acc0a44cdc34a10911dcf0b033860ff1f5b182fbbf11332a327ae7b7a70370aa

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
Size 19.2MB
Sample260720-bd9d8adv2x
SHA256 acc0a44cdc34a10911dcf0b033860ff1f5b182fbbf11332a327ae7b7a70370aa
MD5 8aae52628e626c40413e75b2601220a0
SHA1 3cd12007b7709ec3a9da79dbdc450bd5631394dd
SHA512 3c6732765e57c26c98330d5b572b5a0c8470dfa67e5d5f375323905311a7a374d42a712f6542b8e23ab5e130cd6bd5fe283663b98db8f410de45f30f7884cae9
SSDEEP 393216:KBs8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n3:UscRgq72d46Jw724Sz4uMv
TLSH
T162173355EB98BC60E1FA5432B53582226735FF506A6D42CBE371352809F93C2AB33F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 28 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-188.dat	UPX
behavioral2/files/0x000d00000001c4f8-209.dat	UPX
behavioral2/memory/4536-216-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/memory/4536-218-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/5848-237-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/5848-235-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/files/0x000d00000001c510-251.dat	UPX
behavioral2/files/0x000d00000001c4f2-250.dat	UPX
behavioral2/memory/5424-259-0x0000000071700000-0x00000000719E4000-memory.dmp	UPX
behavioral2/memory/5424-262-0x0000000070F30000-0x0000000070FDD000-memory.dmp	UPX
behavioral2/memory/4536-284-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/memory/4536-289-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/4536-299-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/memory/4536-300-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/5848-308-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/memory/5848-309-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/5424-320-0x0000000071700000-0x00000000719E4000-memory.dmp	UPX
behavioral2/memory/5424-325-0x0000000070F30000-0x0000000070FDD000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4f5-335.dat	UPX
behavioral2/files/0x000d00000001c4f7-337.dat	UPX
behavioral2/memory/5424-423-0x0000000070F30000-0x0000000070FDD000-memory.dmp	UPX
behavioral2/memory/5424-422-0x0000000071700000-0x00000000719E4000-memory.dmp	UPX
behavioral2/memory/4536-677-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/memory/4536-678-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/5848-685-0x0000000072AF0000-0x0000000072C89000-memory.dmp	UPX
behavioral2/memory/5848-686-0x00000000725C0000-0x0000000072AEE000-memory.dmp	UPX
behavioral2/memory/5424-692-0x0000000070F30000-0x0000000070FDD000-memory.dmp	UPX
behavioral2/memory/5424-691-0x0000000071700000-0x00000000719E4000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-188.dat	acprotect
behavioral2/files/0x000d00000001c4f8-209.dat	acprotect
behavioral2/files/0x000d00000001c510-251.dat	acprotect
behavioral2/files/0x000d00000001c4f2-250.dat	acprotect
behavioral2/files/0x000d00000001c4f5-335.dat	acprotect
behavioral2/files/0x000d00000001c4f7-337.dat	acprotect

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_FF7A62A689D9FA30693DDF78F3A4037F	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_FF7A62A689D9FA30693DDF78F3A4037F	SRManagerSOS.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-188.dat	upx
behavioral2/files/0x000d00000001c4f8-209.dat	upx
behavioral2/memory/4536-216-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/memory/4536-218-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/5848-237-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/5848-235-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/files/0x000d00000001c510-251.dat	upx
behavioral2/files/0x000d00000001c4f2-250.dat	upx
behavioral2/memory/5424-259-0x0000000071700000-0x00000000719E4000-memory.dmp	upx
behavioral2/memory/5424-262-0x0000000070F30000-0x0000000070FDD000-memory.dmp	upx
behavioral2/memory/4536-284-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/memory/4536-289-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/4536-299-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/memory/4536-300-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/5848-308-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/memory/5848-309-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/5424-320-0x0000000071700000-0x00000000719E4000-memory.dmp	upx
behavioral2/memory/5424-325-0x0000000070F30000-0x0000000070FDD000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f5-335.dat	upx
behavioral2/files/0x000d00000001c4f7-337.dat	upx
behavioral2/memory/5424-423-0x0000000070F30000-0x0000000070FDD000-memory.dmp	upx
behavioral2/memory/5424-422-0x0000000071700000-0x00000000719E4000-memory.dmp	upx
behavioral2/memory/4536-677-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/memory/4536-678-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/5848-685-0x0000000072AF0000-0x0000000072C89000-memory.dmp	upx
behavioral2/memory/5848-686-0x00000000725C0000-0x0000000072AEE000-memory.dmp	upx
behavioral2/memory/5424-692-0x0000000070F30000-0x0000000070FDD000-memory.dmp	upx
behavioral2/memory/5424-691-0x0000000071700000-0x00000000719E4000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Executes dropped EXE 8 IoCs

pid	Process
1916	Launcher.exe
4536	SRManagerSOS.exe
3344	Launcher.exe
2984	SRServerSOS.exe
5848	SRAgentSOS.exe
5456	SRAppPBSOS.exe
5424	SRFeatureSOS.exe
3428	SRUtilitySOS.exe

