svcstealer | 96d6b0603a4a13e1f7636ec2cb9bc9b2a5491c15bce2c1daf9ace7b60cd20fa4

Analysis

max time kernel
148s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
06/12/2025, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 33KB
Sample251206-my3yqaskgl
SHA256 96d6b0603a4a13e1f7636ec2cb9bc9b2a5491c15bce2c1daf9ace7b60cd20fa4
MD5 42d0dc6ac0930333c19955086bdc00f0
SHA1 880c9ea17b5286380a36461a52b9222411f555a4
SHA512 2d5077cd5a8494329d7bfddb77cdc778b1a65771aed537672c6af0c93ebbc5d16217e861a93a072d9ccd2f32afa74fd08e76d89d3df0491d985cf7d8a3041dca
SSDEEP 768:mnNlAP5jHPTjiBwEYkg3baAezJ3Va0H6+522QWOS0neIs:a45jvKBxKq35522QWOS0e5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery downloader execution svcstealer persistence stealer

Malware Config

Extracted

Family

svcstealer

http://62.60.226.159/zbuyowgn/data.php
http://158.94.208.102/diamo/data.php
http://196.251.107.23/diamo/data.php
http://178.16.53.7/diamo/data.php
http://196.251.107.61/diamo/data.php

Attributes

bot_urls
http://196.251.107.23/bot64.dll
build_id
KC
srv_delay
1
srv_retry
1

Signatures

SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Svcstealer family
svcstealer

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4148	rundll32.exe
10	4148	rundll32.exe
11	2744	rundll32.exe
12	2744	rundll32.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
3	696	file.exe
3	696	file.exe
7	1404	syshost.exe
13	1404	syshost.exe

Executes dropped EXE 10 IoCs

pid	Process
5144	PFXPGWGZ.exe
3652	PFXPGWGZ.exe
5312	PFXPGWGZ.exe
2156	BXZSNVLR.exe
1404	syshost.exe
4048	8.exe
2848	PFXPGWGZ.exe
1032	syshost.exe
232	BYPUOAYT.exe
3076	decdbec.exe

Loads dropped DLL 2 IoCs

pid	Process
4148	rundll32.exe
2744	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PFXPGWGZ.exe"	PFXPGWGZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PFXPGWGZ.exe"	PFXPGWGZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PFXPGWGZ.exe"	PFXPGWGZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PFXPGWGZ.exe"	PFXPGWGZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000\Software\Microsoft\Windows\CurrentVersion\Run\decdbec = "\"C:\\ProgramData\\decdbec.exe\""	BYPUOAYT.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\syshost.job	syshost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
3340	Explorer.EXE
3340	Explorer.EXE
5144	PFXPGWGZ.exe
5144	PFXPGWGZ.exe
3652	PFXPGWGZ.exe
3652	PFXPGWGZ.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe
696	file.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3340	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeDebugPrivilege	696	file.exe
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE
Token: SeShutdownPrivilege	3340	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 5144	696	file.exe	78
PID 5144 wrote to memory of 3340	5144	PFXPGWGZ.exe	52
PID 5144 wrote to memory of 3340	5144	PFXPGWGZ.exe	52
PID 5144 wrote to memory of 660	5144	PFXPGWGZ.exe	79
PID 5144 wrote to memory of 3112	5144	PFXPGWGZ.exe	81
PID 3340 wrote to memory of 4732	3340	Explorer.EXE
PID 3652 wrote to memory of 3340	3652	PFXPGWGZ.exe	52
PID 3652 wrote to memory of 3340	3652	PFXPGWGZ.exe	52
PID 3652 wrote to memory of 4924	3652	PFXPGWGZ.exe	85
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 5312 wrote to memory of 3340	5312	PFXPGWGZ.exe	52
PID 5312 wrote to memory of 3340	5312	PFXPGWGZ.exe	52
PID 5312 wrote to memory of 3712	5312	PFXPGWGZ.exe	88
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 2156	696	file.exe	90
PID 2156 wrote to memory of 1404	2156	BXZSNVLR.exe	91
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 1404 wrote to memory of 5112	1404	syshost.exe	92
PID 5112 wrote to memory of 4148	5112	rundll32.exe	93
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 1404 wrote to memory of 4224	1404	syshost.exe	94
PID 4224 wrote to memory of 2744	4224	rundll32.exe	95
PID 1404 wrote to memory of 4048	1404	syshost.exe	96
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 696 wrote to memory of 3340	696	file.exe	52
PID 2848 wrote to memory of 3340	2848	PFXPGWGZ.exe	52
PID 2848 wrote to memory of 3340	2848	PFXPGWGZ.exe	52
PID 2848 wrote to memory of 3448	2848	PFXPGWGZ.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
    "C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"
      4⤵
      PID:660
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3112
- - C:\Users\Admin\AppData\Local\Temp\BXZSNVLR.exe
    "C:\Users\Admin\AppData\Local\Temp\BXZSNVLR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Roaming\syshost.exe
      "C:\Users\Admin\AppData\Roaming\syshost.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f988f0065903c8\clip64.dll, Main
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5112
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f988f0065903c8\clip64.dll, Main
        6⤵
        Badlisted process makes network request
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4148
    - - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f988f0065903c8\clip64.dll, Main
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4224
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f988f0065903c8\clip64.dll, Main
        6⤵
        Badlisted process makes network request
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\10001290101\8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001290101\8.exe"
        5⤵
        Executes dropped EXE
        
