Overview

overview

9

Static

static

3

2026-10-22...om.exe

windows10-2004-x64

9

2026-10-22...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 16:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 17.7MB
  • Sample261024-th496scw4l
  • SHA256 731e3a6adc9319aa2aac7809be7560e41d9633f1019c2211a0d04c44cd8d79d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 6 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 5 IoCs
    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 10 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6040
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5464
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /f /tn vncrypt_tick /sc minute /mo 30 /tr \"C:\Users\Admin\AppData\Roaming\vncrypt\tick.bat\"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\SYSTEM32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1924
      • C:\Windows\SYSTEM32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:5536
      • C:\Windows\SYSTEM32\rundll32.exe
        rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
        3⤵
          PID:3356
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut('C:\Users\Admin\Desktop\Unlock your files.lnk');$s.TargetPath='C:\Users\Admin\Desktop\Unlock.exe';$s.WorkingDirectory='C:\Users\Admin\Desktop';$s.Save();"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3060
        • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
          C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe watch C:\Users\Admin
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2216
          • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
            C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe watch C:\Users\Admin
            4⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:3288
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              5⤵
              • Executes a command shell one-liner
              PID:5964
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6560
        • C:\Windows\SYSTEM32\rundll32.exe
          rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
          3⤵
            PID:5264
          • C:\Windows\SYSTEM32\rundll32.exe
            rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
            3⤵
              PID:4400
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /create /f /tn vncrypt_tick /sc minute /mo 30 /tr \"C:\Users\Admin\AppData\Local\Temp\tick.bat\"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5660
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5916
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4328
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:5524
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:4852
          • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
            "C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "watch" "C:\Users\Admin"
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4940
            • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
              "C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "watch" "C:\Users\Admin"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3392
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "ver"
                3⤵
                • Executes a command shell one-liner
                PID:6800
          • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
            "C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "boot" "C:\Users\Admin"
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3460
            • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
              "C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "boot" "C:\Users\Admin"
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Sets desktop wallpaper using registry
              • Reads the TCP/IP host and domain name from the registry
              • Modifies Control Panel
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3744
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "ver"
                3⤵
                • Executes a command shell one-liner
                PID:6792
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /create /f /tn vncrypt_tick /sc minute /mo 30 /tr \"C:\Users\Admin\AppData\Roaming\vncrypt\tick.bat\"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:7080
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2480
              • C:\Windows\SYSTEM32\rundll32.exe
                rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
                3⤵
                  PID:404
                • C:\Windows\SYSTEM32\tasklist.exe
                  tasklist /fi "PID eq 3392" /nh
                  3⤵
                  • Discovers running processes
                  • Suspicious use of AdjustPrivilegeToken
                  PID:348
            • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
              "C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "tick" "C:\Users\Admin"
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1464
              • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                "C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "tick" "C:\Users\Admin"
                2⤵
                • Creates a file in the Startup directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Sets desktop wallpaper using registry
                • Reads the TCP/IP host and domain name from the registry
                • Modifies Control Panel
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1484
                • C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                  C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe watch C:\Users\Admin
                  3⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious use of WriteProcessMemory
                  PID:6924
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "ver"
                    4⤵
                    • Executes a command shell one-liner
                    PID:7152
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4884
                • C:\Windows\SYSTEM32\rundll32.exe
                  rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
                  3⤵
                    PID:4904
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /create /f /tn vncrypt_tick /sc minute /mo 30 /tr \"C:\Users\Admin\AppData\Roaming\vncrypt\tick.bat\"
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:432
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:3472
                • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "tick" "C:\Users\Admin"
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6292
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "tick" "C:\Users\Admin"
                    2⤵
                    • Creates a file in the Startup directory
                    • Adds Run key to start application
                    • Sets desktop wallpaper using registry
                    • Reads the TCP/IP host and domain name from the registry
                    • Modifies Control Panel
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:3748
                    • C:\Windows\SYSTEM32\tasklist.exe
                      tasklist /fi "PID eq 3392" /nh
                      3⤵
                      • Discovers running processes
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4268
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6696
                    • C:\Windows\SYSTEM32\rundll32.exe
                      rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
                      3⤵
                        PID:2160
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /create /f /tn vncrypt_tick /sc minute /mo 30 /tr \"C:\Users\Admin\AppData\Local\Temp\tick.bat\"
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1068
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "watch" "C:\Users\Admin"
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:6428
                    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "watch" "C:\Users\Admin"
                      2⤵
                      • Reads the TCP/IP host and domain name from the registry
                      PID:6780
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "boot" "C:\Users\Admin"
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:6668
                    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "boot" "C:\Users\Admin"
                      2⤵
                      • Creates a file in the Startup directory
                      • Adds Run key to start application
                      • Sets desktop wallpaper using registry
                      • Reads the TCP/IP host and domain name from the registry
                      • Modifies Control Panel
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:5672
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /create /f /tn vncrypt_tick /sc minute /mo 30 /tr \"C:\Users\Admin\AppData\Local\Temp\tick.bat\"
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1828
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Drawing;$bmp=New-Object System.Drawing.Bitmap 1920,1080;$g=[System.Drawing.Graphics]::FromImage($bmp);$g.Clear([System.Drawing.Color]::FromArgb(14,17,22));$f1=New-Object System.Drawing.Font('Consolas',44,[System.Drawing.FontStyle]::Bold);$f2=New-Object System.Drawing.Font('Consolas',20);$g.DrawString('YOUR FILES ARE ENCRYPTED',$f1,[System.Drawing.Brushes]::Red,80,300);$g.DrawString('https://t.me/waykuratdistrc',$f2,[System.Drawing.Brushes]::LightGreen,84,440);$bmp.Save('C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png',[System.Drawing.Imaging.ImageFormat]::Png);"
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6084
                      • C:\Windows\SYSTEM32\rundll32.exe
                        rundll32.exe user32.dll,UpdatePerUserSystemParameters 1 1
                        3⤵
                          PID:6592
                        • C:\Windows\SYSTEM32\tasklist.exe
                          tasklist /fi "PID eq 3392" /nh
                          3⤵
                          • Discovers running processes
                          • Suspicious use of AdjustPrivilegeToken
                          PID:7000

