Overview

overview

8

Static

static

3

2026-08-02...at.exe

windows10-2004-x64

8

2026-08-02...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 02:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 81.3MB
  • Sample260802-ctckvsscpg
  • SHA256 55e5a48329cc368c05f14a0e9076c8d1c6da61e612d871fba503a8da70980dc2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 12 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq vmtoolsd.exe" /FI "IMAGENAME eq VBoxService.exe""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq vmtoolsd.exe" /FI "IMAGENAME eq VBoxService.exe"
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:2312
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SnoopUpd" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SnoopUpd" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2264
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
        3⤵
        • Views/modifies file attributes
        PID:2964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -c "Add-MpPreference -ExclusionPath C:\ -ExclusionPath %USERPROFILE% -ExclusionPath %TEMP%""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "Add-MpPreference -ExclusionPath C:\ -ExclusionPath C:\Users\Admin -ExclusionPath C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1188
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles state off
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1520
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq vmtoolsd.exe" /FI "IMAGENAME eq VBoxService.exe""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq vmtoolsd.exe" /FI "IMAGENAME eq VBoxService.exe"
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3732
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SnoopUpd" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SnoopUpd" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4644
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
        3⤵
        • Views/modifies file attributes
        PID:5108
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -c "Add-MpPreference -ExclusionPath C:\ -ExclusionPath %USERPROFILE% -ExclusionPath %TEMP%""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "Add-MpPreference -ExclusionPath C:\ -ExclusionPath C:\Users\Admin -ExclusionPath C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles state off
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1188
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq vmtoolsd.exe" /FI "IMAGENAME eq VBoxService.exe""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1056
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq vmtoolsd.exe" /FI "IMAGENAME eq VBoxService.exe"
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SnoopUpd" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3716
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SnoopUpd" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2708
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-02_fb2eb72b6e2d548ec5ffa854c0e82fb4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
        3⤵
        • Views/modifies file attributes
        PID:4964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -c "Add-MpPreference -ExclusionPath C:\ -ExclusionPath %USERPROFILE% -ExclusionPath %TEMP%""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "Add-MpPreference -ExclusionPath C:\ -ExclusionPath C:\Users\Admin -ExclusionPath C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:60
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles state off
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2964

