cf75e3b29c4a5ae4dbb09ec6a6e236daa0f6d6bc7e5a5fe26293effd1a1fbf77

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260908-krvyesec95
SHA256 cf75e3b29c4a5ae4dbb09ec6a6e236daa0f6d6bc7e5a5fe26293effd1a1fbf77
MD5 a7a46aaaa90771d4633e2974cccf1645
SHA1 27b3bf608ff261deb6245057ff1f4823c207de77
SHA512 14b2b50fec0023796c8d33196942c6af290fed696e528658544f3425121fb10e68bd2758b05c55a80481e2a74b1fa50e736e922b674a2c539368dbb79792dd4c
SSDEEP 393216:A/GmIJxQup/gW0lyAnLAAWage9KHXXMCHWUj4cuI3/PGTAI:UGJNqHL/WDzXMb8NH/O7
TLSH
T1FDE633186AC051FEE9B3827CDED3556DD97874141331C8CB0BA4A2BA9E532A05B3E737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe
3292	powershell.exe
3628	powershell.exe
5996	powershell.exe
5236	powershell.exe
2696	powershell.exe
4304	powershell.exe
5488	powershell.exe
5204	powershell.exe
2124	powershell.exe
2052	powershell.exe
4816	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2456	cmd.exe
2024	cmd.exe
5724	cmd.exe
2636	cmd.exe
5852	cmd.exe
2720	cmd.exe
3772	cmd.exe
3388	cmd.exe
4984	cmd.exe
3340	cmd.exe
2848	cmd.exe
5592	cmd.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5996	powershell.exe
5996	powershell.exe
2124	powershell.exe
2124	powershell.exe
2052	powershell.exe
2052	powershell.exe
4816	powershell.exe
4816	powershell.exe
3196	powershell.exe
3196	powershell.exe
3292	powershell.exe
3292	powershell.exe
3628	powershell.exe
3628	powershell.exe
5236	powershell.exe
5236	powershell.exe
2696	powershell.exe
2696	powershell.exe
4304	powershell.exe
4304	powershell.exe
5488	powershell.exe
5488	powershell.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeIncreaseQuotaPrivilege	5996	powershell.exe
Token: SeSecurityPrivilege	5996	powershell.exe
Token: SeTakeOwnershipPrivilege	5996	powershell.exe
Token: SeLoadDriverPrivilege	5996	powershell.exe
Token: SeSystemProfilePrivilege	5996	powershell.exe
Token: SeSystemtimePrivilege	5996	powershell.exe
Token: SeProfSingleProcessPrivilege	5996	powershell.exe
Token: SeIncBasePriorityPrivilege	5996	powershell.exe
Token: SeCreatePagefilePrivilege	5996	powershell.exe
Token: SeBackupPrivilege	5996	powershell.exe
Token: SeRestorePrivilege	5996	powershell.exe
Token: SeShutdownPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeSystemEnvironmentPrivilege	5996	powershell.exe
Token: SeRemoteShutdownPrivilege	5996	powershell.exe
Token: SeUndockPrivilege	5996	powershell.exe
Token: SeManageVolumePrivilege	5996	powershell.exe
Token: 33	5996	powershell.exe
Token: 34	5996	powershell.exe
Token: 35	5996	powershell.exe
Token: 36	5996	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeIncreaseQuotaPrivilege	2124	powershell.exe
Token: SeSecurityPrivilege	2124	powershell.exe
Token: SeTakeOwnershipPrivilege	2124	powershell.exe
Token: SeLoadDriverPrivilege	2124	powershell.exe
Token: SeSystemProfilePrivilege	2124	powershell.exe
Token: SeSystemtimePrivilege	2124	powershell.exe
Token: SeProfSingleProcessPrivilege	2124	powershell.exe
Token: SeIncBasePriorityPrivilege	2124	powershell.exe
Token: SeCreatePagefilePrivilege	2124	powershell.exe
Token: SeBackupPrivilege	2124	powershell.exe
Token: SeRestorePrivilege	2124	powershell.exe
Token: SeShutdownPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeSystemEnvironmentPrivilege	2124	powershell.exe
Token: SeRemoteShutdownPrivilege	2124	powershell.exe
Token: SeUndockPrivilege	2124	powershell.exe
Token: SeManageVolumePrivilege	2124	powershell.exe
Token: 33	2124	powershell.exe
Token: 34	2124	powershell.exe
Token: 35	2124	powershell.exe
Token: 36	2124	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	2052	powershell.exe
Token: SeSecurityPrivilege	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2052	powershell.exe
Token: SeLoadDriverPrivilege	2052	powershell.exe
Token: SeSystemProfilePrivilege	2052	powershell.exe
Token: SeSystemtimePrivilege	2052	powershell.exe
Token: SeProfSingleProcessPrivilege	2052	powershell.exe
Token: SeIncBasePriorityPrivilege	2052	powershell.exe
Token: SeCreatePagefilePrivilege	2052	powershell.exe
Token: SeBackupPrivilege	2052	powershell.exe
Token: SeRestorePrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	2052	powershell.exe
Token: SeRemoteShutdownPrivilege	2052	powershell.exe
Token: SeUndockPrivilege	2052	powershell.exe
Token: SeManageVolumePrivilege	2052	powershell.exe
Token: 33	2052	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 244	3252	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 244 wrote to memory of 5852	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5852 wrote to memory of 5996	5852	cmd.exe	92
PID 244 wrote to memory of 2720	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2720 wrote to memory of 2124	2720	cmd.exe	96
PID 244 wrote to memory of 3772	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 3772 wrote to memory of 2052	3772	cmd.exe	99
PID 244 wrote to memory of 5592	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5592 wrote to memory of 4816	5592	cmd.exe	102
PID 244 wrote to memory of 2456	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 2456 wrote to memory of 3196	2456	cmd.exe	105