Loads dropped DLL 12 IoCs

pid	Process
4536	SRManagerSOS.exe
4536	SRManagerSOS.exe
4536	SRManagerSOS.exe
4536	SRManagerSOS.exe
2984	SRServerSOS.exe
5848	SRAgentSOS.exe
5848	SRAgentSOS.exe
5848	SRAgentSOS.exe
5848	SRAgentSOS.exe
5424	SRFeatureSOS.exe
5424	SRFeatureSOS.exe
5424	SRFeatureSOS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5988	cmd.exe
3268	cmd.exe
5756	cmd.exe
3192	cmd.exe
3404	cmd.exe
4456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRAgentSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRFeatureSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRAppPBSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRUtilitySOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRManagerSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRServerSOS.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SRManagerSOS.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5848	SRAgentSOS.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
2984	SRServerSOS.exe
2984	SRServerSOS.exe
5456	SRAppPBSOS.exe
5456	SRAppPBSOS.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5988	4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe	88
PID 5988 wrote to memory of 944	5988	cmd.exe	90
PID 4868 wrote to memory of 3268	4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe	91
PID 3268 wrote to memory of 2992	3268	cmd.exe	93
PID 4868 wrote to memory of 5756	4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe	94
PID 5756 wrote to memory of 4324	5756	cmd.exe	96
PID 4868 wrote to memory of 3192	4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe	97
PID 3192 wrote to memory of 6080	3192	cmd.exe	99
PID 4868 wrote to memory of 3404	4868	2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe	102
PID 1916 wrote to memory of 4536	1916	Launcher.exe	104
PID 3404 wrote to memory of 4276	3404	cmd.exe	105
PID 4536 wrote to memory of 2984	4536	SRManagerSOS.exe	111
PID 4536 wrote to memory of 5848	4536	SRManagerSOS.exe	112
PID 4536 wrote to memory of 5456	4536	SRManagerSOS.exe	113
PID 4536 wrote to memory of 5424	4536	SRManagerSOS.exe	114
PID 5424 wrote to memory of 3428	5424	SRFeatureSOS.exe	115
PID 5848 wrote to memory of 4456	5848	SRAgentSOS.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8aae52628e626c40413e75b2601220a0_amadey_elex_icedid_remcos_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c C:\Windows\system32\expand.exe *.cab /f:* .\
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\expand.exe
    C:\Windows\system32\expand.exe *.cab /f:* .\
    3⤵
    - Drops file in Windows directory
    PID:944
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\schtasks.exe
    schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2992
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
    3⤵
    PID:4324
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /run /tn ASOS1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn ASOS1
    3⤵
    PID:6080
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /delete /f /tn ASOS1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn ASOS1
    3⤵
    PID:4276

C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe" SRManagerSOS.exe 1
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe
  "SRManagerSOS.exe"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exe
    SRServerSOS.exe -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe
    "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\Temp\bd2_request_1b43fb76179db00.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4456
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe
    "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe
    "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exe
      SRUtilitySOS.exe -r
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3428

C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01_sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\splashtop\sos\01_sysinfo.txt
Size 385B
SHA256 3c590b43d04c21ebb0063b8307edef92ae1a0e2db6299d53116919911a62d51c
MD5 b8dc175422fb02adbf423981993049a4
SHA1 35a648dc1a96e7d3d036fba6d43b6198eeedcbb3
SHA512 b50dfa81edad650aaf1a98535c129be1daa506a31767b0a95b22e551cd05ef703c49cb14e968540f43f4e7c17c31ec3e6929766baaf2793c06a98ee3fd7e994f
TLSH
T15BE02BE3030884614F64144A79A13F6A9EB4BC4A63FC2045C1A9BC1A455909F5708016
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.txt

Path C:\Users\Admin\AppData\Local\Temp\splashtop\sos\launcher.txt
Size 238B
SHA256 67bb092cd607e7bc8211b7f0fb2ed461f26b6cb6b41cf3b5f5a3956e19a5170f
MD5 0496f40715bacbcefbb7f0e93a8b8606
SHA1 549ade3d329d5da85a6dd1ff325cfb32e7a619d5
SHA512 c6dd277a0015be69450caf3a5ee3265468e0a494553a7128a658a4dc4a93103f4837b1234c27a0e8c4496b2261811eaadff3651159790afd6dbfa92a6db9d5c5
TLSH
T1FED0C96C47D20D56F8B5D90394F7855371723E832A35CD0A01CC1758457B421F561B3A
MD5 SHA1 SHA512 TLSH

Submit Download

unpack1.log

Path C:\Users\Admin\AppData\Local\Temp\unpack1.log
Size 5KB
SHA256 58948cae2941ca20a50a4f136aba215b96fc13400aff7385d3f504f505c1ac9e
MD5 d783c9c5406df12385d57c282ed9e9cf
SHA1 a54cfeb93855cdc6d50753ebfb5c262e0d3fedb0
SHA512 8698bd95a96eb95f30c80601f21fc699a21176b0127f217a4ddd435155336f7034b64c66c022c5bd03461304994cb8f4b862cc60db6fe48fc51f646a3ac6372f
SSDEEP 96:9f5xN28NcNU1Y81SNVGONoN/Yq8qNVDpNLNUYkANVgiNUNJYKNV1/NiNeYCaNVSW:rr5zBSXPFvR8
TLSH
T144B146291BE44813D6F7DAC6EEF752037E357E932B34D90C01C21B0A049A85BF8767A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.cloudbuild.check

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.cloudbuild.check
Size 398B
SHA256 01cb9f826d8d7ab6173459f8f2ec3f14160d24b496f9ea39865b3060efd5a6a8
MD5 4ae96f26ce460bd54914eb608c52e1d7
SHA1 48b20e5e651e25ac67ff0e0b8842525beae76c88
SHA512 54a59d028c8ea4610b2887c45508e025c56a3911ac33e15d5bf174d4a2e4c30f56aa03c170b91d6922551e94eddf04f60826b5b257c7efaa65ed4f2846322fb2
TLSH
T11FE0610DD47D8D274758C1FA446E00183F615FC716992C657955001C4B6DDB735B767C
MD5 SHA1 SHA512 TLSH

Submit Download

.cloudbuild.check.rsa

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.cloudbuild.check.rsa
Size 256B
SHA256 2f425e2414ea08ba4d64540b1ac64b74b67855a02a8913b2316d8575e3ad96d3
MD5 512a686063604123b5024446c389dd42
SHA1 9209b1b6de3e68cc0e56247b5a988cceee06bc4c
SHA512 77f94a6c5d7a3e1413a5263a51f167945c94ce8047a02d322fca75172a7a36ba93f1c1025f9f29c18d492fb6021facb719a4c94a73722922182018fb6540b243
TLSH
T17FD02B167B0041B11451882E4CA92DD967162147D335A2498F4EA25581F2B5310AA412
MD5 SHA1 SHA512 TLSH

