0KDsBVFiXKYwYokYj273QJXEHcXD:v60K4BG6YBoZa7gJX/X
TLSH
T1DA124CE7E2AEE7FCC955647205674C98BE20BA37A1123B1F10E4317F8CE76C14A20710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\libcrypto-3.dll
Size 1.7MB
SHA256 f7f4ba827221ac54bd46979c13b64c2689d55ec2426f685a30c84a4d24644ce3
MD5 00f1ec3fa82fa3690e8d5c5daf1d521e
SHA1 bb39e5cb7e7248e8f3d5f7a20a0c15a5e8c965ed
SHA512 a9fe2e49682472e0a149342a1a39417afe9b1883f16288e3a6f9ef21a27a5d5fcda7f539263f85ad756b8847620c7c0cb960962da9dbe77e35c9af6966f6105f
SSDEEP 49152:xsWiURCvLmt/JLrZchkGQ/8joStJpSD90ozXRsNzx8TGU1CPwDvt3uFA0Cz:WoZ5NZchkDHStuDWOXRsdU1CPwDvt3uK
TLSH
T13785122024FFB80BDA85A974CF34CD66C56E17C2A348DFA02D7EDA4C1C14E1E16B95DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\libffi-8.dll
Size 29KB
SHA256 a7ac89b42d203ad40bad636ad610cf9f6da02128e5a20b8b4420530a35a4fb29
MD5 bb1feaa818eba7757ada3d06f5c57557
SHA1 f2de5f06dc6884166de165d34ef2b029bb0acf8b
SHA512 95dd1f0c482b0b0190e561bc08fe58db39fd8bb879a2dec0cabd40d78773161eb76441a9b1230399e3add602685d0617c092fff8bf0ab6903b537a9382782a97
SSDEEP 768:Op/6aepjG56w24Up3p45YiSyvkIPxWEqG:MA154spK7SytPxF
TLSH
T18CD2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\libssl-3.dll
Size 372KB
SHA256 9b6a3a95ebc04eb5c182841fe402171efb644f46a2e56e9d936a91a3e7f7707b
MD5 45186656e3c2a677e16b6faa1b7b1fe8
SHA1 4b79c113479dd06e5af2ea7d8b7f9f19f86dd04f
SHA512 377c5d1340af445951880f796c80f8c1281483b529ee1ca2d7cb138ddc39fe3a6356fae5d2f788066b9b91f8d278ceace6cd4afda1e27c119b288a32f5d3a534
SSDEEP 6144:Mt8PUIpPlz4mTgRgitzoDDVR9pb2in6likktITMFWIZ3YQkwlby:MafJB4MggiRo1tKitI4FpoQkd
TLSH
T129841292333F257BDC97EEB6DA38A1D9DA3CB7175B02D8573EA6D80005513CC62AE448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\psutil\_psutil_windows.pyd
Size 32KB
SHA256 6bedc0c2aef20f159cf83cb3c00f324274c56a87fccd6d43ab781fcfa443c16a
MD5 12a954fd8bd87c0878945229e7f12d96
SHA1 9b9b79fefb3cea5fb20dfca3aec86ccfdc155b34
SHA512 54eb02623acab7d09167b8f34c29895f50d9ab66e5350c490be633f173f5f7ba91cbc3f498752f56b89cd234cad0a1dcccf6d9549783eecb6497cf99e9808b09
SSDEEP 768:VYU5FhhiJBW2uvTwJ+874UVXaEAZz/ESjhsfojUpH:VYqhhiJVuvsjVpXAdco8
TLSH
T114E2F2C3E227B774CEAB6C331A5712685B89F0372698571B047990377D23AB6BC20C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\python3.DLL
Size 72KB
SHA256 f9acdbcf3383a52353f8d7db3cbda3d3701b1cf7ac3053985fdac766c29e7808
MD5 a4c7e7fbb2f0f342235ca96dbb32bb34
SHA1 d062c7950b28493358628979bdf13c7800cd3d10
SHA512 ecebb35a57893daf8345a1c58ec5081d9e5a5e3add7e65ec4c55e4165a635189d291da987a035c8fe3a473acfb2818a0f41e76cf5b9ca690316030de3fec5d68