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Process Discovery

        1
        T1057

        Query Registry

        1
        T1012

        Lateral Movement

        Collection

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\PyQt5\Qt5\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\PyQt5\Qt5\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 2.3MB
        • SHA256 f93019b4f1cdc96fb1de819f6f63291e1f069fd242b0aa20f6f06eb66c085491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\PyQt5\QtCore.pyd
        • Size 485KB
        • SHA256 f6526d3456458eba25766bce540467f5c2f25598afe9dc840debaa57fb3c2491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\PyQt5\sip.cp314-win_amd64.pyd
        • Size 50KB
        • SHA256 dbc208de86fdc05b003afa343b11dc0a7645342c32a3a5afcaf1ce84b787d925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_asyncio.pyd
        • Size 41KB
        • SHA256 ce6c7891f865775eb24de4bc702326f88a5b36b0ae08dbd6dd6c109493d80f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_bz2.pyd
        • Size 51KB
        • SHA256 6a76e34b6b7496d125a35568e602ca5809cf83c8f70616cfa54d9ee1db543d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_cffi_backend.cp314-win_amd64.pyd
        • Size 71KB
        • SHA256 c31739ec60d423d2493e782816f92955d88b25bf573ac61304166cd4849e4468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_ctypes.pyd
        • Size 66KB
        • SHA256 817058649478556f9246e6346045ec23d189e2ce89845409dc0cc9f37a00cd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_decimal.pyd
        • Size 120KB
        • SHA256 8d81696df64ba8060eaa613c8974ff8d9bc9e56b0cd7a36da555a3c704619313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_elementtree.pyd
        • Size 62KB
        • SHA256 020ff86a678d73d7b2e8d48d38279df8723efcf64ba2bec0629b637970c1c484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_hashlib.pyd
        • Size 38KB
        • SHA256 cc39a7cf30f6632542194538f6ee589fbbab0ddd1d6e0c02e44db5ba6ccca3d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_lzma.pyd
        • Size 88KB
        • SHA256 1412675b14b94a17efdf88b5cc5453f3e75cebb1ef4d97807a642b938063246a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_multiprocessing.pyd
        • Size 29KB
        • SHA256 7a2d141eb758017abb9856d12d319f82b732ce75c7d17dc6b58809bcfe236f09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_overlapped.pyd
        • Size 36KB
        • SHA256 9f084b1756e3d2bae905b3742357253b926c5ec018844e513e339718f5f95bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_queue.pyd
        • Size 28KB
        • SHA256 6812a66bbf8272580bceb20307bdd849c514acb825a9e1723f551a42dd1501da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_socket.pyd
        • Size 46KB
        • SHA256 2497b1959249559018a6912c5233966966b4e161cc94bd888a52d2b68993b37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_ssl.pyd
        • Size 68KB
        • SHA256 1dde46195437c227b76bf9cfaf587127ca29cdfee9e10ff23f31f792b35ab600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_tkinter.pyd
        • Size 41KB
        • SHA256 ae4a891f37ed27c062c492244b1f836995f78763d390ddcfd00f235d2b544f96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_uuid.pyd
        • Size 27KB
        • SHA256 2f141001cc496ff2f462e5247276d16a4f92ff741c75c81ed4e12e16ad859b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_wmi.pyd
        • Size 30KB
        • SHA256 7775928c7d4242246b21cfaba8cfcf3d5a02edd930959dc04a556d99712696ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\_zstd.pyd
        • Size 176KB
        • SHA256 faafe95af1dd70fdcd337670ffc554f767afc240462607e58409cc32e7ca16a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\base_library.zip
        • Size 1.3MB
        • SHA256 b57bf7424c7712edb35a2bd80be94f62dda80621da6ee63d86582e9812da101f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\itsdangerous-2.2.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\libcrypto-3.dll
        • Size 1.6MB
        • SHA256 57778b71f1029c40b7a0a349dbbb63e6fac114c79498a61b1c522d142fcca33d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\libffi-8.dll
        • Size 29KB
        • SHA256 ced71befa72b674586413bdf9db7d93eb734e7ed28fbe5cc66b505f729442c46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\libssl-3.dll
        • Size 224KB
        • SHA256 6ecc5a2add0086440bc44c5ffd130c4a635d8ffbb7098842ce2a1b7689c0ff56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\pyexpat.pyd
        • Size 93KB
        • SHA256 c418d32615505bd4a1337b63625fbcfd747d4e71bbb6a174e845f1edc08ddcd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\python3.dll
        • Size 72KB
        • SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\python314.dll
        • Size 1.9MB
        • SHA256 6e4545086245b46723b1c10cf8f8ce04d3185e79fa5a7640284944b3f1743cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\select.pyd
        • Size 28KB
        • SHA256 62d330e5bcf781c9cf133b7231d99545cce2b797b056a70d7d0f64b9a2a39b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\tcl86t.dll
        • Size 659KB
        • SHA256 d21510f3d63968b4362b9f5128ed2639eaf60206ec06f41a4fd571b90f61e5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\tk86t.dll
        • Size 635KB
        • SHA256 e2e3104e0721e3f450fffb64846e70ba21acaccc47dd4a653acd3e8c46e3158b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\unicodedata.pyd
        • Size 277KB
        • SHA256 9e60746a246d36a56d7cde7dc5fd241ed2ccf52f7dfd12874dd6a0f5513a06b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\win32\win32gui.pyd
        • Size 66KB
        • SHA256 87297eff72996291ab605958f82b752aa69baaf6af4ed39d12a89c7dec35a3ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winsound.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\winsound.pyd
        • Size 27KB
        • SHA256 96f23ccd9917835074c6e367d9880bf76a3312479ef445e012008448d1998245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36442\zlib1.dll
        • Size 77KB
        • SHA256 8c077bfa332c21ef340aa2647fb8d387feebc29ff030cd0427299a636b1dcc14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        euc-cn.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37282\_tcl_data\encoding\euc-cn.enc
        • Size 84KB
        • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt_help_en.qm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\PyQt5\Qt5\translations\qt_help_en.qm
        • Size 16B
        • SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
        • MD5 SHA1 SHA512
        Submit Download

