svcstealer | 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

Analysis

max time kernel
47s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
Size 1.1MB
Sample260825-e3gmaawgrh
SHA256 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
MD5 dbcc02d992bceffe77a9ba0b4e225a63
SHA1 ce31a623ec16eecf82a8387d6a8f7ffa7f6dc9ea
SHA512 42e138e88c015104dcb70d714d63ecd833bf2e1f676b6d197a1b7d79e9ca28170e8e26700eaa872cd3ff7ac263d4544e0fc161134d4a156b31f41bdd3969d247
SSDEEP 24576:WNo8PUrjpgt9TQrTRIbM68YZwmSJmKh3vjhkChq:WNot3pgt9srKo68YZwnmKVjht
TLSH
T1BC457C56BA66D0FCC46EC0B5C75A5673BF21B84A0B317AEB41D056383E66EE02B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader evasion execution exploit svcstealer installer persistence ransomware spyware stealer

Malware Config

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001c509-341.dat	family_svcstealer

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2324	bcdedit.exe
4984	bcdedit.exe
3760	bcdedit.exe
4348	bcdedit.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
1	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
1	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
8	5872	svchlp1.exe
16	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe

Possible privilege escalation attempt 18 IoCs

exploit

pid	Process
5168	icacls.exe
5440	icacls.exe
1056	icacls.exe
4740	takeown.exe
3516	takeown.exe
4368	icacls.exe
1472	takeown.exe
2976	takeown.exe
1700	takeown.exe
2284	icacls.exe
2868	icacls.exe
4472	icacls.exe
4536	takeown.exe
2352	icacls.exe
4072	icacls.exe
2544	takeown.exe
4464	takeown.exe
3864	takeown.exe

Executes dropped EXE 11 IoCs

pid	Process
5872	svchlp1.exe
1624	svchlp2.exe
4952	wlrmdr.exe
2756	qopeb.exe
5864	svchlp3.exe
2752	svchlp3.exe
5788	qopeb.exe
3160	sfjcg93m.exe
1552	svchlp5.exe
5380	3fw0hx90.exe
5124	3fw0hx90.tmp

Loads dropped DLL 3 IoCs

pid	Process
5596	chrome.exe
5492	msedge.exe
5124	3fw0hx90.tmp

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4072	icacls.exe
5168	icacls.exe
2976	takeown.exe
1700	takeown.exe
2868	icacls.exe
2544	takeown.exe
4368	icacls.exe
3516	takeown.exe
1056	icacls.exe
5440	icacls.exe
4464	takeown.exe
3864	takeown.exe
1472	takeown.exe
2284	icacls.exe
4472	icacls.exe
4536	takeown.exe
2352	icacls.exe
4740	takeown.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchlp3.exe"	svchlp3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchlp3.exe"	svchlp3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\qopeb.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Ulmyax\\qopeb.exe"	qopeb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5864 set thread context of 4336	5864	svchlp3.exe	59
PID 2752 set thread context of 4336	2752	svchlp3.exe	59

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2740	cmd.exe
3168	cmd.exe
5868	cmd.exe
1980	cmd.exe
2040	cmd.exe
5992	cmd.exe
5128	cmd.exe
1604	cmd.exe
5140	cmd.exe
3820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3fw0hx90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3fw0hx90.tmp

