Overview

overview

10

Static

static

10

2026-07-01...-s.exe

windows10-2004-x64

7

2026-07-01...-s.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    129s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_823b8153ca3310fb564a5c301495862f_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
  • Size 51.6MB
  • Sample260701-slb75agy9k
  • SHA256 b99eb9e78963fcf7f41f5b1a48642322f3cc8dd1bc0a9ee03b15760830b62cf2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistencepyinstallerransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 31 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 9 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_823b8153ca3310fb564a5c301495862f_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_823b8153ca3310fb564a5c301495862f_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5304
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:700
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\ygkrh.xml /nologo /v:quiet
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wmeoqmza\wmeoqmza.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5268
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2AD.tmp" "c:\Users\Admin\AppData\Local\Temp\wmeoqmza\CSC7F36FA7441024121BEBDD9D3BE3C7D3C.TMP"
            4⤵
              PID:4888
      • C:\Users\Admin\AppData\Local\Temp\2026-07-01_823b8153ca3310fb564a5c301495862f_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-01_823b8153ca3310fb564a5c301495862f_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" --background
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\System32\net.exe
            net session
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5132
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              4⤵
                PID:4516
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\yjfg5.xml" /nologo /v:quiet"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1944
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\yjfg5.xml" /nologo /v:quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4704
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mijpyz0l\mijpyz0l.cmdline"
                4⤵
                  PID:2788
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "getmac"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1828
              • C:\Windows\System32\getmac.exe
                getmac
                3⤵
                  PID:4532
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5292
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic csproduct get uuid
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2468
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5380
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic path win32_videocontroller get caption
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:792
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:380
                • C:\Windows\System32\systeminfo.exe
                  systeminfo
                  3⤵
                  • Gathers system information
                  PID:4908
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\t347oq.xml" /nologo /v:quiet"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2816
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\t347oq.xml" /nologo /v:quiet
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5452
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k1crlhnf\k1crlhnf.cmdline"
                    4⤵
                      PID:5884
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\pr8zkj.xml" /nologo /v:quiet"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1768
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\pr8zkj.xml" /nologo /v:quiet
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1940
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vtogqu0f\vtogqu0f.cmdline"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3928
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFC7.tmp" "c:\Users\Admin\AppData\Local\Temp\vtogqu0f\CSCEFDB6A63903D4479BBBED2BDBA742C50.TMP"
                        5⤵
                          PID:2900
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SystemTelemetry_0kjig.exe
                        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SystemTelemetry_0kjig.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1976
                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SystemTelemetry_0kjig.exe
                          "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SystemTelemetry_0kjig.exe"
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:5864
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM firefox.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1264
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM firefox.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:4532
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM chrome.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2784
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM chrome.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:3716
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM opera.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4792
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM opera.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:2636
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM brave.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2380
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM brave.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:4908
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM vivaldi.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5756
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM vivaldi.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:840
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM 360chrome.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1056
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM 360chrome.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:2740
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM msedge.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3020
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM msedge.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:924
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM qqbrowser.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3404
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM qqbrowser.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:3388
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /F /FI "PID ne 5864" /IM browser.exe /T"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2244
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /FI "PID ne 5864" /IM browser.exe /T
                              7⤵
                              • Kills process with taskkill
                              PID:3232
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\zsh7gg.xml" /nologo /v:quiet"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5024
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\zsh7gg.xml" /nologo /v:quiet
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1680
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jgsr5rju\jgsr5rju.cmdline"
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5300
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFA8.tmp" "c:\Users\Admin\AppData\Local\Temp\jgsr5rju\CSC7B8AC76E8F4E44BE9FD2D0CDDAE13C99.TMP"
                          5⤵
                            PID:5584
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\406utd.xml" /nologo /v:quiet"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1996
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\406utd.xml" /nologo /v:quiet
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:6064
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ljeuoxb1\ljeuoxb1.cmdline"
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5764
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES194B.tmp" "c:\Users\Admin\AppData\Local\Temp\ljeuoxb1\CSC6FB69E0B31BD4DB78DA0B51DB35D7F8B.TMP"
                            5⤵
                              PID:2936
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:5544
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:3568
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:996
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:2216