SSDEEP 768:MQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIm:dbTrnXngXMcQIEG0qyb2QS95fIky6
TLSH
T12D735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\python314.dll
Size 1.9MB
SHA256 40467d080c21661b971b26ce4c18a5e4be9332f0e0d2faffd154492df9a14fd2
MD5 23261e6d1383121cfea4ca4ac935c116
SHA1 89308089f80aac3893b3e9b0ee4a60d64ed938d4
SHA512 c34696283b93520f207f5032f50b1dea9210114d9156e31eeaa73c2a6361e997653b18cbeeb5c585e08b2cd63c7ff28860a3197a6cdf525d7ae8bfbf9e7d9638
SSDEEP 49152:AV6XjCASJlIxAtZ5kEr1YkOsfT+O2ERuWg626:eAm5t/vhX+DEHg626
TLSH
T146953371591DD8F7EBFBB2F38EA3C546256E13E48010AEE2E4618283452B6525F3731E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\select.pyd
Size 28KB
SHA256 b20a440040de74df6f3ba9a99e29dc6693a6ca0763bd20b13eafbe1e43c40afe
MD5 88dc74b76a09f259d5fde2283d9a16cc
SHA1 1a037bd048a3fa864ae24676f479b74816ae662f
SHA512 024676244a15304aac572b143b5d7173c0e971d6e7f246b83b6f48c540f5a4168666f132185db1b56459deb2bb06ba3ffd10eb0adbbd44f0ff6e6ffca638756c
SSDEEP 768:hgmk8qSfU8xUzp9TrIERGLzyb2Zegc2Ip4QTxf1ml6Z+7U2FgV:hWcMTrIERGLzyb2QS98fILdc
TLSH
T149D290D345BCD16BEB639D7161E0CED3FD347BE36815871B30A992AA0E633C19712229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\sqlite3.dll
Size 663KB
SHA256 f44b1344defc294f6e9b4ba4974fc1629e0b66428e5912a320d57f48f98b4088
MD5 005f358426a2688f64166c9fb42f85fa
SHA1 b5a2b948596ca8489b361a96e6e471d43bcf138e
SHA512 84f0a85b2f9fb3553672b88426000588ef0d90b676ec6f0c9495790db4091193737cac81b8a035dcf123584ce0df7ab03c69e2fbd0d6edfe0a1dcda44fc02dd2
SSDEEP 12288:ak+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyvis7X9Cc:a1ojbGec2X5OzEVwFNEgIjNuqGKvJX9f
TLSH
T1D6E423C7261B8C47FDD04872D4F6B493AA2520D6DCF86A8BF5CCA7917CD91E0EA21231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014f42\unicodedata.pyd
Size 278KB
SHA256 6c7bada78f724dd8f458312eaa9abbe66472693bae5191cb3a82a8bba6f76be6
MD5 3dc9314c00598ab9b14ebc74ea4c69bc
SHA1 b2c9f886d8c86951c118936c3c915a32251598b1
SHA512 2b1480cfebbe005f62c250b1c8671944c86ea9c2b6bb7247c15be8be0ccf0b0cec9c6d773306d5b2b1ca657be6eda8f2d76fe2c5e21c62e930c0064983437347
SSDEEP 6144:LM2wOzg+xEMnuR/iaQcjGtTte+YT4vhBwEgmRhI45m6YCPCA:oj0EMnbYi87ehBwERopA
TLSH
T11054229741BC429BEAD2FF7585DE89626115EAA3EF08D061A0CD42B217B73CBD734036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pkdw5utq.bis.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkdw5utq.bis.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-357-0x000001B832800000-0x000001B8328CD000-memory.dmp