        WHEEL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\flask-3.1.3.dist-info\WHEEL
        • Size 82B
        • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_akgu4own.aq0.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_akgu4own.aq0.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1188-1396-0x0000019FAE850000-0x0000019FAF311000-memory.dmp
        Download

        memory/1188-1392-0x0000019FC7810000-0x0000019FC7832000-memory.dmp
        Download

        memory/2204-3959-0x00007FFE46510000-0x00007FFE4653C000-memory.dmp
        Download

        memory/2204-3970-0x00007FFE3A220000-0x00007FFE3A248000-memory.dmp
        Download

        memory/2204-3955-0x0000016E84A10000-0x0000016E8511B000-memory.dmp
        Download

        memory/2204-3974-0x00007FFE3A160000-0x00007FFE3A1A0000-memory.dmp
        Download

        memory/2204-3973-0x00007FFE46340000-0x00007FFE4634D000-memory.dmp
        Download

        memory/2204-3972-0x00007FFE3A1C0000-0x00007FFE3A1D2000-memory.dmp
        Download

        memory/2204-3971-0x00007FFE3A200000-0x00007FFE3A218000-memory.dmp
        Download

        memory/2204-3968-0x00007FFE37A70000-0x00007FFE37D02000-memory.dmp
        Download

        memory/2204-3967-0x00007FFE3A490000-0x00007FFE3A55E000-memory.dmp
        Download

        memory/2204-3966-0x00007FFE3A560000-0x00007FFE3A594000-memory.dmp
        Download

        memory/2204-3965-0x00007FFE37D10000-0x00007FFE38241000-memory.dmp
        Download

        memory/2204-3964-0x00007FFE46370000-0x00007FFE46384000-memory.dmp
        Download

        memory/2204-3963-0x00007FFE464B0000-0x00007FFE464BF000-memory.dmp
        Download

        memory/2204-3962-0x00007FFE464E0000-0x00007FFE464ED000-memory.dmp
        Download

        memory/2204-3956-0x00007FFE46560000-0x00007FFE46589000-memory.dmp
        Download

        memory/2204-3957-0x00007FFE46660000-0x00007FFE4666F000-memory.dmp
        Download

        memory/2204-3958-0x00007FFE46540000-0x00007FFE4655A000-memory.dmp
        Download

        memory/2204-3961-0x00007FFE464F0000-0x00007FFE4650A000-memory.dmp
        Download

        memory/2204-3969-0x00007FFE37420000-0x00007FFE37A61000-memory.dmp
        Download

        memory/2204-3960-0x00007FFE3A6B0000-0x00007FFE3A730000-memory.dmp
        Download

        memory/2956-3982-0x00007FFE46690000-0x00007FFE4669D000-memory.dmp
        Download

        memory/2956-3988-0x00007FFE38330000-0x00007FFE385C2000-memory.dmp
        Download

        memory/2956-3994-0x00007FFE382C0000-0x00007FFE38300000-memory.dmp
        Download

        memory/2956-3983-0x00007FFE46680000-0x00007FFE4668F000-memory.dmp
        Download

        memory/2956-3984-0x00007FFE46590000-0x00007FFE465A4000-memory.dmp
        Download

