2026-07-09_7f8d3ea8d1f957330ff006555c34c3ef_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_remcos_revil_rhadamanthys_smoke-loader_stop_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_7f8d3ea8d1f957330ff006555c34c3ef_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_remcos_revil_rhadamanthys_smoke-loader_stop_vidar
Size 46.1MB
Sample260710-aevrsaaz9j
SHA256 a1b2faa8a82fbdbe551753b225efea75c46835849d2595c5a5c4bfc00c255ccd
MD5 7f8d3ea8d1f957330ff006555c34c3ef
SHA1 28bdb8f017dc992748da0662a78f678a75069d0c
SHA512 0214a53d53104ffcf58663416e828f401c55d8715dbd2ff5440074fffb34c818a095a5aa08e0d3407b5632916a2d08da80e1b4f22e856b513fa82714e6cfef62
SSDEEP 786432:2/SCQ/VseEP0YseEP0LE2TmOPVl2o7EUvvW4KdiBE2TmOPVlUUAv3B:2/S5s3fs3sE2TpVl2o7Lv8diE2TpVls
TLSH
T1AFB7E012B301C0B6D8524571C67E9BBAA13D7E35873040D793C87F6E2DB16D2AA36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_7f8d3ea8d1f957330ff006555c34c3ef_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_remcos_revil_rhadamanthys_smoke-loader_stop_vidar

File Explorer

2026-07-09_7f8d3ea8d1f957330ff006555c34c3ef_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_remcos_revil_rhadamanthys_smoke-loader_stop_vidar

.exe 46.1MB

2026-07-09_7f8d3ea8d1f957330ff006555c34c3ef_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_remcos_revil_rhadamanthys_smoke-loader_stop_vidar

IMPHASH aa85d353d094d647a7ab7e1cc4e8a506
SHA256 a1b2faa8a82fbdbe551753b225efea75c46835849d2595c5a5c4bfc00c255ccd
MD5 7f8d3ea8d1f957330ff006555c34c3ef
SHA1 28bdb8f017dc992748da0662a78f678a75069d0c
SHA512 0214a53d53104ffcf58663416e828f401c55d8715dbd2ff5440074fffb34c818a095a5aa08e0d3407b5632916a2d08da80e1b4f22e856b513fa82714e6cfef62
SSDEEP 786432:2/SCQ/VseEP0YseEP0LE2TmOPVl2o7EUvvW4KdiBE2TmOPVlUUAv3B:2/S5s3fs3sE2TpVl2o7Lv8diE2TpVls
TLSH
T1AFB7E012B301C0B6D8524571C67E9BBAA13D7E35873040D793C87F6E2DB16D2AA36B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1402215

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\MFCAp4444\Release\XA==5+5.pdb

kernel32

GetStdHandle ExitProcess GetFileType SetStdHandle HeapQueryInformation GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LCMapStringW GetConsoleMode QueryPerformanceFrequency VirtualQuery GetSystemInfo RtlUnwind GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW CompareStringW IsValidLocale EnumSystemLocalesW GetCommandLineW SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateFileW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter GetConsoleOutputCP UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceExW SearchPathA GetProfileIntA GetTickCount64 GetTempPathA SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExA FileTimeToLocalFileTime GetACP GetStringTypeExA MoveFileA lstrcmpiA GetShortPathNameA LoadLibraryExA GetCurrentProcess DuplicateHandle GetVolumeInformationA WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile FlushFileBuffers FindFirstFileA FindClose DeleteFileA GetCPInfo GetOEMCP VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryA GetFileSize CreateFileA VerifyVersionInfoA lstrcpyA VerSetConditionMask GetThreadLocale FileTimeToSystemTime GlobalFlags LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection InitializeCriticalSectionAndSpinCount GetUserDefaultLCID SystemTimeToFileTime ReplaceFileA GetTempFileNameA SetFileTime GetFullPathNameA GetFileTime GetFileAttributesA GetDiskFreeSpaceA ResumeThread SetThreadPriority WaitForSingleObject WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA lstrcmpA GetVersionExA CompareStringA GlobalFindAtomA lstrcmpW GlobalDeleteAtom LoadLibraryExW GetSystemDirectoryW GetCurrentThreadId EncodePointer FreeLibrary CopyFileA FormatMessageA MulDiv LocalFree GlobalFree GlobalSize GlobalAlloc FindResourceA MultiByteToWideChar GlobalGetAtomNameA GlobalAddAtomA GlobalLock GlobalUnlock LoadLibraryW LoadLibraryA GetModuleHandleW GetModuleFileNameW GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree VirtualAlloc Sleep SuspendThread GetCurrentThread OutputDebugStringA SetLastError GetLastError CloseHandle GetModuleFileNameA GetWindowsDirectoryA ReadProcessMemory WideCharToMultiByte OpenProcess GetCurrentProcessId GetModuleHandleA GetProcAddress FindResourceW LoadResource LockResource SizeofResource GetCommandLineA WriteConsoleW