Submit Download

.config.json

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.config.json
Size 430B
SHA256 b0b6a18da50233a3a51e122b0406d4959b637d64acc713aac63373d651569740
MD5 567af026cd3fab27c5e6c451308b146d
SHA1 a2efba800eb1f889424370d376a0422ba2e4e091
SHA512 12bb3b17662c9661fc37b43a907fc0435133e532782fcd0525cfd0860f1038bd0cbd0b9f1b3d9617b4c250b4df149f57c01f7815b9be2940437a6c34361876a5
TLSH
T101E06524946B6C3C00D7C9EEC99D3727767D566182BC923E0D78893841D77CE27004EE
MD5 SHA1 SHA512 TLSH

Submit Download

.init_setting.ini

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.init_setting.ini
Size 149B
SHA256 d03d94a2aca90f5976da0b5de9eef16a54d3d764021c87e5fb21c67106672ec2
MD5 e72d7a33f860f90ef4788a56a19cae76
SHA1 3e77c9f3daa81ad28450481fe4624aba8aa56ab2
SHA512 8da3979868654b19e7afd52fb969dd738064d1cb883dc5da57750b31e1af0b9f726d27f9c755272158f09602a8fba64dd7bba4983d671749ceb86862868a2310
TLSH
T1F9C08C2200B8AD2A8C6834343B968260AF623E652A0A9432BB4100A50262262CB7446B
MD5 SHA1 SHA512 TLSH

Submit Download

.splashtop.sostheme

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.splashtop.sostheme
Size 43KB
SHA256 6927bc83d9a2280689e3bf460f9e8f4c78209925eef3c03ee08a675772533c07
MD5 f8c106be1418101316f4b58306aeccee
SHA1 2cf3bac3d1708f45e1b67731508011eb2d8a7a18
SHA512 9cd9c160672719405da734975a709b38d42317a12020f5c8af222f0f2258dc2053d11f06dea226a99baf8a70a358a4306a63cdd1dd10b61aa3696fc33d716acf
SSDEEP 768:U+y2AT31AP75YFiipX5mSRJIqdG7IFRPWod8PeN4mGN7Nr:dy2AAO/qZqg7Ibd8PDmGDr
TLSH
T15E137FF479283CE5E7AB4667EDCA7DF523B235629DC7A6CD4064A7C21063326EE13404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASOS.xml

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\ASOS.xml
Size 2KB
SHA256 1008bce6f93a3863164b0fea34bea07bd6ce304dffafac5615dc52bbb675bd47
MD5 8ce869f7dbbb2e38c8de76716e49b8a5
SHA1 de73a6b80fca67b06a7e1fec1904095d61b7b864
SHA512 98afa1fe513beb31bca44e56fe40f0a049d3bb0ccc7cf4997b8fb2631774131c7232072e733674a3ed6771201d53788e94d595e8254a5ffc4d6cc45ff93417af
TLSH
T132413A4367EE1218B1F76B6CBEB624614A63BC459D39C46C00AC240DCAF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Acknowledgements.htm

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Acknowledgements.htm
Size 153KB
SHA256 116d765d92d26205a27e2fb53412b10fe8837e68030f6ecab1359fed0106170d
MD5 feca7084a45f9933bbc1db986e28d166
SHA1 6ab943f7adf35a27f70a36aa4f2543c94ea223c0
SHA512 129bcc26c6415eb42faf0d5dc829a69b782901ec78f0c95c4e328fa0f099b135fcbb9a725212c57d55b4569cc7c54f17f91d4d505c9653642ab00bd16e5f7d08
SSDEEP 3072:ZHXt/BWDLm8arfT4h6+2j+S64ioX+C15titNI6cSM:gDLmtrfT4hj2ju0XtwGSM
TLSH
T18CE3952EB74503B216E202516A0FA4CEF31A903E366B5564349DC15C27BBF3583BB6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
Size 199KB
SHA256 627798fc9cee75566928e0ee14e5be73651509c94fb5cfd44511048fd16fcbbc
MD5 e9e053acbc1f8dec2242eaa757101c1b
SHA1 3d011091a48446204cceba0e877846d170f0fb48
SHA512 199411b1a85f52f94254eca3b5ccce201e2cab38684a033893f1196df18e756b95e53975cb1d874b25d65f4c1ee684e871de43302cdaa571b4728f082e4a74e8
SSDEEP 3072:VzzfuGXMQn01BW1BSa1blsbXyf4ZxzdLJwr2AGHkGKdBcY0oKbacfquEAgzfI:VzzzXJcWzS2s+f4Z3LOOBEAgzQ
TLSH
T164147D21B8C1C033D5665C3059E4CF759A3DBDA14FA5A8CB67940FFA8E202C19B39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuicServer.cert

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\QuicServer.cert
Size 920B
SHA256 1440a8a61685956e6e5c90c2b420b1d34a5bea698b25cd428e29396df1d7f5cc
MD5 901b93ae43b866eff29e0fdb012d8e67
SHA1 ace09dcebde7242a56d65c2bc3ed9638f7d72cff
SHA512 99f7055374be40bb60a0d2e22ee0025e3cc284265bffed6b6eb8dc12212ae8e44a42acf2258139b5cd6fde7ce168184ceba2ef340e43a195924cfea37c1a1665
TLSH
T10011C4B36A21AC0B9245D08CFE0B08492C2EC375526AA4004D30AA03C39AA0831CE244
MD5 SHA1 SHA512 TLSH

Submit Download

QuicServer.key

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\QuicServer.key
Size 1KB
SHA256 0eab5e60fcb66a6a29abfc85f1ea48ac321a557ba2b141cb7cdc5fd5dda80be7
MD5 97223ff605dd73b944f6e03c38b24a53
SHA1 385dadb8a7cfb6aca018dfda1f481c303681b16a
SHA512 78fc0f0904b1a464495ba8da2d29c34452bfc5143c23fec40f9c7df8579300d4a56e90410536130cb250139d3342e21e92b5deab2218bc0deaabf8b064fa865b
TLSH
T164310873DCC04D19BEAB5AD48CAF3F298099FD27823749F41421C675912E94A8077A15
MD5 SHA1 SHA512 TLSH

