c79abcedcd78c848182bd5e6bd858ce22af633334d4034e4e3f98856ba09690c

Analysis

max time kernel
73s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 73.3MB
Sample260925-ty4zca1cle
SHA256 c79abcedcd78c848182bd5e6bd858ce22af633334d4034e4e3f98856ba09690c
MD5 05dc158b7a575cfeb99036d091863b76
SHA1 36501926939cc99e4a62b92abc2fa32f0ecc7741
SHA512 1c670ba228c6ca499ef45c74c8a88071f1cb92cec27a025539d451fe67655171eadd4f854d11c16525f1bfe0ad9165fdebc4a395d341250c15490fe0b15804e1
SSDEEP 1572864:0ng4gSWztE0iz6Vd1AEJ5Rh1+BDDy4gds8KN24cdhPyprqA9Bht/IK:0nNittVd1AY5bADDxgds8NdhPOqQ/p
TLSH
T13AF7334D9F84A888F56D113681338A0EF9C2A45F42BE444F17F805BA2D671C9BEFDA53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\WINDOWS\System32\drivers\VBoxMouse.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	C:\WINDOWS\System32\drivers\VBoxGuest.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	C:\WINDOWS\System32\drivers\VBoxMouse.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	C:\WINDOWS\System32\drivers\VBoxGuest.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Looks for VMWare drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\WINDOWS\System32\drivers\vmmouse.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	C:\WINDOWS\System32\drivers\vmhgfs.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	C:\WINDOWS\System32\drivers\vmmouse.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	C:\WINDOWS\System32\drivers\vmhgfs.sys	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
1372	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Loads dropped DLL 64 IoCs

pid	Process
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1208	cmd.exe
4304	cmd.exe
3404	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeIncreaseQuotaPrivilege	4596	WMIC.exe
Token: SeSecurityPrivilege	4596	WMIC.exe
Token: SeTakeOwnershipPrivilege	4596	WMIC.exe
Token: SeLoadDriverPrivilege	4596	WMIC.exe
Token: SeSystemProfilePrivilege	4596	WMIC.exe
Token: SeSystemtimePrivilege	4596	WMIC.exe
Token: SeProfSingleProcessPrivilege	4596	WMIC.exe
Token: SeIncBasePriorityPrivilege	4596	WMIC.exe
Token: SeCreatePagefilePrivilege	4596	WMIC.exe
Token: SeBackupPrivilege	4596	WMIC.exe
Token: SeRestorePrivilege	4596	WMIC.exe
Token: SeShutdownPrivilege	4596	WMIC.exe
Token: SeDebugPrivilege	4596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4596	WMIC.exe
Token: SeRemoteShutdownPrivilege	4596	WMIC.exe
Token: SeUndockPrivilege	4596	WMIC.exe
Token: SeManageVolumePrivilege	4596	WMIC.exe
Token: 33	4596	WMIC.exe
Token: 34	4596	WMIC.exe
Token: 35	4596	WMIC.exe
Token: 36	4596	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4596	WMIC.exe
Token: SeSecurityPrivilege	4596	WMIC.exe
Token: SeTakeOwnershipPrivilege	4596	WMIC.exe
Token: SeLoadDriverPrivilege	4596	WMIC.exe
Token: SeSystemProfilePrivilege	4596	WMIC.exe
Token: SeSystemtimePrivilege	4596	WMIC.exe
Token: SeProfSingleProcessPrivilege	4596	WMIC.exe
Token: SeIncBasePriorityPrivilege	4596	WMIC.exe
Token: SeCreatePagefilePrivilege	4596	WMIC.exe
Token: SeBackupPrivilege	4596	WMIC.exe
Token: SeRestorePrivilege	4596	WMIC.exe
Token: SeShutdownPrivilege	4596	WMIC.exe
Token: SeDebugPrivilege	4596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4596	WMIC.exe
Token: SeRemoteShutdownPrivilege	4596	WMIC.exe
Token: SeUndockPrivilege	4596	WMIC.exe
Token: SeManageVolumePrivilege	4596	WMIC.exe
Token: 33	4596	WMIC.exe
Token: 34	4596	WMIC.exe
Token: 35	4596	WMIC.exe
Token: 36	4596	WMIC.exe
Token: SeDebugPrivilege	4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeIncreaseQuotaPrivilege	3080	WMIC.exe
Token: SeSecurityPrivilege	3080	WMIC.exe
Token: SeTakeOwnershipPrivilege	3080	WMIC.exe
Token: SeLoadDriverPrivilege	3080	WMIC.exe
Token: SeSystemProfilePrivilege	3080	WMIC.exe
Token: SeSystemtimePrivilege	3080	WMIC.exe
Token: SeProfSingleProcessPrivilege	3080	WMIC.exe
Token: SeIncBasePriorityPrivilege	3080	WMIC.exe
Token: SeCreatePagefilePrivilege	3080	WMIC.exe
Token: SeBackupPrivilege	3080	WMIC.exe
Token: SeRestorePrivilege	3080	WMIC.exe
Token: SeShutdownPrivilege	3080	WMIC.exe
Token: SeDebugPrivilege	3080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3080	WMIC.exe