        memory/2956-3993-0x00007FFE428F0000-0x00007FFE428FD000-memory.dmp
        Download

        memory/2956-3992-0x00007FFE3A1A0000-0x00007FFE3A1B2000-memory.dmp
        Download

        memory/2956-3975-0x00007FFE393D0000-0x00007FFE39ADB000-memory.dmp
        Download

        memory/2956-3990-0x00007FFE3A3C0000-0x00007FFE3A3E8000-memory.dmp
        Download

        memory/2956-3991-0x00007FFE3A1E0000-0x00007FFE3A1F8000-memory.dmp
        Download

        memory/2956-3986-0x00007FFE3A670000-0x00007FFE3A6A4000-memory.dmp
        Download

        memory/2956-3985-0x00007FFE38E90000-0x00007FFE393C1000-memory.dmp
        Download

        memory/2956-3987-0x00007FFE3A5A0000-0x00007FFE3A66E000-memory.dmp
        Download

        memory/2956-3989-0x00007FFE36900000-0x00007FFE36F41000-memory.dmp
        Download

        memory/2956-3981-0x00007FFE466A0000-0x00007FFE466BA000-memory.dmp
        Download

        memory/2956-3980-0x00007FFE465C0000-0x00007FFE46640000-memory.dmp
        Download

        memory/2956-3979-0x00007FFE466C0000-0x00007FFE466EC000-memory.dmp
        Download

        memory/2956-3978-0x00007FFE4C210000-0x00007FFE4C22A000-memory.dmp
        Download

        memory/2956-3977-0x00007FFE4D180000-0x00007FFE4D18F000-memory.dmp
        Download

        memory/2956-3976-0x00007FFE466F0000-0x00007FFE46719000-memory.dmp
        Download

        memory/4672-1364-0x00007FFE38330000-0x00007FFE385C2000-memory.dmp
        Download

        memory/4672-3427-0x00007FFE46500000-0x00007FFE46529000-memory.dmp
        Download

        memory/4672-1363-0x00007FFE35490000-0x00007FFE354B2000-memory.dmp
        Download

        memory/4672-1362-0x00007FFE37CE0000-0x00007FFE38321000-memory.dmp
        Download

        memory/4672-1393-0x00007FFE37350000-0x00007FFE375D3000-memory.dmp
        Download

        memory/4672-1360-0x00007FFE3A230000-0x00007FFE3A264000-memory.dmp
        Download

        memory/4672-1361-0x00007FFE3A160000-0x00007FFE3A22E000-memory.dmp
        Download

        memory/4672-1763-0x00007FFE37130000-0x00007FFE3734B000-memory.dmp
        Download

        memory/4672-1359-0x00007FFE357C0000-0x00007FFE36B8C000-memory.dmp
        Download

        memory/4672-3430-0x00007FFE46370000-0x00007FFE4639C000-memory.dmp
        Download

        memory/4672-3435-0x00007FFE40240000-0x00007FFE40254000-memory.dmp
        Download

        memory/4672-3445-0x00007FFE37CE0000-0x00007FFE38321000-memory.dmp
        Download

        memory/4672-3522-0x00007FFE428F0000-0x00007FFE428FD000-memory.dmp
        Download

        memory/4672-3520-0x00007FFE37BC0000-0x00007FFE37BD8000-memory.dmp
        Download

        memory/4672-3666-0x00007FFE36B90000-0x00007FFE36F49000-memory.dmp
        Download

        memory/4672-3602-0x00007FFE357C0000-0x00007FFE36B8C000-memory.dmp
        Download

        memory/4672-3714-0x00007FFE37990000-0x00007FFE379A6000-memory.dmp
        Download

        memory/4672-3777-0x00007FFE37130000-0x00007FFE3734B000-memory.dmp
        Download

        memory/4672-3776-0x00007FFE37350000-0x00007FFE375D3000-memory.dmp
        Download