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c50c-348.dat	innosetup

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5872	svchlp1.exe
5872	svchlp1.exe
2756	qopeb.exe
2756	qopeb.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
5864	svchlp3.exe
5864	svchlp3.exe
5864	svchlp3.exe
5864	svchlp3.exe
2752	svchlp3.exe
2752	svchlp3.exe
2752	svchlp3.exe
2752	svchlp3.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe
2568	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	explorer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeSecurityPrivilege	1624	svchlp2.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeDebugPrivilege	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeDebugPrivilege	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeDebugPrivilege	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe
Token: SeShutdownPrivilege	2568	explorer.exe
Token: SeCreatePagefilePrivilege	2568	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5872	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	89
PID 5872 wrote to memory of 4336	5872	svchlp1.exe	59
PID 5872 wrote to memory of 4396	5872	svchlp1.exe	60
PID 5872 wrote to memory of 5516	5872	svchlp1.exe	79
PID 5872 wrote to memory of 2568	5872	svchlp1.exe	80
PID 4100 wrote to memory of 1624	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	90
PID 2568 wrote to memory of 2348	2568	explorer.exe
PID 1624 wrote to memory of 2756	1624	svchlp2.exe	93
PID 2756 wrote to memory of 2568	2756	qopeb.exe	80
PID 1624 wrote to memory of 5128	1624	svchlp2.exe	94
PID 4100 wrote to memory of 5864	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	96
PID 2568 wrote to memory of 5652	2568	explorer.exe
PID 4100 wrote to memory of 5596	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	98
PID 5864 wrote to memory of 4336	5864	svchlp3.exe	59
PID 4100 wrote to memory of 5596	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	98
PID 2752 wrote to memory of 4336	2752	svchlp3.exe	59
PID 4100 wrote to memory of 5492	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	101
PID 4100 wrote to memory of 5492	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	101
PID 2568 wrote to memory of 6104	2568	explorer.exe
PID 5872 wrote to memory of 3160	5872	svchlp1.exe	104
PID 3160 wrote to memory of 2740	3160	sfjcg93m.exe	105
PID 4100 wrote to memory of 1552	4100	3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe	107
PID 5872 wrote to memory of 5380	5872	svchlp1.exe	110
PID 5380 wrote to memory of 5124	5380	3fw0hx90.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5516
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe
    "C:\Users\Admin\AppData\Local\Temp\3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e.exe"
    3⤵
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\svchlp1.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp1.exe
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\sfjcg93m.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sfjcg93m.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp99ddd02d.bat"
        6⤵
        Executes a command shell one-liner
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\3fw0hx90.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3fw0hx90.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\is-F87PUZAQXK.tmp\3fw0hx90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F87PUZAQXK.tmp\3fw0hx90.tmp" /SL5="$800EC,3709115,898560,C:\Users\Admin\AppData\Local\Temp\3fw0hx90.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\j0rtt6mp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\j0rtt6mp.exe"
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\kxg7xhgo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kxg7xhgo.exe"
        5⤵
        
        PID:3440
    - - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\v2ns0yvm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2ns0yvm.exe"
        5⤵
        
        PID:2388
      - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} loadoptions DDISABLE_INTEGRITY_CHECKS
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:2324
      - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} nointegritychecks on
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:4984
      - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} testsigning on
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:3760
      - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} disableelamdrivers yes
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:4348
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2544
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4368
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender"
        6⤵
        Executes a command shell one-liner
        
        PID:5868
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Program Files\Windows Defender" /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1472
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Program Files\Windows Defender" /grant administrators:F /t /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5168
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c rd /s /q "C:\Program Files\Windows Defender"
        6⤵
        Executes a command shell one-liner
        
        PID:1604
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Program Files (x86)\Windows Defender" /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2976
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Program Files (x86)\Windows Defender" /grant administrators:F /t /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5440
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c rd /s /q "C:\Program Files (x86)\Windows Defender"
        6⤵
        Executes a command shell one-liner
        
        PID:1980
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1700
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Program Files\Windows Defender Advanced Threat Protection" /grant administrators:F /t /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2284
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c rd /s /q "C:\Program Files\Windows Defender Advanced Threat Protection"
        6⤵
        Executes a command shell one-liner
        
        PID:5140
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Windows\ELAMBKUP" /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4464
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Windows\ELAMBKUP" /grant administrators:F /t /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4472
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c rd /s /q "C:\Windows\ELAMBKUP"
        6⤵
        Executes a command shell one-liner
        
        PID:3820
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Windows\system32\drivers\WdFilter.sys" /a
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4536
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Windows\system32\drivers\WdFilter.sys" /grant administrators:F /grant SYSTEM:F /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2868
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Windows\system32\drivers\WdBoot.sys" /a
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3516
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Windows\system32\drivers\WdBoot.sys" /grant administrators:F /grant SYSTEM:F /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2352
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Windows\system32\drivers\WdNisDrv.sys" /a
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3864
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Windows\system32\drivers\WdNisDrv.sys" /grant administrators:F /grant SYSTEM:F /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1056
      - C:\Windows\SYSTEM32\takeown.exe
        
        takeown.exe /f "C:\Windows\system32\drivers\WdDevFlt.sys" /a
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4740
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls.exe "C:\Windows\system32\drivers\WdDevFlt.sys" /grant administrators:F /grant SYSTEM:F /c /q
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4072
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /F
        6⤵
        
