368275cedfd4bfed2dd7612304fc8c5a6f708eea0cefe22d7a967f70e655a97a

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 60.8MB
Sample260722-1ckrxace85
SHA256 368275cedfd4bfed2dd7612304fc8c5a6f708eea0cefe22d7a967f70e655a97a
MD5 0225bb91b51ed8e4f3eeaea8c07bddff
SHA1 69e5183d0b7c1ead8df8a1e83551172c7cb1c5fb
SHA512 c7501cf3d39aa51a84f678f26400de047c8110e9e1ee070c2e303de54f6ff1a2ae5ca61e3137765449ac3df83f5d6b87879872348f0dd6d45bc5619948a936dd
SSDEEP 1572864:2TSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED://h8fNknAnIdA7lxpUcj/xWc
TLSH
T19AD7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
3120	powershell.exe
5532	powershell.exe
1984	powershell.exe
3628	powershell.exe
3384	powershell.exe
4428	powershell.exe
2312	powershell.exe
1044	powershell.exe
1072	powershell.exe
5888	powershell.exe
1216	powershell.exe
4216	powershell.exe
2932	powershell.exe

Loads dropped DLL 32 IoCs

pid	Process
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipapi.co
8	ipapi.co

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3340	wscript.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5448	powershell.exe
2176	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
844	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2936	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4100	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
5532	powershell.exe
5532	powershell.exe
1072	powershell.exe
1072	powershell.exe
1072	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
5888	powershell.exe
5888	powershell.exe
5888	powershell.exe
1216	powershell.exe
1216	powershell.exe
1216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2932	powershell.exe
2932	powershell.exe
2932	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeIncreaseQuotaPrivilege	1072	powershell.exe
Token: SeSecurityPrivilege	1072	powershell.exe
Token: SeTakeOwnershipPrivilege	1072	powershell.exe
Token: SeLoadDriverPrivilege	1072	powershell.exe
Token: SeSystemProfilePrivilege	1072	powershell.exe
Token: SeSystemtimePrivilege	1072	powershell.exe
Token: SeProfSingleProcessPrivilege	1072	powershell.exe
Token: SeIncBasePriorityPrivilege	1072	powershell.exe
Token: SeCreatePagefilePrivilege	1072	powershell.exe
Token: SeBackupPrivilege	1072	powershell.exe
Token: SeRestorePrivilege	1072	powershell.exe
Token: SeShutdownPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeSystemEnvironmentPrivilege	1072	powershell.exe
Token: SeRemoteShutdownPrivilege	1072	powershell.exe
Token: SeUndockPrivilege	1072	powershell.exe
Token: SeManageVolumePrivilege	1072	powershell.exe
Token: 33	1072	powershell.exe
Token: 34	1072	powershell.exe
Token: 35	1072	powershell.exe
Token: 36	1072	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeIncreaseQuotaPrivilege	1984	powershell.exe
Token: SeSecurityPrivilege	1984	powershell.exe
Token: SeTakeOwnershipPrivilege	1984	powershell.exe
Token: SeLoadDriverPrivilege	1984	powershell.exe
Token: SeSystemProfilePrivilege	1984	powershell.exe
Token: SeSystemtimePrivilege	1984	powershell.exe
Token: SeProfSingleProcessPrivilege	1984	powershell.exe
Token: SeIncBasePriorityPrivilege	1984	powershell.exe
Token: SeCreatePagefilePrivilege	1984	powershell.exe
Token: SeBackupPrivilege	1984	powershell.exe
Token: SeRestorePrivilege	1984	powershell.exe
Token: SeShutdownPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeSystemEnvironmentPrivilege	1984	powershell.exe
Token: SeRemoteShutdownPrivilege	1984	powershell.exe
Token: SeUndockPrivilege	1984	powershell.exe
Token: SeManageVolumePrivilege	1984	powershell.exe
Token: 33	1984	powershell.exe
Token: 34	1984	powershell.exe
Token: 35	1984	powershell.exe
Token: 36	1984	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeIncreaseQuotaPrivilege	5888	powershell.exe
Token: SeSecurityPrivilege	5888	powershell.exe
Token: SeTakeOwnershipPrivilege	5888	powershell.exe
Token: SeLoadDriverPrivilege	5888	powershell.exe
Token: SeSystemProfilePrivilege	5888	powershell.exe
Token: SeSystemtimePrivilege	5888	powershell.exe