Download

memory/1836-221-0x00007FFCC9E50000-0x00007FFCCA44C000-memory.dmp

Download

memory/1836-387-0x00007FFCD2B50000-0x00007FFCD2B61000-memory.dmp

Download

memory/1836-233-0x00007FFCD5AF0000-0x00007FFCD5B16000-memory.dmp

Download

memory/1836-225-0x00007FFCDCB70000-0x00007FFCDCB99000-memory.dmp

Download

memory/1836-238-0x00007FFCD2B70000-0x00007FFCD2B8B000-memory.dmp

Download

memory/1836-228-0x00007FFCD0B80000-0x00007FFCD0CCD000-memory.dmp

Download

memory/1836-242-0x00007FFCCF7B0000-0x00007FFCCF88A000-memory.dmp

Download

memory/1836-226-0x00007FFCD35E0000-0x00007FFCD3615000-memory.dmp

Download

memory/1836-245-0x00007FFCDBF10000-0x00007FFCDBF1D000-memory.dmp

Download

memory/1836-244-0x00007FFCDDA60000-0x00007FFCDDA6F000-memory.dmp

Download

memory/1836-220-0x00007FFCCBC10000-0x00007FFCCC320000-memory.dmp

Download

memory/1836-250-0x00007FFCDB970000-0x00007FFCDB97B000-memory.dmp

Download

memory/1836-213-0x00007FFCDDA60000-0x00007FFCDDA6F000-memory.dmp

Download

memory/1836-218-0x00007FFCDC210000-0x00007FFCDC224000-memory.dmp

Download

memory/1836-253-0x00007FFCD2990000-0x00007FFCD29CF000-memory.dmp

Download

memory/1836-257-0x00007FFCCBB50000-0x00007FFCCBC0D000-memory.dmp

Download

memory/1836-256-0x00007FFCD35E0000-0x00007FFCD3615000-memory.dmp

Download

memory/1836-252-0x00007FFCC9E50000-0x00007FFCCA44C000-memory.dmp

Download

memory/1836-249-0x00007FFCDC210000-0x00007FFCDC224000-memory.dmp

Download

memory/1836-209-0x00007FFCDF0F0000-0x00007FFCDF0FD000-memory.dmp

Download

memory/1836-206-0x00007FFCDD160000-0x00007FFCDD17A000-memory.dmp

Download

memory/1836-261-0x00007FFCD0B40000-0x00007FFCD0B76000-memory.dmp

Download

memory/1836-203-0x00007FFCD5B20000-0x00007FFCD5BA0000-memory.dmp

Download

memory/1836-266-0x00007FFCD5AF0000-0x00007FFCD5B16000-memory.dmp

Download

memory/1836-201-0x00007FFCDCB40000-0x00007FFCDCB6C000-memory.dmp

Download

memory/1836-271-0x00007FFCD4C40000-0x00007FFCD4C4C000-memory.dmp

Download

memory/1836-270-0x00007FFCCE930000-0x00007FFCCEABA000-memory.dmp

Download

memory/1836-198-0x00007FFCE0EB0000-0x00007FFCE0ECA000-memory.dmp

Download

memory/1836-273-0x00007FFCC9BC0000-0x00007FFCC9E4C000-memory.dmp

Download

memory/1836-267-0x00007FFCD2B50000-0x00007FFCD2B61000-memory.dmp

Download

memory/1836-192-0x00007FFCDCB70000-0x00007FFCDCB99000-memory.dmp

Download

memory/1836-276-0x00007FFCCF780000-0x00007FFCCF7AA000-memory.dmp

Download

memory/1836-278-0x00007FFCCF750000-0x00007FFCCF77F000-memory.dmp

Download

memory/1836-275-0x00007FFCD2B70000-0x00007FFCD2B8B000-memory.dmp

Download

memory/1836-194-0x00007FFCE0FD0000-0x00007FFCE0FDF000-memory.dmp

Download

memory/1836-383-0x00007FFCDB970000-0x00007FFCDB97B000-memory.dmp

Download

