7670f7bc893c63807642b7cb56df36441055cb0e65b6408aa69a858a0f19149e

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
Size 20.1MB
Sample260929-vpcdeayfpg
SHA256 7670f7bc893c63807642b7cb56df36441055cb0e65b6408aa69a858a0f19149e
MD5 eb5308dbc6ad8524fa63f7682cb0792c
SHA1 28fe13dcce7dc4ced6f543803a02cb8a50c6273e
SHA512 0f34faf3b6e4b722dca0954d3cd7d3b804bd7c935292784e3969cba6541f3a68654914f90510489a84b6a876f2322129634e50487c84aaee562d71e705cdc860
SSDEEP 393216:9BA6V6y07YgW3UHQzaXSVqkQJY7PTiDvXnaQhqfkQIITC65MAAya5biUTt:L1r023UvzkUYaDvXhqfrRu6eBPT
TLSH
T13C273375F1483CE5E2A64036B965B92A0364B7538ECE50C993B8B64506B27E2FF23D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000024394-200.dat	acprotect
behavioral1/files/0x0007000000024393-210.dat	acprotect
behavioral1/files/0x00070000000243a0-250.dat	acprotect
behavioral1/files/0x000700000002438d-248.dat	acprotect
behavioral1/files/0x0007000000024390-420.dat	acprotect
behavioral1/files/0x0007000000024392-422.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_FF7A62A689D9FA30693DDF78F3A4037F	SRManagerSOS.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_FF7A62A689D9FA30693DDF78F3A4037F	SRManagerSOS.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024394-200.dat	upx
behavioral1/files/0x0007000000024393-210.dat	upx
behavioral1/memory/1660-217-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/1660-219-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/216-245-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/files/0x00070000000243a0-250.dat	upx
behavioral1/files/0x000700000002438d-248.dat	upx
behavioral1/memory/4144-251-0x0000000072020000-0x00000000720CF000-memory.dmp	upx
behavioral1/memory/4144-253-0x00000000720D0000-0x00000000723B7000-memory.dmp	upx
behavioral1/memory/1660-310-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/1660-317-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/1660-316-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/1660-318-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/216-320-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/216-332-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/4144-338-0x00000000720D0000-0x00000000723B7000-memory.dmp	upx
behavioral1/memory/4144-340-0x0000000072020000-0x00000000720CF000-memory.dmp	upx
behavioral1/memory/1660-364-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/1660-365-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/files/0x0007000000024390-420.dat	upx
behavioral1/files/0x0007000000024392-422.dat	upx
behavioral1/memory/4144-484-0x0000000072020000-0x00000000720CF000-memory.dmp	upx
behavioral1/memory/4144-483-0x00000000720D0000-0x00000000723B7000-memory.dmp	upx
behavioral1/memory/216-587-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/216-588-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/1660-792-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/1660-793-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/1660-825-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/1660-826-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/216-836-0x00000000732C0000-0x0000000073458000-memory.dmp	upx
behavioral1/memory/216-837-0x0000000072D90000-0x00000000732BE000-memory.dmp	upx
behavioral1/memory/4144-842-0x0000000072020000-0x00000000720CF000-memory.dmp	upx
behavioral1/memory/4144-841-0x00000000720D0000-0x00000000723B7000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Executes dropped EXE 8 IoCs

pid	Process
2788	Launcher.exe
1176	Launcher.exe
1660	SRManagerSOS.exe
4332	SRServerSOS.exe
216	SRAgentSOS.exe
1408	SRAppPBSOS.exe
4144	SRFeatureSOS.exe
4028	SRUtilitySOS.exe

Loads dropped DLL 12 IoCs

pid	Process
1660	SRManagerSOS.exe
1660	SRManagerSOS.exe
1660	SRManagerSOS.exe
1660	SRManagerSOS.exe
4332	SRServerSOS.exe
216	SRAgentSOS.exe
216	SRAgentSOS.exe
216	SRAgentSOS.exe
216	SRAgentSOS.exe
4144	SRFeatureSOS.exe
4144	SRFeatureSOS.exe
4144	SRFeatureSOS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2736	cmd.exe
4668	cmd.exe
4632	cmd.exe
4844	cmd.exe
4184	cmd.exe
2916	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SRManagerSOS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SRManagerSOS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SRAgentSOS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SRAgentSOS.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRManagerSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRUtilitySOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRServerSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRAgentSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRAppPBSOS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRFeatureSOS.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SRManagerSOS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SRManagerSOS.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	216	SRAgentSOS.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
4332	SRServerSOS.exe
1408	SRAppPBSOS.exe
1408	SRAppPBSOS.exe
4332	SRServerSOS.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4184	4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe	88
PID 4184 wrote to memory of 1768	4184	cmd.exe	90
PID 4784 wrote to memory of 2916	4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe	93
PID 2916 wrote to memory of 2336	2916	cmd.exe	95
PID 4784 wrote to memory of 2736	4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe	96
PID 2736 wrote to memory of 3872	2736	cmd.exe	98
PID 4784 wrote to memory of 4668	4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe	101
PID 4668 wrote to memory of 2960	4668	cmd.exe	105
PID 4784 wrote to memory of 4632	4784	SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe	108
PID 4632 wrote to memory of 716	4632	cmd.exe	111
PID 1176 wrote to memory of 1660	1176	Launcher.exe	112
PID 1660 wrote to memory of 4332	1660	SRManagerSOS.exe	115
PID 1660 wrote to memory of 216	1660	SRManagerSOS.exe	116
PID 1660 wrote to memory of 1408	1660	SRManagerSOS.exe	117
PID 1660 wrote to memory of 4144	1660	SRManagerSOS.exe	118
PID 4144 wrote to memory of 4028	4144	SRFeatureSOS.exe	120
PID 216 wrote to memory of 4844	216	SRAgentSOS.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
"C:\Users\Admin\AppData\Local\Temp\SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c C:\Windows\system32\expand.exe *.cab /f:* .\
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\expand.exe
    C:\Windows\system32\expand.exe *.cab /f:* .\
    3⤵
    - Drops file in Windows directory
    PID:1768
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2336
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
    3⤵
    PID:3872
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /run /tn ASOS1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn ASOS1
    3⤵
    PID:2960
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c schtasks /delete /f /tn ASOS1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn ASOS1
    3⤵
    PID:716

