svcstealer | 49ea0db8aed7cac06277dedc0ad5f8b43ec393024e2ccb89d02987dbf934f9dc

Analysis

max time kernel
20s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe
Size 41.7MB
Sample260731-dfdrfaseka
SHA256 49ea0db8aed7cac06277dedc0ad5f8b43ec393024e2ccb89d02987dbf934f9dc
MD5 72704cba8c4e0c33bfe1c2b29416e9ba
SHA1 31494b1144d490265f93c3854739fe14ef4ed228
SHA512 46e8f05608cdf3e935c806416c4f00936669b5601656ee21392c37e7325af1b64b7a8f754bbedd732feadff0c9f081d0743f52a31ee2489d559021cbbbed8509
SSDEEP 786432:ZcGiH3ZIMs55DZXe2J89wJGSMs55DZXe2eAtvV+rWOAPUv:ZcGiXZbs55Y2JGps55Y2eSwfAcv
TLSH
T169A73309167C915AE8716B764CBC12C21E74FCE1C5D2969E89CF040CECBB56ADE329F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader execution svcstealer installer persistence pyinstaller spyware stealer trojan upx

Malware Config

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 4 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp	family_svcstealer
behavioral2/files/0x000d00000001c52e-20.dat	family_svcstealer
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	family_svcstealer
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	family_svcstealer

Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/files/0x000d00000001c52e-20.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/4396-22-0x00000258F3520000-0x00000258F3522000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs

resource	yara_rule
behavioral2/memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x000d00000001c52e-20.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral2/memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/files/0x000d00000001c52e-20.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many IR and analysis tools 4 IoCs

resource	yara_rule
behavioral2/memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c52e-20.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 4 IoCs

resource	yara_rule
behavioral2/memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/files/0x000d00000001c52e-20.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c67b-741.dat	UPX
behavioral2/memory/5720-743-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	UPX
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	UPX
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	UPX

Downloads MZ/PE file 3 IoCs

flow	pid	Process
19	3564	gu80pc5b.exe
14	3564	gu80pc5b.exe
14	3564	gu80pc5b.exe

Executes dropped EXE 25 IoCs

pid	Process
5328	nl4k294g.exe
2480	wwjr0ios.exe
2764	2jele6do.exe
4880	wlrmdr.exe
428	j88iqa9d.exe
1072	gkqkaz8a.exe
5384	j88iqa9d.tmp
2536	lrskrq0f.exe
992	nvtelemetryxhf.exe
2616	exm0fle0.exe
3564	gu80pc5b.exe
3324	cdbcededbaccfc.exe
5724	combo-toolkit.exe
1668	lrskrq0f.tmp
3356	exm0fle0.exe
4456	gu80pc5b.exe
2240	gkqkaz8a.exe
5924	svchost.exe
5884	taskhost.exe
3592	spoolsv.exe
4556	winlogon.exe
6064	lsass.exe
1092	taskhost.tmp
2328	lsass.exe
6012	spoolsv.exe

Loads dropped DLL 11 IoCs

pid	Process
1668	lrskrq0f.tmp
2328	lsass.exe
1092	taskhost.tmp
2328	lsass.exe
2328	lsass.exe
2328	lsass.exe
2328	lsass.exe
2328	lsass.exe
2328	lsass.exe
5384	j88iqa9d.tmp
5384	j88iqa9d.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdbcededbaccfc = "\"C:\\ProgramData\\cdbcededbaccfc.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exm0fle0.exe"	exm0fle0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gu80pc5b.exe"	gu80pc5b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exm0fle0.exe"	exm0fle0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\nvtelemetryxhf.exe"	2jele6do.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdbcededbaccfc = "\"C:\\ProgramData\\cdbcededbaccfc.exe\""	gkqkaz8a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdbcededbaccfc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\gkqkaz8a.exe\""	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	combo-toolkit.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 4268	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	89
PID 2616 set thread context of 4396	2616	exm0fle0.exe	60
PID 3356 set thread context of 4396	3356	exm0fle0.exe	60
PID 3592 set thread context of 4396	3592	spoolsv.exe	60
PID 6012 set thread context of 4396	6012	spoolsv.exe	60

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c67b-741.dat	upx
behavioral2/memory/5720-743-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	upx
behavioral2/memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	upx
behavioral2/memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c623-365.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j88iqa9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j88iqa9d.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lrskrq0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lrskrq0f.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.tmp