        PID:1404
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /F
        6⤵
        
        PID:4804
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /F
        6⤵
        
        PID:1928
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /F
        6⤵
        
        PID:5128
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Unknown" /F
        6⤵
        
        PID:4852
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Update Configuration" /F
        6⤵
        
        PID:5092
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c schtasks.exe /Query /FO CSV /V > "C:\Users\Admin\AppData\Local\Temp\~DF4C2A1B.tmp" 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:2040
        
        C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Query /FO CSV /V
        7⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\tnvczkgd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tnvczkgd.exe"
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\tvpcav7o.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tvpcav7o.exe"
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
        6⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
        6⤵
        
        PID:408
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf047e051.bat"
        7⤵
        Executes a command shell one-liner
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\winlogon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\winlogon.exe"
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\lsass.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\4l5dujux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4l5dujux.exe"
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Users\Admin\AppData\Roaming\Ulmyax\qopeb.exe
        
        "C:\Users\Admin\AppData\Roaming\Ulmyax\qopeb.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2756
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4ec26223.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\profile_sync__chrome_4100" --no-first-run --no-default-browser-check --disable-popup-blocking --disable-background-networking --disable-sync about:blank
      4⤵
      Loads dropped DLL
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\profile_sync__msedge_4100" --no-first-run --no-default-browser-check --disable-popup-blocking --disable-background-networking --disable-sync about:blank
      4⤵
      Loads dropped DLL
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
      4⤵
      Executes dropped EXE
      PID:1552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:3580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:2472
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        
        PID:3168
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\B9A0958E12DB454986ED.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9A0958E12DB454986ED.exe"
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\is-LDXJO5HEKE.tmp\B9A0958E12DB454986ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LDXJO5HEKE.tmp\B9A0958E12DB454986ED.tmp" /SL5="$D0118,3709115,898560,C:\Users\Admin\AppData\Local\Temp\B9A0958E12DB454986ED.exe"
        6⤵
        
        PID:1368

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5808

C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Roaming\Ulmyax\qopeb.exe
C:\Users\Admin\AppData\Roaming\Ulmyax\qopeb.exe
1⤵
- Executes dropped EXE
PID:5788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1132

C:\Users\Admin\AppData\Local\Temp\tvpcav7o.exe
C:\Users\Admin\AppData\Local\Temp\tvpcav7o.exe
1⤵
PID:4320

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

1[2].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T62SOWKB\1[2].exe
Size 166KB
SHA256 fcbe9f2d0f07f6c40b258228148fb61e94f4dc59962f2fd4e3ed3051d90cfa3b
MD5 b61499aed9660923cde55a2cd3c88cc5
SHA1 8b1260a28e06c9c0c2d5ae48195aab24926901d3
SHA512 ee96b28539d8a6f75a0e3678420f8e764f26ec36a91c07e1b66421bbd2d723ed818a3ed7dd756a0d70aaac8a1c73960f67f1888ca9cfd99750a465af1ba8461d
SSDEEP 3072:btJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvOvHXrbl5STd:bwCszCYJ8OcgsaftB
TLSH
T1FDF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fw0hx90.exe

Path C:\Users\Admin\AppData\Local\Temp\3fw0hx90.exe
Size 4.7MB
SHA256 ebbb9c3cc42ab9028336da01176293ede39a3f611829728d1a86e4b08d67263d
MD5 f6f2269e6397e76e64ce58b17fb149ce
SHA1 22865221e7a83a05a690d964fb89e05b8fdb0a14
SHA512 3128bb005357ab7df26354cad2e5774266f4f4fbe998332684d125c9f864c042393feba3e7af256c5252905d27c4a6ccaae328124e3cff22c655454416c98c17
SSDEEP 98304:VAX72A6JXaCRG20P7FCgSrEWjq7erB1RuVJFrl/hjq/TDo:U2AeXdH6FC5BOLFl5mPo
TLSH
T162360123F2CB613AE36E5A37D976B130453B6E106C138D0A96E4E46CCF35D603E3A656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4l5dujux.exe

