Overview

overview

9

Static

static

3

2026-08-16...om.exe

windows10-2004-x64

9

2026-08-16...om.exe

windows11-ltsc_2024-x64

9

Resubmissions

16/08/2026, 09:10

260816-k42lqstzcz6

16/08/2026, 04:30

260816-e4ybesbc329

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 28.1MB
  • Sample260816-e4ybesbc32
  • SHA256 431a6c001668b918b36c6c0bca87e633cabe8fe09a4bbad17f1357347c5fd841
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (10778) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 61 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 64 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 4 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:256
    • C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5200
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic useraccount where name="Admin" rename ALTGANG"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5972
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic useraccount where name="Admin" rename ALTGANG
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4288
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "net user Admin ALTGANGBETTERFUCKLERRAN"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5652
        • C:\Windows\system32\net.exe
          net user Admin ALTGANGBETTERFUCKLERRAN
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 user Admin ALTGANGBETTERFUCKLERRAN
            5⤵
              PID:5592
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "net user Administrator ALTGANGBETTERFUCKLERRAN"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3536
          • C:\Windows\system32\net.exe
            net user Administrator ALTGANGBETTERFUCKLERRAN
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1296
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 user Administrator ALTGANGBETTERFUCKLERRAN
              5⤵
                PID:3164
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\syscache""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1916
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\syscache"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5516
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -command "Add-MpPreference -ExclusionProcess 2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3064
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -command "Add-MpPreference -ExclusionProcess 2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1876
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "MicrosoftUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onlogon /rl highest /f /ru "SYSTEM""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4600
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "MicrosoftUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" /sc onlogon /rl highest /f /ru "SYSTEM"
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3700
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "schtasks /change /tn "MicrosoftUpdate" /disable"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4144
            • C:\Windows\system32\schtasks.exe
              schtasks /change /tn "MicrosoftUpdate" /disable
              4⤵
                PID:2320
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x0 /state0:0xa3a28055 /state1:0x41c64e6d
          1⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2156
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k CameraMonitor
          1⤵
            PID:4496
          • C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
              C:\Users\Admin\AppData\Local\Temp\2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops desktop.ini file(s)
              • Suspicious use of WriteProcessMemory
              PID:4432
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "wmic useraccount where name="Admin" rename ALTGANG"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3152
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic useraccount where name="Admin" rename ALTGANG
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5892
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "net user Admin ALTGANGBETTERFUCKLERRAN"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4452
                • C:\Windows\system32\net.exe
                  net user Admin ALTGANGBETTERFUCKLERRAN
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:488
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 user Admin ALTGANGBETTERFUCKLERRAN
                    5⤵
                      PID:5836
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "net user Administrator ALTGANGBETTERFUCKLERRAN"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2824
                  • C:\Windows\system32\net.exe
                    net user Administrator ALTGANGBETTERFUCKLERRAN
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4992
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 user Administrator ALTGANGBETTERFUCKLERRAN
                      5⤵
                        PID:4656

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    2
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Windows Command Shell

                    1
                    T1059.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    2
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Windows Credential Manager