Token: SeProfSingleProcessPrivilege	5888	powershell.exe
Token: SeIncBasePriorityPrivilege	5888	powershell.exe
Token: SeCreatePagefilePrivilege	5888	powershell.exe
Token: SeBackupPrivilege	5888	powershell.exe
Token: SeRestorePrivilege	5888	powershell.exe
Token: SeShutdownPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeSystemEnvironmentPrivilege	5888	powershell.exe
Token: SeRemoteShutdownPrivilege	5888	powershell.exe
Token: SeUndockPrivilege	5888	powershell.exe
Token: SeManageVolumePrivilege	5888	powershell.exe
Token: 33	5888	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4600	5072	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4600 wrote to memory of 844	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 4600 wrote to memory of 2936	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 4600 wrote to memory of 5532	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 4600 wrote to memory of 1072	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 4600 wrote to memory of 1984	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4600 wrote to memory of 5888	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 4600 wrote to memory of 1216	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 4600 wrote to memory of 4216	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 4600 wrote to memory of 3628	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 4600 wrote to memory of 5300	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 4600 wrote to memory of 4100	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 4600 wrote to memory of 2668	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 4600 wrote to memory of 3120	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	117
PID 4600 wrote to memory of 3384	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 4600 wrote to memory of 5448	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4600 wrote to memory of 2176	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 4600 wrote to memory of 4428	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 4600 wrote to memory of 2312	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	127
PID 4600 wrote to memory of 2932	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	130
PID 4600 wrote to memory of 1044	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	132
PID 4600 wrote to memory of 3340	4600	2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:844
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(New-Object System.Security.Principal.NTAccount($env:USERDOMAIN, $env:USERNAME)).Translate([System.Security.Principal.SecurityIdentifier]).Value"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1 Name,NumberOfCores,NumberOfLogicalProcessors,MaxClockSpeed | ConvertTo-Json -Compress)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | Select-Object Name,DriverVersion,@{n='VRAM';e={[int64]$_.AdapterRAM}} | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product | ConvertTo-Json -Compress)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SMBIOSBIOSVersion,ReleaseDate | ConvertTo-Json -Compress)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$c=Get-CimInstance Win32_ComputerSystemProduct;$b=Get-CimInstance Win32_BIOS;$s=Get-CimInstance Win32_SystemEnclosure | Select-Object -First 1;[pscustomobject]@{UUID=$c.UUID; BIOSSerial=$b.SerialNumber;ChassisSerial=$s.SerialNumber;Vendor=$c.Vendor; Name=$c.Name} | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PhysicalDisk | Select-Object FriendlyName,SerialNumber,MediaType,BusType,@{n='Size';e={[int64]$_.Size}} | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3628
- - C:\Windows\SYSTEM32\dsregcmd.exe
    dsregcmd /status
    3⤵
    PID:5300
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4100