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          3
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Windows Command Shell

                          1
                          T1059.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Windows Management Instrumentation

                          1
                          T1047

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Direct Volume Access

                          1
                          T1006

                          Indicator Removal

                          3
                          T1070

                          File Deletion

                          3
                          T1070.004

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Peripheral Device Discovery

                          1
                          T1120

                          Process Discovery

                          1
                          T1057

                          Query Registry

                          2
                          T1012

                          System Information Discovery

                          1
                          T1082

                          System Network Configuration Discovery

                          1
                          T1016

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Exfiltration

                          Impact

                          Defacement

                          1
                          T1491

                          Inhibit System Recovery

                          3
                          T1490

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          .vnc_key
                          • Path C:\Users\Admin\.vnc_key
                          • Size 2KB
                          • SHA256 e214929b22ebbb26efe098228bbb52c554a356fdc26fec56a52a8cc618e61182
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          .vnc_key
                          • Path C:\Users\Admin\.vnc_key
                          • Size 2KB
                          • SHA256 7366f500cb0167b307dc5a94bd36803607a7269614024a701f559c53c0f5a7a5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 3adcc555847b396a321ab3057154394c7fc84886322d2d5cadacd0cca01ab652
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 b586274f78dfadc9006b860cb4df85e9976e7fed630cc5bd5edb419d28841aab
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          _decimal.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\_decimal.pyd
                          • Size 320KB
                          • SHA256 1fb076f03022f01c95c4422712053e0553127a324c3c3989acea8d600c931be5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _multiprocessing.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\_multiprocessing.pyd
                          • Size 37KB
                          • SHA256 f095e3798df2f63c3087871d3355696135725ad5b55df094c34ad42a3c355b7c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          INSTALLER
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\INSTALLER
                          • Size 4B
                          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                          • MD5 SHA1 SHA512
                          Submit Download