Inno Setup is an open-source installation builder for Windows applications. 10 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c534-57.dat	innosetup
behavioral2/memory/428-64-0x00000000009C0000-0x0000000000AAC000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c538-87.dat	innosetup
behavioral2/memory/2536-98-0x0000000000540000-0x0000000000646000-memory.dmp	innosetup
behavioral2/memory/5884-319-0x00000000006B0000-0x00000000007B6000-memory.dmp	innosetup
behavioral2/memory/428-324-0x00000000009C0000-0x0000000000AAC000-memory.dmp	innosetup
behavioral2/memory/2536-358-0x0000000000540000-0x0000000000646000-memory.dmp	innosetup
behavioral2/memory/5884-444-0x00000000006B0000-0x00000000007B6000-memory.dmp	innosetup
behavioral2/memory/2848-471-0x0000000000160000-0x0000000000266000-memory.dmp	innosetup
behavioral2/memory/2848-512-0x0000000000160000-0x0000000000266000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5328	nl4k294g.exe
5328	nl4k294g.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe
2480	wwjr0ios.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4984	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
616	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe
Token: SeShutdownPrivilege	4984	explorer.exe
Token: SeCreatePagefilePrivilege	4984	explorer.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4268	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4104 wrote to memory of 4268	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4104 wrote to memory of 5328	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	90
PID 5328 wrote to memory of 4396	5328	nl4k294g.exe	60
PID 5328 wrote to memory of 4448	5328	nl4k294g.exe	61
PID 5328 wrote to memory of 4108	5328	nl4k294g.exe	65
PID 5328 wrote to memory of 4820	5328	nl4k294g.exe	79
PID 5328 wrote to memory of 4984	5328	nl4k294g.exe	80
PID 5328 wrote to memory of 5052	5328	nl4k294g.exe	83
PID 4104 wrote to memory of 2480	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	91
PID 4104 wrote to memory of 2764	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	92
PID 4984 wrote to memory of 4956	4984	explorer.exe
PID 4104 wrote to memory of 428	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	96
PID 4104 wrote to memory of 1072	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	97
PID 4984 wrote to memory of 5580	4984	explorer.exe
PID 2480 wrote to memory of 5928	2480	wwjr0ios.exe	98
PID 2480 wrote to memory of 5928	2480	wwjr0ios.exe	98
PID 1072 wrote to memory of 4984	1072	gkqkaz8a.exe	80
PID 428 wrote to memory of 5384	428	j88iqa9d.exe	100
PID 4104 wrote to memory of 2536	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	103
PID 4984 wrote to memory of 1500	4984	explorer.exe
PID 4104 wrote to memory of 2616	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	106
PID 2616 wrote to memory of 4396	2616	exm0fle0.exe	60
PID 4104 wrote to memory of 3564	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	107
PID 2480 wrote to memory of 3592	2480	wwjr0ios.exe	138
PID 2480 wrote to memory of 3592	2480	wwjr0ios.exe	138
PID 4104 wrote to memory of 5724	4104	2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe	110
PID 5724 wrote to memory of 616	5724	combo-toolkit.exe	111
PID 616 wrote to memory of 4124	616	msedgewebview2.exe	112
PID 4984 wrote to memory of 4432	4984	explorer.exe
PID 4984 wrote to memory of 2664	4984	explorer.exe
PID 4984 wrote to memory of 1060	4984	explorer.exe
PID 616 wrote to memory of 5404	616	msedgewebview2.exe	116
PID 616 wrote to memory of 5404	616	msedgewebview2.exe	116
PID 616 wrote to memory of 5404	616	msedgewebview2.exe	116
PID 616 wrote to memory of 5404	616	msedgewebview2.exe	116
PID 616 wrote to memory of 3056	616	msedgewebview2.exe	117
PID 616 wrote to memory of 4616	616	msedgewebview2.exe	118
PID 616 wrote to memory of 4616	616	msedgewebview2.exe	118
PID 616 wrote to memory of 4616	616	msedgewebview2.exe	118
PID 616 wrote to memory of 1548	616	msedgewebview2.exe	120
PID 616 wrote to memory of 1548	616	msedgewebview2.exe	120
PID 616 wrote to memory of 1548	616	msedgewebview2.exe	120
PID 616 wrote to memory of 1548	616	msedgewebview2.exe	120
PID 616 wrote to memory of 1548	616	msedgewebview2.exe	120
PID 2536 wrote to memory of 1668	2536	lrskrq0f.exe	121
PID 3356 wrote to memory of 4396	3356	exm0fle0.exe	60
PID 3564 wrote to memory of 5924	3564	gu80pc5b.exe	125
PID 3564 wrote to memory of 5884	3564	gu80pc5b.exe	126
PID 3564 wrote to memory of 3592	3564	gu80pc5b.exe	138
PID 3592 wrote to memory of 4396	3592	spoolsv.exe	60
PID 3564 wrote to memory of 4556	3564	gu80pc5b.exe	128
PID 3564 wrote to memory of 6064	3564	gu80pc5b.exe	129
PID 4984 wrote to memory of 760	4984	explorer.exe
PID 5884 wrote to memory of 1092	5884	taskhost.exe	131
PID 6064 wrote to memory of 2328	6064	lsass.exe	132
PID 6012 wrote to memory of 4396	6012	spoolsv.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000260;000000000000026C;
1⤵
PID:4108

