Overview

overview

7

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

7

2026-08-10...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 01:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 92.7MB
  • Sample260810-bc3kaaycka
  • SHA256 c85ca05572f5857c3f5ac1d28834169c7333457addb8c35426a9bb1407561307
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          PID:2524
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "sc query type= service state= all"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\system32\sc.exe
          sc query type= service state= all
          4⤵
          • Launches sc.exe
          PID:1228
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Discord.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM Discord.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2916
      • C:\Windows\SYSTEM32\fodhelper.exe
        fodhelper.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
          4⤵
          • Loads dropped DLL
          PID:2968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\system32\ipconfig.exe
          ipconfig /all
          4⤵
          • Gathers network information
          PID:3828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c shutdown -l
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Windows\system32\shutdown.exe
          shutdown -l
          4⤵
            PID:4336
        • C:\Windows\SYSTEM32\netsh.exe
          netsh wlan show profiles
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:4148
    • C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      1⤵
        PID:1280
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa395f055 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2840
      • C:\Windows\System32\smss.exe
        \SystemRoot\System32\smss.exe 000000dc 00000084
        1⤵
        • Suspicious behavior: LoadsDriver
        PID:2916
      • C:\Windows\System32\smss.exe
        \SystemRoot\System32\smss.exe 000000e8 00000084
        1⤵
          PID:1228
        • C:\Windows\System32\smss.exe
          \SystemRoot\System32\smss.exe 00000080 00000084
          1⤵
            PID:2968