Path C:\Users\Admin\AppData\Local\Temp\4l5dujux.exe
Size 100KB
SHA256 4fb1aef4c32c9d2e694798fc695b2d81b9ec8a2978c932a4f6f75690e5252ea8
MD5 2c337b02206e1ef8b721f0d7c303761e
SHA1 c75a611aeb21b5bda1421093daa65141116dc863
SHA512 a804d26b98de7847a25fa2b90fd937996dbc83b0df8366d3319273187fb8d0ed9d4737914d7b5a135970d8cc885d470411e5e12fdb095f05c3f8d568652a0ba5
SSDEEP 1536:cOUIcNQDgbcKBiNSS0naCjXFq2SfbJ64MIIupJj4tzeJHQsWf3Nd09dlxzr:DUDogbKNIVF56gpIIupIee3nMvzr
TLSH
T163A36A9B73A530E8E6768238C8650A05EB77B8311621DF6F03A446861F273D19D3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fw0hx90.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-F87PUZAQXK.tmp\3fw0hx90.tmp
Size 4.2MB
SHA256 cd7f1a1f1505394737215ddccd4523ca51df6dc54c04b69d4a08fbccf894a01a
MD5 c2dc5f299822a831d4856d96ad0cb657
SHA1 cb2b1eb01c970f259665cf995aaec0ed9a145466
SHA512 cc63b18c3bc88d9781efb9ffd4ae31c8a181bc80ac6c56f75d8579a30b667fa73f9aa54e3e2ad2641c1f3d4acc5dcbbd9481bf129fd679f1dfc6de8e79e4ccb7
SSDEEP 49152:loPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOo333Wo:lgw26xBij3QG+ddr9/OzGbRwr333l
TLSH
T1E6166C13F2C6653AD5671A3B883BB268583B7F303A178C477BE45D4C4E39A406D2A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-XLEUKNR1G1.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j0rtt6mp.exe

Path C:\Users\Admin\AppData\Local\Temp\j0rtt6mp.exe
Size 166KB
SHA256 a564ca03842ac237973a6f07a1c25fb5a072d8fb7424b6ac8684888377391d9a
MD5 9f0ffb9820e62b6ef058a4cc72be5b4c
SHA1 211ff312c1ee2ef378ff2b5331bd1b7cb773af3e
SHA512 9fe5007c0d27139b43ee152264e304c2d5a8807ac8a5092344e8090eb8c093f6cd5571df498c70c7139b1d6596b6271b2e57e09358c7907a6977e6dacc347d47
SSDEEP 3072:td6/4CsQSODs98mIOWgxwlIFaKAzhDEWxrGvMvHXrb15STd:tJCsDSs98JswWaKAu8R
TLSH
T1D5F37C4A73E510FDE1378239C9551905F772782607209BAF07A04BBA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kxg7xhgo.exe

Path C:\Users\Admin\AppData\Local\Temp\kxg7xhgo.exe
Size 166KB
SHA256 41c0b926d585a233471fd35953c36fca3d3cf7b83060bda5a41ffa6da8317b7a
MD5 1837d886fd3a1a07788f41a3d16416a1
SHA1 bd25114e87be36b5056d4ebba531cbea1058cb7b
SHA512 17f6826e45631ed667d50b676eb39d786a8d1c65d5eccad90c453059af9934cf5d71f583931f966208642484124b072bee46017dcffbdc8f19ecce4621e84285
SSDEEP 3072:Od6/4CsQSODs98mIOWgxwlIFaKAzhDEWxrGvNvHXrb15STd:OJCsDSs98JswWaKAuVR
TLSH
T1D1F37C4A73E510FDE1378239C9551905F772782607209BAF07A04BBA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sf3af29a2.dll