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4820
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_72704cba8c4e0c33bfe1c2b29416e9ba_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\system32\notepad.exe
      C:\Windows\system32\notepad.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\nl4k294g.exe
      "C:\Users\Admin\AppData\Local\Temp\nl4k294g.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\4l5dujux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4l5dujux.exe"
        5⤵
        
        PID:5720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        6⤵
        
        PID:3788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        6⤵
        
        PID:3112
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        6⤵
        Executes a command shell one-liner
        
        PID:3260
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        7⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\wwjr0ios.exe
      "C:\Users\Admin\AppData\Local\Temp\wwjr0ios.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\2jele6do.exe
      "C:\Users\Admin\AppData\Local\Temp\2jele6do.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\j88iqa9d.exe
      "C:\Users\Admin\AppData\Local\Temp\j88iqa9d.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\is-ADO8MDYW1C.tmp\j88iqa9d.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ADO8MDYW1C.tmp\j88iqa9d.tmp" /SL5="$901C8,2775941,905728,C:\Users\Admin\AppData\Local\Temp\j88iqa9d.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\gkqkaz8a.exe
      "C:\Users\Admin\AppData\Local\Temp\gkqkaz8a.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\lrskrq0f.exe
      "C:\Users\Admin\AppData\Local\Temp\lrskrq0f.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\is-E2BFISKQGF.tmp\lrskrq0f.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-E2BFISKQGF.tmp\lrskrq0f.tmp" /SL5="$6024A,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\lrskrq0f.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\exm0fle0.exe
      "C:\Users\Admin\AppData\Local\Temp\exm0fle0.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\gu80pc5b.exe
      "C:\Users\Admin\AppData\Local\Temp\gu80pc5b.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
        5⤵
        Executes dropped EXE
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\is-ZJAR74N8FA.tmp\taskhost.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ZJAR74N8FA.tmp\taskhost.tmp" /SL5="$A0056,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\winlogon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\winlogon.exe"
        5⤵
        Executes dropped EXE
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\lsass.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\lsass.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\combo-toolkit.exe
      "C:\Users\Admin\AppData\Local\Temp\combo-toolkit.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of WriteProcessMemory
      PID:5724
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5724.1256.827682387739429203 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:616
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView /prefetch:4 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd7ecc5fd8,0x7ffd7ecc5fe4,0x7ffd7ecc5ff0
        6⤵
        
        PID:4124
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        6⤵
        
        PID:5404
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        6⤵
        
        PID:3056
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2464 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        6⤵
        
        PID:4616
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72 /prefetch:1
        6⤵
        
        PID:1548
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        6⤵
        
        PID:5224
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4512 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        6⤵
        
        PID:984
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView" --webview-exe-name=combo-toolkit.exe --webview-exe-version=3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1760,i,3384143127486756848,4855132430948028869,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:45b39f9adc9188cc1e7f6a0428abc45335a6dd72
        6⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\is-ARAO4WTNPG.tmp\svchlp2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ARAO4WTNPG.tmp\svchlp2.tmp" /SL5="$C0212,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\svchlp2.exe"
        6⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
        6⤵
        
        PID:4340
- - C:\Users\Admin\AppData\Local\Temp\4B91.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\4B91.tmp.exe
    3⤵
    PID:704

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5052

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4008

C:\Users\Admin\AppData\Roaming\nvtelemetryxhf.exe
C:\Users\Admin\AppData\Roaming\nvtelemetryxhf.exe
1⤵
- Executes dropped EXE
PID:992

C:\ProgramData\cdbcededbaccfc.exe
"C:\ProgramData\cdbcededbaccfc.exe"
1⤵
- Executes dropped EXE
PID:3324

C:\Users\Admin\AppData\Local\Temp\exm0fle0.exe
C:\Users\Admin\AppData\Local\Temp\exm0fle0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3356

C:\Users\Admin\AppData\Local\Temp\gu80pc5b.exe
C:\Users\Admin\AppData\Local\Temp\gu80pc5b.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Users\Admin\AppData\Local\Temp\gkqkaz8a.exe
"C:\Users\Admin\AppData\Local\Temp\gkqkaz8a.exe"
1⤵
- Executes dropped EXE
PID:2240

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6012

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3592

C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
1⤵
PID:3168

C:\Users\Admin\AppData\Local\Temp\4B91.tmp.exe
C:\Users\Admin\AppData\Local\Temp\4B91.tmp.exe
1⤵
PID:5660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2jele6do.exe

Path C:\Users\Admin\AppData\Local\Temp\2jele6do.exe
Size 166KB
SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
MD5 878daa2275262e2d5a124d997b8f3f22
SHA1 91322a927c535b04513eb255d1238039d994b133
SHA512 a2e0473d4d5a0cb8baee3b77df636e436a3637524bd8bd3d453baad9a0c2079569241e38b6f32f46ec0c235a5b19750bae5d4695cfce181a42aafe109e7553ce
SSDEEP 3072:XtJ2fCsQiuzYJ8WreWgxgjIFaphDCMfCv6vHXrbl5STd:XwCszCYJ8OcgsaBB
TLSH
T192F37D4A73E510FDE1778239C9551A45F372782207209BAF07A047BA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4l5dujux.exe