                          METADATA
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\METADATA
                          • Size 4KB
                          • SHA256 047cfc71226409de4318b360aef15c63a2adf609731e3dcf7fe932f14ea042ee
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          RECORD
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\RECORD
                          • Size 17KB
                          • SHA256 455da109c2b69a3c577a4a67f199660107e0950cbdf2aa728cf9c2323b5ece6e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          WHEEL
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\WHEEL
                          • Size 123B
                          • SHA256 de2a5913454d225e97751ebc9a50f508c0999e346a47f777f850a6945a9d4619
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          LICENSE
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\licenses\LICENSE
                          • Size 197B
                          • SHA256 3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          LICENSE.APACHE
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\licenses\LICENSE.APACHE
                          • Size 11KB
                          • SHA256 aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          LICENSE.BSD
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\licenses\LICENSE.BSD
                          • Size 1KB
                          • SHA256 602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          cryptography-rust.cyclonedx.json
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\sboms\cryptography-rust.cyclonedx.json
                          • Size 44KB
                          • SHA256 7e64f80c87ac3ebfdc08626c7ebd819bfca74e3f56e1f7c263465295cb5ceee0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sbom.json
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\cryptography-50.0.2.dist-info\sboms\sbom.json
                          • Size 1KB
                          • SHA256 5b5eea08dd952a16eef188f7a85ad439a4409efa0e2bce9ca339a4de9c8db3f0
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          pyexpat.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\pyexpat.pyd
                          • Size 230KB
                          • SHA256 939ad5e268d3f6f365b900570a9a8118b4fef6e2c6456d4da0949dbc8fbe7788
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          select.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\select.pyd
                          • Size 32KB
                          • SHA256 63b91cac778f46e3e01545b3f358014442dedc105d99ddfece21933399edcf7b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          unicodedata.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000134c2\unicodedata.pyd
                          • Size 735KB
                          • SHA256 2a0975f5b5198771c80b2032e2b5ea4b95a0298a5096e014cb88898428618b59
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\VCRUNTIME140.dll
                          • Size 174KB
                          • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\VCRUNTIME140_1.dll
                          • Size 48KB
                          • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _bz2.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_bz2.pyd
                          • Size 84KB
                          • SHA256 37cbaeff9be4494f682eafe4adb642178f9c7277d4cda9ec343cfc06849a263b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _cffi_backend.cp315-win_amd64.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_cffi_backend.cp315-win_amd64.pyd
                          • Size 177KB
                          • SHA256 41f528cda715179bed45be6913f48aa07ae34c2c04f7ebbd74740632096d213d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_ctypes.pyd
                          • Size 139KB
                          • SHA256 746cf693e04ceb5f5468cbd7d1cbd535403693e421dad0d34ff77a25b171bc20
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _hashlib.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_hashlib.pyd
                          • Size 71KB
                          • SHA256 7ef6760838a5496b47ec3f5a463672e27e23cb9477d20fcde3abf1f41cb3a62f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _lzma.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_lzma.pyd
                          • Size 167KB
                          • SHA256 cfe42690aac2065f94d9e7df8cf53c523fdce787b9cb1593abe0190ae1d5891b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _queue.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_queue.pyd
                          • Size 35KB
                          • SHA256 ce5c36c17242234186180d93fc1299a4dbe2f2e049bba6da3dcacad29cbac1ce
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _socket.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_socket.pyd
                          • Size 86KB
                          • SHA256 a8a469df1c4fadfad6a72d379e1af7591e552c9c24aba0ca3dfd8e2ba8bfdb91
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _sqlite3.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_sqlite3.pyd
                          • Size 127KB
                          • SHA256 66f8824133f02d5d9e446c1be1a04efe312483751ef3002ff7dce3126a013e19
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ssl.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_ssl.pyd
                          • Size 192KB
                          • SHA256 6ed057907738947eef7e78076d3b2b137b7d1b8c925d19b1b04b520614d23a7a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _tkinter.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_tkinter.pyd
                          • Size 69KB
                          • SHA256 042bc50f00c42fb307ec00ec95cb7fd7d25bcb7119c30621d363099cad9df9d1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _uuid.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_uuid.pyd
                          • Size 27KB
                          • SHA256 10ec572d4cf3f1cca178be12b729a7f0d7b415b53e6025f3091cd97f31bb20ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _wmi.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_wmi.pyd