C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe SRManagerSOS.exe 1
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe
  "SRManagerSOS.exe"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exe
    SRServerSOS.exe -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe
    "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\Temp\bd2_request_5641431b2be530.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe
    "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe
    "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exe
      SRUtilitySOS.exe -r
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4028

C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01_sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\splashtop\sos\01_sysinfo.txt
Size 306B
SHA256 f493d758ff699172561a68790b394b79efb8e44d32bbb3ab5ca6382d63127ab3
MD5 5befbfbc4e3d6828acc3f888ee82da44
SHA1 74b133889029c7fdf8051fc53a615751c567b973
SHA512 78d1af96dffef63c9c0374bf732125aed77bf63d73be1b313e967b4faa8fecaa49748371dc3f88ec5f42a4942b1118e32a0f8313591cd9f34f6212ebbf936675
TLSH
T18EE08647034D4460BD5C3A0B6F37D4289260254A11EC20C3F7C59C3E1A6E6AB1340491
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.txt

Path C:\Users\Admin\AppData\Local\Temp\splashtop\sos\launcher.txt
Size 242B
SHA256 1cbe1aeb347e136306fcfc8f1fa39c2e4ba0090d6a98a4fd9aed05ff339d6ba3
MD5 ab76f377ac3eedd5a34da983f7795a64
SHA1 098546996ed416726e93487eb5b2b307d553c3bf
SHA512 d6edcb94e02da43883e8949a4220b162ecc59a7a3ac60980676ec126250d7e1af5af26e9fb71eeaa6a3e19cb2dfc9a7a82f84923da95466981d3b9f9607b1694
TLSH
T1FDD0C92C2FE40831B97ADA5BE8FF805762723ECA2D34990904C807584A77127F6A4B7D
MD5 SHA1 SHA512 TLSH

Submit Download

unpack1.log

Path C:\Users\Admin\AppData\Local\Temp\unpack1.log
Size 2KB
SHA256 d58de5b9583575af945580e9e424e8f8ba0c6a4aca8cc615e7814792db81db7e
MD5 c7c0ef60190dc4a27387ddb4312b280b
SHA1 6927a964d6cfe5b787fba70166b8731ef008d060
SHA512 01bb74fb579129c5b2c773d56d50e0e3c55f4d808754b096335145df6e987a2a95477249bc4af4139d76060c1c5cfc3478b27c214d7d7d9c62a68e6f9c5d5b93
TLSH
T1745185292EF8052396FBDADBEAFB51032E353A935D30D80C01D1170D049B95AE9797F9
MD5 SHA1 SHA512 TLSH

Submit Download

unpack1.log

Path C:\Users\Admin\AppData\Local\Temp\unpack1.log
Size 5KB
SHA256 01b9f77825299437db5ecffafbe22827bd6ae0f6e08786f71576b1a3451b4e0c
MD5 6578be226741b44415a757401eb061fe
SHA1 e500e051ff38b536e95a00167104b602ed8f2d04
SHA512 1caf6829e1769f99e5b03793a78e3034ad6bb5781d2da32355c4617c90d00146d0a229baa58013e8c7968970ce334c58d659c5dd5224ad97b5f3a06f165f527d
SSDEEP 96:+n6e6z62H6NmT6NUU9Y81JNVG1NuNq9Yq8+NVDFNtNF9Yk8NVgmNUNo9YeNV1jNb:IKFtZbsgpmFz
TLSH
T19DC1622A2EF4042396FBDADBEEEB41022E353E935D30D80C41D1170A049B95BE9797F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack1.log

Path C:\Users\Admin\AppData\Local\Temp\unpack1.log
Size 958B
SHA256 6ffbc96cfdf1abd7a063bc67108aab9b9a1b73ad92d332a59ab840b3b2899a52
MD5 8110271672e1895fb9355e2eb8e9f005
SHA1 ed23b95758bef8a5f165384c03d054b7792384b2
SHA512 9981ecc5631fcd02cba5b507f7da6a26eb4fcfd5edc635996b58bea001d705855671fff2747f66c888cb9d033643555474f6a570c94cb5477343df508400623a
TLSH
T1B111C6392EE8023395FFDAA7E5FB420376353A922871C90C01D1070D086B246E435BA9
MD5 SHA1 SHA512 TLSH