Path C:\Users\Admin\AppData\Local\Temp\4l5dujux.exe
Size 965KB
SHA256 3186b8a9b59de43a4a1089bdfa6d750322ea17fc3089816d30500cce4903d33d
MD5 c110aaf8342d488c5778b7ffb25f3a3f
SHA1 86fd62e48c1b73dc6419f6416d1ac5a03a142ee2
SHA512 da9956ed04baf755277c53ca55b1d0df2248545a4a373eba8897b1bec497f80cf6863d8bd1796d598e304b061aad8485797808dfbfddefdd587aa9de397e46f3
SSDEEP 24576:mwgUQJHnixgx+EizsS8ZzZyJYVPwhEDOTwZfe8L:IFca+fb8jVPwlEZfe0
TLSH
T1042533B97D280B41E8FFD9719DE697623D6C8E54808A5124A593382F17B711FBC0FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\base_library.zip
Size 1.3MB
SHA256 b12105ff668cd4f96f48a46ae9223ae3e16c47205ec7eac3241c480befa0ff2d
MD5 6a3be6e4abbb8d5174902301945dc52d
SHA1 e05203793e75edc2b6018093d5daa83e99f0d40e
SHA512 7690a007986766846d9bb958eadd8cf23065125904dac314fbf0a6ebf276bbf3a75d54972b12ceb5838845734e5ad36e2823dfbf2689f4f6d54468daad7028d7
SSDEEP 24576:WQeOdP2m2dfXJRdtRpDFaLzlbNUuUFi3x/rw:W/hRdtRzuUFi35rw
TLSH
T106552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60642\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

combo-toolkit.exe

Path C:\Users\Admin\AppData\Local\Temp\combo-toolkit.exe
Size 10.9MB
SHA256 34f716ad25ae4714238fbbc6f4ee28c850a7c87ad37a3b3471bd67a7ee8dea0f
MD5 b5e03ee581bca3e31bd64ac8a7d8ddb8
SHA1 7ca3056e06c2bb06b87e2a820025147f7e9b11b3
SHA512 ad2ce05fbf8105d31062b9f3fba2a834c9cfaac1847044eeab1715ca64a9060d0c8e99d3472993803d6f0faf30716a59d6907b6608a0c1ed86022c0119061e05
SSDEEP 98304:swTsOEYhPRtIiXHVjZLVFu7yN/hZey2iMXEhKMFkrEA:sgPJPXHnLVFfTZevGKMFzA
TLSH
T1E0C65C57E8A144E9C0AED1348A7A9153BB717C884B3063D72F50F7256FB2BD0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exm0fle0.exe

Path C:\Users\Admin\AppData\Local\Temp\exm0fle0.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkqkaz8a.exe

Path C:\Users\Admin\AppData\Local\Temp\gkqkaz8a.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu80pc5b.exe

Path C:\Users\Admin\AppData\Local\Temp\gu80pc5b.exe
Size 120KB
SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
MD5 842b09509ab819c1e7edecd41d4c301b
SHA1 38efdf62dfb36898c662bb912c0e76d79e8836bf
SHA512 aa3ecddb8af12b6970fccd5106406f86bf55656193b0683da17b23ce47d3abe4cd7e64c4377206664709678f338c338d5e0ba44b193cb38b34113ea33ec29e6a
SSDEEP 1536:HlyFwDCtFe20zYrnw5p15i8VOTypRxn2KXdTY+sWLdP9dldGOIJ:HlyFPtv0kTwDxUepRx2KG6vbGOI
TLSH
T1C2C36B1777A530F8E17B823589215A16E7B378310B758B6F03A4426A6F277D09E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-2AODU8J4U7.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j88iqa9d.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ADO8MDYW1C.tmp\j88iqa9d.tmp
Size 4.2MB
SHA256 3a62ca6296bbb01dea01d20db87eb23ece3ba0360ac5d9174d5ef68bbe31d2ff
MD5 e2419d34fbcb35ebf8022e5bf423befd
SHA1 94bf494102ad88f4d53bcea2d1b230dcf89478ea
SHA512 562e629c4a082d7b4cf33505859ef0e8bf60b28762e6888d5502ea5a18491cbc7b7d67c01e28c02d394dacacdcd7de73cca09d9cdcd0a1fa9c9ba36b9830191b
SSDEEP 98304:w9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J8333H:HItJj90Z6RgKwJ
TLSH
T18D168E13B388793AE4B71A3A8C3FA250593F7A213916CD4B6BF4095C4F396417E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lrskrq0f.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-E2BFISKQGF.tmp\lrskrq0f.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-FSDP4NG9J1.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j88iqa9d.exe