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          SystemTelemetry_0kjig.exe
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SystemTelemetry_0kjig.exe
                          • Size 15.6MB
                          • SHA256 9bcb4556b40e885f9461243e1c4b361f4ca2bc074f3cd225d5165bba5ae66559
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SystemTelemetry_0kjig.exe
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SystemTelemetry_0kjig.exe
                          • Size 15.6MB
                          • SHA256 e2c7cbf8aab87cca332e83a682028b3c877c1b030fab07d19a9d211f6d220e66
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          prep_Activatable Class_Hermes_perf.cache
                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                          • Size 599B
                          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          406utd.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\406utd.xml
                          • Size 900B
                          • SHA256 6954523452d492956d344711185fd6ff82b8f8f5b17affc20b498d4ae3db05e1
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          RESD2AD.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\RESD2AD.tmp
                          • Size 1KB
                          • SHA256 29f732dd82f9048e5c04d3fa5fcea59c1f9fe5f25c15a609a26c284e1b3f5a16
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          RESFFA8.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\RESFFA8.tmp
                          • Size 1KB
                          • SHA256 f4acb9452dada48111d236226ffbfa4e957ad6e781930c5335a433ee23825925
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          RESFFC7.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\RESFFC7.tmp
                          • Size 1KB
                          • SHA256 278270122ee45d149040c62d0f8fd5f571f99f285e250035303d87796a0fc8bf
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\VCRUNTIME140.dll
                          • Size 117KB
                          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\VCRUNTIME140_1.dll
                          • Size 48KB
                          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _bz2.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_bz2.pyd
                          • Size 84KB
                          • SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_ctypes.pyd
                          • Size 131KB
                          • SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _hashlib.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_hashlib.pyd
                          • Size 67KB
                          • SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _lzma.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_lzma.pyd
                          • Size 155KB
                          • SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _queue.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_queue.pyd
                          • Size 34KB
                          • SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _socket.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_socket.pyd
                          • Size 84KB
                          • SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ssl.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_ssl.pyd
                          • Size 177KB
                          • SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _wmi.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\_wmi.pyd
                          • Size 38KB
                          • SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\base_library.zip
                          • Size 1.3MB
                          • SHA256 d9fb30b76e765744fdcb1c2926585fddc18cde16f2c512066306a751cc0ebef4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libcrypto-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\libcrypto-3.dll
                          • Size 5.0MB
                          • SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\libffi-8.dll
                          • Size 38KB
                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python313.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\python313.dll
                          • Size 5.8MB
                          • SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          select.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\select.pyd
                          • Size 32KB
                          • SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ucrtbase.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI19762\ucrtbase.dll
                          • Size 1.1MB
                          • SHA256 a58995e4f6b9a87abde4088d5d0d1a0f182594b9d3f9e4494ff8b1c4499cb091
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          bookmarks.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\bd_4f7ia_ux\Browser-Datas\firefox\nightly\m1lvo8db.default-release\bookmarks.txt
                          • Size 336B
                          • SHA256 f62778bc8519b24f20aedc434bc0b2ecbb00ab90732b0c483170294594f4beb7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          fdouy.bin
                          • Path C:\Users\Admin\AppData\Local\Temp\fdouy.bin
                          • Size 288B
                          • SHA256 537d31765863d1d1b77034586ae82c1385cb5d53d2a49a7bc025b4c642ee5ae9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          jgsr5rju.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\jgsr5rju\jgsr5rju.dll
                          • Size 4KB
                          • SHA256 f37e927c99ccef78df0f6b915961de3351be57632382fcada077e306bfc43dca
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          jgsr5rju.pdb
                          • Path C:\Users\Admin\AppData\Local\Temp\jgsr5rju\jgsr5rju.pdb
                          • Size 13KB
                          • SHA256 f8c60d04a536f923c661335dad254a66f4647aca65e572a971ddea63c8b44d58
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          pr8zkj.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\pr8zkj.xml
                          • Size 1KB
                          • SHA256 67453c8a15be76704e593463ff96209858b12947c35ad77caf973c84e054bbae
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          t347oq.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\t347oq.xml
                          • Size 1KB
                          • SHA256 a5ee4e6c3c244dbd00c0689fce148498ea05362acfbcf96a7714adf2f8e183ea
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vtogqu0f.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\vtogqu0f\vtogqu0f.dll
                          • Size 4KB
                          • SHA256 12cd09b321e3e1ed88739290b15ecfd51a6bc50836990a9947bba0dd10d2cdf4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vtogqu0f.pdb
                          • Path C:\Users\Admin\AppData\Local\Temp\vtogqu0f\vtogqu0f.pdb
                          • Size 13KB
                          • SHA256 983feebe58f4c3557c4ca3fa2e96aa753d2f85ef99d091ec7c21258073751547
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          wmeoqmza.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\wmeoqmza\wmeoqmza.dll
                          • Size 4KB
                          • SHA256 36c4c9d8d248cf0a3c2c4a99b3b1dc3ff2fbbdf0ddb24b9c5642ff439f6a5a80
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wmeoqmza.pdb
                          • Path C:\Users\Admin\AppData\Local\Temp\wmeoqmza\wmeoqmza.pdb
                          • Size 13KB
                          • SHA256 77494ae4bafc484cb3c85e46854ca20156df487d20898c4bd39add186c5bcdca
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          xmyjq.bin
                          • Path C:\Users\Admin\AppData\Local\Temp\xmyjq.bin
                          • Size 32B
                          • SHA256 f053bee26f4e6d09a82be6b5ef2eec9fe3387fcff13b007e43e847045dd8c76f
                          • MD5 SHA1 SHA512
                          Submit Download