Token: SeRemoteShutdownPrivilege	3080	WMIC.exe
Token: SeUndockPrivilege	3080	WMIC.exe
Token: SeManageVolumePrivilege	3080	WMIC.exe
Token: 33	3080	WMIC.exe
Token: 34	3080	WMIC.exe
Token: 35	3080	WMIC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4388	3896	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 4388 wrote to memory of 1208	4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 1208 wrote to memory of 4596	1208	cmd.exe	106
PID 4388 wrote to memory of 4304	4388	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 4304 wrote to memory of 1372	4304	cmd.exe	103
PID 1372 wrote to memory of 4284	1372	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	107
PID 4284 wrote to memory of 3404	4284	2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	109
PID 3404 wrote to memory of 3080	3404	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber, manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber, manufacturer
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Ethernet Windows Support\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Users\Admin\AppData\Local\Ethernet Windows Support\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Ethernet Windows Support\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Users\Admin\AppData\Local\Ethernet Windows Support\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Ethernet Windows Support\2026-09-23_05dc158b7a575cfeb99036d091863b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
        5⤵
        Looks for VirtualBox drivers on disk
        Looks for VMWare drivers on disk
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber, manufacturer"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get serialnumber, manufacturer
        7⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\_bz2.pyd
Size 83KB
SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
MD5 30f396f8411274f15ac85b14b7b3cd3d
SHA1 d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA512 7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
SSDEEP 1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
TLSH
T1CE839E92E3956AF5F41F81B956C10367E771B945075083EFF348C2592F03B426EAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\_ctypes.pyd
Size 122KB
SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
MD5 5377ab365c86bbcdd998580a79be28b4
SHA1 b0a6342df76c4da5b1e28a036025e274be322b35
SHA512 56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
SSDEEP 3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
TLSH
T174C36C1B339400A9EBA34178C4B36E07D7F1B41B076197CF12A4C6992F637A76E6E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\_lzma.pyd
Size 156KB
SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
MD5 9e94fac072a14ca9ed3f20292169e5b2
SHA1 1eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA512 b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
SSDEEP 3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
TLSH
T1DCF32992A394F0D5F6728C78D6624F17E7F67849032092DA02CCD36D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-console-l1-1-0.dll
Size 13KB
SHA256 0099f17128d1551a47cbd39ce702d4acc4b49be1bb1cfe974fe5a42da01d88eb
MD5 71405f0ba5d7da5a5f915f33667786de
SHA1 bb5cdf9c12fe500251cf98f0970a47b78c2f8b52
SHA512 b2c6438541c4fa7af3f8a9606f64eeef5d77ddbc0689e7501074bb72b7cc907a8461a75089e5b70b881bc3b1be009888ff25ea866faaf1c49dd521027041295a
SSDEEP 192:WfBWfhWooeWvcuyjS7HnhWgN7a8WhlZGh+Il+jX01k9z3ARCvXD8N:W5WfhWd7HRN7sOEjR9zSSG
TLSH
T108523B979FEC8503FD9A6CB053B8D9037C3C6FD32900505A26A2F56919A3399EB2472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-datetime-l1-1-0.dll
Size 12KB
SHA256 ac227773908836d54c8fc06c4b115f3bdfc82e4d63c7f84e1f8e6e70cd066339
MD5 a17d27e01478c17b88794fd0f79782fc
SHA1 2b8393e7b37fb990be2cdc82803ca49b4cef8546
SHA512 ddc6dda49d588f22c934026f55914b31e53079e044dec7b4f1409668dbfe8885b887cc64a411d44f83bc670ac8a8b6d3ad030d4774ef7bf522f1d3bc00e07485
SSDEEP 192:WTWfhWKkeWvcuyjS7HnhWgN7a8WhaYah+Il+jX01k9z3ARiuXLL1w:WTWfhWN7HRN7ISEjR9zS/f2
TLSH
T126524B96DBAC8106FD9B6D7053B8D9137D3C6BD72A00805B1A52F4681CA37C6EB3072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-debug-l1-1-0.dll