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir_348b\Sf3af29a2.dll
Size 186KB
SHA256 c7c7f4f03110bf6254b23f7cb47063b372da1168fd79a54289d362a679a21c64
MD5 97eefcb2ad3a24986251c1bc074f52db
SHA1 cebd4878216bf3cd60b588565dc9e0d4aeca0e6e
SHA512 a5052ab58e3d391dcec984ce0410692795319d5a3706229ed82a1489f77c1e18cf59a82abf036caffd72d4a80988a1dd915cce0860987551ead37d428dc0a830
SSDEEP 3072:NJN07C5ozWeV08qRxfPKpCCpGZskCK597UODQsU1j0JkoiWK2CSwBjgDh:NJ9EmvOpGZsUgOEtuktV2ChgD
TLSH
T132146C66F60950B9E489C07C821A5572B67B7CC50B216AFF22A872342F3ABD17F3C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfjcg93m.exe

Path C:\Users\Admin\AppData\Local\Temp\sfjcg93m.exe
Size 212KB
SHA256 1cbad26e560805b31cdd674e17de876d2791a2534e25c6b6c87547d762b92ead
MD5 d4c8da8391131faafbc1622050df06d6
SHA1 e67a542b01dec3265263b2d2b87d8c1381403d00
SHA512 5b24071d9958b414b6992080f3013de28d827d474c3fec5934c93125d9b00fb95aede325478310b185e8d1f394e39c1882236f9090958fb7b47e50075c33a01e
SSDEEP 6144:S3GvcwEi6j2eE1dwp9FKoN0zzeqhxE4Zf:QGvtwpiS0zzeeBd
TLSH
T1F7248D6BB4E41BB4F46FE235C5456B26C1F2344A5B31D29F51B48EE62F13332A22D386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp1.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp1.exe
Size 54KB
SHA256 985ead812b8b99573d2567169d73968a3754b4fbea16447bea2ac878974e6110
MD5 26b59bc7336133a5e2f3c696584a9cb9
SHA1 bc2f26426ab52186449688d6e56326a4ef65de27
SHA512 6292a2c4e44449cd7f02aebb2b3f3f6c6b9425c851b75946575004a84b075ab9a26dd2cd705b5dbd41d9eaf672217ed7c0e611b6c99bd0190e3a001986085b36
SSDEEP 1536:KP2AunwYLdkqx4sOLsWz129UXMRRpUafq8LECJu:znXfqLsWJ2LRJfq8Lbu
TLSH
T1ED43082653A213B9D9EAC636C9F4533BF1F07542BA26931F0378F6281B73742751CAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp2.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
Size 212KB
SHA256 933e29899de1ff32f50bf687c38835e4b2d3de29934cb66386948b4befd8e1cb
MD5 c7171b652dca77633dbfe2cb13468055
SHA1 d25eccacd7fd3d84aabf1674ede1a9dc48d26dad
SHA512 081668c2025c9e186a1136a3415b0a4b1bd24e063a06e1f8b921a54e94ebedfcb7dbcc9e970e11a7b861c44283a0525dcd292ea471f1c41727a63a1e47470714
SSDEEP 3072:rS/umYftd1ew8WiRLNSQ94fyU8ImVhyCn26WOFz0lkAPxETc7rRxjytD:rCNEN8WENSQefycwhyK2loMxEOryN
TLSH
T138247E6BB5F45BB8F46FE235C9416A26D1B274091B31D38F22B48ED61F13332A22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp3.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp5.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
Size 2.3MB
SHA256 ea449d04d3a664eadbff4e054b1717ce36db82c40d27f179833cf15118de9e73
MD5 158a748771be8a06b496a410516d63a9
SHA1 a5926b439887f3f8d4f6b2686c5d4081673ff862
SHA512 491f1f18dc0f03261b5984255036e37c930cf368d7c11df4aead335a2feb8dcae366b575d4d2f3114d53e396568bdd1b940a20749ff562614dfb746d261b46bc
SSDEEP 49152:Lp2n/GN8i6JmPXcjxR2Z3Au/PJvTs6EBC:xCxRa/54
TLSH
T1FAB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4ec26223.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4ec26223.bat
Size 193B
SHA256 e7bfd0043bf2a2bf875828fffc09f6fa705cfbaf552184a4b106daa33d3c4e0c
MD5 3cffb46b842c4edd801b348bce045782
SHA1 d8691c7272970e08c2c1a938b5a087cd6a3b22ee
SHA512 b303c3d89934d9429862ea57931182738b4c2bd6316b8b20065ca1593b709392ec5e987e209080e0cff8d836951e7f944d7188ae73791278e2df88acc000ff3e
TLSH
T124C0124581DBC6991809517706A5718DE0BA8C983F8B27185F21C45E719641DF5DB382
MD5 SHA1 SHA512 TLSH