                          ygkrh.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\ygkrh.xml
                          • Size 850B
                          • SHA256 802c4100974e8c13fb1d5e74c0a204fd20c12620cc390ac0b1a57b4d071dc7be
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          yjfg5.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\yjfg5.xml
                          • Size 1KB
                          • SHA256 35962c7f6e3987267def5471f13f5a59537482cef6e0c1ad1e03413a69b7648a
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          zsh7gg.xml
                          • Path C:\Users\Admin\AppData\Local\Temp\zsh7gg.xml
                          • Size 900B
                          • SHA256 7791170f512a070e726c1b2181d0cfa557f290425dae76a5bc3ffa67b6b9d418
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          CSC7B8AC76E8F4E44BE9FD2D0CDDAE13C99.TMP
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\jgsr5rju\CSC7B8AC76E8F4E44BE9FD2D0CDDAE13C99.TMP
                          • Size 652B
                          • SHA256 ee255885e42ab88e23f75adde3c107e473b91317d7063bb5c3da3528dd0912c4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          jgsr5rju.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\jgsr5rju\jgsr5rju.0.cs
                          • Size 1KB
                          • SHA256 7fd561b1a462222d161693e0cac61b1282c52fdcde4c982b6b210b0e7519087b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          jgsr5rju.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\jgsr5rju\jgsr5rju.cmdline
                          • Size 775B
                          • SHA256 daf8b43c299daa834c5e22d0b526c07155e8726e332ad0a57dd994503397d3f9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          k1crlhnf.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\k1crlhnf\k1crlhnf.0.cs
                          • Size 1KB
                          • SHA256 c2f40a9dc087ec6d85ea195becd50de63bb91ead6da74523641457bef06466de
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          k1crlhnf.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\k1crlhnf\k1crlhnf.cmdline
                          • Size 660B
                          • SHA256 a2f0c8ac44795f98a9a5f56e4d8e2cc354c0242bf0b284920ce0c229b70bb937
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          mijpyz0l.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\mijpyz0l\mijpyz0l.0.cs
                          • Size 2KB
                          • SHA256 9501ab14b1db7183391e93e3feb827b1233f850c7cf92eb2a5cb026e28076f12
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          mijpyz0l.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\mijpyz0l\mijpyz0l.cmdline
                          • Size 660B
                          • SHA256 b8fa95b53bd38ff37a4cb6d3b642812f9e5475be8950031dfa53f1947d4061e3
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          CSCEFDB6A63903D4479BBBED2BDBA742C50.TMP
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\vtogqu0f\CSCEFDB6A63903D4479BBBED2BDBA742C50.TMP
                          • Size 652B
                          • SHA256 42647cabf0029e5a6d5fe76c370684c569e60d18c4c8250180baff47ee021af2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vtogqu0f.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\vtogqu0f\vtogqu0f.0.cs
                          • Size 2KB
                          • SHA256 90483e6300876da9fbac7cd154e1288b8fabd59b6ddab764bc9612b557764020
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vtogqu0f.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\vtogqu0f\vtogqu0f.cmdline
                          • Size 660B
                          • SHA256 9b293d9c2d03bb2b520e333c705380257b3e58bca0106bc26d52e32b47555736
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          CSC7F36FA7441024121BEBDD9D3BE3C7D3C.TMP
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\wmeoqmza\CSC7F36FA7441024121BEBDD9D3BE3C7D3C.TMP
                          • Size 652B
                          • SHA256 c432301d1b73ad33070fbbdd0820eb1ad34e68cace3961403b208ddf13a79247
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wmeoqmza.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\wmeoqmza\wmeoqmza.0.cs
                          • Size 1KB
                          • SHA256 c769d67edc64b2b56e3c3b84d0a535a70e5625b3c795503432e22c9c835a29e3
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wmeoqmza.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\wmeoqmza\wmeoqmza.cmdline
                          • Size 779B
                          • SHA256 d453c2e5bd0d5b5fde8bd1b13110f21a5d036186f40e40bb81dd4f9b2e191e8d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/996-429-0x000001DC01A40000-0x000001DC01A60000-memory.dmp
                          Download