Size 12KB
SHA256 c734022b165b3ba6f8e28670c4190a65c66ec7ecc961811a6bdcd9c7745cac20
MD5 e485c1c5f33ad10eec96e2cdbddff3c7
SHA1 31f6ba9beca535f2fb7ffb755b7c5c87ac8d226c
SHA512 599036d8fa2e916491bedb5bb49b94458a09dddd2908cf770e94bb0059730598ec5a9b0507e6a21209e2dcae4d74027313df87c9ab51fad66b1d07903bae0b35
SSDEEP 192:W/WfhWJeWvcuyjS7HnhWgN7a8WhpaWGaN4NhrJgX01k9z3An9PLLIh:W/WfhWJ7HRN7svTN4tgR9zYxi
TLSH
T1865229C5DBAC9107EDAF6D7053B8DD533C3C2BC61950812A0A86F5A81CA33C9EB3062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-errorhandling-l1-1-0.dll
Size 12KB
SHA256 863a07d702717cf818a842af0b4e1dfd6e723f712e49bf8c3af3589434a0ae80
MD5 0ffb34c0c2cdec47e063c5e0c96b9c3f
SHA1 9716643f727149b953f64b3e1eb6a9f2013eac9c
SHA512 4311d582856d9c3cac2cdc6a9da2137df913bcf69041015fd272c2780f6ab850895deb69279a076376a2e6401c907cb23a3052960478a6cf4b566a20cce61bd1
SSDEEP 192:WgmxD3JbDWfhWqjeWvcuyjS7HnhWgN7aUWh1kG1q21eX01k9z3ABfNBnJbIx:WgAbDWfhWo7HRN74l1l8R9zmfNBlg
TLSH
T1E5523A92DBAC9207FDAB6D7052A8E9037C3D27931960915A12C8F6542CA33C5EE2073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-file-l1-1-0.dll
Size 16KB
SHA256 d26d433f86223b10ccc55837c3e587fa374cd81efc24b6959435a6770addbf24
MD5 792c2b83bc4e0272785aa4f5f252ff07
SHA1 6868b82df48e2315e6235989185c8e13d039a87b
SHA512 72c99cff7fd5a762524e19abee5729dc8857f3ee3c8f78587625ec74f2ad96af7dee03aba54b441cda44b04721706bed70f3ad88453a341cbb51aac9afd9559e
SSDEEP 192:W/IAuVYPvVX8rFTs0WfhWueWvcuyjS7HnhWgN7a8Whiah+Il+jX01k9z3AR0Xik3:WVBPvVXuWfhWI7HRN7mEjR9zS0PP
TLSH
T146722A93D9A8E34FF88FAD3151A2C9436C385387041444CA1BD5E76D3CF738AE7A8699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-file-l1-2-0.dll
Size 12KB
SHA256 476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
MD5 49e3260ae3f973608f4d4701eb97eb95
SHA1 097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA512 df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653
SSDEEP 192:WKMWfhW0eWvcuyjS7HnhWgN7a8WhMcy/JdSh+Il+jX01k9z3ARvXdRfn8x:W9WfhWe7HRN7DcMyEjR9zSvn8x
TLSH
T15D524BA5D76C8107F9A72C7053F8D9137C3C6BD71A00805A16A2F4682CA33C9EA3076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-file-l2-1-0.dll
Size 12KB
SHA256 c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
MD5 7f14fd0436c066a8b40e66386ceb55d0
SHA1 288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA512 d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
SSDEEP 192:WrVzWfhW5eWvcuyjS7HnhWgN7a8Wh/g26WGaN4NhrJgX01k9z3An9fXPu:WrVzWfhW57HRN7qTN4tgR9zY8
TLSH
T12E5239C5DBAC9103FA9B6CB052E4C9137D3D3BC71900805E1A91F6582CA73C9EA387AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-handle-l1-1-0.dll
Size 12KB
SHA256 154ef0bf9b9b9daa08101e090aa9716f0fa25464c4ef5f49bc642619c7c16f0e
MD5 10f0c22c19d5bee226845cd4380b4791
SHA1 1e976a8256508452c59310ca5987db3027545f3d
SHA512 3a5d3dc6448f65e1613e1a92e74f0934dd849433ceca593e7f974310cd96bf6ad6ccc3b0cb96bdb2dcc35514bc142c48cb1fd20fee0d8fa236999ad155fc518b
SSDEEP 192:WxWfhWmeWvcuyjS7HnhWgN7aUWhR1+Eh+Il+jX01k9z3AReXz:WxWfhWg7HRN7eEQEjR9zSeD
TLSH
T138522A96D7AC8107F9AB6D7053A8DA037D3C6BC31900816B1A52F9651CA33C9EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-heap-l1-1-0.dll
Size 13KB
SHA256 1c1b88d403e2cde510741a840afa445603f76e542391547e6e4cc48958c02076
MD5 405038fb22cd8f725c2867c9b4345b65
SHA1 385f0eb610fce082b56a90f1b10346c37c19d485
SHA512 b52752ac5d907dc442ec7c318998fd54ad9ad659bde4350493fe5ca95286ecefcbbbf82d718d4bf4e813b4d20a62cd1f7ba11ee7c68c49ec39307b7746968d18
SSDEEP 192:WUZlKWfhWieWvcuyjS7HnhWgN7a8WhwXh+Il+jX01k9z3ARxiXNk:W6lKWfhWM7HRN7J5EjR9zSw9k
TLSH
T1B5524AD9C76C8103FDAB6D7053E5D9133C3D2BC72910406A2A92F5691CA338AEB3476E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-interlocked-l1-1-0.dll
Size 12KB
SHA256 159ecb50f14e3c247faec480a3e6e0cf498ec13039c988f962280187cee1391d
MD5 aff9165cff0fb1e49c64b9e1eaefdd86
SHA1 cdef56ab5734d10a08bc373c843abc144fe782cb
SHA512 64ddf8965defaf5e5ae336d37bdb3868538638bad927e2e76e06ace51a2bca60aefaab18c300bb7e705f470a937ad978edd0338091ad6bcc45564c41071eeb40
SSDEEP 192:WzWfhWceWvcuyjS7HnhWgN7a8Whkh+Il+jX01k9z3ARNXJXEmo:WzWfhWG7HRN7NEjR9zSN5XJo
TLSH