PID 244 wrote to memory of 2024	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2024 wrote to memory of 3292	2024	cmd.exe	108
PID 244 wrote to memory of 3388	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 3388 wrote to memory of 3628	3388	cmd.exe	111
PID 244 wrote to memory of 4984	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 4984 wrote to memory of 5236	4984	cmd.exe	114
PID 244 wrote to memory of 5724	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5724 wrote to memory of 2696	5724	cmd.exe	117
PID 244 wrote to memory of 3340	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 3340 wrote to memory of 4304	3340	cmd.exe	120
PID 244 wrote to memory of 2848	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 2848 wrote to memory of 5488	2848	cmd.exe	123
PID 244 wrote to memory of 2636	244	2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 2636 wrote to memory of 5204	2636	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-07_a7a46aaaa90771d4633e2974cccf1645_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\sojakux'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\sojakux'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 120f661670b9c9bcef6fa45b38c693ea6166a266146df31d722eb6ed8a06b221
MD5 220d7629912a8fecde10014b46c1efba
SHA1 e041e3f3af622f37660165e7b68741875f7ec838
SHA512 9c5658995eea147b95774e8f0acb6eeba2cd715887b6fa497d0c82a154078ffc93356983fb8902fb00383745255939d0e874a4a0c7d38f2857882d0155bf8624
TLSH
T1B4216833F3DD8624D89A413A10CDAC1036B6C7DB41DFCFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f81052f90705ff3c4bc03fc8b9ac2ffceacccd5f0f3739e2714069519b9bb4ad
MD5 2f1da7a0666fb96458aa8743c4f5b80b
SHA1 b0c6e5f3c64776b6266fb4e28bb3065a96d60b7d
SHA512 de556547472406d20bb3a76e292e3e84723ffdc80c09cb58f607590c0a81eea234c1625a77ab322b39ad64a5acf366bf164a9a11a70b6a6ef0c8d9872c484a9a
TLSH
T1A8216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_uuid.pyd
Size 25KB
SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
MD5 3acf3138d5550ca6de7e2580e076e0f7
SHA1 3e878a18df2362aa6f0bdbfa058dca115e70d0b8
SHA512 f05e90a0feaa2994b425884af32149fbbe2e11cb7499fc88ca92d8a74410edcd62b2b2c0f1ecd1a46985133f7e89575f2c114bd01f619c22ce52f3cf2a7e37c4
SSDEEP 384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
TLSH
T19DC27F56DAA05C46DD278A70B4E24E16EEB5BA514B50C3CB3318C2950F623C37BA73F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\base_library.zip
Size 1.3MB
SHA256 8fbfa319b41505ec132a7daa148cfc7b6bb61d8344f76e4bd8f97d0624ecd537
MD5 8afd2290ab28630ca45f494f84c53793
SHA1 8c29106732dc2084137a5e5721f025a15961bbdb
SHA512 e4045a60b6dc5b9ff0f9dcc25300c335f0f267e3ccb7daf7aa6b2ab95b88f429cf45081d6109b3aff5a9edf4b38b215c5530f3793fdc5f8ea3545cdd1f9aec14
SSDEEP 12288:6i2cPudx5/S6wdjQSTZFtn2pL+DsnuOBg80201jwCVRDVoioSYBvHS91lANLeGQs:65cPudx5/yddB2bRvSHeHaLg7Wp6
TLSH
T144551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 625KB
SHA256 6e51381db5a97213bfb1a91b4ee71c043ef8257b0e9b6c8eadb3f2452fa04ee2
MD5 bdfc79c45d4a55923eb28533d75965a5
SHA1 3e052045f7b5ce8ab95c4586fbfdced1fd334807
SHA512 96efb3d4651f1d62247f61856f0745797b24324a1ad244760d3d1366fd4f4aa0691ebb800e6bd6e09e8d6f4cf6a8e4f82599e1d4a1736369ed44e2ae9e421217
SSDEEP 12288:kcIxPU6PCVHvi5v3ctjdcg7fUoP9c95RnEvZCG:kcWM4ctjdcg7fUoP9c95Rnew
TLSH
T13ED4294BE1FA25E0E6B6D17C078BF2737C3ABA488160775B355CD3A127D4A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\python3.DLL
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1xt3gz3j.vlj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1xt3gz3j.vlj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-151-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/244-79-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/5488-143-0x000002A7A5820000-0x000002A7A58D2000-memory.dmp

Download

memory/5996-68-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-70-0x00000255FFD90000-0x00000255FFD9A000-memory.dmp

Download

memory/5996-71-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-72-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-73-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-74-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-75-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-76-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-77-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-67-0x000002559A340000-0x000002559A35E000-memory.dmp

Download

memory/5996-81-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-78-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-69-0x000002559A360000-0x000002559A412000-memory.dmp

Download

memory/5996-64-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-63-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-133-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-62-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-61-0x00000255FFE70000-0x00000255FFE92000-memory.dmp

Download

memory/5996-58-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download

memory/5996-57-0x00007FFDCCD0F000-0x00007FFDCCD10000-memory.dmp

Download

memory/5996-152-0x00007FFDCCB80000-0x00007FFDCD524000-memory.dmp

Download