Submit Download

.cloudbuild.check

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.cloudbuild.check
Size 398B
SHA256 f7e14a9489863e696a5afd58255a13612c90e956922dfc504dec8ba4e6509088
MD5 1dc8879d3b369df8f181b77594b49288
SHA1 ddcc47ad3c61c95aa73979bde4691b2d55d2f54e
SHA512 d1af48e29b1290e40381719b5f0f8e6b2f8c2a5ceb7f38d0aa713b675a03404e38bde8f7cd04a9449cfbca8d36e730b87305601e64228749aef8d0d7c6c4160c
TLSH
T1A4E06105F0395C2F4318E2D6886F000197605E4356995C74AED6DC4CCF7D175347D778
MD5 SHA1 SHA512 TLSH

Submit Download

.cloudbuild.check.rsa

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.cloudbuild.check.rsa
Size 256B
SHA256 2d1ae62124cc12c892f3937c782c8adabe8e3340f7fe1b997d962baa351d355f
MD5 d424a215a1389f27aaaf101bc8eae567
SHA1 2f0227fce1a6c0867cb5ed84dc76e702e76414aa
SHA512 c13c1e173b4694fc8d70804a74331f8e56eeb06c67d6639b940c4add24f45511743067b5c8901d658cff1b5e7fe11d21067e1042123c0b5a5662cb8e1d8861e6
TLSH
T143D0EB8A7A9520E0E2818220859821C4DA2890423920B1069008AD92C1A485A0000833
MD5 SHA1 SHA512 TLSH

Submit Download

.config.json

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.config.json
Size 432B
SHA256 e806ab2c8240216d9ca3e0524687f9db64a58ff633fc7d4d5ed6ca8013fe1a2a
MD5 d368835f781d11e14e9ab7f4c5e0a6e0
SHA1 ab81d99251b3c697d28abdd16b42ebe3fbcb977a
SHA512 6d62974bf47ae48a0479d78a9093f10d12782eca3c162b537d2263699da165fd0810fd97537ec91fea960f5fe4739348dad91f7c6674c36f555c621a69857c34
TLSH
T137E03924E4675C2C00DBDAEECE9E27076ABD426181BC937D5978893800A72CD23508A5
MD5 SHA1 SHA512 TLSH

Submit Download

.init_setting.ini

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.init_setting.ini
Size 149B
SHA256 56a41a56324d7b26629da4243fcf51f2822b9d9817db409c15877dcaf7202d4b
MD5 841554ddeba2a843d519031f0465bc06
SHA1 faab7755cbb4c3bf7a0d2a937bef421d25984f91
SHA512 35874d3b2775948abbe46b7bab67517a768f051d3a4ca4441a452402665b22e9ddd7eef901b9489e24a5b63cb284a619a5211796a20a549442d1e4cba8744eac
TLSH
T14EC02B2250E69D1D9E7874346B698280CFF12B243E0FA1B4774102D512722A3C378C13
MD5 SHA1 SHA512 TLSH

Submit Download

.splashtop.sostheme

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\.splashtop.sostheme
Size 817KB
SHA256 bcc7b301c30105e09aacd134df78746030ee7d5d954e9fbf8ae8bfd87f917832
MD5 758db1ef67e0d68335501e90dabead2c
SHA1 01ba64887106c6c7336aef838d9a5f911d7336eb
SHA512 00b5698f759c637b1a447939b7a06ee7935b9df8c7a460f40d5063d395aaafc7ebd8fb2b46623463c0fd567e59d8d36719a636e835f0cc9662ce5647e88f4d3a
SSDEEP 24576:QuY1UuCspSX/+BeJelrPLX61HKYRd7qtU1tV9:t
TLSH
T138059EB971082DE6F66F8147E58ABC9C03667663DDCF688851FCA6810667B31FE12C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASOS.xml

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\ASOS.xml
Size 2KB
SHA256 1008bce6f93a3863164b0fea34bea07bd6ce304dffafac5615dc52bbb675bd47
MD5 8ce869f7dbbb2e38c8de76716e49b8a5
SHA1 de73a6b80fca67b06a7e1fec1904095d61b7b864
SHA512 98afa1fe513beb31bca44e56fe40f0a049d3bb0ccc7cf4997b8fb2631774131c7232072e733674a3ed6771201d53788e94d595e8254a5ffc4d6cc45ff93417af
TLSH
T132413A4367EE1218B1F76B6CBEB624614A63BC459D39C46C00AC240DCAF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Acknowledgements.htm