                    1
                    T1555.004

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\VCRUNTIME140.dll
                    • Size 117KB
                    • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VCRUNTIME140_1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\VCRUNTIME140_1.dll
                    • Size 48KB
                    • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _bz2.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_bz2.pyd
                    • Size 85KB
                    • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _cffi_backend.cp314-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_cffi_backend.cp314-win_amd64.pyd
                    • Size 177KB
                    • SHA256 9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ctypes.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_ctypes.pyd
                    • Size 139KB
                    • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _hashlib.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_hashlib.pyd
                    • Size 67KB
                    • SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _lzma.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_lzma.pyd
                    • Size 157KB
                    • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _queue.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_queue.pyd
                    • Size 35KB
                    • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_socket.pyd
                    • Size 85KB
                    • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _sqlite3.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_sqlite3.pyd
                    • Size 129KB
                    • SHA256 b0c4edff6d60f300373ec929ab915f95ee601bf167e04d28e4e9e28a8e536fe0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_ssl.pyd
                    • Size 186KB
                    • SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _wmi.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_wmi.pyd
                    • Size 39KB
                    • SHA256 0ab1fbcf18c95d70343012feb1aad61e1ba95aaed5b4a08e57fc5990e8a9a452
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _zstd.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\_zstd.pyd
                    • Size 491KB
                    • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
                    • Size 218KB
                    • SHA256 3048af5864e17f79410273b3074416d67473eae22b3d7d1b7b58f24a506f82ed
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api-ms-win-core-console-l1-1-0.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\api-ms-win-core-console-l1-1-0.dll
                    • Size 15KB
                    • SHA256 18d552fd987cc10701cd102191ec7c5a0d05b08c7271e525abe9ec530eae5ed2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api-ms-win-core-datetime-l1-1-0.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\api-ms-win-core-datetime-l1-1-0.dll
                    • Size 14KB
                    • SHA256 8bcccc37d02e157cd0e80c11a893e27d7c7c60f2fb6bbea985748dbe217ea413
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api-ms-win-core-debug-l1-1-0.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\api-ms-win-core-debug-l1-1-0.dll
                    • Size 14KB
                    • SHA256 c947b6e1372c387aa62e301cb7a3c68ffaa246b05ae91901b5f6fb087788abef
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api-ms-win-core-errorhandling-l1-1-0.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\api-ms-win-core-errorhandling-l1-1-0.dll
                    • Size 14KB
                    • SHA256 a84788c8f075a2fba309b5243c3c3277cf7914398fa63b5dd902ef6479af0f72
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api-ms-win-core-file-l1-1-0.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\api-ms-win-core-file-l1-1-0.dll
                    • Size 18KB
                    • SHA256 7f2e6d9ba0c7c604ed0147a341e2a47f1b559a90ed876629625e05707a77fcca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    base_library.zip
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\base_library.zip
                    • Size 1.3MB
                    • SHA256 836e2186bde43ee9b01e9f6457b13f98966e0300c5a9f076979c80d64313d2a9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cd.cp314-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\charset_normalizer\cd.cp314-win_amd64.pyd
                    • Size 10KB
                    • SHA256 032b490f6b42a0928b3cb6e17fd4caf8a6becaaf05739c4fe41267dcf890c278
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _rust.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\cryptography\hazmat\bindings\_rust.pyd
                    • Size 9.5MB
                    • SHA256 05fefb14b1cb1c90bcccce87e82d205f5f2396977bf911243972790ba2376849
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libcrypto-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\libcrypto-3.dll
                    • Size 6.0MB
                    • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libffi-8.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\libffi-8.dll
                    • Size 38KB
                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libssl-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\libssl-3.dll
                    • Size 1.3MB
                    • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _psutil_windows.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\psutil\_psutil_windows.pyd
                    • Size 69KB
                    • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python3.DLL
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\python3.DLL
                    • Size 72KB
                    • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python314.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\python314.dll
                    • Size 6.5MB
                    • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pywintypes314.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\pywin32_system32\pywintypes314.dll
                    • Size 133KB
                    • SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\select.pyd
                    • Size 32KB
                    • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Lorem ipsum.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                    • Size 1KB
                    • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sqlite3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\sqlite3.dll
                    • Size 1.5MB
                    • SHA256 3557565665e608cd24726730e52690a131efcb0e2d5090337b2e05fb89d49c76
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ucrtbase.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\ucrtbase.dll
                    • Size 964KB
                    • SHA256 2775b59264f6536a0da39e3dae8bfe22c492666d5f3313411c461715af057ece
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unicodedata.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\unicodedata.pyd
                    • Size 741KB
                    • SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    win32crypt.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI2562\win32\win32crypt.pyd
                    • Size 123KB
                    • SHA256 1144670ad8271e4d477167bcb55b8ec38e8ad9f02c6fbfe66024e67083da2131
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __PSScriptPolicyTest_mnlrvxsd.4n0.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mnlrvxsd.4n0.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1876-1106-0x000002064A410000-0x000002064A53F000-memory.dmp
                    Download

                    memory/5200-3212-0x0000017AFB7B0000-0x0000017AFB7B1000-memory.dmp
                    Download

                    memory/5200-2129-0x0000017AFB7B0000-0x0000017AFB7B1000-memory.dmp
                    Download

                    memory/5516-1096-0x000002ACEF520000-0x000002ACEF53E000-memory.dmp
                    Download

                    memory/5516-1100-0x000002ACEF190000-0x000002ACEF2BF000-memory.dmp
                    Download

                    memory/5516-1098-0x000002ACEF700000-0x000002ACEF70A000-memory.dmp
                    Download

                    memory/5516-1097-0x000002ACEF540000-0x000002ACEF5F2000-memory.dmp
                    Download

                    memory/5516-1093-0x000002ACEF120000-0x000002ACEF142000-memory.dmp
                    Download