memory/1836-368-0x00007FFCE0EB0000-0x00007FFCE0ECA000-memory.dmp

Download

memory/1836-369-0x00007FFCDCB40000-0x00007FFCDCB6C000-memory.dmp

Download

memory/1836-370-0x00007FFCD5B20000-0x00007FFCD5BA0000-memory.dmp

Download

memory/1836-371-0x00007FFCDD160000-0x00007FFCDD17A000-memory.dmp

Download

memory/1836-313-0x00007FFCD2990000-0x00007FFCD29CF000-memory.dmp

Download

memory/1836-326-0x00007FFCCBB50000-0x00007FFCCBC0D000-memory.dmp

Download

memory/1836-372-0x00007FFCDF0F0000-0x00007FFCDF0FD000-memory.dmp

Download

memory/1836-375-0x00007FFCC9E50000-0x00007FFCCA44C000-memory.dmp

Download

memory/1836-343-0x00007FFCD0B40000-0x00007FFCD0B76000-memory.dmp

Download

memory/1836-183-0x00007FFCCBC10000-0x00007FFCCC320000-memory.dmp

Download

memory/1836-367-0x00007FFCE0FD0000-0x00007FFCE0FDF000-memory.dmp

Download

memory/1836-366-0x00007FFCDCB70000-0x00007FFCDCB99000-memory.dmp

Download

memory/1836-374-0x00007FFCDC210000-0x00007FFCDC224000-memory.dmp

Download

memory/1836-365-0x00007FFCCBC10000-0x00007FFCCC320000-memory.dmp

Download

memory/1836-373-0x00007FFCDDA60000-0x00007FFCDDA6F000-memory.dmp

Download

memory/1836-380-0x00007FFCD2B70000-0x00007FFCD2B8B000-memory.dmp

Download

memory/1836-385-0x00007FFCCBB50000-0x00007FFCCBC0D000-memory.dmp

Download

memory/1836-388-0x00007FFCD4C40000-0x00007FFCD4C4C000-memory.dmp

Download

memory/1836-389-0x00007FFCC9BC0000-0x00007FFCC9E4C000-memory.dmp

Download

memory/1836-235-0x00007FFCCE930000-0x00007FFCCEABA000-memory.dmp

Download

memory/1836-386-0x00007FFCD0B40000-0x00007FFCD0B76000-memory.dmp

Download

memory/1836-391-0x00007FFCCF750000-0x00007FFCCF77F000-memory.dmp

Download

memory/1836-390-0x00007FFCCF780000-0x00007FFCCF7AA000-memory.dmp

Download

memory/1836-381-0x00007FFCCF7B0000-0x00007FFCCF88A000-memory.dmp

Download

memory/1836-384-0x00007FFCD2990000-0x00007FFCD29CF000-memory.dmp

Download

memory/1836-382-0x00007FFCDBF10000-0x00007FFCDBF1D000-memory.dmp

Download

memory/1836-379-0x00007FFCCE930000-0x00007FFCCEABA000-memory.dmp

Download

memory/1836-377-0x00007FFCD0B80000-0x00007FFCD0CCD000-memory.dmp

Download

memory/1836-378-0x00007FFCD5AF0000-0x00007FFCD5B16000-memory.dmp

Download

memory/1836-376-0x00007FFCD35E0000-0x00007FFCD3615000-memory.dmp

Download

memory/2936-312-0x0000024373750000-0x000002437381D000-memory.dmp

Download

memory/2936-310-0x0000024374290000-0x000002437429A000-memory.dmp

Download

memory/2936-309-0x00000243742C0000-0x0000024374372000-memory.dmp

Download

memory/2936-308-0x0000024374270000-0x000002437428E000-memory.dmp

Download

memory/3152-292-0x00000235FF5B0000-0x00000235FF5D2000-memory.dmp

Download

memory/4428-328-0x000001ED8A210000-0x000001ED8A2DD000-memory.dmp

Download

memory/4532-342-0x000001CA13100000-0x000001CA131CD000-memory.dmp

Download