T180522BD2DB6C9107F9E72C7083B9DA537C3C6BD75900406A1692F4691CA33C9EB3462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-libraryloader-l1-1-0.dll
Size 13KB
SHA256 820e3acd26ad7a6177e732019492b33342bc9200fc3c0af812ebd41fb4f376cb
MD5 4334f1a7b180998473dc828d9a31e736
SHA1 4c0c14b5c52ab5cf43a170364c4eb20afc9b5dd4
SHA512 7f2a12f9d41f3c55c4aff2c75eb6f327d9434269ebff3fbcc706d4961da10530c069720e81b1573faf919411f929304e4aaf2159205cf9a434b8833eea867aa9
SSDEEP 192:WivuBL3BBLJWfhWGeWvcuyjS7HnhWgN7a8WhfZVh+Il+jX01k9z3ARLFXWk:WivuBL3BrWfhWA7HRN7cZLEjR9zSZGk
TLSH
T151522AD6D76C9243F9EA6C7093A8C9033C3C67C75910846E4695E6692CF3385EB20B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-localization-l1-2-0.dll
Size 15KB
SHA256 db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
MD5 71457fd15de9e0b3ad83b4656cad2870
SHA1 c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA512 a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
SSDEEP 384:WbOMw3zdp3bwjGjue9/0jCRrndbWsWfhWU7HRN7ApUad+JR9zuszu:yOMwBprwjGjue9/0jCRrndbGDVadk9zk
TLSH
T174622992D6E8D20BFC9EA8713127D5023C3D67861811995A47E2FB2828F37C9E77032D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-memory-l1-1-0.dll
Size 13KB
SHA256 aeec3d48068137870e6e40bad9c9f38377aa06c6ea1ac288e9e02af9e8c28e6b
MD5 d39fbbeac429109849ec7e0dc1ec6b90
SHA1 2825c7aba7f3e88f7b3d3bc651bbc4772bb44ad0
SHA512 b4197a4d19535e20ed2aff4f83aced44e56abbb99ce64e2f257d7f9b13882cbdb16d8d864f4923499241b8f7d504d78ff93f22b95f7b02996b15bb3da1a0ef42
SSDEEP 192:W/qWfhW0eWvcuyjS7HnhWgN7a8Wh+Yq21eX01k9z3ABfNB/xqw:W/qWfhWe7HRN7Ql8R9zmfNB0w
TLSH
T13A524B8ACBAC950BFCAB2C7153A4DA437D3E67831990905A12D4F5451CA33D9DB2077F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-namedpipe-l1-1-0.dll
Size 12KB
SHA256 1846947c10b57876239d8cb74923902454f50b347385277f5313d2a6a4e05a96
MD5 0e5cd808e9f407e75f98bbb602a8df48
SHA1 285e1295a1cf91ef2306be5392190d8217b7a331
SHA512 7d8e35cabe7c3b963e6031cd73dc5ad5edf8b227df735888b28d8efb5744b531f0c84130e47624e4fea8ef700eabde20a4e2290a1688a6acffb6a09ca20d7085
SSDEEP 192:WUWfhWyeWvcuyjS7HnhWgN7a8WhYw0mh+Il+jX01k9z3ARj4XGAzux:WUWfhWc7HRN7GXEjR9zSk2AzA
TLSH
T1CC5239A5976C8207ED9B2D7093E9D9033C3D6BC72900846A5692F8652CA33D5EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-processenvironment-l1-1-0.dll
Size 13KB
SHA256 990dc7898fd7b442d50bc88fec624290d69f96030a1256385391b05658952508
MD5 cc52cd91b1cbd20725080f1a5c215fcc
SHA1 2ce6a32a5bd6fa9096352d3d73e7b19b98e0cc49
SHA512 d262f62adde8a3d265650a4b56c866bdd2b660001fb2ca679d48ee389254e9ffa6ce9d69f2aaa619d22a155a5523dce5f7cfdd7638c0e9df1fe524b09520d5a3
SSDEEP 192:WAWWfhWZeWvcuyjS7HnhWgN7a8Wh0Dq21eX01k9z3ABfNBd5++x:WAWWfhWZ7HRN7rDl8R9zmfNBf+k
TLSH
T1A9523BC2DAAC9207F9DB7C7042A9E9633C3C13A31C40806A5594EB592CF7391EB6076F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-processthreads-l1-1-0.dll
Size 14KB
SHA256 a958fd20c06c90112e9e720047d84531b2bd0c77174660dc7e1f093a2ed3cc68
MD5 2dd711ea0f97cb7c5ab98ae6f57b9439
SHA1 cba11e3eebe7b3d007eb16362785f5d1d1251acd
SHA512 d8d39ca07fdfed6a4e5686eae766022941c19bfbceb5972edd109b453fd130b627e3e2880f8580a8a41601493d0c800e64a76e8590070aa13c1abd550bd1a1ba
SSDEEP 384:WyWXk1JzNcKSIHWfhWH7HRN7pEjR9zSgX:BbcKStkpEF9zZ
TLSH
T1136239D5C66CD283F8CE6C3062A5D9133C7E97861D1444350AA2F6A93EFB386D63823D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-processthreads-l1-1-1.dll
Size 13KB
SHA256 ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
MD5 e93816c04327730d41224e7a1ba6dc51
SHA1 3f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA512 beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
SSDEEP 192:WKtyDfIe9jWfhWyReWvcuyjS7HnhWgN7a8WhXO/h+Il+jX01k9z3AR/iXiz:WKtyDfIe9jWfhWyR7HRN7Y6EjR9zSqe
TLSH
T1E6523B91D7AC9143F9DB6D70A3A9D9133C3D6BC72A10847A16A1F1281DE7385EB2072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-profile-l1-1-0.dll
Size 12KB
SHA256 752542f72af04b3837939f0113bfcb99858e86698998398b6cd0e4e5c3182fd5
MD5 051847e7aa7a40a1b081ff4b79410b5b
SHA1 4ca24e1da7c5bb0f2e9f5f8ce98be744ea38309e
SHA512 1bfb96d15df1cd3dcefc933aeca3ce59bef90e4575a66eaab92386f8e93652906626308886dd9b82c0863d1544331bbf99be8e781fa71d8c4c1f5fff294056dc
SSDEEP 192:W7AaVWfhWdieWvcuyjS7HnhWgN7a8Whvrq21eX01k9z3ABfNBo3:W7AIWfhWdM7HRN7Ul8R9zmfNB0