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-NetFirewallProfile | ForEach-Object { ('{0}={1}' -f $_.Name, $_.Enabled) }) -join ', '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-BitLockerVolume -MountPoint 'C:' -ErrorAction SilentlyContinue).ProtectionStatus"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-Tpm -ErrorAction SilentlyContinue).TpmPresent"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:2176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { (Confirm-SecureBootUEFI) } catch { '' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PnpDevice -Class Camera -Status OK | Select-Object -ExpandProperty FriendlyName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_SoundDevice | Where-Object { $_.Status -eq 'OK' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_SoundDevice | Where-Object { $_.Status -eq 'OK' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat_apply_pe_replace.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_bz2.pyd
Size 84KB
SHA256 64d9fbb516e08a6780dca160e40d8c6723d2a659b5ca3020de7a041305b3a3d4
MD5 7098611e0258f8bd1ed5ecb971c88763
SHA1 009b95baaeb3cd8b1012a8af487d52c091381cb3
SHA512 ad44afc2962e746c9720d33b490445c05e0dbd6a70acf568d5e0bd1138d092d2e49f89c51aab6a2a6b5e6ac4bacc771816b76963bae15553e8ee630af70ccaff
SSDEEP 1536:udsvXm8z7+Cnqncm4WlTtdKSzBdzM8yOBs8iMtIeLV8yG5TT/9vfIZRzz:qsvXm8zaYqRptX7zvyOC8htIeLVmpSZl
TLSH
T1B7836D86F36552B6F99BD1B886800793F730BB950B50A36FF148C2993F13B916E5C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
MD5 f2eff52a9b6ed2534f84cc7b77379649
SHA1 05947063d4912dfc288ea1fb2a768b9d23c60dfd
SHA512 2ab45ab98af90433ca6c122136c9ef7b7cd9eafea306aae1b412fbb7df8e86407858bb9da5124ac5ff8a80a9f9f3aa8839a2c871952469bf3abe9965175fb504
SSDEEP 3072:DsI2F3Ar92NZtfmzsYDZhXkQ1ISuigE2QvHNjOhKQchdqS7xxSTL7KNCtRnh+HRS:Ds5tfmo231ISuig9QvHw8hsgxSTLOcda
TLSH
T1EF044B5B329C10B6D5A2517886675B53E3B3B471130197CF01A0C7B92F1BBE67A7FA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_ctypes.pyd
Size 131KB
SHA256 b9c9e713f11e111daa55e4a62a135d7e385fa7aa0986d30b286d000e122b13aa
MD5 1606ace764f2b3ca8ab20cada221cf56
SHA1 ff63d15ea0b6b0c52deceab3f54c671a44e5e8f2
SHA512 658df5ed480cebc92685aa617c2ec5a5ff0c8613d420bcc3dbea0af0e1f7274c6963605f6284a69d3df40d075b02310fa35c361a176f5a2d80c2510db5290fc0
SSDEEP 3072:gaSQJ/VrFMXqvN2Ptf/Fm02R0JrsgvGzhIeyPxp5:oQJ/V1Ef/Fm082rsgAe
TLSH
T12DD37D0B776800AADAA39174C173AF47EBB1B453171047CF02A4C69A2F63792AE7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_elementtree.pyd
Size 133KB
SHA256 951e2623208ee402825f574041944cb9de2c67a9671c2cac607c1c22cd6da31a
MD5 436e76488b4b127ab426b70744c12517
SHA1 bf77f78ae7d0a63b010957b52e24e9616bfa84d8
SHA512 9bcbfc54bd69741096eca0fb0554d3a0390c9485822fbc56433cf7886032344976cac096df34b6d78fe69e8bb61c31e63b4b6aa866e8ac3218918deff51d593b
SSDEEP 3072:BKDLZNMLHY3kE6v5CUCZx5K3gcZRxZsAtUhD44gnfhgFdIezfSpdb:BKDz3kE0VCZx5wlsVd4fhiu
TLSH
T1FFD34B9B7265C06BE0A34038E6678F56DBB6F9A20E0087DF1284F29C9F733917E59714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_hashlib.pyd
Size 67KB
SHA256 1e079c6b44488e273bc62d9bcb27cec519e9916b47b8c2878ebade0772e0f484
MD5 82c0261589ab1c473c765d3ff36f9f8b
SHA1 293d34cd3108861976373c4972e634fb83f70a4a
SHA512 3db1062db85fe5e6fb37b3e769c6d9fe459714761b27f597d7f693296522411912e2730f2d613c66601fa0dec97c3ad9563166775d9107bc59a36f5282e79822
SSDEEP 1536:xqXn1xAu1lEAXfXtfcV5TaPutFCAFIevIWyG5TT/9VfIW44Dkr2u:C1l1uA1fcyPutFCAFIevIcpYW4Ik2u
TLSH
T1D8637B95AA884092E96382B5C4A34F83FD75F35257119BCFA2A8C0CD2F233C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_lzma.pyd
Size 155KB
SHA256 999ba26fe0b0376b7898d50ddb2f5012e7a64228e31fcdca99a4d7079df669e3
MD5 b7100b8fb3c579c848d8960b927d322f
SHA1 f6303fd3e27b93b7f0ff8251ca85636d01dc19d9
SHA512 9e778f62e28dc105d54211a9b708fd51cff9e7b53e79b78e73461fdd495c78b9091dd11e2a6522a82088a76cb356fc7176706afe519f8bfab1287285aeb27f6f
SSDEEP 3072:IqZ/boPLmhrKifqGDRJUsTznfB9mNo9vm28fgS+tIe01Lfp2/Ih:IeTgLhyvUsv5YO9Cfd+Qfk
TLSH
T10BF35C86B794F0D5F7728C38D2624F57E6F5781A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_socket.pyd
Size 84KB
SHA256 7acc6c44436bf77be3c425d39f0acba03b42119513ef9db31a7039c969e056bd
MD5 659d1aa860099428669dcdae9c7ab661
SHA1 324fcf8d090c3ffda1386c85f263f7bb104889a2