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Acknowledgements.htm
Size 153KB
SHA256 116d765d92d26205a27e2fb53412b10fe8837e68030f6ecab1359fed0106170d
MD5 feca7084a45f9933bbc1db986e28d166
SHA1 6ab943f7adf35a27f70a36aa4f2543c94ea223c0
SHA512 129bcc26c6415eb42faf0d5dc829a69b782901ec78f0c95c4e328fa0f099b135fcbb9a725212c57d55b4569cc7c54f17f91d4d505c9653642ab00bd16e5f7d08
SSDEEP 3072:ZHXt/BWDLm8arfT4h6+2j+S64ioX+C15titNI6cSM:gDLmtrfT4hj2ju0XtwGSM
TLSH
T18CE3952EB74503B216E202516A0FA4CEF31A903E366B5564349DC15C27BBF3583BB6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
Size 199KB
SHA256 96f371489ccde44d2410f06913f5633b0ee40411212e205f20fbd79eb01fc69a
MD5 b5870327941440613c450bd41b73f5a7
SHA1 61eb9ba9a76c04c38f7230ed86865ebd931a08e0
SHA512 6b3625969b6b5ce90117fedc5a9848f18f009e2ed30e5e69f65846df2c82545d13818c890509dcba21411747d32b22749ae7b0266e27301fd71bfb31c1d48284
SSDEEP 3072:MUzzfuGXMQn01BW1BSa1blsbXyf4ZxzdLJwr2AGHkGKdBcY0oKbachqulAgz9R:MUzzzXJcWzS2s+f4Z3LOOnlAgzf
TLSH
T136148D11B8C1C033D5665C3059E4CF759A3DBDA14FA5A8CB67944FFA8E202C19B39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuicServer.cert

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\QuicServer.cert
Size 920B
SHA256 8f13875939261027fb2f2622f55f6632f22e0177f11fb20202699dd38703dfc5
MD5 59a890770266bad00781d9447a8d7f1e
SHA1 aa925341a0d5de5c7a0a164825a3ec435f444489
SHA512 e0c6d445ab13db6b49ce88c9ca29005897740d105028edece7bdc3bcf27fd23bdfb91da2e4a041a808798999cf5a83d8a6ab033c8d39a5aba3bb094cf6abd865
TLSH
T12B1188AACCA35CCD5557CD7CC87F427B51164070AF4BB31816377C6992151009DFC044
MD5 SHA1 SHA512 TLSH

Submit Download

QuicServer.key

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\QuicServer.key
Size 1KB
SHA256 d2bccda1b6fdc6bf748710dc78fbe93f25328210e46fde64da66e841a78c90b6
MD5 2c8067311cf4c72a4e310e4c04e7658d
SHA1 e0b034c2b3033319b0c5df8af3666746997ee24d
SHA512 982a18fc551b26a7bc435577d63708cff4bcbfe6e334efbd6a43ba3965980fbb63765dec33a59b6988d779b6b71609a310fb83646c267eb70d584bbc4e9fb600
TLSH
T167312B8A4C6706AF8352E18165B45DCD9833B5BF58B019242E931501243E84EC82FCA4
MD5 SHA1 SHA512 TLSH

Submit Download

SRAgentSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe
Size 3.6MB
SHA256 f9e148bc3369049f15c7d87cab5463c4d5d948ab4d6b249ae09fec2b49fb4082
MD5 c8ad9a131ff5ede882cd7c5c4780f8cf
SHA1 a0b8a340e00f3ee1a08f8f85d46e3af33a36edef
SHA512 dd580f722ed95c811396f43901b487b8efb0e5151126ef7755ac661b529d194b0bcbbfdcb47011f8bc946a99356fa93fe1a5556a77bbfe72e96f6cad420657fb
SSDEEP 98304:lZ+B9chis6z1uvjOZ3WnwDflxxNQTadRjpPJjhy7p:Bhi8jGWnwDflxxNQTadRlC7p
TLSH
T14806AE23FACC807BE0610271652DA3A14A6CF6711A71C8CB73D46A4D56B29D1F27EF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAppPBSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe
Size 2.8MB
SHA256 91ee435c70e8769e5d83fadb613505c5ac3d7102e87f75755dcac928a2eb554a
MD5 2b214fed0977617001fe116fe3f640b8
SHA1 d77ee33e53309949a8898f84e55b21531613b74c
SHA512 f332960d2f61a4324fb9fb8125625d9da6889327e1725a784eb9b1e588e8b21fc5f58c2c1f22542b658c9425c31426d6855ed06902f17791c075a21da9b4306f
SSDEEP 49152:UI1SKYsZmCRdGS0Yn3WE/1ZGpkLUmq1Ip2ppZNsS8ujZR1kHWxl0OM0v:UI1SKJmC+nav1Z4kLTq1I4DZNsS88zSE
TLSH
T162D59E123E5063B2C5A387705D48F37AF1AD6D700F3E41C793D0FB2A29B55B24A19A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAppSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppSOS.exe
Size 2.7MB
SHA256 456ff720f6eb0077db319f3fcfb350c952984991fad6299f369ee7030102967c
MD5 7dd0f48f5b52064edf1e1a41d234d09a
SHA1 ab635546a4d5153504c7945248d7eabfaaaa180f
SHA512 157f2b009e52aa860afb53319b286879d6e85cad9ec4b871efd9f466bf6835e261c4c7185faa2aff9fa1ccbf1be022ca60a4c7d8e664c3be711a1e4a44c25ce1
SSDEEP 49152:nGkd8YmI5wLfVz6XZkTz/XTWpSzjnM1rHluUVlcO1kHW1KX0NL:nGwtJEz6XKzrWpSz72HluUVlfSW1v
TLSH
T13BD59F333A6043B6C1A30630991DFF7EE3BCAD7036B691E752C4FA1B1B754918619A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAudioChatSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAudioChatSOS.exe
Size 2.7MB
SHA256 d94348856bddc46de0c43b75b7f86d1b37f95708210be16e865b0efee7e5b36f
MD5 179aae95ee6a2d367c9cc33a44a23b23
SHA1 57f440e5fd72355b095d44d5ff233c7df46c80af
SHA512 1c8f30e0a690d3db53e0d3b66e752d28326a49338b7d68c364cede481c96c73344b52a66241d63ed1354a1be9aef46ed5bae1e8c7f6db016ab68a7fa38b56bfb
SSDEEP 49152:YxlgWDXbwrkWp4CNRJSegxz4XnEbWmlspziovPotEQhd/oFdAHix2+NvNEY8T:YxlgWDXEwIn07xcXnEbXlspzioveEQhJ
TLSH
T12CD56B23F7605366C3A20630AD0AF336E36CE764062F4097D3F4FA1A59756D24B1BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAudioResample.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAudioResample.dll
Size 130KB
SHA256 d03ef03137e1ab10466c2b4a3c2bb241a10a9ab5e49ced059fc0cf45732c92c1
MD5 f362278522ef9e03764362b876fd4e3d
SHA1 cf26298b9b3820f7f3e8973cd9f41123a03074df
SHA512 c6f919d21caea2ec5063556eff5af2575d6268754b509b7c56c5bf0d9d90bd76cf3232e2fc87c86710345eba9d0dbf4d39c0803f46d729b85bff05e8ccd87000
SSDEEP 3072:Y4L2ELbFPNg21VEdjTA34nnGfSotAY+I7iln15Nkm:f2mNgCVEdPEqnGw15N9
TLSH
T1E2D39D01B5C0C432D8BE19380874EB764F3E7970DFA09DDB639456AA9F742C09F36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRChatSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRChatSOS.exe
Size 2.7MB
SHA256 3261036d5e05738dca696c066c017bb1fa1d2d92340913dc5591de8672f04cf3
MD5 96cd7f7a94921783c59e09c0fedec3e2
SHA1 1f6dc29eca11af2c71fb8eee793168f657bc8edb
SHA512 69f2e10c799e672fca9f29706ae30b0f5aa701b59fdeea8b4def5c0a1a327196415d82a7e97288fd5a5294fedee12abc7aaa597313fb664dc1935f2b4746a0fe
SSDEEP 49152:gxlgWDXbwrkWp4CNRJSegxz4XnEbWmlspziovPotEQhd/oFdAHix2+NvNEY8C:gxlgWDXEwIn07xcXnEbXlspzioveEQh4
TLSH
T1FCD56B23F7605366C3A20630AD0AF336E36CE764062F4097D3F4FA1A59756D24B1BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRClient.pem