                          • Size 38KB
                          • SHA256 8e71054e8798fe3595de7ceaa7ecef3eee808652cf2ebf08418109e8b2651ae4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _zstd.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\_zstd.pyd
                          • Size 494KB
                          • SHA256 229e2029d167490a4fc95def7ca1670aee358a732cae13285478e74b8ce2f1d1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\base_library.zip
                          • Size 1.4MB
                          • SHA256 433817bf1dbedbf335c6565f1518b7f63ae4e6d949634c333cb0249da7cb68db
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _rust.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\cryptography\hazmat\bindings\_rust.pyd
                          • Size 10.4MB
                          • SHA256 4ee475cea79ddf074daf11ce0acc997101b3ebf49471d991c3695639994ff32a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libcrypto-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\libcrypto-3.dll
                          • Size 5.7MB
                          • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\libffi-8.dll
                          • Size 38KB
                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libssl-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\libssl-3.dll
                          • Size 1.2MB
                          • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libtommath.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\libtommath.dll
                          • Size 93KB
                          • SHA256 1e6070bbc991be96feb82d6dce7aa84d9bfe644b71f7e599b9b89ff0249dd076
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python315.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\python315.dll
                          • Size 7.5MB
                          • SHA256 ca4f7b4823ca187f4a6483fba9f21804390a183b783ee2bf9b5ab75d98f62c3b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python3t.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\python3t.dll
                          • Size 74KB
                          • SHA256 b5c04ad9bdf6857bcb73e30d7a69f4fee1dc36d6208453cf01980864d6067cb9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          sqlite3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\sqlite3.dll
                          • Size 1.6MB
                          • SHA256 8a65064bad951ce2ed19104f125b6258fb6d770b01e9868637b89f808a6fbeff
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tcl90.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\tcl90.dll
                          • Size 3.2MB
                          • SHA256 6f2e8b20574a5e34856831bf3b9d12156de1df6287a92def69205e13396e3cc6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tcl9tk90.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\tcl9tk90.dll
                          • Size 2.1MB
                          • SHA256 79f039ba6c719024a882f93bfd54630eb16c3ff5db53a66424dabb4166ccaa03
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          zlib1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017982\zlib1.dll
                          • Size 114KB
                          • SHA256 0be8513f1860df4fcf9895247ec36365b814c4fc5eb9fcf205c10218ce21fa74
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          __PSScriptPolicyTest_1c1xuzcc.pmp.psm1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1c1xuzcc.pmp.psm1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                          • Path C:\Users\Admin\AppData\Roaming\vncrypt\2026-10-22_3c27ad5a181152e977a27396bf232f1c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
                          • Size 17.7MB
                          • SHA256 731e3a6adc9319aa2aac7809be7560e41d9633f1019c2211a0d04c44cd8d79d7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          wallpaper.png
                          • Path C:\Users\Admin\AppData\Roaming\vncrypt\wallpaper.png
                          • Size 18KB
                          • SHA256 8438486eced89b27b18124c5fcb3be312d00390d5a45142df3dd4780479203a9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ClearProtect.bin.vnc
                          • Path C:\Users\Admin\Downloads\ClearProtect.bin.vnc
                          • Size 791KB
                          • SHA256 4d9ff26958d6ef55463634f80af29bb98496003d59641d3b1740bc1c6817fc3c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CompressRequest.MTS.vnc.part
                          • Path C:\Users\Admin\Downloads\CompressRequest.MTS.vnc.part
                          • Size 1.1MB
                          • SHA256 440bf276d7887cd997b11c35b67cb7fe7c8b2fe2b56ff11618be2bb6358749f3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ConnectConfirm.xml.vnc.part
                          • Path C:\Users\Admin\Downloads\ConnectConfirm.xml.vnc.part
                          • Size 494KB
                          • SHA256 35084c16840eac6b828db3eaf94205f5b6181c682249ba011513d23707363c0e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          README_RANSOM.html
                          • Path C:\Users\Admin\README_RANSOM.html
                          • Size 412B
                          • SHA256 94166a4f39cca293b69b9876d1da2fbf1fa38f142efd8ee479281ddc7904f221
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          README_RANSOM.txt
                          • Path C:\Users\Admin\README_RANSOM.txt
                          • Size 960B
                          • SHA256 ad69c66ed963f0d10d6080a3255a6ac4d4e0e3d6220089784b9c1793e9f973f2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          README_RANSOM.txt
                          • Path C:\Users\Admin\README_RANSOM.txt
                          • Size 958B
                          • SHA256 091b846d9d97a2bffb2f6906b924c3dcbf69113ed37e72efa3df4e450581c0e7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/2844-104-0x00000251E4CF0000-0x00000251E4D12000-memory.dmp
                          Download