Submit Download

SRAgentSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe
Size 3.0MB
SHA256 bb6c4afa3fd59192c7fdcb3e4482f54028c6624be06c7e4113e04c6046857d0b
MD5 c500d153cf374a30491747f2e7393c3b
SHA1 9c16103bb60ff3b1fbc850942502bb4642ba7eca
SHA512 82282fe15fbed08f54e43c1d3e336a3aa051d697e32c8ca18f05fdf1b32a846bf967833779f3f5787c288f3b89418bc3308acdec85a0de82bb16519eb519ab3a
SSDEEP 98304:5tCRI8Y9155gsERhnCIlObHJjtS1zl2Sti:uRIlAhnCqWHdoli
TLSH
T1DEE58F23B68C807BE5630230556C97A18DBCF6311A7148DB73C95A5D6BB0AD2A33BF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAppPBSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe
Size 2.8MB
SHA256 96de45f42364fc67b5ccdb46692da5d347aac249bcdfebc1e497ce694d07e4a4
MD5 b29c4d48149dc4d9d5448066ddc1c116
SHA1 44642ac252d38503ca54e4074079f4c520b85cd7
SHA512 e6c3f31ef3e968c1d0ccd8f2a4f289348133f227c7ce1782e9dec374fcc76ce6c7116df1cfd08217627b4e61ed03204c76bef89f560e07c4aa3b36520e02619e
SSDEEP 49152:M9ibv/s5WFkfNwSiEmzJxP9DBebwe8A5pKijOE20U1kHWvQA0gPq:M9ibXs5bGYmzJ19DBebwS5pKijOE2NSr
TLSH
T14BD5AE123E6063B2C5A386705D48F37AF1ADAD700F3D41C793C4FA2E29F55B14A19A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAppSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppSOS.exe
Size 2.7MB
SHA256 2ed0c3edef51ae2203e25933cdfd38e5f40357237e23c501d76cc7347cd2a194
MD5 471f7fc9bfe2e3119ede994bcd8caf95
SHA1 5217d80bbee3e6c73332533ed913062f966454a3
SHA512 438d8ef3fb6803d789b8b73145123f7b8e0c9548d1c0a6cd6fd59256983509a5107e621693a0544d17c2cf44b8bed9e0765cf211fa778423684c145763469be1
SSDEEP 49152:zGkd8YmI5wLfVz6XZkTz/XTWpSzjnM1rHluUVlSO1kHWoKX0N3:zGwtJEz6XKzrWpSz72HluUVlxSWoj
TLSH
T14ED59F333A6043B6C1A30630991DFF7EE3BCAD7036B691E752C4FA1B1B750918619A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAudioChatSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAudioChatSOS.exe
Size 2.7MB
SHA256 bbd6cfb87f2a317805580916f72deb98b32f969a5a62a74249b691ad70171deb
MD5 c0e28db387ebc9aecc0ba838ee374e92
SHA1 4bcb4f8d2bebd89ffd6774fc089d2926ed8c0159
SHA512 4f5b9a752cb4e749d49d268c910fabf3e2577f4402ab94571a3e94647286d19f434acf94d5b3ddf398afbbee8271027137758967e50ab430d7999d7dee341365
SSDEEP 49152:yQiYzbdV0Z/Fk0vk/tqiYeBeVirU61Bo95EComtnbOFTfW2NLZb:yQiYzbSd2/giYmeVirUky95ECocbOFTF
TLSH
T10CD55B23F7605362C3A206306D1AF736E3ACE760062F4097D3F4FA1A69756D2471AD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAudioResample.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAudioResample.dll
Size 130KB
SHA256 d17762f6924a926ef6190e05a7606fcd7da451ddc8905acb112e06bfc667f309
MD5 77e2989ee0fe491098d94f9932a86bea
SHA1 d804636ec06d0f1dcfdd9e3ac58aed5f8be93088
SHA512 a9de1385d14ebaf5c74e1f250af7ebddcfd310cc109fa2151e33bd71099ed1f98c0af60ab37c55d4ca6c6e51f2bfe4009ca7487f826b4b0acb47595857392113
SSDEEP 3072:MJ4L2ELbFPNg21VEdjTA34nnGfSotAY+I72lmj5NaAL:32mNgCVEdPEqnG8u5NhL
TLSH
T1D0D39D01B5C0C432D8BE19380874EB764F3E7970DFA09DDB639456AA9F742C09F36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRChatSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRChatSOS.exe
Size 2.7MB
SHA256 2a574598472970cc34b5a7edd94253e1b9325d77dc964f9efcf393999c988ea5
MD5 23b0f3ef8efc8b173aa0603d74eed67a
SHA1 8bb0cb87e87dd8dfd794fea8a67c652e673ac46e
SHA512 53f00cb92194e5787ed756dc2ceaddfb9f5a5deab5e72a141404a01c86fac8f32b33968a3320d7dcf69a80fd85a817efed757eeec38d1b90d47fb8fb5590a086
SSDEEP 49152:sQiYzbdV0Z/Fk0vk/tqiYeBeVirU61Bo95EComtnbOFTfW2NLZv:sQiYzbSd2/giYmeVirUky95ECocbOFTN
TLSH
T1C6D55B23F7605362C3A206306D1AF736E3ACE760062F4097D3F4FA1A69756D2471AD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRClient.pem

