Overview

overview

10

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

10

2026-08-03...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    31s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 02:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_f215f0b115ee460fdbfd68b0fe8f84ce_cobalt-strike_icedid_satacom_vidar.exe
  • Size 40.3MB
  • Sample260803-cg4htaam71
  • SHA256 9f22a150c460cafa17267d01df9a09583853ae192a9c93e92c87ad14a90a74ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverydownloaderexecutionsvcstealerinstallerpersistencepyinstallerspywarestealer

Malware Config

Extracted

Family

  • svcstealer

C2

  • http://196.251.107.186/acovp/post.php

  • http://192.162.199.186/usovp/post.php

  • http://196.251.107.163/bioxp/post.php

Attributes
  • build_id

    Dropped

  • srv_delay

    1

  • srv_retry

    1

Signatures

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Detects SvcStealer Payload 3 IoCs

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • Detects executables containing common artifacts observed in infostealers 3 IoCs
  • Detects executables referencing many IR and analysis tools 3 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 3 IoCs
  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:4372
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:4456
      • C:\Windows\system32\ctfmon.exe
        /QuitInfo:000000000000024C;0000000000000250;
        1⤵
          PID:5044
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:5152
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5912
              • C:\Users\Admin\AppData\Local\Temp\2026-08-03_f215f0b115ee460fdbfd68b0fe8f84ce_cobalt-strike_icedid_satacom_vidar.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-03_f215f0b115ee460fdbfd68b0fe8f84ce_cobalt-strike_icedid_satacom_vidar.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3428
                • C:\Users\Admin\AppData\Local\Temp\95mrwwqb.exe
                  "C:\Users\Admin\AppData\Local\Temp\95mrwwqb.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5348
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
                    5⤵
                      PID:5240
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
                      5⤵
                        PID:2824
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
                        5⤵
                        • Executes a command shell one-liner
                        PID:4332
                        • C:\Windows\system32\netsh.exe
                          netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
                          6⤵
                            PID:5816
                      • C:\Users\Admin\AppData\Local\Temp\z6stnkhs.exe
                        "C:\Users\Admin\AppData\Local\Temp\z6stnkhs.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5140
                      • C:\Users\Admin\AppData\Local\Temp\aiiiek6a.exe
                        "C:\Users\Admin\AppData\Local\Temp\aiiiek6a.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:2420
                      • C:\Users\Admin\AppData\Local\Temp\15zu1nne.exe
                        "C:\Users\Admin\AppData\Local\Temp\15zu1nne.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:5244
                      • C:\Users\Admin\AppData\Local\Temp\7ozfwxd6.exe
                        "C:\Users\Admin\AppData\Local\Temp\7ozfwxd6.exe"
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2740
                        • C:\Users\Admin\AppData\Local\Temp\is-V92LH2EZFD.tmp\7ozfwxd6.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-V92LH2EZFD.tmp\7ozfwxd6.tmp" /SL5="$A011C,2775941,905728,C:\Users\Admin\AppData\Local\Temp\7ozfwxd6.exe"
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:3444
                      • C:\Users\Admin\AppData\Local\Temp\p9pgwfxi.exe
                        "C:\Users\Admin\AppData\Local\Temp\p9pgwfxi.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of WriteProcessMemory
                        PID:6076
                      • C:\Users\Admin\AppData\Local\Temp\ii0ndqbt.exe
                        "C:\Users\Admin\AppData\Local\Temp\ii0ndqbt.exe"
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4124
                        • C:\Users\Admin\AppData\Local\Temp\is-0SE9OFT06D.tmp\ii0ndqbt.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-0SE9OFT06D.tmp\ii0ndqbt.tmp" /SL5="$C0056,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\ii0ndqbt.exe"
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:2652
                      • C:\Users\Admin\AppData\Local\Temp\wod8did2.exe
                        "C:\Users\Admin\AppData\Local\Temp\wod8did2.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:804
                      • C:\Users\Admin\AppData\Local\Temp\elph2s7z.exe
                        "C:\Users\Admin\AppData\Local\Temp\elph2s7z.exe"
                        4⤵
                        • Downloads MZ/PE file
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of WriteProcessMemory
                        PID:5864
                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:5392
                        • C:\Users\Admin\AppData\Local\Temp\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5840
                          • C:\Users\Admin\AppData\Local\Temp\is-SI0840RAQ8.tmp\taskhost.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-SI0840RAQ8.tmp\taskhost.tmp" /SL5="$C01C6,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:4688
                        • C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
                          "C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"
                          5⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:3128
                        • C:\Users\Admin\AppData\Local\Temp\winlogon.exe
                          "C:\Users\Admin\AppData\Local\Temp\\winlogon.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:5424
                        • C:\Users\Admin\AppData\Local\Temp\lsass.exe
                          "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:3292
                          • C:\Users\Admin\AppData\Local\Temp\lsass.exe
                            "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5260
                      • C:\Users\Admin\AppData\Local\Temp\KGB_SMTPCRACKER.exe
                        "C:\Users\Admin\AppData\Local\Temp\KGB_SMTPCRACKER.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:2292
                    • C:\Users\Admin\AppData\Local\Temp\60AF.tmp.exe
                      C:\Users\Admin\AppData\Local\Temp\60AF.tmp.exe
                      3⤵
                        PID:2648
                  • C:\Windows\System32\smartscreen.exe
                    C:\Windows\System32\smartscreen.exe -Embedding
                    1⤵
                      PID:4920
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3044
                    • C:\Users\Admin\AppData\Roaming\svchostlip.exe
                      C:\Users\Admin\AppData\Roaming\svchostlip.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4120
                    • C:\ProgramData\addbfdfdeddccbc.exe
                      "C:\ProgramData\addbfdfdeddccbc.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:5584
                    • C:\Users\Admin\AppData\Local\Temp\p9pgwfxi.exe
                      "C:\Users\Admin\AppData\Local\Temp\p9pgwfxi.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:1508
                    • C:\Users\Admin\AppData\Local\Temp\wod8did2.exe
                      C:\Users\Admin\AppData\Local\Temp\wod8did2.exe
                      1⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:2196
                    • C:\Users\Admin\AppData\Local\Temp\elph2s7z.exe
                      C:\Users\Admin\AppData\Local\Temp\elph2s7z.exe
                      1⤵
                      • Executes dropped EXE
                      PID:5704
                    • C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
                      C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
                      1⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1488
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:6036
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:4748