user32

MapVirtualKeyA GetKeyNameTextA ShowOwnedPopups TranslateMessage GetMessageA ClientToScreen GetWindowDC TabbedTextOutA GrayStringA DrawTextExA DrawTextA GetNextDlgTabItem EndDialog CreateDialogIndirectParamA PostQuitMessage IsDialogMessageA SetWindowTextA SendDlgItemMessageA CheckDlgButton MoveWindow GetMonitorInfoA MonitorFromWindow GetScrollInfo SetScrollInfo LoadIconA CallNextHookEx SetWindowsHookExA GetTopWindow GetClassLongA ScreenToClient AdjustWindowRectEx GetWindowTextLengthA GetWindowTextA RemovePropA GetPropA SetPropA ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow EndPaint BeginPaint SetForegroundWindow GetForegroundWindow TrackPopupMenu DeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu CreateWindowExA GetClassInfoExA RegisterClassA CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos DispatchMessageA IsZoomed GetCursorPos LockWindowUpdate ValidateRect SetTimer SetRect DrawIconEx InflateRect FillRect DrawFocusRect GetSysColorBrush MapWindowPoints SetWindowRgn DrawStateA DrawFrameControl DrawEdge RegisterWindowMessageA RemoveMenu InsertMenuA GetMenuState GetMenuStringA MessageBoxA LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus UnhookWindowsHookEx SystemParametersInfoA SetParent IsRectEmpty GetClientRect DeleteMenu AppendMenuA GetSystemMenu RealChildWindowFromPoint UnionRect LoadCursorA DrawMenuBar RedrawWindow UpdateWindow GetSystemMetrics EnumWindows EndDeferWindowPos BeginDeferWindowPos PtInRect GetWindowRect ReleaseDC GetDC ReuseDDElParam UnpackDDElParam WinHelpA LoadImageA DestroyIcon LoadIconW GetWindow GetLastActivePopup GetWindowThreadProcessId GetClassNameA GetParent GetDesktopWindow KillTimer WindowFromPoint SetCapture GetDCEx SetLayeredWindowAttributes LoadCursorW EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard LoadImageW CopyImage MonitorFromPoint TrackMouseEvent CharUpperA GetAsyncKeyState LoadMenuW MessageBeep NotifyWinEvent SetCursorPos GetMenuItemInfoA EnableWindow PeekMessageA SendMessageA PostMessageA GetClassInfoA IsWindow ShowWindow SetWindowPos IsWindowVisible IsIconic BringWindowToTop GetDlgItem GetDlgCtrlID SetFocus GetActiveWindow GetKeyState GetCapture ReleaseCapture IsWindowEnabled LoadAcceleratorsA TranslateAcceleratorA LoadMenuA GetMenu SetMenu CreatePopupMenu DestroyMenu GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuItemA SetActiveWindow SubtractRect InvalidateRect SetCursor GetSysColor SetRectEmpty CopyRect IntersectRect OffsetRect EqualRect GetWindowLongA SetWindowLongA DefFrameProcA DefMDIChildProcA TranslateMDISysAccel IsClipboardFormatAvailable MapDialogRect LoadAcceleratorsW GetKeyboardLayout GetKeyboardState ToAsciiEx CreateAcceleratorTableA CopyAcceleratorTableA RegisterClipboardFormatA CharUpperBuffA PostThreadMessageA WaitMessage GetNextDlgGroupItem IsCharLowerA MapVirtualKeyExA GetComboBoxInfo CreateMenu DestroyCursor GetWindowRgn DrawIcon HideCaret InvertRect FrameRect GetUpdateRect UpdateLayeredWindow SetClassLongA DestroyAcceleratorTable ModifyMenuA SetMenuDefaultItem GetMenuDefaultItem CopyIcon GetIconInfo GetDoubleClickTime EnableScrollBar

gdi32

GetBkColor GetTextColor GetTextExtentPoint32A PatBlt ExtTextOutA CreatePolygonRgn Polygon Polyline BitBlt CreatePen CreatePatternBrush Rectangle RoundRect GetTextMetricsA CreateRoundRectRgn CreateFontIndirectA CreateDIBSection SetBkColor SetTextColor GetStockObject Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign Ellipse MoveToEx TextOutA SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx SetRectRgn DPtoLP CreateDIBitmap EnumFontFamiliesA GetTextCharsetInfo RealizePalette SetPixel StretchBlt SetDIBColorTable GetRgnBox OffsetRgn CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExA ExtFloodFill SetPaletteEntries FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx LPtoDP GetWindowOrgEx SetPixelV GetTextFaceA CreateSolidBrush CreateRectRgnIndirect CreateRectRgn CreateHatchBrush CreateEllipticRgn CombineRgn GetDeviceCaps CreateDCA CopyMetaFileA GetObjectA StretchDIBits SelectObject GetCharWidthA DeleteObject CreateFontA CreateCompatibleDC CreateCompatibleBitmap CreateBitmap DeleteDC