SHA512 3b87e0fd8c68c7fa829e1fad13e4e5d14b42a36d9e25ae1c5b7fb8f87bfe087183fafb51c7734a4169dd64ce833d19e47e8f11f7f5640b67ac00bbfff557798a
SSDEEP 1536:rVl/fxzeola7SVitdyJw3QlyJ+9+nzn3Y4KxtS4DTDghIeyw9yG5TT/9SfIZRwz:rVRdeoo7YoyJw3QlyJs+nz3tKxB8hIeE
TLSH
T1DF836C04A66050FAEBB3D075C2639E62FB74B1C11394A35F1066C65A1F333C2BF7AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_sqlite3.pyd
Size 127KB
SHA256 48672a5c55ca7d0cda0e05e9b00201f3aff791bea79604e671d4e0b25cfb5dbe
MD5 6eb0061a11b55dc793a82acfd39c29fe
SHA1 c2f464831aea15773624a53ff5d65f5eade62ab1
SHA512 b10b7fc328363d5d6c22225246b2f060fdefec303d4c6cb4e1777543197132dac77a33aaa9636d51d96c017727475a5b3f55ff2db77bfbedbecc0d225db55eaa
SSDEEP 3072:TZ9YIms48PJCOaiW56pYWq5i7o8FIevQupTYb:DFk8PgKW5Wq5i7o87ub
TLSH
T19FD34A6B631400A6F9B792B8C1735613EB75F462572143DF41A0C2892F377D3AE3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_ssl.pyd
Size 177KB
SHA256 738c579ed151498337026ea1f5dc7688197b41b74e39f4d9de05261bb35d9206
MD5 359e1c3e69044b4283223783ca406b95
SHA1 f322f7e99ccb604954cc18ac3e525e53480a22bf
SHA512 ca4e267d618f4eee91eca799ae99b5127612ca5debf9bbf76368c95502fc5c35049dc2ce973cf859a92f1f2fa833137522d9425c959d7afb632e89f0401730e5
SSDEEP 3072:fofuOjwYdI1bnMlfR6CPfzsvyII7IM/cbPuC/JWtIeL7zpaY9:fo20wYdknqR6CPIvySgTx9
TLSH
T144047C47B59459F7E813E4F9C2234903EBB0F155321247DE48D6E64A0F03B4AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\_wmi.pyd
Size 38KB
SHA256 6793bd216b5a329689cde8b1532858d6731707ec5063897f979a81e57077402c
MD5 f94e8c9a440cdac95d2f69a9045d937f
SHA1 95d49b1d987db3a751524712b49bc86ece3bbb86
SHA512 d2ac9607e9a1be542cedb92ca0caf98bdca4447f22b04d09e451a1031ad7d6771406ae29a4b366d2add08bc1bd7519d17bebe2d33cd21bbccbc12589cfe6f03e
SSDEEP 768:q2/EEqrVmjsNuEkc9+utIeLibdyG5TkKrLy2Ip4TTxf1mltPRVYgt:vE9BEfEkc9+utIeLiZyG5TT/9xfIZRWw
TLSH
T158037CC9E6680092EA67CA74C5A6DE52F531B7935B0187CF3265C2990F233D1E739339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\base_library.zip
Size 1.3MB
SHA256 f995e57b0b812e9d20e3a4dd90754fed44feafed8f85d39bb97a83b375f0d6bd
MD5 f899668c71d578c83d73718580abae1b
SHA1 bc9ea421912acdcec3bc2b9c73abff34b796af08
SHA512 4559c08283cef3dea0f29234b916c572de4c822439af77457b7ef994cb8015d8be9b8adc2b0a53dfd7a765d75880787372da9e20af62a18eafdd6631fb3fa630
SSDEEP 12288:PdjdTji2cPPdxhYnWJmL+DN6vFUDqfZUijtYzGNcT1hSuIva80201jwCVRDVoioQ:PdZj5cPPdxhYnESeT1Ql97WpLqLzS
TLSH
T168551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\cryptography\hazmat\bindings\_rust.pyd
Size 8.7MB
SHA256 fe5c4cdb5512f792fb0f5b3ce0cd8c1484614851d56ff5d1e7215213eb9e0bca
MD5 096d119952f45d16c1d55ff15bd1592d
SHA1 a8a436dd1ad10cd3f1a680ecb4e2db165ee9f1a0
SHA512 9b96d91833b63a74de745d0fbbb86ad4bab763859c4ba910fabea84190f97641e804de44f4aee5fcea3db862f25350f4af6fcbeb66c66b28363ad989a34d022c
SSDEEP 98304:1W6bzDfOZTvepY947DuKXzbDq/26mzRs5h+cIIy:1VDXzXq/26mzROj
TLSH
T10D967D29BAA940A8D86AC4B8C34757339B7174CA07747AEF49D486B52F37BE41B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\cv2\__init__.py
Size 6KB
SHA256 957a91bfd98ffb07a10cd789b7c5c46806568476b61e34c7ad56a00092b981a5
MD5 6f043aff1edd20d3c9d6398f936fbf58
SHA1 7149d2d20e1eb8c10c5d2bdb8eda23551fc82650
SHA512 7358dba479899dbc3afb955903820d2a7a54b9c398bf5d4565c8dc044241821edd621d7416862af396db4216373b1e8aac00eb78046fcc3cc2396aa02cd6947b
SSDEEP 96:cHqnQbu/3aOjcEYIL9GE6AUmZris46/B5aVOQOo2/nH/h5M966GMBWtReWE3uSI3:2qQYaOjIKtc6/Bb/H/h2BWtc93k
TLSH
T1F7E142425DB2641A0036D69DFF9180A4CF5F5FE35628240BBADC21C86FB8460D3F99B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config-3.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\cv2\config-3.py
Size 748B
SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
MD5 e8ed8f25854821c8910bcb8308507dce
SHA1 8a3ac32d3df44794e8a834a6b6a8a1ed3f3aa5f7
SHA512 f3f36edf288a870f5e1f14f3b1113031721e12f30bf235b0e5385711e2bf7f08d0123e6ab14600ab069d2e692d81b7abc3692fb69eed34374fefab3b24f03d86
TLSH
T1B801D07E080F246492B2C759D88440DDC3D762E3F2238554FC6C6300E738CCC4283979
MD5 SHA1 SHA512 TLSH