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Query Registry

                1
                T1012

                System Information Discovery

                1
                T1082

                System Network Configuration Discovery

                2
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Wi-Fi Discovery

                1
                T1016.002

                Lateral Movement

                Collection

                Clipboard Data

                1
                T1115

                Data from Local System

                2
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                emissive_mask.png
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12802\PyQt5\Qt5\qml\QtQuick3D\Materials\maps\emissive_mask.png
                • Size 334B
                • SHA256 03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RadioDelegateSpecifics.qml
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12802\PyQt5\Qt5\qml\QtQuick\Controls.2\designer\RadioDelegateSpecifics.qml
                • Size 2KB
                • SHA256 8207c603c9de51d9954302dd9df559a1df70e0a9658af62637229b5a2437eec3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                SwitchSpecifics.qml
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12802\PyQt5\Qt5\qml\QtQuick\Controls.2\designer\SwitchSpecifics.qml
                • Size 2KB
                • SHA256 07911dff4b3128de29fb83223a78878f9e972f35a596429861c7ea7956923b2d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                qtdeclarative_en.qm
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\PyQt5\Qt5\translations\qtdeclarative_en.qm
                • Size 16B
                • SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
                • MD5 SHA1 SHA512
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\VCRUNTIME140.dll
                • Size 116KB
                • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_bz2.pyd
                • Size 48KB
                • SHA256 f580e5dce978da0560dff60e539a05325bed4168db9a57dd27cb3f2df20ecd59
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_ctypes.pyd
                • Size 59KB
                • SHA256 dd78091994670799a568fae810aa8a987826493c26030b083dc9cb73b01c7680
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_lzma.pyd
                • Size 86KB
                • SHA256 be927ef88e22474d3556b0297358c9d27800d0c2fc90922708e734904fcc7c31
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                antivm.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\antivm.py
                • Size 3KB
                • SHA256 6a78bc1ef55dc500933236daa8590131f9d95ef7ba683c63c70d0ad1a2ed1ba8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                api-ms-win-core-console-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-console-l1-1-0.dll
                • Size 21KB
                • SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-datetime-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-datetime-l1-1-0.dll
                • Size 21KB
                • SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-debug-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-debug-l1-1-0.dll
                • Size 21KB
                • SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-errorhandling-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-errorhandling-l1-1-0.dll
                • Size 21KB
                • SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-file-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-file-l1-1-0.dll
                • Size 25KB
                • SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-file-l1-2-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-file-l1-2-0.dll
                • Size 21KB
                • SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-file-l2-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-file-l2-1-0.dll
                • Size 18KB
                • SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-handle-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-handle-l1-1-0.dll
                • Size 21KB
                • SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-heap-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-heap-l1-1-0.dll
                • Size 21KB
                • SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-interlocked-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-interlocked-l1-1-0.dll
                • Size 21KB
                • SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-libraryloader-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-libraryloader-l1-1-0.dll
                • Size 21KB
                • SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-localization-l1-2-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-localization-l1-2-0.dll
                • Size 21KB
                • SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-memory-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-memory-l1-1-0.dll
                • Size 21KB
                • SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-namedpipe-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-namedpipe-l1-1-0.dll
                • Size 21KB
                • SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-processenvironment-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-processenvironment-l1-1-0.dll
                • Size 21KB
                • SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-processthreads-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-processthreads-l1-1-0.dll
                • Size 21KB
                • SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-processthreads-l1-1-1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-processthreads-l1-1-1.dll
                • Size 21KB
                • SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-profile-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-profile-l1-1-0.dll
                • Size 21KB
                • SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-rtlsupport-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-rtlsupport-l1-1-0.dll
                • Size 21KB
                • SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-string-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-string-l1-1-0.dll
                • Size 21KB
                • SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-synch-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-synch-l1-1-0.dll
                • Size 21KB
                • SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-synch-l1-2-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-synch-l1-2-0.dll
                • Size 21KB
                • SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-sysinfo-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-sysinfo-l1-1-0.dll
                • Size 21KB
                • SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-timezone-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-timezone-l1-1-0.dll
                • Size 21KB
                • SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-core-util-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-util-l1-1-0.dll
                • Size 21KB
                • SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-conio-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-conio-l1-1-0.dll
                • Size 21KB
                • SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-convert-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-convert-l1-1-0.dll
                • Size 25KB
                • SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-environment-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-environment-l1-1-0.dll
                • Size 21KB
                • SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-filesystem-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-filesystem-l1-1-0.dll
                • Size 21KB
                • SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-heap-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-heap-l1-1-0.dll
                • Size 21KB
                • SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-locale-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-locale-l1-1-0.dll
                • Size 21KB
                • SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-math-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-math-l1-1-0.dll
                • Size 29KB
                • SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-private-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-private-l1-1-0.dll
                • Size 73KB
                • SHA256 8b19bcb4918b346a8ba5e19d91823e5842314e928dbb86de8758d0dbb2b94bb4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-process-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-process-l1-1-0.dll
                • Size 21KB
                • SHA256 bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-runtime-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-runtime-l1-1-0.dll
                • Size 25KB
                • SHA256 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-stdio-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-stdio-l1-1-0.dll
                • Size 25KB
                • SHA256 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-string-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-string-l1-1-0.dll
                • Size 25KB
                • SHA256 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-time-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-time-l1-1-0.dll
                • Size 21KB
                • SHA256 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                api-ms-win-crt-utility-l1-1-0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-utility-l1-1-0.dll
                • Size 21KB
                • SHA256 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                autodestruct.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\autodestruct.py
                • Size 272B
                • SHA256 d9b3c0b184160951bc7233460465fa03afdff6b96a5fe3d5d7e15cb90452c70a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\base_library.zip
                • Size 1.3MB
                • SHA256 f36454a982f5665d4e7fcc69ee81146965358fcb7f5d59f2cd8861ca89c66efa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                browser_stealer.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\browser_stealer.py
                • Size 6KB
                • SHA256 629d8006fbbb3b8971c7e4e5f9b0986b285957c7e86ea4f759c530d94ee2869b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bsod.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\bsod.py
                • Size 694B
                • SHA256 d047d2f2bf81ade70694d5553bc12b6965439656e007a07d0d15c90229f6d4dd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                clipboard.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\clipboard.py
                • Size 1KB
                • SHA256 d71a684afa44e447c75adf024057a4326a61f13452dbff496d61d15fe3229e6c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                credentials.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\credentials.py
                • Size 1KB
                • SHA256 36faabf7fdc80345482598e61ea6070ca5edb54e5a12fd69a83ac5825d21bb19
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                crypto_stealer.py
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\crypto_stealer.py
                • Size 6KB
                • SHA256 7507e7e9ddcdfaf5a2ed90c4f952ebddc6023d5a83b6987b966c18396e39259e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libffi-8.dll
                • Size 29KB
                • SHA256 2e9ed28cade51ccade24be026fe1febb18e608a9f0f649ef985e07d3c05d2af8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.DLL
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python3.DLL
                • Size 66KB
                • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python312.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python312.dll
                • Size 1.7MB
                • SHA256 4b94f80f9ebb812282c3c3bb769da3567c314adb4972e3b46e39374357bb77d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ucrtbase.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\ucrtbase.dll
                • Size 992KB
                • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1684-2796-0x00007FFD72280000-0x00007FFD7239A000-memory.dmp
                Download