Submit Download

tmp99ddd02d.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp99ddd02d.bat
Size 195B
SHA256 0171c80f5f7b1912ca52ca02b877b8628fa70a900173f31fbaf457a4df9c7c30
MD5 723283a1581ac9397efb7f8af1ff4fed
SHA1 02323f6b891a623dc8e1ba399d4e2b6fdd39bdda
SHA512 32971f288c958b15d9bd296e943d30bd332b5c2eee7b540fd28e091930709b25ad2ba0cb694459bfbd1ec9b684652abba1b5d61ec8d3ae18d1dfe262fee83f11
TLSH
T1DED0120641C6CE5A184851BB0AAA698DE0BD48993F8F2B145671C85E72D341DF6DF341
MD5 SHA1 SHA512 TLSH

Submit Download

tmpf047e051.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpf047e051.bat
Size 195B
SHA256 4199daea41eb23e843db0373a04d3ed81e4b878f1ecc1bf1ca0f55118363761e
MD5 55701c4151a0e38fd7f0e5e795199930
SHA1 902df4d63877e8bfdbc52d1c1fe182d16897d862
SHA512 349f34c085936940905032217fa1f1426f8dc679332ea8432cb5bfb9051a2164684d13fe41c9b806823bc13fc5d7786e523407877af40b2b3e0e461aefa052ce
TLSH
T19CD0124142C6C659280C95A706E6A1CCE17908683FCA7B545621C55DA2A241DF6C7342
MD5 SHA1 SHA512 TLSH

Submit Download

tnvczkgd.exe

Path C:\Users\Admin\AppData\Local\Temp\tnvczkgd.exe
Size 257KB
SHA256 0b594995b053042d2985260ee4092d9a46705e5f9fa4a482d476a5857714307d
MD5 b828e126346def192551a0917ca9264d
SHA1 c04fff6cb2652d6465ed3b3759225b9d8ba90aa9
SHA512 e649d29f0a8175d2d361ba8edd8f1a7fe1b18e8b2e47d8c7c4edf02e17a76af9b963e6d900c6d35ab0d142bbc5d675310b28762285ea133ee720dd40b3919efa
SSDEEP 3072:RpFyagHeoO59yMNTwIabzeUjymtes8gr6nwZcKtuMq7wORu3ee8/SKoY46PpdNKY:R2aAMNTwIc3jymtes8gOnwZq7wIohbY
TLSH
T1FE446B4A72A90CF8EDB7813CC9525A46E672B81607B0D6EF07A043675F276D09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvpcav7o.exe

Path C:\Users\Admin\AppData\Local\Temp\tvpcav7o.exe
Size 120KB
SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
MD5 842b09509ab819c1e7edecd41d4c301b
SHA1 38efdf62dfb36898c662bb912c0e76d79e8836bf
SHA512 aa3ecddb8af12b6970fccd5106406f86bf55656193b0683da17b23ce47d3abe4cd7e64c4377206664709678f338c338d5e0ba44b193cb38b34113ea33ec29e6a
SSDEEP 1536:HlyFwDCtFe20zYrnw5p15i8VOTypRxn2KXdTY+sWLdP9dldGOIJ:HlyFPtv0kTwDxUepRx2KG6vbGOI
TLSH
T1C2C36B1777A530F8E17B823589215A16E7B378310B758B6F03A4426A6F277D09E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v2ns0yvm.exe