Submit Download

config.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\cv2\config.py
Size 123B
SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
MD5 73e8bcbeba4dbe040c5f9a096ceda9de
SHA1 52c2e1bb717e8e8bc8409313c7e7e9d654033229
SHA512 f61394e48d8ade108ffd1f38a62267b36c2a1f525aa193884d1128ad47a0ca43ff852c8ce22a789a520964ff8e526e77264d5c61e1e4d8c0753703528ca36ba1
TLSH
T111B092FB84F2608C8212CBB9071E86C4411EEFDEAF422980384039928618CC00306038
MD5 SHA1 SHA512 TLSH

Submit Download

load_config_py3.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\cv2\load_config_py3.py
Size 253B
SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
MD5 39b5b0b9ffe1c35c95bbee8a325fbd1e
SHA1 217417fd40e92b47faff557c03542e5137424872
SHA512 1b1e8bff9e749633c00627a6006fadafd53d78bad1b5796f9c5fdb38155da5aeef2e0ddc9589431c43a8f61c16808cd781cea92f42073defd05bda3dc18ceb20
TLSH
T13DD0A7105D4D1D3400E5C27C0B2DF8B2D3EBA1423F01E14BFE5C87D22F94A14C381A94
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libscipy_openblas64_-9e3e5a4229c1ca39f10dc82bba9e2b2b.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\numpy.libs\libscipy_openblas64_-9e3e5a4229c1ca39f10dc82bba9e2b2b.dll
Size 19.5MB
SHA256 9e3e5a4229c1ca39f10dc82bba9e2b2bf48037790932566f37aff1a7ccf3588f
MD5 fbc8856b64ba7e16e7042672f0f352bd
SHA1 fa6194262cd9b8416299d778fb49e3387cd547fd
SHA512 1f933500de79c653a9104b9e828c7764539da44a098b432652ce6f396cd91c0fc141509a16c68d83d44019bf0a00eb0307c3f3797a05bd5c37602466a558f624
SSDEEP 196608:96YlKrv90lOzPWr1NGFooXl45bumfk1aOU:hOzPW8l1m81az
TLSH
T12B27E68BF4A250D8C47BD4B4936AF533BE60780DC53839665F81CB202FB5F50AA6BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiarray_umath.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
Size 4.3MB
SHA256 04a87dcb37e46eff7b931a45e6d87366ede144b5ff319070a2cb983a9b2e1bbc
MD5 3a43060de6eec8e83c8e5540774a9e12
SHA1 31c5facf237bcf03349178c704fbcc415e43a545
SHA512 7969669035db89a107a8e7f53c0e82d70adccda33b2f1f1efc36ca368e503a86e6fdb6122cb374ed8b645bc939feb37e3ae36f540f0c7b5002260b64de345084
SSDEEP 49152:5hVuZIkYNgNcJB6RcrMQKhSVfzC4e3QfvmnBkR5dcNxOuyq/Bp1ZGcub4ZNvi:4HPOu5ZI
TLSH
T1F0269E8BE5AE119CC0A7D034872AB11AFB51746703A1AAFB259CD7212FA3FD5137E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_umath_linalg.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
Size 109KB
SHA256 ce9c95c3836521e26f4b34d71ad89ddc8e945fe72a2016f8b339999c6fb0edf4
MD5 0369d816d43014aab5ab5d093d3d0716
SHA1 d016727dd5233838836557f14e3b87ea5195b717
SHA512 bb36e4c6c254f22655ed25f9e1660104127ab5256b9a140b7d91195fcaba7aa27c5cc341e28b95cbeec1096a4b2d6377fc2bdfb3ab9cfc9e449fd0a8a50051b2