        memory/4672-3737-0x00007FFE375E0000-0x00007FFE3760D000-memory.dmp
        Download

        memory/4672-3734-0x00007FFE37610000-0x00007FFE377B1000-memory.dmp
        Download

        memory/4672-3720-0x00007FFE377C0000-0x00007FFE37990000-memory.dmp
        Download

        memory/4672-3713-0x00007FFE379B0000-0x00007FFE379DA000-memory.dmp
        Download

        memory/4672-3712-0x00007FFE3FDC0000-0x00007FFE3FDD0000-memory.dmp
        Download

        memory/4672-3711-0x00007FFE379E0000-0x00007FFE37A0C000-memory.dmp
        Download

        memory/4672-3709-0x00007FFE37A10000-0x00007FFE37AD2000-memory.dmp
        Download

        memory/4672-3705-0x00007FFE37AE0000-0x00007FFE37B01000-memory.dmp
        Download

        memory/4672-3704-0x00007FFE37B10000-0x00007FFE37B27000-memory.dmp
        Download

        memory/4672-3703-0x00007FFE37B30000-0x00007FFE37B5F000-memory.dmp
        Download

        memory/4672-3702-0x00007FFE35490000-0x00007FFE354B2000-memory.dmp
        Download

        memory/4672-3694-0x00007FFE36B90000-0x00007FFE36F49000-memory.dmp
        Download

        memory/4672-3519-0x00007FFE37BE0000-0x00007FFE37C08000-memory.dmp
        Download

        memory/4672-3523-0x00007FFE37B60000-0x00007FFE37BA0000-memory.dmp
        Download

        memory/4672-3521-0x00007FFE37BA0000-0x00007FFE37BB2000-memory.dmp
        Download

        memory/4672-3441-0x00007FFE38330000-0x00007FFE385C2000-memory.dmp
        Download

        memory/4672-3440-0x00007FFE3A160000-0x00007FFE3A22E000-memory.dmp
        Download

        memory/4672-3436-0x00007FFE38E90000-0x00007FFE393C1000-memory.dmp
        Download

        memory/4672-3434-0x00007FFE464B0000-0x00007FFE464BF000-memory.dmp
        Download

        memory/4672-3433-0x00007FFE464E0000-0x00007FFE464ED000-memory.dmp
        Download

        memory/4672-3432-0x00007FFE46350000-0x00007FFE4636A000-memory.dmp
        Download

        memory/4672-3431-0x00007FFE3A270000-0x00007FFE3A2F0000-memory.dmp
        Download

        memory/4672-3424-0x00007FFE393D0000-0x00007FFE39ADB000-memory.dmp
        Download

        memory/4672-3429-0x00007FFE46530000-0x00007FFE4654A000-memory.dmp
        Download

        memory/4672-1365-0x00007FFE393D0000-0x00007FFE39ADB000-memory.dmp
        Download

        memory/4672-1358-0x00007FFE36B90000-0x00007FFE36F49000-memory.dmp
        Download

        memory/4672-3439-0x00007FFE3A230000-0x00007FFE3A264000-memory.dmp
        Download

        memory/4672-3428-0x00007FFE464F0000-0x00007FFE464FF000-memory.dmp
        Download

        memory/4672-1357-0x00007FFE38E90000-0x00007FFE393C1000-memory.dmp
        Download

        memory/4672-1356-0x00007FFE40240000-0x00007FFE40254000-memory.dmp
        Download

        memory/4672-1339-0x00007FFE428F0000-0x00007FFE428FD000-memory.dmp
        Download

        memory/4672-1340-0x00007FFE37B60000-0x00007FFE37BA0000-memory.dmp
        Download

        memory/4672-1341-0x00007FFE37B30000-0x00007FFE37B5F000-memory.dmp
        Download

        memory/4672-1342-0x00007FFE37B10000-0x00007FFE37B27000-memory.dmp
        Download