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRClient.pem
Size 5KB
SHA256 33fe8889070b91c3c2e234db8494fcc174ecc69cfff3d0bc4f6a59b39c500484
MD5 a8b2b3d6c831f120ce624cff48156558
SHA1 202db3bd86f48c2a8779d079716b8cc5363edece
SHA512 3b1fc8910b462ea2e3080418428795ca63075163e1e42a7136fa688aa2e130f5d3088ab27d18395c8c0a4d76bdc5ed95356255b8c29d49116e4743d269c97bf9
SSDEEP 96:LrdBs5tNThpCwTWYOHS2zkoGwhav1x6s7xPe47Oq1JmIyztq43ZEDRS4bcrkpk7:Hg5tNTDCdRoothav1xd7Be6Ositq43yY
TLSH
T13FB17E71BDA4CDFC2442F029999EB306C1B38A69916B8788DCF57841D3245CE3ABC4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRFeatureSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe
Size 4.6MB
SHA256 93c00a0ff5b1baef61ab4726993a81a70388509ea3f87881009bfcfa21ff79e4
MD5 f8a382eb384c85bfae7b83a7e09176fd
SHA1 7c91501dd77b2b58ea520bf20d65b7e51b00dc04
SHA512 84f991b48192b6beea787c88ce2e032d289e4be8dc082849ebfa7fdc628b297911f16a3fababbcff4a915d7b938a45d3cb13152d3353ccc30a31f3b7e69ffed9
SSDEEP 98304:ftgpc4d9wgdRIQIeLWFYGvpbBO3IGIsRURt0p1KKMwItIbmM7BDnJSvjV6ETPhcs:Vgpc4d9wgdRIQIeLWFYGvpbBO3IGIsRy
TLSH
T1BD269E62E5FB00E5D4A308706152669B7938DF128F18C1A6FAC5FF9AE834B81DD9D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRManagerSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe
Size 1.9MB
SHA256 fab5c6a29e043b4dc4c496ce3fc08c9a4bbeede204fd7a48386a3fe5a30bf44e
MD5 dcc415c84bcfc0d372828cbcf8786606
SHA1 6ada8324e996dc839a797b03ea21db8b874767ca
SHA512 1af18730ee73835f781b44000d6bc1fbe2c4cd01384167fe9ffb77931509952a83ff7581343e75315f762c51a8e4fd7e430f78ee7b721834163c9183c991bca9
SSDEEP 49152:SUI2YP3Bmc0F/8ltbi4ie7ZmrpO6gte+e8vW13HY0RGcDj:Sz2YZJ08tbi4ieV2p7gtZ+1f
TLSH
T132957C73FBC48027F5624630B61D93268A79B9312E7994CBB3815B5D39F06C2F629E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRServerSOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exe
Size 5.2MB
SHA256 f7244b5cbb758022b5ecf60a97a7476e9e9c2bd3d72d302aea748482742ba6c0
MD5 630da4923f144941af12ce9cfdf5673f
SHA1 c66a076e3eb8a76b6499050b4ac76801a155bd0b
SHA512 97a34edae714a5814b8d2d3b3ac7d2645ae04a9ad99e5a015cdec97f31cc0334ed0453ed0f8a473dda6fd905b12d93d6d218178fb0d3de4a0ab6cebb239fdcaa
SSDEEP 98304:CIwtcqr3jgSRgyIv7/O9grTuo+rCG2Z3hkScaMJc27DPPCv0BGaNG:CR8QuO2Wo+rCliI+XnPPCv0TI
TLSH
T122467D11B684A8A6D1671E317D6CF275F3ACBF640A3D808B53B17E2C2D711C2571AF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRSocketCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRSocketCtrl.dll
Size 528KB
SHA256 1cc6ad9457e9706df0824c68e7498811b9fe029e3f7d4d36fec6dba6ce88956b
MD5 ec0727332ce97d44d7f00b2c5f2f8ac2
SHA1 6a61aaf607dbf237956ac819a4d8d6268319e491
SHA512 ccee10cc3eb67c08e532c3136a77998d13612ba4b941150b0a422754d912de70553cd495d30331b9ff638dbf920b11cd8d5086886a82db089d0b6daf0eeb9648
SSDEEP 6144:aVpSE6Sm6h5D9WeEWAxSZ1F+qxOIr/ELv8Ocxv2s9afhE8NOmiu+zKioc1bbPSUD:6HU0GERg1iocBKUx6jEWdmu93HkN
TLSH
T183B48D60B241C232D55E01F05DF9EBA999ADA9354B7064CBB7C41E7E5AB00C3A736F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRUtilitySOS.exe