TLSH
T1DA4238D2DBAC810BEDAB6D7092E8DA133C3D67D72950916E0599F4581CE33C5EA2063F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 13KB
SHA256 d2c9ee6b1698dfe99465af4b7358a2f4c199c907a6001110edbea2d71b63cd3f
MD5 2aa1f0c20dfb4586b28faf2aa16b7b00
SHA1 3c4e9c8fca6f24891430a29b155876a41f91f937
SHA512 ae05338075972e258bcf1465e444c0a267ad6f03fbb499f653d9d63422a59ac28f2cb83ec25f1181699e59ecbaac33996883e0b998cbade1cc011bc166d126d0
SSDEEP 192:WLGeVxWfhWkeWvcuyjS7HnhWgN7a8WhZch+Il+jX01k9z3ARLXX:WLGeVxWfhWO7HRN7HEjR9zSLn
TLSH
T15F522AA5E76C9103F8D72D7053A8DA177D3D2BC32990406A0592F5691CE33C9EF24B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-string-l1-1-0.dll
Size 12KB
SHA256 30dc0deb0faf0434732f2158ad24f2199def8dd04520b9daabbc5f0b3b6ddf40
MD5 6e5da9819bd53dcb55abde1da67f3493
SHA1 8562859ebf3ce95f7ecb4e2c785f43ad7aaaf151
SHA512 75eb227ca60ff8e873dac7fa3316b476b967069e8f0ac31469b2de5a9b21044db004353febf2b53069392be10a8bf40563bb5d6d4be774d37d12cf6fbeced175
SSDEEP 192:WvyMv9WfhW0FCeWvcuyjS7HnhWgN7a8Wh/kkQOh+Il+jX01k9z3ARpXZE:WvyMv9WfhWas7HRN7x0EjR9zSppE
TLSH
T119524B92EB6C9107F9976D7093E9DA537C3C6BC32910806A1692F5291CA33C5EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-synch-l1-1-0.dll
Size 14KB
SHA256 91e50f94a951aa4e48a9059ad222bbe132b02e83d4a7df94a35ea73248e84800
MD5 f378455fb81488f5bfd3617e3c5a75c0
SHA1 312fa1343498e99565b1fbf92e6e1e05351cbc99
SHA512 11d80d4f58da3827a317a3c1ed501432050e123eb992ed58c7765c68ddd2fc49b04398149e73fdb9fb3aa4494b440333aa26861b796e7ae8c7ad730f4faf99f7
SSDEEP 384:WWdv3V0dfpkXc0vVaCWfhWU7HRN7wTN4tgR9zYYB:/dv3VqpkXc0vVabjwTNx9zlB
TLSH
T176622B85D7D8A647F9AFDD7093E6C8137C3817C60920843656C6EA292DE33C5EF2422E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-synch-l1-2-0.dll
Size 13KB
SHA256 219cc445c1ad44f109219a3bb6900ab965cb6357504fc8110433b14f6a9b57be
MD5 5e393142274d7589ad3df926a529228c
SHA1 b9ca32fcc7959cb6342a1165b681ad4589c83991
SHA512 5eb31be9bce51a475c18267d89ee7b045af37b9f0722baaa85764114326c7a8d0a1662135e102d7ac074c24a6035232a527fc8745139a26cb62f33913ace3178
SSDEEP 192:WttZ36WfhWBaeWvcuyjS7HnhWgN7a8WhEaNh+Il+jX01k9z3ARPXnge:WttZ36WfhWBk7HRN7LMEjR9zSP3z
TLSH
T1AE524BD6DB9C9207FDAB6C7053E5D9133C3C6BC22910442A1666F1251CF33C5EA24B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-sysinfo-l1-1-0.dll
Size 13KB
SHA256 4bcd366eaf0bde99b472fa2bf4e0dda1d860b3f404019fb41bbb8ad3a6d4d8f2
MD5 7b997bd96cb7fa92dee640d5030f8bea
SHA1 ee258d5f6731778363aa030a6bc372ca9a34383c
SHA512 92b9f4dd0b8cc66a92553418a1e18bbbee775f4051cd49af20505151be20b41db11d42c7f2436a6fa57e4c55f55a0519a1960e378f216ba4d7801e2efb859b2a
SSDEEP 192:WWKIMFqnWfhWpeWvcuyjS7HnhWgN7a8Wh8oSh+Il+jX01k9z3ARMiXxT8:WWTnWfhWp7HRN7poqEjR9zSXm
TLSH
T1CB521BA6DBBCD102F99B6D3052E5DA033C3C67C62510811D06D2E6696DB3389EB3063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-timezone-l1-1-0.dll
Size 13KB
SHA256 64b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
MD5 acf40d5e6799231cf7e4026bad0c50a0
SHA1 8f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA512 f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
SSDEEP 192:W2HtoXeOWfhWteWvcuyjS7HnhWgN7a8WhPh+Il+jX01k9z3ARiXC:WmOWfhWd7HRN7IEjR9zSiS
TLSH
T110522AE6D7688106FCDB6E7053F9D9137C3C6BA31910815A1AD3F9292897389EB3072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-core-util-l1-1-0.dll
Size 12KB
SHA256 52226dc5f1e8cd6a22c6a30406ed478e020ac8e3871a1a0c097eb56c97467870
MD5 7a75bc355ca9f0995c2c27977fa8067e
SHA1 1c98833fd87f903b31d295f83754bca0f9792024
SHA512 ba96fdd840a56c39aaa448a2cff5a2ee3955b5623f1b82362cb1d8d0ec5fbb51037bdc9f55fe7b6c9f57932267e151e167e7f8d0cb70e907d03a48e0c2617b5b
SSDEEP 192:WfRWWfhWEeWvcuyjS7HnhWgN7a8WhAq21eX01k9z3ABfNBhKD5lx:WfRWWfhWu7HRN7rl8R9zmfNBUD5lx
TLSH
T1A15239D29BAC8007ECAB6D3043E8DA433C3D2BD71950909A16D5F5542CA33D9EB24B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-conio-l1-1-0.dll
Size 13KB
SHA256 07fda71f93c21a43d836d87fee199ac2572801993f00d6628dba9b52fcb25535
MD5 19876c0a273c626f0e7bd28988ea290e
SHA1 8e7dd4807fe30786dd38dbb0daca63256178b77c
SHA512 cdd405f40ac1c0c27e281c4932fbbd6cc84471029d7f179ecf2e797b32bf208b3cd0ca6f702bb26f070f8cdd06b773c7beb84862e4c01794938932146e74f1ca