                memory/1684-2805-0x00007FFD719B0000-0x00007FFD719D4000-memory.dmp
                Download

                memory/1684-2778-0x00007FFD80310000-0x00007FFD805A2000-memory.dmp
                Download

                memory/1684-2779-0x00007FFD72C20000-0x00007FFD73261000-memory.dmp
                Download

                memory/1684-2780-0x00007FFD807F0000-0x00007FFD80818000-memory.dmp
                Download

                memory/1684-2784-0x00007FFD80E30000-0x00007FFD80E3F000-memory.dmp
                Download

                memory/1684-2783-0x00007FFD73270000-0x00007FFD73935000-memory.dmp
                Download

                memory/1684-2782-0x00007FFD84620000-0x00007FFD8462D000-memory.dmp
                Download

                memory/1684-2781-0x00007FFD83100000-0x00007FFD83119000-memory.dmp
                Download

                memory/1684-2786-0x00007FFD802D0000-0x00007FFD80306000-memory.dmp
                Download

                memory/1684-2785-0x00007FFD81700000-0x00007FFD81725000-memory.dmp
                Download

                memory/1684-2788-0x00007FFD726E0000-0x00007FFD72C13000-memory.dmp
                Download

                memory/1684-2787-0x00007FFD807D0000-0x00007FFD807E4000-memory.dmp
                Download

                memory/1684-2791-0x00007FFD80290000-0x00007FFD802C3000-memory.dmp
                Download

                memory/1684-2792-0x00007FFD73F50000-0x00007FFD7401E000-memory.dmp
                Download

                memory/1684-2793-0x00007FFD72C20000-0x00007FFD73261000-memory.dmp
                Download

                memory/1684-2790-0x00007FFD80310000-0x00007FFD805A2000-memory.dmp
                Download

                memory/1684-2789-0x00007FFD80C00000-0x00007FFD80C2D000-memory.dmp
                Download

                memory/1684-2794-0x00007FFD80280000-0x00007FFD8028D000-memory.dmp
                Download

                memory/1684-2795-0x00007FFD723A0000-0x00007FFD72471000-memory.dmp
                Download

                memory/1684-2724-0x00007FFD81700000-0x00007FFD81725000-memory.dmp
                Download

                memory/1684-2801-0x00007FFD7FF60000-0x00007FFD7FF8E000-memory.dmp
                Download

                memory/1684-2800-0x00007FFD71F10000-0x00007FFD720A9000-memory.dmp
                Download

                memory/1684-2799-0x00007FFD720B0000-0x00007FFD7227A000-memory.dmp
                Download

                memory/1684-2798-0x00007FFD80E30000-0x00007FFD80E3F000-memory.dmp
                Download