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRClient.pem
Size 5KB
SHA256 33fe8889070b91c3c2e234db8494fcc174ecc69cfff3d0bc4f6a59b39c500484
MD5 a8b2b3d6c831f120ce624cff48156558
SHA1 202db3bd86f48c2a8779d079716b8cc5363edece
SHA512 3b1fc8910b462ea2e3080418428795ca63075163e1e42a7136fa688aa2e130f5d3088ab27d18395c8c0a4d76bdc5ed95356255b8c29d49116e4743d269c97bf9
SSDEEP 96:LrdBs5tNThpCwTWYOHS2zkoGwhav1x6s7xPe47Oq1JmIyztq43ZEDRS4bcrkpk7:Hg5tNTDCdRoothav1xd7Be6Ositq43yY
TLSH
T13FB17E71BDA4CDFC2442F029999EB306C1B38A69916B8788DCF57841D3245CE3ABC4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRFeatureSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe
Size 4.7MB
SHA256 ad00e66348c8fcfa656f6e6ff6943a275756d9aa782aa0af6525a789f4ef3b90
MD5 e579396bf6d86d7d1ba3eaf84c82d17c
SHA1 dec1eb8fde5c4570a619cfcb36aec1050b1e2a3b
SHA512 3ba5f70691d2af5103779a7e72ebba7ad6834156404550b9c2dec4fa3057776a6960b70e3a547eb0f3501f0d6bc9dbd1025a2a291b5d24d1e83a445abc1bd279
SSDEEP 98304:la/1ELSn5TMsIVI/oB1wRMz6e3uIXI9cb11PWn/h11IIIq4Lo0Fgu3F3ROUTXlrV:Y/1ELSn5TMsIVI/oB1wRMz6e3uIXI9cT
TLSH
T13E368D62E5FB00E1D4621870A155B6AF79389F168F08C1A7FAC4FF99D830B81DDA9353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRFeatureSOSNoUIA.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOSNoUIA.exe
Size 4.6MB
SHA256 271730aef580f169615d0b1ddccd83e7ec8e5a23976f237f9df4bb1e519af423
MD5 43c5ed14eb071b214359d43c644d779d
SHA1 c64b9f65721dea8f7e589b6434fdc384cf6a4f51
SHA512 077413c4245b457ae4f80eeb9ef7503c25ea94e703d606699e3c6945f3a432e3f8ef53bee5252e532385cdc00cc0a5fb4b67d7eb0484babc149c63b0d80d00a1
SSDEEP 98304:jQPVkbCHdMJxIUIuLRVQh8zyuHlIWIUhwtl8lZMxFFIYI6XgXZWwenrHheUTX38c:MPVkbCHdMJxIUIuLRVQh8zyuHlIWIUhu
TLSH
T124269E62E5FB40E5D0A20870615176AB7A38DF124F08C1A7FAC5FF99E834B81DDA9353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRManagerSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe
Size 2.0MB
SHA256 73ef0d89b04262d64a2f509d5877a627494e03fb25ccc3209a0f9f00e08c2d7c
MD5 abd8f6654d0bd20dd81efcbb4e7eda1e
SHA1 167e7534459028c493e0432f7d9acb577fec4d7a
SHA512 554768d43c4703249905bf831b51487ab633ed6dc27f606c80986740db4ffbf6d978aca4c3dc17c80adc85d9299b1584aa106e6095490eacf1f3192f50ded02a
SSDEEP 49152:pstgRbMLpysTeZMuvRIl2dWzVej0Ixfs4U7hTsrJ5s1E:pstb1ybMuv30hej6Fg
TLSH
T189958D33BB85806BF5624230A11D932D8969B5722F7594CBB3C05B5E69E06C2F63DF23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRServerSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exe
Size 5.2MB
SHA256 290ded9f8851808cc1210294fc3b773202f793695ab682b16cad784cccbd0694
MD5 ff4837573b374a6d7d85f266eb42fa10
SHA1 c05e1b7d233b4a8e64fbed1dc7bea147e9135a06
SHA512 9bfb15d65006d20025139287a4134d041bc46a1df20c79ba10ee399fcb6ddb7219c1dbd5b001ce65825c51942a361f114b31b05f494a581be0d49435cae4e21b
SSDEEP 98304:2NlGka63bXW1WMlbVaPgNpZ6bLam9yfdI350SfyCLcXh7WsYHvwKa0DafK2:2eka4OlBZZaOm9yfdq3qlPkvwKa0GS2
TLSH
T17A466C01B7846466D1631E31796CF276E3BDBF241B7D818B53A07E1C29702C3972EE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRSocketCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRSocketCtrl.dll
Size 527KB
SHA256 6fc25bf2fdb71e79468e7e705515267c27b0377e4f8fb6c38aa689f3a711c870
MD5 347356a3caf2fd1c891bb97c94a13462
SHA1 414995d428bfd87a2133c3a8b3515785ec9d46e7
SHA512 643dde4281558514d7897e46f3514e70f9e01eccf1d8e7e12b06789178d06908d478231154e111457534e447735a75ab5d35162d53ca8eb4e6aaef18f708208b
SSDEEP 12288:B6xtyLJ38LvuWgD3puenR5sVUb2Xk0cnlHQ1SoU1:B6xILuLvuWgDZuexaXuoK
TLSH
T1AAB49D21B141C132E68E42F05DFADFA9A66D6D301BB468C7B7C42E7E58704C26B35B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRUtilitySOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exe
Size 172KB
SHA256 060e5af5161fa20b99ad633e8fa476766356077bf89d8b65828b4afb82706b34
MD5 c39d86e972251a361c0d4a6688669d7d
SHA1 1b00f94278fbc2600db21eaff38c72c4b5704b14
SHA512 0be5f9766d654c1c0651b14934da8a20756f13eacefd9ab366ff2cb542c7fea6e1ba59a84af025c5f35d9271f25f75ddbdfca8301db6e1630f31a722f357106b
SSDEEP 3072:NkOQQVQLBnQ+TGW2K3jINYxl2OldQdL92a/R3G+zszDMrmwFQ0s4ZpPKzoYZ694:mEVQLBnQ+Ty+DlAL92a/R3GkqML12c32
TLSH
T18F047C21B8D1C433D66A0D3058E4CA75DA7DB8B14FA099DB6B840FFA4E346D0DB39627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-60.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\avutil-60.dll
Size 521KB
SHA256 611c5a353f80cc3a78cea637a159b099995e788e44c9c4e0356da71c65660f85
MD5 3e12776e2a5b6e99e6e678fba4a08835
SHA1 5e0c5aff3b2671724833039a1576d481741e208a
SHA512 e9b6fc7c46e745b865b636c3aa25dc69ed56d7cbfdcbb6b76407c84e31b1a2fcb510bb56646b8db53b7ef2523b25f67e755b8c2c2fe65b27449365f1fb26f4c5
SSDEEP 12288:YmaywGrAYNIHADWqp2HV2mWp8FHUp1Aoz8zlmN7j1pP1OY:Ympw0CUcomWwyPP1pV
TLSH
T143B423ED49C4C826DF682CBC7CADA6269751674BEDE07880D77CD6987C325C2B607A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAgent.sqlite3