Path C:\Users\Admin\AppData\Local\Temp\j88iqa9d.exe
Size 11.8MB
SHA256 6c555cf90603114a43bdea6966bc6562de8187678ffafa0e50544561e5c32061
MD5 f6481e5a46c72784eca66dd60dcd7e70
SHA1 a1e9b0b4b00cb91af02801ac12761e1215270551
SHA512 244a4e059692936bbc4c9567ad5186e6d3fcd669d87563dd15858692fead88eba400a0dc58296d2aadf2057be6762b4987dda29283c99d0b7815f806e3f959ea
SSDEEP 98304:E5OkH+3qndcIM57t775sQdfTQn1gTTXeP8ElMIxo:gC3qnu575rTY2eP8
TLSH
T156C6F17BA18BBDBAE07B15353EB2A210553B6B5065124C029BECC44DDF250B92F3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lrskrq0f.exe

Path C:\Users\Admin\AppData\Local\Temp\lrskrq0f.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\AppData\Local\Temp\lsass.exe
Size 8.1MB
SHA256 62d98f765dc8bd74c921f483d9e5464c9277dd062f5d6114abdc7f030c2ce805
MD5 b2bbdf2134f086225dbe12b97f54e272
SHA1 e0f8b28f85a45085bf46ced209d4959dd7f918e8
SHA512 13fba5d51ecc148132b6d1c90194a8343900f84d327873df538473fc9c7174aff9a4a29bd5e8881c72541184a6cf08a2cae39e1901ac86a4052ac7221e4fd04d
SSDEEP 196608:qYLKbnG0OrsW4gXyTntTFqq8N3tTHsGXqr3pXFSFE7E:qYLKbGZrGtZq5XTHsGXqD7SN
TLSH
T1D486334892C019A7E897623D9AB3D556E3E1F8221B22CDDF1791132D3F73691483DBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl4k294g.exe

Path C:\Users\Admin\AppData\Local\Temp\nl4k294g.exe
Size 54KB
SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
MD5 3e88f1a1f48cb2a3556fdac9de4e8ef9
SHA1 dd839cd4619e104298bb2d823f4678504f148622
SHA512 fe55272561838a1cc3ed5d4145c7e4c7a1418d3c1bfd92f5bc8dfa29b1f7e7417ab6e3635ed8f249277c0be3a24be09bfa4f3065c81390624b0a65fdcc3fde0f
SSDEEP 1536:vtW4y8UFRx6GbgCSUMH18htq5Hk9Uepxc6kRdps:1W4yKBHmhg5HSUep3
TLSH
T15F43092916F64B65E8728279EAB44327D0F87C46BC70421F0773CE592F938C1A67CB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlogon.exe
Size 88KB
SHA256 7afbef6873b37e6878c000a1ae7dee21899978facb69402111a3c3a248254e62
MD5 a801299383ac36137d8fd89c4301a187
SHA1 53842743560356b89c904ba26d7f3c2370d1b13a
SHA512 2562bf3583679ef9326fa3832cde85d2162678df15092b5b401c664a2172ca25eb91c17eed58434cbefdbab7f7baa5e86acae0a5826f96575599a2a94c40dae6
SSDEEP 1536:00GygBsWhz/TuMTYirB7lth/M5LAf29B6Ai428AZzjpIcJOR0fRURVX6:00GHxhUidltxwL9B6TdzaWVWRVX
TLSH
T12293C06B279425A4C9ABC171C9708B17E6F2B8191629435F07B8C9D72F63322733DB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwjr0ios.exe

