stealc | 046c4924818902ea213e2077a7257eeadb388ac3682be1c6621274c2cab45bf2

Analysis

max time kernel
37s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe
Size 26.1MB
Sample260922-bevx8acc74
SHA256 046c4924818902ea213e2077a7257eeadb388ac3682be1c6621274c2cab45bf2
MD5 3e64e525e33e8bf7a983afea6e802648
SHA1 a5ff714e1cfec995d946ec20ad5c1c1f616a2ec1
SHA512 a60326dd77b6e37d05a533e65f852bc69cba8b7988072da12fa928f3d4b9f38b91efa0f77fb8d3cd91045a81e22207e6f2b23df6d6e32dfdb52f6fbf7ab63b8e
SSDEEP 393216:rgTs57q4kzztgkntS5lAuL8MArsVQ4+16GzAZ6n9c9M5Qmd5YH0XZz+2Dt6i4LfQ:rhU4kXtBtsP4pYGP9ynmd5fZzs5Q
TLSH
T1F657335A32919917F460DA72C8040598FF72B8321BD0DA3A4917B1BABD1F2FC7ECE645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

20x09x2026 discovery stealc installer persistence stealer

Malware Config

Extracted

Family

stealc

Botnet

20x09x2026

http://193.178.158.107/auth.php

Attributes

url_path
/auth.php

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c571-19.dat	family_stealc_v3

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral2/memory/4348-40-0x000001F552790000-0x000001F552792000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/5800-66-0x0000000002510000-0x0000000002531000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Executes dropped EXE 15 IoCs

pid	Process
1332	j2bum7xo.exe
3200	g9pvz4w4.exe
8	crbn9dcf.exe
3624	syshost.exe
5408	wgichg9g.exe
2312	g6jys69z.exe
1036	j2bum7xo.tmp
4852	keto34km.exe
2876	4uk5j9mn.exe
5728	synchost.exe
624	skylineloader.exe
5572	wlrmdr.exe
4340	svchostzlu.exe
4176	syshost.exe
3968	synchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1036	j2bum7xo.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Syshost = "\"C:\\Users\\Admin\\AppData\\Roaming\\syshost.exe\""	g9pvz4w4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\svchostzlu.exe"	crbn9dcf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
624	skylineloader.exe
624	skylineloader.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\synchost.job	synchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j2bum7xo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j2bum7xo.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000f00000001c558-2.dat	innosetup
behavioral2/memory/1332-8-0x00000000004B0000-0x0000000000598000-memory.dmp	innosetup
behavioral2/memory/1332-77-0x00000000004B0000-0x0000000000598000-memory.dmp	innosetup
behavioral2/memory/1332-96-0x00000000004B0000-0x0000000000598000-memory.dmp	innosetup

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4852	keto34km.exe
4852	keto34km.exe
4176	syshost.exe
4176	syshost.exe
624	skylineloader.exe
624	skylineloader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5800	explorer.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeDebugPrivilege	4176	syshost.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe
Token: SeShutdownPrivilege	5800	explorer.exe
Token: SeCreatePagefilePrivilege	5800	explorer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1332	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4856 wrote to memory of 3200	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	91
PID 4856 wrote to memory of 8	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	92
PID 3200 wrote to memory of 3624	3200	g9pvz4w4.exe	93
PID 4856 wrote to memory of 5408	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	94
PID 4856 wrote to memory of 2312	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	96
PID 1332 wrote to memory of 1036	1332	j2bum7xo.exe	95
PID 4856 wrote to memory of 4852	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	97
PID 4856 wrote to memory of 2876	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	98
PID 4852 wrote to memory of 4348	4852	keto34km.exe	59
PID 4852 wrote to memory of 4396	4852	keto34km.exe	60
PID 4852 wrote to memory of 1372	4852	keto34km.exe	81
PID 4852 wrote to memory of 5800	4852	keto34km.exe	82
PID 2876 wrote to memory of 5728	2876	4uk5j9mn.exe	99
PID 5800 wrote to memory of 1584	5800	explorer.exe
PID 5800 wrote to memory of 3076	5800	explorer.exe
PID 5800 wrote to memory of 5156	5800	explorer.exe
PID 4856 wrote to memory of 624	4856	2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe	103
PID 4176 wrote to memory of 5800	4176	syshost.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1372
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Users\Admin\AppData\Local\Temp\2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-21_3e64e525e33e8bf7a983afea6e802648_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\j2bum7xo.exe
      "C:\Users\Admin\AppData\Local\Temp\j2bum7xo.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\is-CTCUH6N86Q.tmp\j2bum7xo.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CTCUH6N86Q.tmp\j2bum7xo.tmp" /SL5="$4019C,3755066,888832,C:\Users\Admin\AppData\Local\Temp\j2bum7xo.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\g9pvz4w4.exe
      "C:\Users\Admin\AppData\Local\Temp\g9pvz4w4.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Users\Admin\AppData\Roaming\syshost.exe
        
