Overview

overview

8

Static

static

3

2026-05-06...at.exe

windows10-2004-x64

8

2026-05-06...at.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/05/2026, 16:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-06_5151d2f3b1c6956385967374dfec7cb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 12.4MB
  • Sample260506-trfm6set2y
  • SHA256 3a82e71aacfe5a673b0a72dacd12acf0db3b848e9ad70183ec3348bcfc65f82c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-06_5151d2f3b1c6956385967374dfec7cb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-06_5151d2f3b1c6956385967374dfec7cb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\2026-05-06_5151d2f3b1c6956385967374dfec7cb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-06_5151d2f3b1c6956385967374dfec7cb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3280
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\system32\ipconfig.exe
          ipconfig /all
          4⤵
          • Gathers network information
          PID:3736
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "arp -a"
        3⤵
        • Network Service Discovery
        • Suspicious use of WriteProcessMemory
        PID:3880
        • C:\Windows\system32\ARP.EXE
          arp -a
          4⤵
          • Network Service Discovery
          PID:3300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "route print"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\system32\ROUTE.EXE
          route print
          4⤵
            PID:2832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh winsock show catalog"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\system32\netsh.exe
            netsh winsock show catalog
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2584
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh advfirewall firewall show rule name=all"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4140
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall show rule name=all
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:3324
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /v /fo csv"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Windows\system32\tasklist.exe
            tasklist /v /fo csv
            4⤵
            • Enumerates processes with tasklist
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2524
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc query state= all"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3740
          • C:\Windows\system32\sc.exe
            sc query state= all
            4⤵
            • Launches sc.exe
            PID:2024
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Get-AppxPackage | Select Name, PackageFullName, InstallLocation | ConvertTo-Json""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-AppxPackage | Select Name, PackageFullName, InstallLocation | ConvertTo-Json"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:760
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "schtasks /query /fo LIST /v"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:684
          • C:\Windows\system32\schtasks.exe
            schtasks /query /fo LIST /v
            4⤵
              PID:3100