Path C:\Users\Admin\AppData\Local\Temp\v2ns0yvm.exe
Size 224KB
SHA256 75afc0bbcd3ecb351965247e92a74c22dfe69517874cdd8eae1b8e8c06017875
MD5 4bcfcbec33b667a47277f6c702336616
SHA1 3deb5a9d43de00372c85a87f43a160005dc448a6
SHA512 3f889b06ede74b625eb862f64a7e5f9fd92e016b2a28cd6f26519bbd1bf0fce43230b64b53d963211e69f649d8666f14dd374ed97a74a24f91f2be09b6027374
SSDEEP 3072:jk+2d+PvEnBBnfmYD2ZBOj0XyzJs27Ru1fFDXq/jMNxHS8S0jNea+z8EN9lDr+k:jkHd+nEBBfmYDCB3i22sLxXS2elP+
TLSH
T19F244B0672A501FDE07BD138C9915A02E7B6B8161720EEDF07A006769F27BD2BD3DB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF4C2A1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\~DF4C2A1B.tmp
Size 7KB
SHA256 6d298b7639c317198404666cac67482020f745130213a8a020fd3137b1b6ded5
MD5 86044ee2898d701175d2d278345bd689
SHA1 a6a612026beb7ffbaf8702f8b70c6be5ccc9e0d4
SHA512 ab5301be3c338baa91e7649b00227581f1276d175e64adf11ba44d8d703fd3d6562eba5d7a2e4050e1f7cafabc7c20d53eb1787455c583e601fe7c4f2ea3d0e8
SSDEEP 192:alwDQMlwnlwnlwnlwnlwnlwnlwnlwnlwnlwnlwnlwUlwRQ9:aSDPSnSnSnSnSnSnSnSnSnSnSnSUSRE
TLSH
T120F158AE03855D7BDBC809B9F1FC2B4E3D608306AA9F8944D9855074819E2D9D377F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qopeb.exe

Path C:\Users\Admin\AppData\Roaming\Ulmyax\qopeb.exe
Size 212KB
SHA256 ede0298bd6fe60fb50cd130870ddcc79464441a1f844b2a9e147edec36857a83
MD5 ff033be61f1c29ba9c7caec93cf636ac
SHA1 48fdbaf00d407cd08fab420fb8bf7fdaa63f11c9
SHA512 1cb6d45cbc4ac5e650c8beb0b3b6e14345148d554f84a0478f988eaefb2e9c58330f6872a0d45f240d1ea46127a7cbf09c4ce04323ed4c8d57d3669050871023
SSDEEP 3072:rS/umYftd1ew8WiRLNSQ94fyU8ImVhyCn26WOFz0lkAPxETc7rRxjytZ:rCNEN8WENSQefycwhyK2loMxEOryD
TLSH
T142247E6BB5F45BB8F46FE235C9416A26D1B274091F31D38F22B48ED61F13232A22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-57-0x0000000001DB0000-0x0000000001DBB000-memory.dmp