SSDEEP 1536:+DDJT0nJEgCzb7spwjSc2GuuQLhDHV5ho7mYtxZsvLwsMP5NcR+R4FhpmCSzD849:uS2gykRomYtxcR+spGmCtdkbj4LK
TLSH
T18DB33A7370C552E8C57AC1F8E5461A67FF53748A53202BAB13E0CA902E6BF616E3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\pyexpat.pyd
Size 210KB
SHA256 922dd767c7a27065d2a8bd08f151bfcf22f92b25e9abdf981297960f7587d650
MD5 2a23d9e46ba8bf1473aa5a3092efaf55
SHA1 1d53f32118fee382cf7323bc6df4f7c86e82a0ae
SHA512 6c5b51e4e20bb5cabb893974fbc8e45f423e88ac2f38e6855a2ed5e7a615790713ffd8fc9f89e917b1559c2d75e8d1dd2ac49eaa5d5c58178601d3d8d40eb525
SSDEEP 6144:WXX8SNJkYld2V7X3jxmllonKod4xJJZUr3:WRNJkcc7N1KxPa3
TLSH
T1E1246C5BB261C1E7D853C03CE5968B13DAB2B86603909ACF22C4E77C9F2B7513B69315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\python3.DLL
Size 70KB
SHA256 9b179a9e44badc9c9d327182996040c87be183ad4c9469645280ed3e4a2d7694
MD5 04ba59ed5314652ec779f1389900913e
SHA1 83cc9297bf0aa85ce055710e3a178db4268c0323
SHA512 0cb3090721fac1d25aa0e4b3f9b6028bef80c30011b718dc217791b463085cab224cd058d5b63dc3e67ae1d3a099a444163234d465241df83b97f1385c413e8b
SSDEEP 1536:wotssyKcunV8PzhIey0lyG5TT/9vfIUX:XtssyK8hIey0lpW
TLSH
T15A633BC26B57F8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\python313.dll
Size 5.8MB
SHA256 c9f98606d0d06f4e8ae75ae385021e58b57c90d4fd325c0313c8c42abe1ebf63
MD5 48edb6a0be2bfee5b83e2c31675511e5
SHA1 43a1c8df434401901a5529cac03a664a5e64be71
SHA512 2b6ea04ef35085355bd9ee077ef533f80481d85a5b7d60c1756d06369313c4c39157018e76e30f4974eabdc6abba81bf6ec7cecc477cdee350acde7796567122
SSDEEP 98304:I8uWXsdqWZobQdaehM91cnivzHDMiENKULAd:puWmqeobQdaepiFULAd
TLSH
T1EA567C12729E51ACD9778078CA038A4BF7B27C413F60534B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\pywin32_system32\pywintypes313.dll
Size 132KB
SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
MD5 f7fa93a0bc20b155e9b141b6705870f0
SHA1 72c6bf418a55806e86cf67b3d363a385ae9cfca6
SHA512 3d8b7ae0303020e6fed0066f08eb30ae437541de0918528561e50f923cd42654a6453f59e610f11c4676022552ce09fa63a8fc8b1e13b5a3a8de0378d54c5b2e
SSDEEP 3072:F54SfEA3X4IiyNHpFBiuQdY/r06YrfNaQQDElr4ohgmF+M90X3:j9TH4IiyNH7BodY/rk7NaY4wgs+M90H
TLSH
T19FD34A47374644DAE966E37D8C771E02D3A2B0100711E3CF06A5C2AB6F63BD66D3B646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\select.pyd
Size 32KB
SHA256 01c8fef709b657b17e1db3754b05cb1070ad3e303dd531ef0f5545316df53aa2
MD5 c13138061da04f3fc3cd44c9fd3b9db0
SHA1 a7d03e1b9dc39065f76a3249fefe7355a69a500b
SHA512 04d907ab25d7fd4cde2cadefe8bced515dacf176ef93f72149341773938e0f2342f60076e1e8d8eaf42e0817c6118374b5c7a144ec1d09f4edf55ddfaf83f0bd