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Defense Evasion

                              Modify Registry

                              1
                              T1112

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              2
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Credentials in Registry

                              1
                              T1552.002

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              2
                              T1012

                              System Information Discovery

                              1
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Lateral Movement

                              Collection

                              Data from Local System

                              2
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              1[1].exe
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BWL9CVZL\1[1].exe
                              • Size 2.3MB
                              • SHA256 3d092589ca9c4f5efe7fbfe6bfbff0e24c4e2d007914c3bbc0cbbd52ab2d1bf8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              15zu1nne.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\15zu1nne.exe
                              • Size 166KB
                              • SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              60AF.tmp.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\60AF.tmp.exe
                              • Size 100KB
                              • SHA256 5820310484b02aa17de02f75ae3081cc83328685e977b5740dcebbc48deea611
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              7ozfwxd6.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\7ozfwxd6.exe
                              • Size 11.8MB
                              • SHA256 6c555cf90603114a43bdea6966bc6562de8187678ffafa0e50544561e5c32061
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              95mrwwqb.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\95mrwwqb.exe
                              • Size 2.3MB
                              • SHA256 96453d371a8ae6e88534b65a6bf310a2e7c9c8130520e6e7fa4c05fe9fe3c540
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              KGB_SMTPCRACKER.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\KGB_SMTPCRACKER.exe
                              • Size 9.2MB
                              • SHA256 284238f2fa97680e99f91426ba352bbe7ffbdeaf546e27181ec1bca84ca1b50b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              VCRUNTIME140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\VCRUNTIME140.dll
                              • Size 117KB
                              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _bz2.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_bz2.pyd
                              • Size 86KB
                              • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _ctypes.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_ctypes.pyd
                              • Size 139KB
                              • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _lzma.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_lzma.pyd
                              • Size 157KB
                              • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _zstd.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_zstd.pyd
                              • Size 491KB
                              • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              base_library.zip
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\base_library.zip
                              • Size 1.3MB
                              • SHA256 b12105ff668cd4f96f48a46ae9223ae3e16c47205ec7eac3241c480befa0ff2d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libffi-8.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\libffi-8.dll
                              • Size 38KB
                              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              python314.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\python314.dll
                              • Size 6.5MB
                              • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              aiiiek6a.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\aiiiek6a.exe
                              • Size 2.3MB
                              • SHA256 224d5fe012ace019f2c7cc75a98b2c0e122519e9e2bd96a3ce174cd8fd17e0bc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              elph2s7z.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\elph2s7z.exe
                              • Size 120KB
                              • SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ii0ndqbt.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\ii0ndqbt.exe
                              • Size 13.1MB
                              • SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ii0ndqbt.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\is-0SE9OFT06D.tmp\ii0ndqbt.tmp
                              • Size 4.3MB
                              • SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _isdecmp.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\is-7YCSNCVG54.tmp\_isetup\_isdecmp.dll
                              • Size 31KB
                              • SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _isdecmp.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\is-FE0RN1LN5S.tmp\_isetup\_isdecmp.dll
                              • Size 34KB
                              • SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              7ozfwxd6.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\is-V92LH2EZFD.tmp\7ozfwxd6.tmp
                              • Size 4.2MB
                              • SHA256 3a62ca6296bbb01dea01d20db87eb23ece3ba0360ac5d9174d5ef68bbe31d2ff
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              lsass.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\lsass.exe
                              • Size 8.1MB
                              • SHA256 62d98f765dc8bd74c921f483d9e5464c9277dd062f5d6114abdc7f030c2ce805
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              p9pgwfxi.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\p9pgwfxi.exe
                              • Size 90KB
                              • SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wod8did2.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\wod8did2.exe
                              • Size 1.1MB
                              • SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              z6stnkhs.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\z6stnkhs.exe
                              • Size 54KB
                              • SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              svchostlip.exe
                              • Path C:\Users\Admin\AppData\Roaming\svchostlip.exe
                              • Size 168KB
                              • SHA256 5122f2a30b3a40079d63e50b4dd5159c634dd44995ca74b77fa05c89495fab97
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/1508-135-0x00007FF631570000-0x00007FF63158E000-memory.dmp
                              Download