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\db\SRAgent.sqlite3
Size 216KB
SHA256 a2ea5753716427ce8c6ebf4df022826f09b99367562ae815c710b35d2f64942a
MD5 87c9a43b1bb2b2c757369d197c06717c
SHA1 1573ec630cafc4617c2d713b33c9ec3b3f27fc98
SHA512 1820770a9ec5d07f33244fd27354080b57ff36b44a3d6e4a7b391094fcaaadd5f33faa3cefc42ddd9c6e9374a7d233ba020a74cc4c0abf74fffbf499390a6e4d
SSDEEP 6144:e9mB17PvKwXuIxGZBZ/ma5phxdpwPsmY7uYfEDeyaC:e9m7Pvd+3/xtZBr6qiaC
TLSH
T10B2423C3466B7C7D234A512C53DA6649C3AA11E02AB074BC7476F85CEEB3BCB15A36C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAgent.sqlite3

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\db\SRAgent.sqlite3
Size 216KB
SHA256 22e0045514e9aed85e62d6da7a06ae34f1f160d852ee1d5855f637907372963b
MD5 acc357fffcc84eb95e547ccfea1e01cc
SHA1 3ccd257027ba01db58af2eb87294d2eca44b7b73
SHA512 862ce3b447391cf86de4e44699fd6b7032efacd5171dd859e4e112bc36f2907b9399749797f7c28ff06c7c891c2480f0bb75af36cd280972f1efebb79d4221fd
SSDEEP 6144:DzqB17PvKwXuIxGZBZ/mae0QNkkxByYfEDey4D:Dzq7Pvd+3/xe0OyqiO
TLSH
T1522423F605EA9C6A1787424863D59300CF4B31E44B30A0A9FC6EF4DD6273AEBD5967C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\dbghelp.dll
Size 1.0MB
SHA256 4b890de3708716d81c1c719b498734339d417e8ffc4955d81483d1ebc0f84697
MD5 eeda10135ede6edb5c85df3bd878e557
SHA1 8a1059dfd641269945e7a2710b684881bb63e8d2
SHA512 a56bfc73537e36efba8e09ffd0b2f6bfc56bc4cb4fe90b52858c7afd5d67db23ccba51c8097befe4ecb5082ba66c2b2612e2975ef3448252c48b97f41d12d591
SSDEEP 24576:n7PeeMxAg8KA6EhyC/H488sCGF8MBo9Bi8sROlu4VWKl6sEPdf8/2RYv:cxNEhyC/H488sLqMDIlu4Nl6suK2Re
TLSH
T159354A20D641C279DCEA30F5526D713926ACEAF2031161C723C85FF9DB762E46E3869B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fips.cnf

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\fips.cnf
Size 860B
SHA256 45569313e0586604fecd3dcdac23f75b01796b8277e150d2bbcf74ce8e85e3f0
MD5 1809897b02536d516b39543131a7208d
SHA1 40c5539fc882a44b04e0159d8c6256011c4eb906
SHA512 5ab432d1d8b1d2bad99929ecec4d564d52982de03ce28748498423e10b775ebbbf6685bedb2f68e529a1e53a5e987d8dec3d401ec36b6d173de4c803c486f0a7
TLSH
T11F11D288242498F5698CE7B58711B5D2FEE060060FA11FF5F2F136AE1D17C55C993623
MD5 SHA1 SHA512 TLSH

Submit Download

fips.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\fips.dll
Size 796KB
SHA256 d28f105feab691bde1f05ba4f4d91602d52528ed629f1ceb00c19f9801592f84
MD5 dba784709cbe597242a76047bfcf10d0
SHA1 17614b22f0f8aa4fc466afdfa23b7a8add3f3095
SHA512 4e7dbb4aa1acde01d6e3d9e21a4f9f6feddee4f2f04dd4fe773d4afe22078e535c187ccfba34dba36dc790bf9804e24def189ee08d870d4a117fb39995ad8cb4
SSDEEP 24576:7mAz3q/ePChRkPDMpW/ufcX2QMFtQveOe:7mUq2PmaPyfc3MFtQv5e
TLSH
T18605330340406DF9FD437DB8A1809420AED9B8F6CD9D7196929ADD82CD7D69BED20BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

legacy.cnf

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\legacy.cnf
Size 168B
SHA256 9acde3809e2c02fe5d6c59153aefffe6628996ec5cfb7c2385865dcd1ec8be7e
MD5 a43b7d72b482d48804b377d8832c2693
SHA1 b1598efda8e9863f520abef9aaa942c313c002fd
SHA512 f0777a8f79e70f8a12f531c3e77f5241e9ed46acc6a1cbf06ff7a29d91ee281e4cd2a9c1832642992fe74d33b052670f85439e5925fdb7c44de60014e53712da
TLSH
T100C01274CD1BD5C94841A523BDF45CA3DD84055688048891EAC3C0A45712814987858F
MD5 SHA1 SHA512 TLSH