SSDEEP 384:Woc5WfhWW7HRN7yI4hBnRmuTcR9z/BIWd:7hxyH7RmuU9zld
TLSH
T103522AD39AAC5903E8976A30A3F5DB837D3C27872940702A4546F52438D77DAFF2062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-convert-l1-1-0.dll
Size 16KB
SHA256 252b14d09b0ea162166c50e41aea9c6f6ad8038b36701981e48edff615d3ed4b
MD5 d66741472c891692054e0bac6dde100b
SHA1 4d7927e5bea5cac77a26dc36b09d22711d532c61
SHA512 c5af302f237c436ac8fe42e0e017d9ed039b4c6a25c3772059f0a6929cba3633d690d1f84ab0460beb24a0704e2e1fe022e0e113780c6f92e3d38d1afa8cee95
SSDEEP 192:WjJpdkKBcyxWfhWueWvcuyjS7HnhWgN7aoWhl9MMBdRgjLX01k9z3Azsu70S3:WnuyxWfhWI7HRN7GleLR9zusu7H
TLSH
T1F372D793A6E42F56EADF177221FAC7D36A381742158043B4C643E54C3483782BDB792E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-environment-l1-1-0.dll
Size 13KB
SHA256 10eb78864ebff85efc91cc91804f03fcd1b44d3a149877a9fa66261286348882
MD5 0eeb09c06c6926279484c3f0fbef85e7
SHA1 d074721738a1e9bb21b9a706a6097ec152e36a98
SHA512 3ceb44c0ca86928d2fdd75bf6442febafaca4de79108561e233030635f428539c44faae5bcf12ff6aa756c413ab7558ccc37eef8008c8aa5b37062d91f9d3613
SSDEEP 192:W3WfhWTeWvcuyjS7HnhWgN7a8WhkJh+Il+jX01k9z3ARdXd3:W3WfhWr7HRN7PPEjR9zSdJ
TLSH
T107523AC68BAC9607FA976D7092F8DE133C3D67D72900412A0A63F5681C97395EB3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-filesystem-l1-1-0.dll
Size 14KB
SHA256 a5b66647ee6794b7ee79f7a2a4a69dec304daea45a11f09100a1ab092495b14b
MD5 a5dce38bc9a149abe5d2f61db8d6cec0
SHA1 05b6620f7d59d727299de77abe517210adea7fe0
SHA512 252f7f841907c30ff34aa63c6f996514eb962fc6e1908645da8bbde137699fe056740520fee6ad9728d1310261e6e3a212e1b69a7334832ce95da599d7742450
SSDEEP 192:WB7q6nWlC0i5CpWfhW9eWvcuyjS7HnhWgN7aUWhyaWGaN4NhrJgX01k9z3An9U3g:W9q6nWm5CpWfhWt7HRN7jTN4tgR9zYkE
TLSH
T1E362188797D86E02DEEB1F7252F8DB973F3D1B8218824226C043A45839D73C4BE2555E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-heap-l1-1-0.dll
Size 13KB
SHA256 2eafce6ff69a237b17ae004f1c14241c3144be9eaeb4302fdc10dd1cb07b7673
MD5 841cb7c4ba59f43b5b659dd3dfe02cd2
SHA1 5f81d14c98a7372191eceb65427f0c6e9f4ed5fa
SHA512 f446acb304960ba0d262d8519e1da6fe9263cc5a9da9ac9b92b0ac2ce8b3b90a4fd9d1fdfe7918b6a97afe62586a36abd8e8e18076d3ad4ad77763e901065914
SSDEEP 192:WHY3vY17aFBR0WfhWmeWvcuyjS7HnhWgN7a8Wht+h+Il+jX01k9z3ARzXNZ8l:WHY3eRWfhWg7HRN75EjR9zSz9K
TLSH
T1FE5229968BAC9503E9976E70A2F8DA473D3E2BC36D00442B8153F56528933D4BF3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-locale-l1-1-0.dll
Size 13KB
SHA256 80c291e9fcee694f03d105ba903799c79a546f2b5389ecd6349539c323c883aa
MD5 a404e8ecee800e8beda84e8733a40170
SHA1 97a583e8b4bbcdaa98bae17db43b96123c4f7a6a
SHA512 66b99f5f2dcb698137ecbc5e76e5cf9fe39b786ea760926836598cabbfa6d7a27e2876ec3bf424a8cbb37e475834af55ef83abb2ed3c9d72c6a774c207cff0e0
SSDEEP 192:W/WfhWVeWvcuyjS7HnhWgN7a8WhrWGaN4NhrJgX01k9z3An9T28++:W/WfhWl7HRN7HTN4tgR9zYI8++
TLSH
T143523BC6C7AC5503E9DB2EB056F8EA477D3E27C71900446A5683F9982C833DCAE2562D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 80c09eb650cf3a913c093e46c7b382e2d7486fe43372c4bc00c991d2c8f07a05
MD5 ccf0a6129a16068a7c9aa3b0b7eeb425
SHA1 ea2461ab0b86c81520002ab6c3b5bf44205e070c
SHA512 d4f2285c248ace34ea9192e23b3e82766346856501508a7a7fc3e6d07ee05b1e57ad033b060fe0cc24ee8dc61f97757b001f5261da8e063ab21ee80e323a306e
SSDEEP 384:WjQUbM4Oe59Ckb1hgmLVWfhWg7HRN7lQiTN4tgR9zYk:mRMq59Bb1jyLlHTNx9zh
TLSH
T1CAA2D6478ADCFF57C58F0BB301F08BCE6A381EA254D0B6B5D847A48934A27C47D97A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-multibyte-l1-1-0.dll
Size 20KB
SHA256 0bd96e91a0aa1e1a967f08d778026e7ea922feb898757f19a58db59eae6d312b
MD5 fdb5b8009b3a2dda351ccd2e40c7a953
SHA1 245ad27902852929bcb826902f69aec24f8d9318
SHA512 d104c7c8501020accff5e18e3da1be734fb1dbd0579c1ed553e6ab605cf2137fa8312d9b5015e9b6831deae3e1cc0ea72b1ee4131943723fa8e8105fbc24e794
SSDEEP 384:Wey+Kr6aLPmIHJI6/CpG3t2G3t4odXLVWfhWV7HRN7STN4tgR9zYXn:LZKrZPmIHJI6kmSTNx9z6n
TLSH
T198A24E6B8EA82E12D58FD7F3B5F2C7C62A351F8104C07379E66795483842EE9BD52E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-private-l1-1-0.dll
Size 64KB
SHA256 dfb080ff0f9460bf3b57da71e58bff93f8cbbb5f53e3f6d2a65f5264809f90ab
MD5 c034fea829b3f287e08d9857b74c5570