        memory/4672-1343-0x00007FFE37AE0000-0x00007FFE37B01000-memory.dmp
        Download

        memory/4672-1344-0x00007FFE37A10000-0x00007FFE37AD2000-memory.dmp
        Download

        memory/4672-1345-0x00007FFE379E0000-0x00007FFE37A0C000-memory.dmp
        Download

        memory/4672-1346-0x00007FFE3FDC0000-0x00007FFE3FDD0000-memory.dmp
        Download

        memory/4672-1347-0x00007FFE379B0000-0x00007FFE379DA000-memory.dmp
        Download

        memory/4672-1349-0x00007FFE377C0000-0x00007FFE37990000-memory.dmp
        Download

        memory/4672-1350-0x00007FFE37610000-0x00007FFE377B1000-memory.dmp
        Download

        memory/4672-1351-0x00007FFE375E0000-0x00007FFE3760D000-memory.dmp
        Download

        memory/4672-1353-0x00007FFE464B0000-0x00007FFE464BF000-memory.dmp
        Download

        memory/4672-1354-0x00007FFE37BA0000-0x00007FFE37BB2000-memory.dmp
        Download

        memory/4672-1355-0x00007FFE37130000-0x00007FFE3734B000-memory.dmp
        Download

        memory/4672-1352-0x00007FFE37350000-0x00007FFE375D3000-memory.dmp
        Download

        memory/4672-1348-0x00007FFE37990000-0x00007FFE379A6000-memory.dmp
        Download

        memory/4672-1331-0x00007FFE37BE0000-0x00007FFE37C08000-memory.dmp
        Download

        memory/4672-1332-0x00007FFE37BC0000-0x00007FFE37BD8000-memory.dmp
        Download

        memory/4672-1333-0x00007FFE464E0000-0x00007FFE464ED000-memory.dmp
        Download

        memory/4672-1327-0x00007FFE3A270000-0x00007FFE3A2F0000-memory.dmp
        Download

        memory/4672-1326-0x00007FFE37CE0000-0x00007FFE38321000-memory.dmp
        Download

        memory/4672-1325-0x00007FFE38330000-0x00007FFE385C2000-memory.dmp
        Download

        memory/4672-1314-0x00007FFE3A230000-0x00007FFE3A264000-memory.dmp
        Download

        memory/4672-1315-0x00007FFE3A160000-0x00007FFE3A22E000-memory.dmp
        Download

        memory/4672-1311-0x00007FFE46500000-0x00007FFE46529000-memory.dmp
        Download

        memory/4672-1308-0x00007FFE40240000-0x00007FFE40254000-memory.dmp
        Download

        memory/4672-1309-0x00007FFE393D0000-0x00007FFE39ADB000-memory.dmp
        Download

        memory/4672-1310-0x00007FFE38E90000-0x00007FFE393C1000-memory.dmp
        Download

        memory/4672-1305-0x00007FFE464B0000-0x00007FFE464BF000-memory.dmp
        Download

        memory/4672-1302-0x00007FFE464E0000-0x00007FFE464ED000-memory.dmp
        Download

        memory/4672-1300-0x00007FFE46350000-0x00007FFE4636A000-memory.dmp
        Download

        memory/4672-1270-0x00007FFE46530000-0x00007FFE4654A000-memory.dmp
        Download

        memory/4672-1274-0x00007FFE46370000-0x00007FFE4639C000-memory.dmp
        Download

        memory/4672-1275-0x00007FFE3A270000-0x00007FFE3A2F0000-memory.dmp
        Download

        memory/4672-1263-0x00007FFE46500000-0x00007FFE46529000-memory.dmp
        Download

        memory/4672-1266-0x00007FFE464F0000-0x00007FFE464FF000-memory.dmp
        Download

        memory/4672-1256-0x00007FFE393D0000-0x00007FFE39ADB000-memory.dmp
        Download