Submit Download

legacy.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\legacy.dll
Size 170KB
SHA256 5881cefef0bfb4afee790e4676d40eb39e4001e9f68b13a063fc5773d7e208e8
MD5 f3ecd5ff7ffe50d85e2174c516f11c09
SHA1 47f448414715318d203a92373e4b0716c1558552
SHA512 d5f2c9e72829bc266c21e2dbee130308432156d18081e5a89c1b8557adee5472111f1e15bb18760d1606f71f0d15829da19d3db63bdce9e46c3207404309a503
SSDEEP 3072:RVU1YwV2/Y6rufJ9eAl6uGsWmH6/k0VjL3k/BEWUueX6wTxOIlcX1dd7ktYJRLGt:RDY60JEAl6uGsZofVX06WSKwVVc1kt+Y
TLSH
T1F104122789980C15CC629BFFE9D8CE13BD6AF9A62961C1CF0355C2B0567CF413E96127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcelt-0.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcelt-0.dll
Size 104KB
SHA256 b644f5d3b3a627e52000191a34f825eb5753b276efb5ffe4d5af17923adb896e
MD5 84f9aa20b31f18cbd86362cd4d731250
SHA1 a5ad2724ccaf985ea3e054be155bd5e08e0ad38f
SHA512 a87ee7374395d3448dfc3c654f86b89a8b4cfde3164da4db71f400705d3a2fc6b5df3b3c14c72d4b16ef2f5a5a0442b7da0e897196e3baa5e34b27862d6fac20
SSDEEP 3072:fdvQnJ9Cy5G4XmkRCXZ5YPPAq4SjIZUKzFrRjbuPp9nI:fdvby0lZ5YPPAq4SjIZUKLjbuPTI
TLSH
T17DA34C57658384BAE253237345929AA72138A79D02F13FCF9EAC0D28DB337D0AD94357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcrypto-3.dll
Size 1.7MB
SHA256 c6eb36a9f09d5c8eaf42c851306ffb886dbfc330c2b9c8eef4bf9697689428dd
MD5 7d8d92aa35af9ef3d4c47d0fa96cff44
SHA1 2461a97db2b8b1d1c1b3634e43d5c007fc475f27
SHA512 b30d0f780a02d8e08f5fe79cec0ebb57d68cb3eb212166dc05b57f55eab06780a9b007ddcb92fbdb5084d7d44821a318e423991fa4a134dd92f8527fa6f54d29
SSDEEP 49152:Fpt/2ETAMFyVXItDXRd2/A4wcX4gLSQWpKnQCo1CPwDvt3uFA0Ci:Fp92MCXUDX6/A494gOBAnQCo1CPwDvtq
TLSH
T1B785121424BFB84BF685A4789F31CC37891D5771A308DEB32DBEC9540838E1E4AB56DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcurl.dll
Size 739KB
SHA256 9763d48c561485b6b3d28f911f6368f9930ece3ef8193b5ff4bb5f1ca630fc2d
MD5 cbfeba8e36f0fcfc281e22f05f5a26fd
SHA1 879e8b84dd8374693ea14d5953e0ff0214ef22a2
SHA512 d29286c7d0405b3f52ae38628a61078dd4bc0c94b0ad31cdf0f4c0ea5bb05b0265f6c7d64b80f32720bc16e02977f612857a92b5a55c5d1c47a785a8a9ee41d8
SSDEEP 12288:cu+ufTywKpKg7CHQO+0ADhKkVCuXK4mYk1t8BPX7tvMrCcKUxkVcjq4NnyRFFKi1:cu+uf3H/bjkz64mYkv8BPX7tvvcKPVTx
TLSH
T182F48D11FD40C0A2E5E90031A2B88FB34D7D50B4277994D3E794E9A8AA705E3BB3D75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libssl-3.dll
Size 489KB
SHA256 bdbfdc55885736fe9657d5a2834550f8ff28141350e05279716ea321805dda39
MD5 2e4f3c838bb1537448a1e70c93b5973c
SHA1 c34ef47818d23e0cf427d92bdaddff5a1b3a572e
SHA512 692e4dd775ad12b1abd330ca46a4cfa5c71576bb52ae614204e739229e31a238446e1ff8efd92ef2f98b1b9c7b808c7e6b953128ddced309615ac6da9106e4ee
SSDEEP 6144:A4nGxYL3y1hnbYNUEq/ktZ3IRUYpjoFvETNxjzZBOEAQdyM57Ev38+lTXQjReMoG:nGii1hvEq/iaRdpjMvsjLRd8E+l8jhl
TLSH
T15AB41341B96F1A23E893EEF4F7B821FAC67E77051706EE89B527DA9007B050D9B5C009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libx264-116.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libx264-116.dll
Size 1.0MB
SHA256 f28539f93e463b3c14db5122eeee5a6871fbf1b610466562d0c7d6c03d114715
MD5 e045009b2c79b848721c096482bada90
SHA1 5a93c9da2f57508c5817a8ab84d7f98cbcb2d427
SHA512 2261703ac276ed4c48987b60e1e9058f877bf6b7ae4bf32efc4fa1dd31d4fe0940c75d911cf0d81269202de058d02b5ae1bc4dc968b0d101c98f6d37f2820f07
SSDEEP 24576:A99IeBE76bZaCUrF0XbuqIpInZVrUCzfk44di:A9S+EAZeY/Ufo
TLSH
T16C356BC0EADB55F0E86B0D70901AF33F6634260CE62CCD61EFD4AF42EAB6B52451A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p_mount.bat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\p_mount.bat
Size 214B
SHA256 b085f4e0d6a7a4dc967c96d7c318cb749bc497135fd9e35d7ad0c88e6c53f577
MD5 88e59700f53de95d2847b9687764be30
SHA1 cd5780dbf1c711b9c28dc001f4149ba3251becf7
SHA512 6e7d2fd4cf87b63bab39e225362ecbe60f52fab0da42c97834b8ea59d653cdbd06b98e2c490c5465b1999af2f7869f729cbfc34e55d5ecc768d85d48b9874374
TLSH
T1D2D092E340127E1252B98593C285035A006F25A28AFE3221A60284CC28CF571C11A3DD
MD5 SHA1 SHA512 TLSH

Submit Download

p_unmount.bat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\p_unmount.bat
Size 203B
SHA256 347b12e6e2fc79e2a3668625341d7642d531159ffe5b01ab2bc5469e0efc6b3f
MD5 fa3c191799254e542687f1f5d0974bc5
SHA1 dc85aac2aa31cd3de9017e7e099581457ad4fbf2
SHA512 635689814e63084910541ba68fe8ade8fdfbc3d0100afd61ddd13d07e61f3478ba75e4d24aa7b26df21a3e46c4ed2b1c8789520c5634cac63cfe32dcb1e8686e
TLSH
T1E5D013754141F54460A94A56C15803CED01F74D647FF3062F511D4CC3F49150830A2DB
MD5 SHA1 SHA512 TLSH