Path C:\Users\Admin\AppData\Local\Temp\wwjr0ios.exe
Size 2.2MB
SHA256 5f602e2fc6c0604849d058f0f4ad95b720c9eb2aec8514e01acdae2950327f29
MD5 1770ea43e9edde2d4798e55aed9b50dd
SHA1 8b3e974199fe2c4ca78802c2f1360d6868319433
SHA512 c3fbb5b02317fd4168d4d5d9474c333d537d2d1a8c3c52a7ee9449c0341bd9d18d3d3c57ba5ca566b9eea5fe04e39a47af7f4ba0d54a3fc900b7fa601f2300d4
SSDEEP 49152:cjuPKFat8mPME2iZt132kst7dI9qBYfIj:byS3Jsc9qD
TLSH
T1E3A59F4AA3B801FDD0BBC274C9175647DBB2B8461670979F13E0479A2F53B626E2F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6d5a6a6b9a7c39bc0be06bce951ba88dc3106c783d69153f58c11f02d8016473
MD5 5368af6fd82d35ca7ff9cb2bc8812e5b
SHA1 bbdf7e78d07459978bf07bbf64bcb6e6211fcb64
SHA512 cba7c390ed5cb6cfccdbbf17b300d1d842d37210d5d6b85c040df6bf94c9ca6344141a952d69f0e97df96c282ddfc9e88106c3e521e21ebee91a5f9156c3a711
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 75e951c08ecb31ff045d7e5534ed5034ee5cbc9cc0d9c97591a1d39645083f3e
MD5 b5f8c7a3d550ba64fafbaf8201caaf4a
SHA1 d3ba6b179596119d7e75e36e840281ec5f792048
SHA512 d0e2359b9a2bb84157f6e590235e77d71bc3b9603d93b450abe1ccb042f47f700c5f9e1e0d7f92936b34c651b6f6a126015d8ee3d4d047d6d7d9d695435b943e
TLSH
T152D0121373210234C12030331942A1082400D10B410540165439866E6A440501903551
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ea3055602ee1dd3ce5681fa991ee6e60277e1e9b397d018607325773193838df
MD5 82a3838581003942968eb9e646a6aabb
SHA1 d941ba867aac40e5902b9e88c8951cb5133d10aa
SHA512 48c160ecea27eeeb1732287569e9031c5f9fa3bd1ef313869f09d7d02a6b49e0eed7567597020b25c2c6f12b4218724e33be7e9975e6a0ee923c8ddc524dc6c4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2877b82df948993729fc91aec5b395a365447405f5b0f4725655a9b68fd8813e
MD5 100543cd0db0bf64411483a133d87750
SHA1 ff54aa2d8bd70108e84f0df78084964c9a402e4a
SHA512 e0885975aa03fc592c0c8c52c5a2b160b53027740352b32acda13c91bc20d7e58942243ffbc5797cc24e9a88f0b09432bd6da9198187cf056e93ba31ecf5c47b
TLSH
T151B0021245112081C11433B161C255573539AD154657159553E10A756E553D79995504
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4de3.TMP

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Network\Network Persistent State~RFe5a4de3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 1248f14255198d49f25392a22e0d59f3cc92144ccc892cdf3d9c7a2877ef2ace
MD5 85b31d751982aab3b7da991a44e1bab5
SHA1 edeac6ea7f46f43346657b9a15789e9a3e001247
SHA512 7732fde956fe0a5f8bbb25a72c1f1ff6605958bfa31e2e8bd2e7462ed7109321883d5121101ee16c93ed320c0055c031b83ef41d129fb2b4b5d77f1cd0595be3
SSDEEP 96:stC/d7bmFxb9akNo5h16Z5Os7/x+6MhmuecSGd1ejegK+gkII28XM1C7K:stalHSoKOsV+F2GdQjQAG6K
TLSH
T1F2D196065E28697B4CC7E15ABA29BB07E2F55072B1951E58E7F8861C04DB6CC7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 2a10c5a014b6a40cb132367d7b1fd1d38bffb2bcbd07cbf303751a820142c71c
MD5 c5c2fe22b5c862d869b745aee53320e9
SHA1 856cc50f02db873282f874c9b604bcec12f5e2c2
SHA512 c5331f8dcccf02c0b380ea4cee1ced6ba6d391ed8e04eb4f14c7ef74c6883ff673d63b6cff697daa380d2dfbd5061bba33581a7b4e5fe809b217de321df32e73
SSDEEP 96:rC/d7bmFxb9akRdo616Z5Os7/x+6MhmuecSGd1ejegK+gkII28XM1C7K:ralHyo7OsV+F2GdQjQAG6K
TLSH
T1D0C1A5065A28697B4CC7E159BA297B07E2F55032B5D51E58E7F8872C08DB6CC7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 6fe2efb68bca7bef6742dddf52ae837ffbfbfc2d5ed4ac42e8c254a58b970938
MD5 a7a6f765c8393e3837157b1c9dc1fdee
SHA1 afa91bdf23be5a500e82fa8bc5d3bc14bddbed29
SHA512 89519ec338a5e8aef4af4cb9f9c1bf18471ce06317cb08144c5aa7dd12aa84e1295bcffcd184721561c98254543925f2098a1ddada117841b6f6ece11781c36f
SSDEEP 96:stC/d7bmMGxb9akNo5h16Z5Os7/x+6MhmuecSGd1ejegK+gk5928XM1C7K:stalhSoKOsV+F2GdQjQAG6K
TLSH
T109D1A7065E28697B4CC7E15ABA29BB17E2F55072B1951E58E7F8861C04DB6CC7303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59bffb.TMP