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exe
Size 172KB
SHA256 7feec5526dde4fda28943d978163e6981e48fc1fdbcbe937c6a0b7429575a9f1
MD5 d15be052b2893c9e72496a136b610bf1
SHA1 d8d673874b503be2bd0b5adad6673010e839e211
SHA512 158913c2d5060c43108f4c1cc39e1f0f637b8de2c7098ae717bbc65dc8cf0283e8153e80939db35db757049c3bf781aecacd43d952168ace14a9e4508cbdb72e
SSDEEP 3072:3kOQQVQLBnQ+TGW2K3jINYxl2OldQdL92a/R3G+zszDMrmwFQ0s4ZpPTzolT6Ct:0EVQLBnQ+Ty+DlAL92a/R3GkqML1XcYo
TLSH
T14C047C21B8D1C433D66A0D3059E4CA75DA3DB8B14FA099DB6B840FFA4E346D0DB39627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-60.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\avutil-60.dll
Size 508KB
SHA256 ff5348b0bfa7cc81109ba3ede719076b2d77e9cc27df4582afaad3308699ba16
MD5 abbcd6d96ec5ef812433fb6ba881830b
SHA1 cee607af34a064e2aacb6f3d7e7c6bdf400ca401
SHA512 5547c850680356ce8bb07e6fc685f701116fd75d7c42438af372cfc798d3d375de20fd0f93f6f03a0231442a67eb757f25efb352e1273dfa50f09c2472ef98bc
SSDEEP 12288:ICexlrB5D3yFoOHKWOCTtOU5UnEVl0rx3gQrCshV/qdaV0XE1OR:IC6lr/POH4jEVl0rqQr1V/v8
TLSH
T15FB412ADEC52DC17FB963CB8BC9DB30B0A1EA24BED91B2C8E71D4544B4216D1724364E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRAgent.sqlite3

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\db\SRAgent.sqlite3
Size 268KB
SHA256 28a33751c9f1b50d765438ebacdce4ade5fa4b8de78e28c4273a6ce9e22ed0f1
MD5 4701ecff794b25754b72130161b6b779
SHA1 eb0ab91ab93a5a2fce50b999cc68de27bb361d6e
SHA512 65b6bc46b7d8177264add0b714baf1bdd92cebf105f0ce59acb85fccfc83c0e23b6f577e0eca9f8632a45c51b11a3b5c545e3c48bce1fbaa3829bffc3f01b60b
SSDEEP 6144:LB17VNN9uIxXBZ/maVfQB2nY8o7gTKIlasRphqKqOQJmN2JN0:L7V08/xSBoY8o7g9laYphq7OQm2JW
TLSH
T10D4423B40243CB5B0C0C0EB0619B404A9AFB757896719A965CBFF9DCAF6DC5D83C22C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\dbghelp.dll
Size 1.0MB
SHA256 4b890de3708716d81c1c719b498734339d417e8ffc4955d81483d1ebc0f84697
MD5 eeda10135ede6edb5c85df3bd878e557
SHA1 8a1059dfd641269945e7a2710b684881bb63e8d2
SHA512 a56bfc73537e36efba8e09ffd0b2f6bfc56bc4cb4fe90b52858c7afd5d67db23ccba51c8097befe4ecb5082ba66c2b2612e2975ef3448252c48b97f41d12d591
SSDEEP 24576:n7PeeMxAg8KA6EhyC/H488sCGF8MBo9Bi8sROlu4VWKl6sEPdf8/2RYv:cxNEhyC/H488sLqMDIlu4Nl6suK2Re
TLSH
T159354A20D641C279DCEA30F5526D713926ACEAF2031161C723C85FF9DB762E46E3869B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.ico