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegOpenKeyExW RegEnumValueA RegEnumKeyExA GetFileSecurityA SetFileSecurityA RegQueryValueA RegEnumKeyA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegQueryValueExA RegOpenKeyExA RegSetValueA RegCloseKey FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

ShellExecuteA DragQueryFileA DragFinish SHAppBarMessage SHAddToRecentDocs SHBrowseForFolderA SHGetDesktopFolder SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetFileInfoA ExtractIconA

shlwapi

PathFindFileNameA PathIsUNCA StrFormatKBSizeA PathStripToRootA PathRemoveFileSpecW PathFindExtensionA

uxtheme

DrawThemeText DrawThemeBackground GetThemePartSize IsThemeBackgroundPartiallyTransparent DrawThemeParentBackground OpenThemeData CloseThemeData GetThemeColor GetCurrentThemeName GetThemeSysColor GetWindowTheme IsAppThemed

ole32

OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoDisconnectObject CoInitialize CoCreateInstance CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc StringFromCLSID CoUninitialize CoInitializeEx CoGetObject

oleaut32

VarBstrFromDate VariantCopy SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen LoadTypeLi VariantChangeType VariantClear VariantInit SysAllocStringByteLen SysFreeString SysAllocStringLen

gdiplus

GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipSetInterpolationMode GdipDrawImageRectI GdiplusShutdown GdipAlloc GdipBitmapUnlockBits

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA InternetReadFile

oleacc

LresultFromObject CreateStdAccessibleObject AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundA

_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA10@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA11@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA12@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA13@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA14@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA15@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA16@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA17@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA18@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA19@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA20@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA21@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0@0 _AAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj100@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj101@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj102@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj103@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj104@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj105@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj106@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj107@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj108@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj109@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj10@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj110@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj111@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj112@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj113@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj114@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj115@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj116@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj117@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj118@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj119@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj11@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj120@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj121@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj122@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj123@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj124@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj125@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj126@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj127@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj128@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj129@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj12@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj130@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj131@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj132@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj133@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj134@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj135@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj136@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj137@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj138@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj139@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj13@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj140@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj141@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj142@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj143@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj144@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj145@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj146@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj147@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj148@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj149@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj14@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj150@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj151@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj152@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj153@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj154@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj155@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj156@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj157@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj158@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj159@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj15@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj160@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj161@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj162@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj163@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj164@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj165@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj166@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj167@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj168@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj169@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj16@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj170@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj171@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj172@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj173@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj174@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj175@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj176@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj177@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj178@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj179@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj17@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj180@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj181@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj182@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj183@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj184@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj185@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj186@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj187@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj188@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj189@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj18@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj190@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj191@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj192@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj193@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj194@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj195@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj196@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj197@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj198@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj199@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj19@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj1@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj200@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj20@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj21@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj22@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj23@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj24@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj25@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj26@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj27@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj28@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj29@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj2@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj30@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj31@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj32@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj33@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj34@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj35@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj36@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj37@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj38@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj39@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj3@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj40@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj41@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj42@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj43@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj44@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj45@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj46@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj47@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj48@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj49@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj4@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj50@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj51@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj52@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj53@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj54@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj55@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj56@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj57@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj58@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj59@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj5@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj60@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj61@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj62@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj63@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj64@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj65@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj66@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj67@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj68@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj69@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj6@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj70@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj71@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj72@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj73@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj74@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj75@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj76@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj77@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj78@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj79@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj7@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj80@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj81@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj82@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj83@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj84@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj85@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj86@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj87@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj88@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj89@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj8@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj90@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj91@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj92@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj93@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj94@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj95@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj96@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj97@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj98@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj99@0 _safasfasfsagsafsafasfsadsafsfrgfgfdgfhj9@0

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_7f8d3ea8d1f957330ff006555c34c3ef_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_magniber_medusalocker_njrat_remcos_revil_rhadamanthys_smoke-loader_stop_vidar

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

wininet

oleacc

imm32

winmm

generic