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Default\Preferences~RFe59bffb.TMP
Size 5KB
SHA256 8a418e1a12cc60a9e7f530018469b7c47bf517c04ac49034d744ae1738381d7e
MD5 215278e154939ce8592aef937169b0a9
SHA1 8f357bb8dd740565852b063dbeec19c8ba1959a4
SHA512 09f14cd3e8565b6f49979315b97e383eb45bfcc42b3adc16b43475d8443aa7903c04df4269aad44739108b6c47af95b2e840a2147dd2e08c66767d8038601b3a
SSDEEP 96:rC/d7bmFxb9akpdo616ZZs7/x+6MhmuecmjegK+gq28XM1C7K:ralHkojsV+FijQsG6K
TLSH
T1AEC193065E28A97B4CC6F149BA297B03E2FA603275D52E58E7F8861C08DA5CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Local State
Size 3KB
SHA256 38a881bd3d321b05ab39b40e2700994d228ae8e43fa2c5e4a4af9c37a1ab952e
MD5 dae42dd0f33efc1e2a7f218ec8c99326
SHA1 731489711b1f4274c6c41be9f1e514fff5d5eaa5
SHA512 3d88be75625314e8282eafec5206006809d599adcd3eccccf4503061fd6dce42528415990f8655ac7c7e723b507f688b210ec6d820b23f7e4caccccb13c41173
TLSH
T1497175376978AA374EF3D645B8463F036A659163E5867FA4CAEC4F0D41D72C80342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Local State
Size 3KB
SHA256 9ccabdae935465de1861c1dc364db761d7fcf0efb9858e1a1d4d9cbf371f91dd
MD5 0f6be04f2e564741b247f9e3b3729e87
SHA1 d3e0670730d624ac8756a9dfcd091b6f9f1eda46
SHA512 ae3528ebe12a4d544a9bddc30deba013ae9728f5a1ecf862bd888dff57ff0a42495892e647055b68b71700658b49d3e2af2137d7dd9f4294f0e6285e62d5ea17
TLSH
T14B7164376978A9378EF3D645B8863F036A655066E5867FA8CAEC4F0D45D72C80342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Local State
Size 15KB
SHA256 963b46adf28aca9474fa066cbf56b44b519166de9056580740edffcdc4a63591
MD5 07bb6353c4720e74bbdda85243c304a3
SHA1 71f843a403bc09acdceee72909f3efe60d76bc20
SHA512 81dff4e1bc2f42187391910618eafe7ad1783f7634650f9b90281102e8ec76f09c43983a616dffdac1f29862673ea9e4792eb1ad9fe7a0212ad6fefe05e24e63
SSDEEP 384:Y+aQikB+z/xvxjg/qhEwNBSqoQLd1O+bU9zO:X/UxvxjgC+SzRBbUFO
TLSH
T15672AF3B557C7D2396F3E605795D1B4BCEB988B291822AB48AED5F0D0AD73D80302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Local State
Size 2KB
SHA256 f99fa3d78261de4edf7a6b624c51ee75ff3a29a9fcb8e8f1d8c4a93978e5fdc5
MD5 66fadc8220b4c1fee0d768fb32ff7097
SHA1 b3f23a46cb53d286732811251ae14e2f4c17e8ed
SHA512 08031a027c9bd314b6f5da03662d1096b90a175155136e5e9caca54af5dba48b7df095b38113d8233e4d2231696f0a21e2091048d2ad24d3f97202010ede5734
TLSH
T1D451623369189B378AE3974AB94A7E138E7591A5EA522F20DAED8B1840D719C1702C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Local State
Size 3KB
SHA256 fa77b3409a38a6665d626ad741ec9ab6d07a7e76d374e27f6b1361ab1da26ed0
MD5 2214bf97eb893e17cf7ed148646068a8
SHA1 47a2aaa63a6707439ce3448fe20543197a76ce53
SHA512 c29fa3c899a0c0863a0b4c9ba2610ad4d9ea0374e8e3bfdd51118260919ffead827a9b4405ab41e94459279a4071448d3dd0f5c01cd72eeb7c97ab65d835b8cd
TLSH
T16561853769789A378EF39B45B8863F076BA55166E5953F64CAEC4F0C01D72C81342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5921c7.TMP

Path C:\Users\Admin\AppData\Roaming\combo-toolkit.exe\EBWebView\Local State~RFe5921c7.TMP
Size 1KB
SHA256 ba7e9f7cae48f0a76a965775f13fcd1b2f69cca55a9277f0e7e447b9bcf58ee8
MD5 ebc2b769f14ed2c6515a52050c5f7043
SHA1 5bb1d8e7f3600a1e4771cb12673585273876c9a5
SHA512 5c6f7fbb2a04301a817d7df69bb43fc1a0fae941db51a6b0aa7195c858997859d6846ccf987e9ead60d7f9ffd57fec66aabf67cebc146aa4d83432cceb089889
TLSH
T1B32132B3E9289B32EDD663877106BE471E3151AAC2118F0099EE871D45E718C9B1AD37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-64-0x00000000009C0000-0x0000000000AAC000-memory.dmp

Download

memory/428-324-0x00000000009C0000-0x0000000000AAC000-memory.dmp

Download

memory/984-732-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-730-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-733-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-731-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-723-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-725-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-729-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/984-734-0x000001CE04600000-0x000001CE04601000-memory.dmp