        C:\Users\Admin\AppData\Roaming\syshost.exe
        5⤵
        Executes dropped EXE
        
        PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\crbn9dcf.exe
      "C:\Users\Admin\AppData\Local\Temp\crbn9dcf.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:8
  - - C:\Users\Admin\AppData\Local\Temp\wgichg9g.exe
      "C:\Users\Admin\AppData\Local\Temp\wgichg9g.exe"
      4⤵
      Executes dropped EXE
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\g6jys69z.exe
      "C:\Users\Admin\AppData\Local\Temp\g6jys69z.exe"
      4⤵
      Executes dropped EXE
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\keto34km.exe
      "C:\Users\Admin\AppData\Local\Temp\keto34km.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\4uk5j9mn.exe
      "C:\Users\Admin\AppData\Local\Temp\4uk5j9mn.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Users\Admin\AppData\Roaming\synchost.exe
        
        "C:\Users\Admin\AppData\Roaming\synchost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\skylineloader.exe
      "C:\Users\Admin\AppData\Local\Temp\skylineloader.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:5572

C:\Users\Admin\AppData\Roaming\svchostzlu.exe
C:\Users\Admin\AppData\Roaming\svchostzlu.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\AppData\Roaming\syshost.exe
"C:\Users\Admin\AppData\Roaming\syshost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
- Executes dropped EXE
PID:3968

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
PID:1936

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4uk5j9mn.exe

Path C:\Users\Admin\AppData\Local\Temp\4uk5j9mn.exe
Size 529KB
SHA256 ce0d27a44176caf7e574ca69bb38d8f20880fb3f8a694c41696d24edcb7f4129
MD5 b8961dde0920a57932994bbc4131c161
SHA1 b49ccfeefcf25308e4dcf6cc6a4d942bf925688e
SHA512 1dc61eed0dd5a6e075e5b68f51eea20a1c41e46ed980130a094b9f82d7dabc4ba02fa671cc24f69c245fef1784059a7f25d751d962b7e20632b8d5feb539513b
SSDEEP 6144:NjLNrSV/lRyH3foOsYlf0lPcRbLG9qSB5Vh69yRyQllVP9TlMXmjCohgyAqjT4pZ:hL5w0HDsY1acR/EP6M5FuwCoZAsE
TLSH
T176B45B5AA29943FCE07BE07CD9475A42F639744703B18AEF039045772E572E2AF7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crbn9dcf.exe

Path C:\Users\Admin\AppData\Local\Temp\crbn9dcf.exe
Size 160KB
SHA256 595ba12751e0e9bf048e2a1df0450d744426d8a21afe3ed14eb273e010c351ca
MD5 1d30ff6275ebbffbfda93cac7265c491
SHA1 3a51322ea62d3bd9db51e714a0894c6bdd2faaf5
SHA512 e231a86240a43bfd41b188c039d15a579b227ccabc178ecca26ebef8064884290cb9981b05628c6a0c011198e60da6092ca46b7ab2de9257d2044a0b9331d6d6
SSDEEP 3072:7tHM5WfKM3SADLqa+DeWfNL8OXMdBY+F/vlH9pi:7ts5WfFrLqBZLfMdKi7
TLSH
T1B6F35B0BB3A524F9D1778239C8A11A06F772783217618BEF07A407765F632D19E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g6jys69z.exe