SHA1 4f48a54e42d11a628e3c3e3e42eb1322dbc51340
SHA512 2d6232c60b79cad68ec9d1626b692f95e32d2555299d161f70018243f834a1dc18de13d483a5f8799ef3829fa92bcdbe96871d9bfb33aefb3a85c4f13792d9de
SSDEEP 1536:C/XeuJDe5c4bFe2JyhcvxXWpD7d3334BkZn+P7dVzcEf:SXeuJDe5c4bFe2JyhcvxXWpD7d3334Bl
TLSH
T1775317DB49E63F21E58FF7B767FB17C91B253A0408806234EAC7956B34853A9BC53A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-process-l1-1-0.dll
Size 13KB
SHA256 bd475e0c63ae3f59ea747632ab3d3a17dd66f957379fa1d67fa279718e9cd0f4
MD5 e62a28c67a222b5af736b6c3d68b7c82
SHA1 2214b0229f5ffc17e65db03b085b085f4af9d830
SHA512 2f3590d061492650ee55a7ce8e9f1d836b7bb6976ae31d674b5acf66c30a86a5c92619d28165a4a6c9c3d158bb57d764ee292440a3643b4e23cffcdb16de5097
SSDEEP 192:WYRQqjd7xWfhWvNeWvcuyjS7HnhWgN7a8Wh/XBq21eX01k9z3ABfNBoOdb5e:WYKAWfhWF7HRN74Bl8R9zmfNBNdbo
TLSH
T1A7521ADBD7E95A4BEABB2E3182F4CB437F3B1387594091698456F0493853389AF3052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-runtime-l1-1-0.dll
Size 17KB
SHA256 301c5418d2aee12b6b7c53dd9332926ce204a8351b69a84f8e7b8a1344fa7ea1
MD5 83433288a21ff0417c5ba56c2b410ce8
SHA1 b94a4ab62449bca8507d70d7fb5cbc5f5dfbf02c
SHA512 f20de6248d391f537dcc06e80174734cdd1a47dc67e47f903284d48fb7d8082af4eed06436365fce3079aac5b4e07bbd9c1a1a5eb635c8fe082a59f566980310
SSDEEP 192:WbPtIPrpJhhf4AN5/KilWfhWneWvcuyjS7HnhWgN7a8WhRh+Il+jX01k9z3ARRXu:WbPtYr7LWfhWP7HRN7WEjR9zSR7bO
TLSH
T1EF82074797EC3F17E9872F3252F9D7D71E3A23822A00413AD953E4983993785BD2721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-stdio-l1-1-0.dll
Size 18KB
SHA256 799e9174163f5878bea68ca9a6d05c0edf375518e7cc6cc69300c2335f3b5ea2
MD5 844e18709c2deda41f2228068a8d2ced
SHA1 871bf94a33fa6bb36fa1332f8ec98d8d3e6fe3b6
SHA512 3bbb82d79f54d85dcbe6ee85a9909c999b760a09e8925d704a13ba18c0a610a97054ac8bd4c66c1d52ab08a474eda78542d5d79ae036f2c8e1f1e584f5122945
SSDEEP 192:W5fgnLpHquWYFxEpahXWfhWlYeWvcuyjS7HnhWgN7a8WhZOh+Il+jX01k9z3ARXF:WEZpFVhXWfhWli7HRN7FEjR9zSXUg
TLSH
T18892E54796DC7F06E28B47336AFAEBEB563557822800717DC503E89436C6389BE1316A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-string-l1-1-0.dll
Size 18KB
SHA256 3bf407f8386989aa5f8c82525c400b249e6f8d946a32f28c469c996569d5b2e3
MD5 5a82c7858065335cad14fb06f0465c7e
SHA1 c5804404d016f64f3f959973eaefb7820edc97ad
SHA512 88a06e823f90ef32d62794dafe6c3e92755f1f1275c8192a50e982013a56cf58a3ba39e2d80b0dd5b56986f2a7d4c5b047a75f8d8f4b5b241cdf2d00beebd0d5
SSDEEP 384:W5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWfhWJ7HRN7yl8R9zmfNBqFn284:y6S5yguNvZ5VQgx3SbwA71IkFDSylQ9e
TLSH
T19392B58387F83F05C9DF1BB355FA8BC72A384F4616402375D063A48838827A6BE6791D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-time-l1-1-0.dll
Size 15KB
SHA256 2f6b0f89f4d680a9a9994d08aa5cd514794be584a379487906071756ac644bd6
MD5 b64b9e13c90f84d0b522cd0645c2100c
SHA1 39822cb8f0914a282773e4218877168909fdc18d
SHA512 9cb03d1120de577bdb9ed720c4ec8a0b89db85969b74fbd900dcdc00cf85a78d9469290a5a5d39be3691cb99d49cf6b84569ac7669a798b1e9b6c71047b350de
SSDEEP 192:WAJD2WfhWfeWvcuyjS7HnhWgN7a8WhSfdh+Il+jX01k9z3ARaXMgecI:WAcWfhWn7HRN7XfTEjR9zSacgbI
TLSH
T18E62098796D8B60BE9DB1B7152FDCBE73B3817C21A80716A8213D8543A97344FE3251D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\api-ms-win-crt-utility-l1-1-0.dll
Size 13KB
SHA256 dfad88b5d54c597d81250b8569f6d381f7016f935742ac2138ba2a9ae514c601
MD5 26f020c0e210bce7c7428ac049a3c5da
SHA1 7bf44874b3ba7b5ba4b20bb81d3908e4cde2819c
SHA512 7da07143cab0a26b974fa90e3692d073b2e46e39875b2dd360648382d0bfca986338697600c4bc9fe54fc3826daa8fc8f2fec987de75480354c83aba612afa5f
SSDEEP 192:W1fHQdujWfhWmeWvcuyjS7HnhWgN7a8WhLq21eX01k9z3ABfNB13gE:W1f9WfhWg7HRN7Ql8R9zmfNB3
TLSH
T1A5524BD78B9C5603EDAB2E7093F8EA833D3E17821510926A4495F5442CA37D5FF3162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\base_library.zip
Size 1.3MB
SHA256 f36454a982f5665d4e7fcc69ee81146965358fcb7f5d59f2cd8861ca89c66efa
MD5 21bf7b131747990a41b9f8759c119302
SHA1 70d4da24b4c5a12763864bf06ebd4295c16092d9
SHA512 4cb45e9c48d4544c1a171d88581f857d8c5cf74e273bb2acf40a50a35c5148fe7d6e9afcf5e1046a7d7ae77f9196f7308ae3869c18d813fcd48021b4d112deb5
SSDEEP 12288:rclJGUq/aLmn9vc+fYNXPh26UZWAzbX7jg/yquPxQh/dmFP/H71dlt/RO2/HUQ:rclJGUza9zb/gXOQ/dmFPvL3g2/HUQ