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
            • Size 211KB
            • SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\_bz2.pyd
            • Size 85KB
            • SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\_ctypes.pyd
            • Size 139KB
            • SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\_lzma.pyd
            • Size 157KB
            • SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\_zstd.pyd
            • Size 491KB
            • SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-console-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-console-l1-1-0.dll
            • Size 22KB
            • SHA256 27954e62e12d115bb1540db4bb9de6e2c852d914aea61cba3c203595138537b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-datetime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-datetime-l1-1-0.dll
            • Size 22KB
            • SHA256 6f22ff5bf9d53b7f2c3fcd553d9b8664ef5401912194b8e599e4dbd8f3105405
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-debug-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-debug-l1-1-0.dll
            • Size 22KB
            • SHA256 c5dc0df2fcc456c2b08392ea7d539d43549d04d14ed83d69cd46f79b9e34902a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-errorhandling-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-errorhandling-l1-1-0.dll
            • Size 22KB
            • SHA256 9ff8300ecf0ebd4c8130800b5b8857b6ddf21902264af42fb1ac15c794115864
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-fibers-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-fibers-l1-1-0.dll
            • Size 22KB
            • SHA256 39174763da266b4b955e27eecaef15d8283bb77f9eca94fe925d4928f37a4fa1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-file-l1-1-0.dll
            • Size 26KB
            • SHA256 a9660f0e3ab6032bba0b75e1d02ce0bc57c9043bca423477843a7a3af1b1c200
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-file-l1-2-0.dll
            • Size 22KB
            • SHA256 445a2c24c8565834e1e41e4c617d2f9cf5def8e4a477e55e2f18583845b24c1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l2-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-file-l2-1-0.dll
            • Size 20KB
            • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-handle-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-handle-l1-1-0.dll
            • Size 22KB
            • SHA256 94f7611fa4568f4577deba250c1254a3c83ffc7b4fd2f00243f3bfac5a993fd8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 d655a217f4c17982b4c5ecb406290885c74afba361dd840c4245c0b28e07c192
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-interlocked-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-interlocked-l1-1-0.dll
            • Size 22KB
            • SHA256 69b0f1e099dac7ffbbf1260eb4818abeacd2b9cf105b742b16e6bd5dda3bf035
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-libraryloader-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-libraryloader-l1-1-0.dll
            • Size 22KB
            • SHA256 87622d07bb5c9fa5ccd9f74ac70a1e2ae0cdf54462f90f365178a15a814bf3c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-localization-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-localization-l1-2-0.dll
            • Size 22KB
            • SHA256 79ec668286cb900c66e1caf8a47309d986c9dc4d37a5d2dcedb2ff2a973896d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-memory-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-memory-l1-1-0.dll
            • Size 22KB
            • SHA256 7f12e6eb9a992ea199bcfc755eea488a8889cd2642dba00e49fb06a14bec8408
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-namedpipe-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-namedpipe-l1-1-0.dll
            • Size 22KB
            • SHA256 daf13af507230a92191c348611e8b31bc384055ea5b9a6d18057646d93bfe4f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processenvironment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-processenvironment-l1-1-0.dll
            • Size 22KB
            • SHA256 74d809270a418e4bc1d3b94348094f00463635cedfbadd97d29686a6d037d2da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processthreads-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-processthreads-l1-1-0.dll
            • Size 22KB
            • SHA256 6620a7962adb6a25a51e13add907189763b76d0816a356465d135eeeed1065a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processthreads-l1-1-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-processthreads-l1-1-1.dll
            • Size 22KB
            • SHA256 82850eb2e7d100938ebd419440e4575750999bc9e349cd074019e413673d02c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-profile-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-profile-l1-1-0.dll
            • Size 22KB
            • SHA256 b43119bdfc7c562bf07c26e01b7b862aa8dc9d5e795798fe93969111244ed2da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-rtlsupport-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-rtlsupport-l1-1-0.dll
            • Size 22KB
            • SHA256 bd0cff402e3f64baaf2bfb17d86b2c4c7d03584ea2601ca5c55de147a769a32a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-string-l1-1-0.dll
            • Size 22KB
            • SHA256 1985000499475faf541b17c8acbce788bcdba6dddd3b8910b6730238f1c18862
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-synch-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-synch-l1-1-0.dll
            • Size 22KB
            • SHA256 055544d562ca50d49443926bca396de985735f7451806ff2565486e406809d25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-synch-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-synch-l1-2-0.dll
            • Size 22KB
            • SHA256 0d8f2f7d031f143110c9bf5bdd4f75b24e8b41319fa2e20f78068c084e0d7603
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-sysinfo-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-sysinfo-l1-1-0.dll
            • Size 22KB
            • SHA256 8010d006df2d62839c933d3b5998abc7a7830ffe32ca68b17c76f3292f5e56ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-timezone-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-timezone-l1-1-0.dll
            • Size 22KB
            • SHA256 1789f5e749cf3a5d419e3b835bd9d78a077ee77f3e761f0fbf3609e38ace6f40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-util-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-core-util-l1-1-0.dll
            • Size 22KB
            • SHA256 c893a59c4d1fa86fb50d486ebf3a873244b910efec5b00690d4a20afb7ce0761
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-conio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-conio-l1-1-0.dll
            • Size 22KB
            • SHA256 9e466e76079b73bd9b0114004d040d193dc982e4150eee1241a902d16c2bda38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-convert-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-convert-l1-1-0.dll
            • Size 26KB
            • SHA256 64c48b1280e4540c205ee7798b7da200afd95898d520ece1d56bf8a8a351fc3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-environment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-environment-l1-1-0.dll
            • Size 22KB
            • SHA256 1a513c0601c5b628018c003d8598586d4a48fd1acf51372f6783dc23b0a27756
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-filesystem-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-filesystem-l1-1-0.dll
            • Size 22KB
            • SHA256 89bb192dd079784d9ba716a2e45a1ee6af75c67e9151fde77eb8ec32cb014182
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 e5a0c8d551e36e5fd394a45a5e9229f592b46d8e80897f25e7f0ca449abb6b00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-locale-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-locale-l1-1-0.dll
            • Size 22KB
            • SHA256 f13dc1d6895f21fe2f7fd4b7ada78828b5a819013f751aa32eb1704beb4dc469
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-math-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-math-l1-1-0.dll
            • Size 30KB
            • SHA256 a13aed9e8d7f4f53826cedd6acbc7b75dba51aeecd7f030b0f0d7b7c66e1a042
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-process-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-process-l1-1-0.dll
            • Size 22KB
            • SHA256 90d0c8e9ea6a4e82efcdc7ba522da3989316397218f3d1320eed1bab491c0938
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-runtime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-runtime-l1-1-0.dll
            • Size 26KB
            • SHA256 d893a0f2c1bf6247fb94393728c6293570090028d4dd30dcea01a01b0460b0c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-stdio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-stdio-l1-1-0.dll
            • Size 26KB
            • SHA256 456adaf7d2116f3e9410a0c1acd19f54bc9decc8e75b02f82c4a7d56c980e71f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-string-l1-1-0.dll
            • Size 26KB
            • SHA256 8d360f373b21726d005df5d6e1e5d55f5aa83f6d9d6a055f4dc0331965671dba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-time-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-time-l1-1-0.dll
            • Size 22KB
            • SHA256 c674ee45208477eec3669db64abb586df50d4fa38aa5b47ed2012d4bc5d9ec4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-utility-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\api-ms-win-crt-utility-l1-1-0.dll
            • Size 22KB
            • SHA256 7c31b21496d4783456d9093d0742e1727fe77e1ccb27d717c327039859561438
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\base_library.zip
            • Size 1.3MB
            • SHA256 b30c364e69d88da0f40429ef9f22db85bbc972d740a277b8e5d54ca832710264
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\libcrypto-3.dll
            • Size 5.0MB
            • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\libssl-3.dll
            • Size 776KB
            • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\pyexpat.pyd
            • Size 213KB
            • SHA256 b6d5142424d161039c25bea00e6acd8f7b1a5331d3994d9f3c28bd083ede159f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\python3.dll
            • Size 72KB
            • SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\python314.dll
            • Size 6.4MB
            • SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\select.pyd
            • Size 32KB
            • SHA256 05734bd352ce60c944d474aa62468cc5eebf400097f1d9d0c453d37aed26fcca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10762\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_yo2rbpb2.unz.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yo2rbpb2.unz.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/760-159-0x000001967FCD0000-0x000001967FCEC000-memory.dmp
            Download