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\default.ico
Size 16KB
SHA256 efd655d3eaae64c057d621c2cd81b253027be087485b16e729b518352ec12c82
MD5 bd59f7eac286d81beaa7a4647ee5abc8
SHA1 1ab817b1a746ed097e5a219acb2d3de0cc46a633
SHA512 35cdb0dc84162c23865ac4c143b745d1a13c52ba66d25941c3eaa3d277e0210fdc76895fd6656281b25a5f09a13a9fc10a67109e1e4203219215be7672ae6e3d
SSDEEP 384:p84AcMSBE1Vrz8si4kjjqfgBIeSagItnivvABtq:SaMS6Ri4k/zX3tnw3
TLSH
T11772D0D9B5B84F3735D5CD6B8BD54B21DB341ED184EB29B58851662A39C00B3318F3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fips.cnf

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\fips.cnf
Size 1KB
SHA256 07318180bfa6a6f6f7d97b25bd06ec581bf52d26398c98a23030aedef01b46b2
MD5 644c9196118d57ec3b5532bae13ba78f
SHA1 8baa4b9fc6715f425d5f2005eba4d18461c80ac0
SHA512 41f03dc2001b22bd854df5339a65492f75b68860bfb12011c8a3465e5a0cf02d6e6d430086dc7c025d0c68cb9e4db3f02ca0d0f4a137d1d2dd53898efe1bce1f
TLSH
T1C11100D86425D8F9298CE7A1AB91B9D1FEE460000B610EE1F2E136AC5E07C60D693557
MD5 SHA1 SHA512 TLSH

Submit Download

fips.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\fips.dll
Size 785KB
SHA256 7cef4f9034e115bfc44c4543c404dd41d3a8df384f56a015709e92cdc2a4d625
MD5 8736f9ebfd8d4bb18cfc647effa56281
SHA1 d3f15f51c7f03a8d624f8a555247f298fc53c718
SHA512 913eafde09889cf7dfd821646afecd6169d64a914d9a2f9a7e61e86924f1ce9aaf15c31fc1c58f405675f200ce00088f8896706e69275d769ed24e8ad05f00ff
SSDEEP 12288:1cEyHEuB1xSDikZ70lHpIJHRVWiek8/Zir/8WecuzV6nHURy3p0oPv2Tzrss:gHbrcDikZ+pI5bmZm0WedU042zt
TLSH
T1760523BE14483A70EA122C702ADDFC13B8023A764EAD7034E54ED4D7517BEDB7D64226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

legacy.cnf

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\legacy.cnf
Size 226B
SHA256 7d74c36752b2168912fe98463a4515e49b8c195ee073a99a8b2e26c9f8c0436b
MD5 2b67dfac3f52b32e2fcba7ae99c85419
SHA1 1439d4679305b6a7fbc40091a27af1980ea4c378
SHA512 137f242384ea4ec996af7011fa3b13059c15069523455121b8811a8513a85715239503d309d2135746427c423ce04eadc7898af4bd3be2a8b1c64845a9c176ca
TLSH
T1C4D0A7709D0BD5CC44417D33BAF41CA3DDC4194E4C046851FAC2C46553038548C7838F
MD5 SHA1 SHA512 TLSH