                              memory/2652-279-0x0000000000E90000-0x00000000012F0000-memory.dmp
                              Download

                              memory/2652-285-0x0000000000E90000-0x00000000012F0000-memory.dmp
                              Download

                              memory/2652-273-0x0000000000E90000-0x00000000012F0000-memory.dmp
                              Download

                              memory/2652-366-0x0000000000E90000-0x00000000012F0000-memory.dmp
                              Download

                              memory/2652-252-0x0000000000E90000-0x00000000012F0000-memory.dmp
                              Download

                              memory/2740-67-0x0000000000560000-0x000000000064C000-memory.dmp
                              Download

                              memory/2740-169-0x0000000000560000-0x000000000064C000-memory.dmp
                              Download

                              memory/3444-170-0x0000000000880000-0x0000000000CC7000-memory.dmp
                              Download

                              memory/3444-377-0x0000000000880000-0x0000000000CC7000-memory.dmp
                              Download

                              memory/3444-275-0x0000000000880000-0x0000000000CC7000-memory.dmp
                              Download

                              memory/3444-416-0x0000000000880000-0x0000000000CC7000-memory.dmp
                              Download

                              memory/3444-264-0x0000000000880000-0x0000000000CC7000-memory.dmp
                              Download

                              memory/4124-105-0x0000000000BC0000-0x0000000000CC6000-memory.dmp
                              Download

                              memory/4124-171-0x0000000000BC0000-0x0000000000CC6000-memory.dmp
                              Download

                              memory/4372-117-0x000001EEDC090000-0x000001EEDC0C2000-memory.dmp
                              Download

                              memory/4372-271-0x000001EEDC1C0000-0x000001EEDC1F1000-memory.dmp
                              Download

                              memory/4372-21-0x000001EEDAC10000-0x000001EEDAC12000-memory.dmp
                              Download

                              memory/4688-398-0x00000000000F0000-0x0000000000550000-memory.dmp
                              Download

                              memory/4688-306-0x00000000000F0000-0x0000000000550000-memory.dmp
                              Download

                              memory/4688-278-0x00000000000F0000-0x0000000000550000-memory.dmp
                              Download

                              memory/4688-267-0x00000000000F0000-0x0000000000550000-memory.dmp
                              Download

                              memory/5044-24-0x0000000180000000-0x0000000180005000-memory.dmp
                              Download

                              memory/5584-101-0x00007FF7B11B0000-0x00007FF7B11CE000-memory.dmp
                              Download

                              memory/5584-100-0x00007FF7B11B0000-0x00007FF7B11CE000-memory.dmp
                              Download

                              memory/5840-165-0x0000000000020000-0x0000000000126000-memory.dmp
                              Download

                              memory/5840-266-0x0000000000020000-0x0000000000126000-memory.dmp
                              Download

                              memory/5912-192-0x0000000003DF0000-0x0000000003DF1000-memory.dmp
                              Download

                              memory/5912-92-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-138-0x00000000057C0000-0x00000000057C1000-memory.dmp
                              Download

                              memory/5912-90-0x0000000003870000-0x0000000003871000-memory.dmp
                              Download

                              memory/5912-97-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-95-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-94-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-77-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-93-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-76-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-118-0x0000000003B10000-0x0000000003B11000-memory.dmp
                              Download

                              memory/5912-65-0x0000000003860000-0x0000000003861000-memory.dmp
                              Download

                              memory/5912-91-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-50-0x0000000003840000-0x0000000003841000-memory.dmp
                              Download

                              memory/5912-119-0x0000000003CA0000-0x0000000003CA1000-memory.dmp
                              Download

                              memory/5912-168-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/5912-184-0x00000000039E0000-0x0000000003A05000-memory.dmp
                              Download

                              memory/6076-71-0x00007FF631570000-0x00007FF63158E000-memory.dmp
                              Download

                              memory/6076-80-0x00007FF631570000-0x00007FF63158E000-memory.dmp
                              Download