        PID:4048
- - C:\Users\Admin\AppData\Local\Temp\BYPUOAYT.exe
    "C:\Users\Admin\AppData\Local\Temp\BYPUOAYT.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:232

C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"
  2⤵
  PID:4924

C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"
  2⤵
  PID:3712

C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"
  2⤵
  PID:3448

C:\Users\Admin\AppData\Roaming\syshost.exe
C:\Users\Admin\AppData\Roaming\syshost.exe
1⤵
- Executes dropped EXE
PID:1032

C:\ProgramData\decdbec.exe
"C:\ProgramData\decdbec.exe"
1⤵
- Executes dropped EXE
PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8.exe

Path C:\Users\Admin\AppData\Local\Temp\10001290101\8.exe
Size 33KB
SHA256 96d6b0603a4a13e1f7636ec2cb9bc9b2a5491c15bce2c1daf9ace7b60cd20fa4
MD5 42d0dc6ac0930333c19955086bdc00f0
SHA1 880c9ea17b5286380a36461a52b9222411f555a4
SHA512 2d5077cd5a8494329d7bfddb77cdc778b1a65771aed537672c6af0c93ebbc5d16217e861a93a072d9ccd2f32afa74fd08e76d89d3df0491d985cf7d8a3041dca
SSDEEP 768:mnNlAP5jHPTjiBwEYkg3baAezJ3Va0H6+522QWOS0neIs:a45jvKBxKq35522QWOS0e5
MD5 SHA1 SHA512 SSDEEP

Submit Download

BXZSNVLR.exe

Path C:\Users\Admin\AppData\Local\Temp\BXZSNVLR.exe
Size 707KB
SHA256 9b7ebcd4b27ace0f237f2ccab58503340be62a43112f9c537d16f42d40abb715
MD5 086294773f43035c3302893954deec2c
SHA1 c26bed76b02a1c356dc88b62193dabd1f71e17da
SHA512 9f998bfd6e68837ec6a3ee42ace03f658e7e81c91aa7fa5b310467bbf2fc4b285179b1798cb9a6c762a80bb6bc913df86a2ba6c0031809e90d5c55a4ce81b172
SSDEEP 12288:GUrQmKQxsUCWn0vlIHTkAd4OnRGZh/ls+w/stQPn8LZCe+gntFdygA4b:GU0Ust1KoAd4U0NrwEtK8LgrsPdyg
MD5 SHA1 SHA512 SSDEEP

Submit Download

BYPUOAYT.exe

Path C:\Users\Admin\AppData\Local\Temp\BYPUOAYT.exe
Size 600KB
SHA256 4caf2a7831a78d5e22fee325aef6b7aa350b43226c7392fa086a2f5cd13c51f8
MD5 f8276d4d3406c5df2329f395fbca8f1f
SHA1 4ec1f3a5f7e0c9ad27ff9225bf77c922a4a0b639
SHA512 e1927898e2bf417a6b266563b80555c223aaeecdaf1a3544ac0c056c43a99460e5e9b8abcc15acdf962143d38324ca229c681d927fe8b67e9e6dcdae8289ea4b
SSDEEP 12288:JSuCbRfsiRSmCsdcah6NdHN0ych6j8lqrksKXAYBv5rxo:JzmsKxnh6N1NVnj8lqQLfju
MD5 SHA1 SHA512 SSDEEP