SSDEEP 768:WpX5/HfamHzPhIe9G+dyG5TkKrLy2Ip4STxf1mltPRVpgh:SX5//amHzPhIe9GGyG5TT/9KfIZRbI
TLSH
T16CE27CCA6E685087EA63C671C5E2DE42F939B3A38A1186DF31B581D91E277C0E336354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\sqlite3.dll
Size 1.5MB
SHA256 42f525fecf951b3fac7c62d85afa9070f7fd6fd9220da2e1821949233bf5f1fb
MD5 3068065ebcdf5ae62fd955c98f10c246
SHA1 35915a0260b36184e9c6e3e0f364f25d38dc9433
SHA512 2eb88352d8b45c476c6e496d1a923c0c7c84044b51990116889d76f37f76d21f6633be01f1bcce1d101f2385610544b623f56b989a12ca1bdfa39f1fe16fc79c
SSDEEP 49152:xVc2uC/wThp5YNE9nhcf+V3wSOgiMT4VylpEB:pnIThp5YScQ3vC
TLSH
T122759D4BF2B801ADD0A7C0B9851B1707EBB1B4051F64A7CF5594CA692F63FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32cred.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\win32\win32cred.pyd
Size 38KB
SHA256 f7dd953f24e800eaa4719fd5423c51f9d6987c9eebd5ee5fcab42a4295638ae4
MD5 0f6ea2e4e1c51bc80b86aa84612fdec4
SHA1 03e75bb13b4190aa263371c2bfcb48876dc0c9d0
SHA512 341f56a6b2e846e01108130ad2b82cee8d5955cae1e4a10995b3b5071d0c11afce883de280c819721af29ed974dea323d31d8a49da9bca6f1236ebfedf55cae3
SSDEEP 384:GLlecg3dTkjZ3B96ARSlNv3RcMfdhkjucByULrDp5/8bnG6orclOfbvhB8iDQUi:G4c1/9ulNfojucYUIG34wjZBbQU
TLSH
T11603188376D858D8C966C17DC8334E16FA71F4A0875062DF42A4C1AE0FA73D6B93DB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\win32\win32crypt.pyd
Size 121KB
SHA256 f07fbdcebda155ece29f64a4ca199db544bfa1f3472661f20b569d2b56926123
MD5 f71f82c87b41b0947773c19ddabb6919
SHA1 114fd986b0f6696aedd67905455f9c0a5f9eb029
SHA512 ad54d68422965b2be4b78eb49a392bac061f4f192b9e6196dd2d2ec13b981a94b1ccc3fa726ca744d8d5d043399b7c97a5da65d922938a204f67e6caafe054be
SSDEEP 3072:ISoHAMz+4O3CCCwgd5uehihNGvvlPU64S:vogMzjO38zdwhNOlPU64S
TLSH
T1FFC34B03729159CAE8AAE3BDC823A907E7A1701507116BCF0590C6DA1F67BE57D3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_yaml.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50722\yaml\_yaml.cp313-win_amd64.pyd
Size 248KB
SHA256 8a747bb4bb166b3caf53c5ee91931eb1317cc3ad617f18dcd12dd8c181ced226
MD5 dcd28c7f45e088aef45bf621ee39874c
SHA1 6c1e233306034d2138f1ed717b2be90dcc7381dd
SHA512 515e19cc0aa609076f94ac1cb579c73e09eb5f756c9cc07bc29a37cc7c34b0913ccabf449e0fc2ce33b3f43dcb2ba10e325349f7323199fa249acc6431eb79d2
SSDEEP 3072:+VyEtzqB5+hlJU/L/luN5tpVc1sw+mguNiUBxLtkllSMZ/Vb:T+LJU/L/lupMUmguNrRMZ/
TLSH
T194444A157AA0086AFEA380B84837DD17E7F270056720E7DF03B0E6493F17A967ABD255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fszulsxz.5r4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fszulsxz.5r4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