Download

memory/1624-68-0x00000000027D0000-0x00000000027EB000-memory.dmp

Download

memory/1624-77-0x0000000005010000-0x00000000050E3000-memory.dmp

Download

memory/1624-76-0x00000000047E0000-0x000000000500A000-memory.dmp

Download

memory/1624-67-0x00000000026A0000-0x00000000027C1000-memory.dmp

Download

memory/1624-65-0x00000000022D0000-0x000000000264C000-memory.dmp

Download

memory/1624-74-0x00000000041A0000-0x0000000004239000-memory.dmp

Download

memory/1624-73-0x0000000004120000-0x000000000412C000-memory.dmp

Download

memory/1624-72-0x0000000004160000-0x0000000004198000-memory.dmp

Download

memory/1624-71-0x0000000004030000-0x000000000404C000-memory.dmp

Download

memory/1624-70-0x0000000002A10000-0x0000000002A3F000-memory.dmp

Download

memory/1624-69-0x00000000027F0000-0x00000000027FD000-memory.dmp

Download

memory/1624-66-0x0000000002650000-0x0000000002698000-memory.dmp

Download

memory/1624-63-0x00000000020D0000-0x0000000002173000-memory.dmp

Download

memory/1624-62-0x0000000001FB0000-0x00000000020C6000-memory.dmp

Download

memory/1624-61-0x0000000001F00000-0x0000000001FA7000-memory.dmp

Download

memory/1624-60-0x0000000001E50000-0x0000000001EF9000-memory.dmp

Download

memory/1624-55-0x0000000001B20000-0x0000000001DA3000-memory.dmp

Download

memory/1624-53-0x00000000019A0000-0x0000000001B16000-memory.dmp

Download

memory/1624-51-0x0000000001740000-0x00000000018D9000-memory.dmp

Download

memory/1624-49-0x0000000001010000-0x0000000001706000-memory.dmp

Download

memory/1624-64-0x0000000002180000-0x00000000022CB000-memory.dmp

Download

memory/1624-58-0x0000000001DC0000-0x0000000001DE7000-memory.dmp

Download

memory/1624-59-0x0000000001DF0000-0x0000000001E1A000-memory.dmp

Download

memory/1624-56-0x00000000018F0000-0x000000000190A000-memory.dmp

Download

memory/1624-54-0x00000000018E0000-0x00000000018ED000-memory.dmp

Download

memory/1624-52-0x0000000001920000-0x0000000001994000-memory.dmp

Download

memory/1624-50-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Download

memory/1624-48-0x0000000000FB0000-0x000000000100D000-memory.dmp

Download

memory/1624-75-0x0000000004240000-0x0000000004266000-memory.dmp

Download

memory/1624-47-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

Download

memory/1624-46-0x0000000000CD0000-0x0000000000E93000-memory.dmp

Download

memory/1624-45-0x0000000000B30000-0x0000000000BCD000-memory.dmp

Download

memory/1624-44-0x0000000000680000-0x0000000000A21000-memory.dmp

Download

memory/1624-78-0x0000000004270000-0x00000000042A5000-memory.dmp

Download

memory/1624-43-0x00000000005B0000-0x0000000000677000-memory.dmp

Download

memory/2568-39-0x0000000003C10000-0x0000000003C51000-memory.dmp

Download

memory/2568-40-0x0000000003C10000-0x0000000003C51000-memory.dmp

Download

memory/2568-38-0x0000000003C10000-0x0000000003C51000-memory.dmp

Download

memory/2568-37-0x0000000003C10000-0x0000000003C51000-memory.dmp

Download

memory/2568-97-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/2568-28-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download

memory/2568-88-0x0000000001300000-0x0000000001301000-memory.dmp

Download

memory/2568-20-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/2756-101-0x00000000006A0000-0x0000000000A41000-memory.dmp

Download

memory/2756-119-0x00000000020B0000-0x00000000021C6000-memory.dmp

Download

memory/2756-125-0x00000000028D0000-0x00000000028EB000-memory.dmp

Download

memory/2756-118-0x0000000002000000-0x00000000020A7000-memory.dmp

Download

memory/2756-116-0x0000000001B60000-0x0000000001B8A000-memory.dmp

Download

memory/2756-114-0x0000000001B20000-0x0000000001B2B000-memory.dmp

Download

memory/2756-113-0x00000000018F0000-0x000000000190A000-memory.dmp

Download

memory/2756-111-0x00000000018E0000-0x00000000018ED000-memory.dmp

Download

memory/2756-127-0x0000000002B10000-0x0000000002B3F000-memory.dmp

Download

memory/2756-117-0x0000000001BC0000-0x0000000001C69000-memory.dmp

Download

memory/2756-120-0x00000000021D0000-0x0000000002273000-memory.dmp

Download

memory/2756-126-0x00000000028F0000-0x00000000028FD000-memory.dmp

Download

memory/2756-104-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

Download

memory/2756-107-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Download

memory/2756-109-0x0000000001920000-0x0000000001994000-memory.dmp

Download

memory/2756-115-0x0000000001B30000-0x0000000001B57000-memory.dmp

Download

memory/2756-123-0x0000000002750000-0x0000000002798000-memory.dmp

Download

memory/2756-105-0x0000000000FB0000-0x000000000100D000-memory.dmp

Download

memory/2756-100-0x00000000005D0000-0x0000000000697000-memory.dmp

Download

memory/4100-99-0x00007FF6433B0000-0x00007FF6434D6000-memory.dmp

Download

memory/4100-0-0x00007FF6433B0000-0x00007FF6434D6000-memory.dmp

Download

memory/4336-91-0x00000168AC610000-0x00000168AC642000-memory.dmp

Download

memory/4336-8-0x00000168A8D50000-0x00000168A8D52000-memory.dmp

Download