Path C:\Users\Admin\AppData\Local\Temp\g6jys69z.exe
Size 52KB
SHA256 35e85dc1dc0e40726f511b8414ebfbd87fd7e75d5b9cba5c48a78ff41281ffe6
MD5 0db5991bed00dbaacd79b2df061c979e
SHA1 5a2a66e75a17285502775e4d670e56238d8ab671
SHA512 22da18382568de3bacdc41a233f6f504936edfa4aee2ba290cbe9039acc474022ec9725ced0f5e3a29042f646820aff6c0293340ff9b49b8718212c465e60871
SSDEEP 768:Yutv/xHqkobzZ4FzgrQVmcWi+Yb/beSud7lYVGRBHuNwM5N74F:YuxRc6WZYb/3ud7SVcB
TLSH
T19C335A423583D5ADE25A8CB45661B232E130BC6527222DFF7B94D43A3D36AC02E7CE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g9pvz4w4.exe

Path C:\Users\Admin\AppData\Local\Temp\g9pvz4w4.exe
Size 226KB
SHA256 b52b9e6735af28a3b67a6ff48622a02ddcfeb1d43ea4254198bd1448fc149db6
MD5 4c371bb8995207eb072f9a30032e47ef
SHA1 5c3db139e2a3cc029468445b88b885b2965c07d4
SHA512 cfc07053c6ffc6aebf8de70da077a32a0925c456fdae73618312e74c18638aeeaa5747855a2fa8e615de57d31eb2d30f3eebd849b16ffe922f77c802a5c24e08
SSDEEP 3072:Mu7oXKl1K+qYfeVEp8PrPaDEB+oLv8TzYqO7MEvJBFQoM28DZxhF3oMGHqcKdP:vAKlYPYaPwk+nH5O7MQGZzGVKdP
TLSH
T158345B0A73A508FBE836923DC8535A06E776B4160721CFAF076406AA5F277D09D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-APKS47FVKJ.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j2bum7xo.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CTCUH6N86Q.tmp\j2bum7xo.tmp
Size 4.2MB
SHA256 d9290b09364e2af27b95c65cd73678202ab7d4fd26722064d1d7a55524503a7f
MD5 8d14fd19ace5aded1f30283f71ed4386
SHA1 a9290a027b73d27da2b6eecc6b6eff2ec680af39
SHA512 4cc23e24df85204db2b9815a8bd7e197eb4c0657a2571bf98b4a10d2010ac8e46735c73b53d616a2ff63e22e0873ebf8c1c793b0b8068a5ea74ad81ecdab868e
SSDEEP 49152:1oPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOL3338y:1gw26xBij3QG+ddr9/OzGbRwM333h
TLSH
T1D2166C13B388653AE46B1A3B483BA658583F7F313A168C577BE40D4D4E396407E2A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j2bum7xo.exe

Path C:\Users\Admin\AppData\Local\Temp\j2bum7xo.exe
Size 10.8MB
SHA256 5ee6fd37ac43946e7bbd556bfd730c11d725ce0bc2b0dc734688f936f216ce2f
MD5 ecef61f6f8abfd7a98f254ad9537ec66
SHA1 6dd407470563347e6df4f944e035e09be47b5cf9
SHA512 f3e818584b459be0bfb7f8c842733fbea893e682961e723e6b90b068c205fb4affd29b909a191002a2388a8db29f0e3e29dcbf435cc84b23bee2e0af3ccdedbc
SSDEEP 98304:VAX7EZNJElKLdM2jAsqd+82B/VivzgTYp0oRPcr6DJKHl3NK:UGY8+2sBdAB/gbgTYpDI6DcHl3N
TLSH
T111B61237B28A653EE06E1A365AB3E210543B7A61AC134D1ED7F4489CCF251A03E3F657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keto34km.exe

Path C:\Users\Admin\AppData\Local\Temp\keto34km.exe
Size 55KB
SHA256 441627232462ff8f33eb995a2ec1cb53077a3a47699ce3bf6a9b320fa7c1fb40
MD5 4d0e58563a96ca551cfc9ddcc183cf1e
SHA1 b30dcf2adef57979c65f76c02901a77d0ee6426e
SHA512 1acd4ee33ae079d7e70db1a26f780e300e51b68ac0a789e690e7051c81ef51136e069810b5f233b8c6e167a1ef6e4bdbc524390109522369b640f037cac54c1c
SSDEEP 1536:1ez0lgRjV1k6KojQnfnlx7ZTwL3rETWUJG/iLj:/AjV1kIjQfnV0LwTWU8/iX
TLSH
T157432A2613EB835ADD27823CCDB69267D1E4FA457E30521F0F2EC90B1BB31657938A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skylineloader.exe