                memory/1684-2797-0x00007FFD80210000-0x00007FFD80226000-memory.dmp
                Download

                memory/1684-2802-0x00007FFD807D0000-0x00007FFD807E4000-memory.dmp
                Download

                memory/1684-2804-0x00007FFD719E0000-0x00007FFD719F8000-memory.dmp
                Download

                memory/1684-2803-0x00007FFD726E0000-0x00007FFD72C13000-memory.dmp
                Download

                memory/1684-2725-0x00007FFD89770000-0x00007FFD8977F000-memory.dmp
                Download

                memory/1684-2806-0x00007FFD71760000-0x00007FFD719AA000-memory.dmp
                Download

                memory/1684-2808-0x00007FFD80280000-0x00007FFD8028D000-memory.dmp
                Download

                memory/1684-2807-0x00007FFD70C80000-0x00007FFD710A5000-memory.dmp
                Download

                memory/1684-2809-0x00007FFD6F8D0000-0x00007FFD70C77000-memory.dmp
                Download

                memory/1684-2810-0x00007FFD723A0000-0x00007FFD72471000-memory.dmp
                Download

                memory/1684-2811-0x00007FFD71E90000-0x00007FFD71EB2000-memory.dmp
                Download

                memory/1684-2812-0x00007FFD80210000-0x00007FFD80226000-memory.dmp
                Download

                memory/1684-2813-0x00007FFD720B0000-0x00007FFD7227A000-memory.dmp
                Download

                memory/1684-2814-0x00007FFD71F10000-0x00007FFD720A9000-memory.dmp
                Download

                memory/1684-2715-0x00007FFD73270000-0x00007FFD73935000-memory.dmp
                Download

                memory/1684-3348-0x00007FFD73270000-0x00007FFD73935000-memory.dmp
                Download

                memory/1684-3366-0x00007FFD81700000-0x00007FFD81725000-memory.dmp
                Download

                memory/1684-3410-0x00007FFD80290000-0x00007FFD802C3000-memory.dmp
                Download

                memory/1684-3411-0x00007FFD73F50000-0x00007FFD7401E000-memory.dmp
                Download

                memory/1684-3401-0x00007FFD726E0000-0x00007FFD72C13000-memory.dmp
                Download

                memory/1684-3611-0x00007FFD719B0000-0x00007FFD719D4000-memory.dmp
                Download

                memory/1684-2731-0x00007FFD80C00000-0x00007FFD80C2D000-memory.dmp
                Download

                memory/1684-2730-0x00007FFD86340000-0x00007FFD8635A000-memory.dmp
                Download

                memory/1684-4062-0x00007FFD70C80000-0x00007FFD710A5000-memory.dmp
                Download

                memory/1684-4061-0x00007FFD71760000-0x00007FFD719AA000-memory.dmp
                Download

                memory/1684-4460-0x00007FFD719E0000-0x00007FFD719F8000-memory.dmp
                Download

                memory/1684-4459-0x00007FFD6F8D0000-0x00007FFD70C77000-memory.dmp
                Download

                memory/1684-4430-0x00007FFD73270000-0x00007FFD73935000-memory.dmp
                Download

                memory/2840-4461-0x000002B262120000-0x000002B262419000-memory.dmp
                Download

                memory/2968-4455-0x00007FFD86340000-0x00007FFD8635A000-memory.dmp
                Download

                memory/2968-4454-0x00007FFD89770000-0x00007FFD8977F000-memory.dmp
                Download

                memory/2968-4453-0x00007FFD81700000-0x00007FFD81725000-memory.dmp
                Download

                memory/2968-4456-0x00007FFD80C00000-0x00007FFD80C2D000-memory.dmp
                Download

                memory/2968-4458-0x00007FFD72C20000-0x00007FFD73261000-memory.dmp
                Download

                memory/2968-4452-0x00007FFD73270000-0x00007FFD73935000-memory.dmp
                Download