Download

memory/1072-89-0x00007FF622230000-0x00007FF62224E000-memory.dmp

Download

memory/1072-77-0x00007FF622230000-0x00007FF62224E000-memory.dmp

Download

memory/1092-632-0x0000000000510000-0x0000000000970000-memory.dmp

Download

memory/1092-714-0x0000000000510000-0x0000000000970000-memory.dmp

Download

memory/1092-510-0x0000000000510000-0x0000000000970000-memory.dmp

Download

memory/1092-466-0x0000000000510000-0x0000000000970000-memory.dmp

Download

memory/1548-255-0x00007FFDA0960000-0x00007FFDA0961000-memory.dmp

Download

memory/1668-426-0x0000000000590000-0x00000000009F0000-memory.dmp

Download

memory/1668-631-0x0000000000590000-0x00000000009F0000-memory.dmp

Download

memory/1668-603-0x0000000000590000-0x00000000009F0000-memory.dmp

Download

memory/2240-278-0x00007FF622230000-0x00007FF62224E000-memory.dmp

Download

memory/2536-358-0x0000000000540000-0x0000000000646000-memory.dmp

Download

memory/2536-98-0x0000000000540000-0x0000000000646000-memory.dmp

Download

memory/2848-512-0x0000000000160000-0x0000000000266000-memory.dmp

Download

memory/2848-471-0x0000000000160000-0x0000000000266000-memory.dmp

Download

memory/3104-513-0x00000000004B0000-0x0000000000910000-memory.dmp

Download

memory/3104-691-0x00000000004B0000-0x0000000000910000-memory.dmp

Download

memory/3324-136-0x00007FF7A4EB0000-0x00007FF7A4ECE000-memory.dmp

Download

memory/3324-135-0x00007FF7A4EB0000-0x00007FF7A4ECE000-memory.dmp

Download

memory/4108-25-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/4268-2-0x0000000140000000-0x000000014022E000-memory.dmp

Download

memory/4336-485-0x00007FF666330000-0x00007FF66634E000-memory.dmp

Download

memory/4336-484-0x00007FF666330000-0x00007FF66634E000-memory.dmp

Download

memory/4396-119-0x00000258F49A0000-0x00000258F49D2000-memory.dmp

Download

memory/4396-519-0x00000258F4B50000-0x00000258F4B81000-memory.dmp

Download

memory/4396-22-0x00000258F3520000-0x00000258F3522000-memory.dmp

Download

memory/4448-696-0x000002F2C8B50000-0x000002F2C8B81000-memory.dmp

Download

memory/4556-361-0x00007FF738A80000-0x00007FF738A9E000-memory.dmp

Download

memory/4556-359-0x00007FF738A80000-0x00007FF738A9E000-memory.dmp

Download

memory/4984-108-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-112-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-794-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-53-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/4984-79-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/4984-380-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/4984-481-0x0000000003740000-0x0000000003741000-memory.dmp

Download

memory/4984-82-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-323-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-336-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-81-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-111-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-628-0x0000000003750000-0x0000000003751000-memory.dmp

Download

memory/4984-149-0x00000000036F0000-0x00000000036F1000-memory.dmp

Download

memory/4984-150-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/4984-109-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-107-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-106-0x0000000005F50000-0x0000000005F75000-memory.dmp

Download

memory/4984-148-0x00000000036E0000-0x00000000036E1000-memory.dmp

Download

memory/4984-105-0x0000000001000000-0x0000000001001000-memory.dmp

Download

memory/5224-641-0x00007FFDA0110000-0x00007FFDA0111000-memory.dmp

Download

memory/5224-640-0x00007FFDA07A0000-0x00007FFDA07A1000-memory.dmp

Download

memory/5384-541-0x0000000000940000-0x0000000000D87000-memory.dmp

Download

memory/5384-636-0x0000000000940000-0x0000000000D87000-memory.dmp

Download

memory/5384-357-0x0000000000940000-0x0000000000D87000-memory.dmp

Download

memory/5384-508-0x0000000000940000-0x0000000000D87000-memory.dmp

Download

memory/5384-447-0x0000000000940000-0x0000000000D87000-memory.dmp

Download

memory/5404-233-0x00007FFDA0960000-0x00007FFDA0961000-memory.dmp

Download

memory/5720-743-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp

Download

memory/5720-783-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp

Download

memory/5720-796-0x00007FF7A1360000-0x00007FF7A15AA000-memory.dmp

Download

memory/5724-140-0x00007FF61D490000-0x00007FF61DFDD000-memory.dmp

Download

memory/5724-439-0x00007FF61D490000-0x00007FF61DFDD000-memory.dmp

Download

memory/5884-319-0x00000000006B0000-0x00000000007B6000-memory.dmp

Download

memory/5884-444-0x00000000006B0000-0x00000000007B6000-memory.dmp

Download