                          memory/996-446-0x000001DC01C80000-0x000001DC01CA0000-memory.dmp
                          Download

                          memory/996-431-0x000001DC01E40000-0x000001DC01F40000-memory.dmp
                          Download

                          memory/996-469-0x000001DC04200000-0x000001DC04220000-memory.dmp
                          Download

                          memory/996-423-0x000001DC001E0000-0x000001DC002E0000-memory.dmp
                          Download

                          memory/1484-16-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-4-0x0000020FC0A10000-0x0000020FC0A2A000-memory.dmp
                          Download

                          memory/1484-21-0x0000020FDAFA0000-0x0000020FDB006000-memory.dmp
                          Download

                          memory/1484-20-0x0000020FDB480000-0x0000020FDB5FC000-memory.dmp
                          Download

                          memory/1484-19-0x0000020FDAEE0000-0x0000020FDAF24000-memory.dmp
                          Download

                          memory/1484-18-0x0000020FDB0A0000-0x0000020FDB1C2000-memory.dmp
                          Download

                          memory/1484-17-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-2-0x00007FF8D78EF000-0x00007FF8D78F0000-memory.dmp
                          Download

                          memory/1484-15-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-14-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-13-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-12-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-10-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-8-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-9-0x0000020FC2240000-0x0000020FC2270000-memory.dmp
                          Download

                          memory/1484-7-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-6-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-5-0x0000020FDAD80000-0x0000020FDAEDA000-memory.dmp
                          Download

                          memory/1484-39-0x00007FF8D7760000-0x00007FF8D8104000-memory.dmp
                          Download

                          memory/1484-22-0x0000020FDB660000-0x0000020FDB9C0000-memory.dmp
                          Download

                          memory/1484-3-0x0000020FC0560000-0x0000020FC059E000-memory.dmp
                          Download

                          memory/1484-37-0x0000020FC2210000-0x0000020FC2218000-memory.dmp
                          Download

                          memory/1680-65-0x00000188FBC30000-0x00000188FBC80000-memory.dmp
                          Download

                          memory/1680-90-0x00000188E1860000-0x00000188E1868000-memory.dmp
                          Download

                          memory/1940-97-0x000001D6F7FD0000-0x000001D6F7FD8000-memory.dmp
                          Download

                          memory/6064-383-0x0000014159580000-0x0000014159588000-memory.dmp
                          Download