Path C:\Users\Admin\AppData\Local\Temp\skylineloader.exe
Size 13.5MB
SHA256 98692048fef03170ab43379f01b18173e692050ccef61eeb18b5e0e5ca15b7e3
MD5 0920940f9d5395a0ce7c39d87bb2316a
SHA1 935a0434a87c954c57b88aa02a1b23b4fcd51c0c
SHA512 dd907af0c0e9660d7f7282f87ed2bef2172c69337da8210be0934f0fbc455abd7274fdb7015cbf123f2fb6453e71b23b26d2d4066837eac97da5ba16ad1f78c1
SSDEEP 393216:Lc14wpP5/rUyBt4uBtOoDsRaWhzKu3v521eVW/YgR:Lqd5QyrBBZs0WMEW/YgR
TLSH
T175E623EA91E522E4E8D35A80724E9BCD71C0B25D45E96C2D3AC62C039F35D9F028DE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgichg9g.exe

Path C:\Users\Admin\AppData\Local\Temp\wgichg9g.exe
Size 766KB
SHA256 d6281a74e66950abb22861fd1ec68281d4975bd8aade8c26cf3a89820cdc9bb0
MD5 62ebf2222d0257515ed7f00bbd7a10bc
SHA1 76312b25d7fcfcd19017496efb1e05a803a3876b
SHA512 975f99f91d152e8beba5fa4ebfeedc4bc7b01bf38192ec6bb2d142d9af3c1411629a619e315556dd7814ac485fef6f4c9f4ef74b0077f9c87397b5a2d703cd63
SSDEEP 12288:rpS+rA4Tg4Co6Kew0MOaShacMXyxBlDetAqxSvvJ:rw+l04ljr09aEacmyb
TLSH
T1ECF47D1AF3A502FCD0BBC178CA524552EB72BC565370A69F03E14A6A1F376906F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 526KB
SHA256 5dc3ef3862dda1c7f3d289f52cffcd13f182dc393ca6b71fc6bcd95f7e8e9845
MD5 b5efb0e380735de832f10d767f0a165c
SHA1 66e02c27539e98132c2c4dcc3075f4ee56fee1c7
SHA512 d75a5c8852e8d66d78377a31cafcb054ac3e4faf8fff2d78c51771cdb0148140e45032fa9e8081f5247c4315e9c3fe34bddfd955c12fe96cdea5dda39e799a3d
SSDEEP 6144:jLNrSV/lRyH3foOsYlf0lPcRbLG9qSB5Vh69yRyQllVP9TlMXmjCohgyAqjT4pZ:jL5w0HDsY1acR/EP6M5FuwCoZAsE
TLSH
T19DB44B5AA29943FCE07BE07CD9475A42F639744703B18AEF039045B72E572E1AF7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-74-0x0000000140000000-0x00000001415E0000-memory.dmp

Download

memory/624-73-0x00007FF839400000-0x00007FF839402000-memory.dmp

Download

memory/624-72-0x00007FF8393F0000-0x00007FF8393F2000-memory.dmp

Download

memory/1036-95-0x0000000000160000-0x00000000005A6000-memory.dmp

Download

memory/1036-85-0x0000000000160000-0x00000000005A6000-memory.dmp

Download

memory/1036-83-0x0000000000160000-0x00000000005A6000-memory.dmp

Download

memory/1036-78-0x0000000000160000-0x00000000005A6000-memory.dmp

Download

memory/1332-8-0x00000000004B0000-0x0000000000598000-memory.dmp

Download

memory/1332-77-0x00000000004B0000-0x0000000000598000-memory.dmp

Download

memory/1332-96-0x00000000004B0000-0x0000000000598000-memory.dmp

Download

memory/4348-40-0x000001F552790000-0x000001F552792000-memory.dmp

Download

memory/5800-66-0x0000000002510000-0x0000000002531000-memory.dmp

Download

memory/5800-67-0x0000000003690000-0x00000000036B5000-memory.dmp

Download

memory/5800-44-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/5800-69-0x0000000003690000-0x00000000036B5000-memory.dmp

Download

memory/5800-57-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/5800-55-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/5800-56-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download