TLSH
T16C55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\pyexpat.pyd
Size 197KB
SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
MD5 8c1f876831395d146e3bcadcea2486dd
SHA1 82cbfb59f0581a0554d6a5061e1f82e6b46a3473
SHA512 73067bb8dcc44cd52551a48400bd8e721268dd44f9884ebb603452ece9c7bd276d40b7cbca4f10223f27b8ccdcd1d2ec298a1c767a691859aea10056c108a730
SSDEEP 3072:qwJ1l3SauVCjLwifFPYKDRW97oaU+1urfmwl1CnLiHbe7pjMeU8F5IMLhA8:73SauVCwi6KDRW97oaVybCLiS7pq8FZ
TLSH
T190146B5B72A2C0EBD8938038E6D74E07DAB2B865078097CF12D4E77D5F27B423A69315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\python3.dll
Size 66KB
SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
MD5 5eace36402143b0205635818363d8e57
SHA1 ae7b03251a0bac083dec3b1802b5ca9c10132b4c
SHA512 7cb3619ea46fbaaf45abfa3d6f29e7a5522777980e0a9d2da021d6c68bcc380abe38e8004e1f31d817371fb3cdd5425d4bb115cb2dc0d40d59d111a2d98b21d4
SSDEEP 768:OV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/d:ODmF61JFn+/Ob5IML0l7SySxUx
TLSH
T112637052BB54F8A3DBFA65FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\python312.dll
Size 6.6MB
SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
MD5 166cc2f997cba5fc011820e6b46e8ea7
SHA1 d6179213afea084f02566ea190202c752286ca1f
SHA512 49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
SSDEEP 49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
TLSH
T170667D697268C0A9C96BA0B0CC13C28AE7B27C517F50530B70EBB75E2F737A2535A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\select.pyd
Size 30KB
SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
MD5 7c14c7bc02e47d5c8158383cb7e14124
SHA1 5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA512 af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
SSDEEP 384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
TLSH
T1AFD29E576BB46845DD23C87268A28F26EE35B756871082CF3368C15D1F227C27B7B3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER
Size 5B
SHA256 0b77bdb04e0461147a7c783c200bc11a6591886e59e2509f5d7f6cb7179d01ab
MD5 00305bc1fb89e33403a168e6e3e2ec08
SHA1 a39ca102f6b0e1129e63235bcb0ad802a5572195
SHA512 db43b091f60de7f8c983f5fc4009db89673215ccd20fd8b2ced4983365a74b36ac371e2e85397cac915c021377e26f2c4290915ea96f9e522e341e512c0fc169
MD5 SHA1 SHA512

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\sqlite3.dll
Size 1.5MB
SHA256 054a7b736de7afbd447b07ee5e72df2febcaa06758f7a028873771567e8735d3
MD5 f3592da629e4f247598e232b2cbfbac1
SHA1 65429fbec3f5545640f2cda784dc7dcca420eb3b
SHA512 6fc24890a7be1ed73f1efdf2b7723c3a7de5ddb36b87ff7b01949fc2b14813e7b7c8b8311abee2796a9a4efffedfc1d2020ffa794e59004ca4fb6798b993190d
SSDEEP 24576:OU/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTDJl:HVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoP
TLSH
T176658C4BF2B801ADC0A7C179C91B170BEBB2B405177497DF5594CA692F23EE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\tcl86t.dll
Size 1.7MB
SHA256 1026c8c8eaaf3744f3ad8e80b4baa366e88aa0a048c0823838e39acef86ce964
MD5 1ddd4633814e91eb748c84647c526d19
SHA1 c3c2561fd5f971e6487eafff151b2cb00f2eb1e3
SHA512 2c9e64ca4edcd2ec0292b558f40feaa2da875deafd85945aac77e49d0b71e2280e020396f719fecca52afa66454d7a55aa9712113e8fcbbe30202c956bf7f552
SSDEEP 24576:9AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDC:9A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDM
TLSH
T1C4858E1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI38962\ucrtbase.dll
Size 994KB
SHA256 36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
MD5 8e7680a8d07c3c4159241d31caaf369c
SHA1 62fe2d4ae788ee3d19e041d81696555a6262f575
SHA512 9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
SSDEEP 24576:hLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+c:VyubJvlhrVETiR+c
TLSH
T17D25AE64FA5C0AA6D57BE07CC95B550FE972340243708ACF02EA4BB96E3BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4284-2242-0x0000019480000000-0x0000019480491000-memory.dmp

Download

memory/4284-2241-0x00007FFAE27D0000-0x00007FFAE27FA000-memory.dmp

Download

memory/4388-1151-0x00007FFAE1230000-0x00007FFAE125A000-memory.dmp

Download

memory/4388-1152-0x0000019F9C270000-0x0000019F9C3E9000-memory.dmp

Download