            memory/760-161-0x000001967FF40000-0x0000019680102000-memory.dmp
            Download

            memory/760-166-0x00000196018D0000-0x00000196018E2000-memory.dmp
            Download

            memory/760-150-0x000001967FD00000-0x000001967FD22000-memory.dmp
            Download

            memory/760-163-0x000001961ABF0000-0x000001961B118000-memory.dmp
            Download

            memory/760-158-0x0000019619F10000-0x0000019619FC3000-memory.dmp
            Download

            memory/760-157-0x0000019619E40000-0x0000019619E5C000-memory.dmp
            Download

            memory/760-162-0x000001967FDA0000-0x000001967FDC6000-memory.dmp
            Download

            memory/760-160-0x000001967FCF0000-0x000001967FCFA000-memory.dmp
            Download

            memory/2584-140-0x000001D2298E0000-0x000001D229A7A000-memory.dmp
            Download

            memory/3280-143-0x0000020569FB0000-0x0000020569FB9000-memory.dmp
            Download

            memory/3280-142-0x0000020568900000-0x0000020568A9A000-memory.dmp
            Download

            memory/3280-167-0x0000020568900000-0x0000020568A9A000-memory.dmp
            Download

            memory/3280-168-0x0000020569FB0000-0x0000020569FB9000-memory.dmp
            Download

            memory/3324-141-0x000001A8CAA40000-0x000001A8CABDA000-memory.dmp
            Download