Submit Download

PFXPGWGZ.exe

Path C:\Users\Admin\AppData\Local\Temp\PFXPGWGZ.exe
Size 288KB
SHA256 b5588ea2f98d661192c901a59bfad2975d1a1ead2e45eaadbf7815892fc009a6
MD5 b1aecfc83e5df6a6b29be7efd7c0343d
SHA1 d53e0d19b5d41653121841fd6ad3cf721328ac49
SHA512 33f9830951023386218f8bcae61aefbb7cee11b08cc115597b53e9f7dac9ad50dcd8890fbf78d73ccaef70db8908fbcdc4c5f36bca372a24ddb8b5be107c4ac3
SSDEEP 6144:xhzTLdWUF63UDlkiy2x2/hSTyC2fPJyTpg+q9k1s:xryg/x4JSg+q9kq
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\f988f0065903c8\clip64.dll
Size 114KB
SHA256 182bc3c2b19b3254ea84fa8c0379c03edac5bfbe0a6ed27b03544192281ad899
MD5 cff0d2bbf0c5291577d37299090cb82b
SHA1 9338d6b179783c968274e60c67817a4a50de3ab6
SHA512 0a1aaa51caac58c236ed75373331c9e79d05caffd55f548a8aec8cf7b478d24b18cb115dcdacde4415124b8dd0458c935c2467ffb8c6d4dcb9018efbf84fce56
SSDEEP 3072:6+RSQxoFEtiFKgz8lfZ08hZ5RbYNGgsZtpNQwLjZmXJ:jRSQxoFEtiFJqtLFYNFGEJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

syshost.exe

Path C:\Users\Admin\AppData\Roaming\syshost.exe
Size 605KB
SHA256 79b120acdb37fd5b5fa927a6ffb370d5a7cbc8039f2e9b31831029d0f16bc38b
MD5 c95602d4cc0eafc4d7743138118b612e
SHA1 c6e216a64a83767111b2fd8154c0f48809cd5344
SHA512 6da5d0d6646c0061ef8d7ee7265db2e19ef65b86114d6bafbf05aeb91af3903feacb54143dcca3941e06e0db5272973f4d51d6938e0730605fb2e4c88abfcd2d
SSDEEP 12288:kUCWn0vlIHTkAd4OnRGZh/ls+w/stQPn8LZCe+gntFdyg:kt1KoAd4U0NrwEtK8LgrsPdyg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-156-0x0000000140000000-0x0000000140082000-memory.dmp

Download

memory/696-0-0x00007FFF60A80000-0x00007FFF60C89000-memory.dmp

Download

memory/1032-137-0x00000261A1720000-0x00000261A17A7000-memory.dmp

Download

memory/1404-83-0x0000019C65B80000-0x0000019C65C07000-memory.dmp

Download

memory/1404-81-0x0000019C65B80000-0x0000019C65C07000-memory.dmp

Download

memory/1404-120-0x0000019C65B80000-0x0000019C65C07000-memory.dmp

Download

memory/1404-113-0x0000019C65B80000-0x0000019C65C07000-memory.dmp

Download

memory/3340-17-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/3340-133-0x0000000006EF0000-0x0000000006F2A000-memory.dmp

Download

memory/3340-18-0x00007FFF5FDA0000-0x00007FFF5FDA1000-memory.dmp

Download

memory/3340-22-0x0000000005870000-0x00000000058AA000-memory.dmp

Download

memory/3340-51-0x0000000005B90000-0x0000000005BCA000-memory.dmp

Download

memory/3340-12-0x0000000002A80000-0x0000000002AB4000-memory.dmp

Download

memory/3340-13-0x0000000002AC0000-0x0000000002AFA000-memory.dmp

Download

memory/3340-16-0x0000000002AC0000-0x0000000002AFA000-memory.dmp

Download

memory/3340-28-0x0000000002B80000-0x0000000002BB6000-memory.dmp

Download

memory/3340-24-0x0000000005870000-0x00000000058AA000-memory.dmp

Download

memory/3340-174-0x000000000BE80000-0x000000000BEEF000-memory.dmp

Download

memory/3340-49-0x0000000005B90000-0x0000000005BCA000-memory.dmp

Download

memory/3340-135-0x0000000006EF0000-0x0000000006F2A000-memory.dmp

Download

memory/3340-15-0x0000000002AC0000-0x0000000002AFA000-memory.dmp

Download

memory/3340-1-0x00000000028D0000-0x0000000002903000-memory.dmp

Download

memory/3340-2-0x0000000002B80000-0x0000000002BB6000-memory.dmp

Download

memory/3340-157-0x0000000007310000-0x00000000073D6000-memory.dmp

Download

memory/3340-158-0x0000000007310000-0x00000000073D6000-memory.dmp

Download

memory/3340-161-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/3340-163-0x0000000007310000-0x00000000073D6000-memory.dmp

Download

memory/3340-165-0x0000000007310000-0x00000000073D6000-memory.dmp

Download

memory/3340-166-0x0000000007310000-0x00000000073D6000-memory.dmp

Download

memory/3340-162-0x0000000007310000-0x00000000073D6000-memory.dmp

Download

memory/4048-122-0x00007FFF60A80000-0x00007FFF60C89000-memory.dmp

Download