Submit Download

reboot.bat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\reboot.bat
Size 3KB
SHA256 eb700422c31c15757a6c70141274a184d291aac3bde191a964f75a90bc084143
MD5 abe8e3568b6d951e7dd395da46531932
SHA1 304d81c1b48e16533ef691a9c965818136b9583c
SHA512 19a79d90883103302bddbac8a765c6a5196fb78c223d911633285b4ba44ebffa9c64690102498e3bef5991dba0f28847473a44d4f9aa7d637a4c4d3f1efea12e
TLSH
T1BC6112EEA8719D2D74D016912E08E461EFE2FF0365E6026FB87C354C973B12278BA1D5
MD5 SHA1 SHA512 TLSH

Submit Download

stprinter.cat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\stprinter.cat
Size 17KB
SHA256 eb61a0e06bf8c69597f9bb1909e3eb4f926e49800c3f9721fda3007993da5ee7
MD5 2dac6568b843ebdc5c98598ca32918be
SHA1 e7740e4be7f71a82adbb6e5224d33534e237614c
SHA512 1bc8aa82e68911f5ee1835d19cf49a736c1c35c2f6b4fcd48c3c6fcf7ff6958400d1e815c5e891e172af9035232175bb00e8a21f5a0590f02dc683f45a6c3d8b
SSDEEP 192:fNDJbjaXGStblM2wk0mev6/9IDRfupdYpJIBbIgx+4lMrp2/CsECw8nYe+PjPVhc:n3dw75xa1Sw8nYPLVhtOUez
TLSH
T1D382636E15AD02A3A19BC4B25BCAE47FF8359E6BF4444ABE30DB27600AC1741774DC2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stprinterx.cat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\stprinterx.cat
Size 19KB
SHA256 84e1a32b4975e92477cf6a36d8931921da735ef988e0c09a2b056f2904541b1e
MD5 1d56a3f8d7f5dab184a8cc4feddaa173
SHA1 75d291cb96fdc05d54c962f1cb08796ee439b22f
SHA512 fb58167a98d9309a703f06d5c6414ab707b37e90a26bfc1c0812b10381c116fa6c7c26ac30fc8570b8f87186775bc64e7af6d409a7d213fc3b4b76b0b7a76fb6
SSDEEP 192:UelM68cpgw3otOCxH50u4RkeelMpSfpd/CJHJ2elMSJfApwtNJKGT1hvJNMvIqvQ:EWtO5smIwg9Zh3q8pUclGNbc
TLSH
T1DA9251B2355E07C6E09368F41685F52F987E6B4F841052BD75AF73384CA1B84F72AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

streamer1.cab

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\streamer1.cab
Size 18.7MB
SHA256 854f41ded9e937717734e628116205986a98bc7e0247101dfa41c2823051f5e3
MD5 4902d5afa27c20cd50aa63c467a6967f
SHA1 ed2f9c22e0367ac974817427aeb9ba047e827b51
SHA512 095caa99d11b1327b9cdc407ce41ffbbdf972c7b670667334063ba8adaa0eb085efb2aecf0a347817d77a79f5dea6003e2fd3db2ce173732426ee2e8f14dd964
SSDEEP 393216:gs8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n3x:gscRgq72d46Jw724Sz4uMvp
TLSH
T13D1733EECFA9F514E6ACD576F22442247B327D4CB0ED6AA6930734601A6D3C88B413D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swresample-6.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\swresample-6.dll
Size 191KB
SHA256 999674324c39f1c9ed41ced9c6a67fef7703dfb1431bdf2096f4e362ad7e3f83
MD5 8f06226092b464cc46611d6d030e9164
SHA1 6e28695a5c3db9eee1211a40ea499c5297b496b2
SHA512 c735f08fb862c03730bc0b9d9f4676330104c5a14f2bde5402d38ecec1702042b2cbce4a04dc9fef4b7aff48aee2c3ced21236b777c6e56cd1e087e14d542fa5
SSDEEP 3072:xXmVrS0YSIq0+eLPu0WG1GQq+4QYKSyIQ7Ox/YQ0Vji1sJpEv9rAynM0MILUDb4V:x4SWIB+WvWG1p4QKNAjimEv9rAsMYgRM
TLSH
T1EC14132297249C31FEF3413436479527343AB8E841C1EACB326695BD83B43477E92E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd2_request_1b43fb76179db00.bat

Path C:\Windows\Temp\bd2_request_1b43fb76179db00.bat
Size 160B
SHA256 b9c44a7c6d3f910709b2849331034caa8d5b5abf1a4b89365e57a8aec57871b5
MD5 a16208e242b940f86d01fb2d256b2de9
SHA1 c155a66def8ee084e2bcf70c671251fda5ef79f2
SHA512 695a89e30a839df4b296f5b178b9ca53cfaf466a3980bea12aeeefcc11d6e8a9182e109414daf69173df1b6f4e6ae536e2b379c75c25e8aed5702a7c6ba7cda5
TLSH
T100C08CE601E2A7A5220021825FA7E20881B2BD18BF9A09310B24571AB18490ED19374E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4536-216-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download

memory/4536-677-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download

memory/4536-678-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/4536-218-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/4536-284-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download

memory/4536-300-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/4536-299-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download

memory/4536-289-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/5424-320-0x0000000071700000-0x00000000719E4000-memory.dmp

Download

memory/5424-262-0x0000000070F30000-0x0000000070FDD000-memory.dmp

Download

memory/5424-259-0x0000000071700000-0x00000000719E4000-memory.dmp

Download

memory/5424-691-0x0000000071700000-0x00000000719E4000-memory.dmp

Download

memory/5424-422-0x0000000071700000-0x00000000719E4000-memory.dmp

Download

memory/5424-423-0x0000000070F30000-0x0000000070FDD000-memory.dmp

Download

memory/5424-325-0x0000000070F30000-0x0000000070FDD000-memory.dmp

Download

memory/5424-692-0x0000000070F30000-0x0000000070FDD000-memory.dmp

Download

memory/5848-237-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/5848-308-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download

memory/5848-685-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download

memory/5848-686-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/5848-309-0x00000000725C0000-0x0000000072AEE000-memory.dmp

Download

memory/5848-235-0x0000000072AF0000-0x0000000072C89000-memory.dmp

Download