screen_1_20260722_223048.png

Path C:\Users\Admin\AppData\Local\Temp\creds_export_5y4fibwl\screen_1_20260722_223048.png
Size 359KB
SHA256 07d5cbf7b885c81647a0c5d15cc30548a1a3a6c09d2f4c00d92e6a2c1048aab7
MD5 c88166107e720a597d005139d8742265
SHA1 094f2f19cc71fd27ea4b616bba6d488e542fbd4f
SHA512 4deb326bcb2f47a1b73f8435994ac5b7936e41799d52a34772bceaf3aee086d6319572e3cc3643e17b3fb170e50b9d5e5b40d79304a43beb6dcdbc2647c9690a
SSDEEP 6144:wkNb9EQKLAroeMoKIN+LiZ0OcG6uKKP2LEnkT6/iG0ZMJ4+9Z7dmabUceCsX9kp1:wkt9EQ0ArocKIgLi+OcluKKP2LHOAWmC
TLSH
T16174125B4E1249E1CDC4C4768437E396FB7810AAF842112A8B36E3625F6777D1D4ECCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-157-0x0000021C70CC0000-0x0000021C70CCA000-memory.dmp

Download

memory/1072-162-0x0000021C71810000-0x0000021C71D38000-memory.dmp

Download

memory/1072-155-0x0000021C70BE0000-0x0000021C70BFE000-memory.dmp

Download

memory/1072-158-0x0000021C70F70000-0x0000021C70F9A000-memory.dmp

Download

memory/1072-159-0x0000021C70F70000-0x0000021C70F94000-memory.dmp

Download

memory/1072-160-0x0000021C71110000-0x0000021C712D2000-memory.dmp

Download

memory/1072-156-0x0000021C70C00000-0x0000021C70CB2000-memory.dmp

Download

memory/1984-168-0x0000018066B50000-0x0000018066C02000-memory.dmp

Download

memory/3384-203-0x000001C2CC9E0000-0x000001C2CC9EE000-memory.dmp

Download

memory/3384-204-0x000001C2CCF60000-0x000001C2CCF7A000-memory.dmp

Download

memory/3628-189-0x00000211637B0000-0x00000211637CE000-memory.dmp

Download

memory/3628-190-0x0000021163680000-0x000002116368A000-memory.dmp

Download

memory/3628-191-0x0000021163690000-0x000002116369A000-memory.dmp

Download

memory/4600-161-0x00007FFB52660000-0x00007FFB539DE000-memory.dmp

Download

memory/4600-247-0x00007FFB52660000-0x00007FFB539DE000-memory.dmp

Download

memory/5532-149-0x000001CAD3A70000-0x000001CAD3A92000-memory.dmp

Download