Submit Download

legacy.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\legacy.dll
Size 167KB
SHA256 3a085b04c0fd5bd9ec7cd9a6197d20dccaaeea841b61fa0c92eb23481f75f213
MD5 5dd027a5080b516da5900a33b05ec4fa
SHA1 c26ef4da0dc2635cc8d3052a33b8d668f005b748
SHA512 9d7e92ea1a474fe6f1a33afeb5dc234bd3b9dba1845d6b9e731ca626b03ae255bc0f96923773728ee0848e58c4696c5a294c42752997a0702814415252de5e4a
SSDEEP 3072:zVPn2mO3RvbsJbG697jnbuc8NX95XAeyWCpuJAyK5tznc:pu3RDsZG697jb/8lA3mu55c
TLSH
T13DF312B2A4B97802DF7B5EBC38E8D52DD0398861E4602081318FC35BCB68B45DBAE559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcelt-0.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcelt-0.dll
Size 104KB
SHA256 dd30a0ccff24f01d79dbc78a521ff690ddbbe954ace64fbc47f4914b3ca5d2e3
MD5 fd85a34d78a2deff9d9258ecc0c43711
SHA1 88501a807935e9f00f26fca6d1b50b56b097d975
SHA512 370df6b85f26efa18b57069fac86344867df1241ad6b93303df8e3ab0750c88348347880885bee230ced633fb4b57a15525293615d46c3e57fd795c6e83261c1
SSDEEP 3072:BdvQnJ9Cy5G4XmkRCXZ5YPPAq4SjIZUKzFrRjbuPp9nw:Bdvby0lZ5YPPAq4SjIZUKLjbuPTw
TLSH
T136A34C57658384BAE253237345929AA72138A79D02F13FCF9EAC0D28DB337D0AD94357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcrypto-3.dll
Size 1.6MB
SHA256 6b83aa677206fa813e7a9efd38164e80c0c1a88cc073cc5e20b64dd04a128af7
MD5 4ee6ad2147ceeef7550021d588aabce9
SHA1 b3964ba529e082bff97d6761980c4168804da802
SHA512 6f674004f71b308c299e0ae5541834550e81b5b681fd30f7af137497308df9d47b59f6d9e11f84613ff3dd3bebca1f423eede9ab6572ecf2e0dde5e79bf14587
SSDEEP 49152:XNAgQvK/5zCz253LKhKz6V3qOOaKo1hYRIf1CPwDvt3uFA0CD:XNAgQvI5zCz25eW6VIyqRIf1CPwDvt3b
TLSH
T1F185122414BFB80FF689887C8F30DD2BC9194B325718EEA72DAEC9490834E5E59F46D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcurl.dll
Size 781KB
SHA256 58683077d3dfe3abfe3953fa086607db1d547ad3b37564362eda50a0974cf13b
MD5 2203cc8b4c95cebbf9f5d967b84f60b4
SHA1 953fa11450ea0a0222111407d88a0d478566ec8b
SHA512 8ab5f7a3b8f6dc466691df7c2df6575f27bf48737d02e69963edd099c31155993030781d87d4085b7e16d327351772237fe5c35665ad08dcd190157a2484229b
SSDEEP 24576:iCg8Bo/1dYGS4xgo7ikxc2ySldQlFD22FKm:iCrozxvxTwlFCY
TLSH
T177058E12BD418063E6E50035B2BD8F724D7D51B413B890E7E794ACA46A709E3BB3D36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libssl-3.dll
Size 480KB
SHA256 e89da0461c93ce4ed0f3a57d1a5d4ca924f38cb1d5ab2450de53b847f4c4d0cb
MD5 0758f72174d9b4512dbd50d781623977
SHA1 6e5c9822dbae77508e33cd7b1c51a48270a279cc
SHA512 6942128df6ba6dce9df2a145c9c3920dc9f4c25e8cf28ea978b9cf5aa629fb6ba9690d47761bac9ed197000d023ed1fa14454c2de7e0b90e0919262c29feefe3
SSDEEP 12288:mHMBmQ/Ehl/e1BigXcqwhJJ4S0CEw5FKZJgWh:YMMAQAwhJJ4SPDPKZn
TLSH
T1CDA42235329FAC23ECA3EFBDFE35A0C9D63C33955396D884BE21DA9016A1A0C579C511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libx264-116.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libx264-116.dll
Size 1.0MB
SHA256 831a81956af7845f43a3d3176d9d4c3802c2a447d1899b5b506ae460a8c31cf5
MD5 6483b2cd8ecf7f62d3c26cdb7baaea2b
SHA1 2395d2344157e873310de27119c663536f7a7b3a
SHA512 6a7016d2f3c68052245d87334ac03fb8422bded12db5fb36d578a763d1ed4aa98272be6254a3394ca9ec2fe742da3dd262724cab7b6dd8f95db1bc5a8a7b7fad
SSDEEP 24576:399IeBE76bZaCUrF0XbuqIpInZVrUCzfk44dm:39S+EAZeY/UfA
TLSH
T146356BC0EADB55F0E86B0D70901AF33F6634260CE62CCD61EFD4AF42EAB6B52451A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p_mount.bat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\p_mount.bat
Size 214B
SHA256 b085f4e0d6a7a4dc967c96d7c318cb749bc497135fd9e35d7ad0c88e6c53f577
MD5 88e59700f53de95d2847b9687764be30
SHA1 cd5780dbf1c711b9c28dc001f4149ba3251becf7
SHA512 6e7d2fd4cf87b63bab39e225362ecbe60f52fab0da42c97834b8ea59d653cdbd06b98e2c490c5465b1999af2f7869f729cbfc34e55d5ecc768d85d48b9874374
TLSH
T1D2D092E340127E1252B98593C285035A006F25A28AFE3221A60284CC28CF571C11A3DD
MD5 SHA1 SHA512 TLSH

Submit Download

p_unmount.bat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\p_unmount.bat
Size 203B
SHA256 347b12e6e2fc79e2a3668625341d7642d531159ffe5b01ab2bc5469e0efc6b3f
MD5 fa3c191799254e542687f1f5d0974bc5
SHA1 dc85aac2aa31cd3de9017e7e099581457ad4fbf2
SHA512 635689814e63084910541ba68fe8ade8fdfbc3d0100afd61ddd13d07e61f3478ba75e4d24aa7b26df21a3e46c4ed2b1c8789520c5634cac63cfe32dcb1e8686e
TLSH
T1E5D013754141F54460A94A56C15803CED01F74D647FF3062F511D4CC3F49150830A2DB
MD5 SHA1 SHA512 TLSH

Submit Download

reboot.bat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\reboot.bat
Size 3KB
SHA256 eb700422c31c15757a6c70141274a184d291aac3bde191a964f75a90bc084143
MD5 abe8e3568b6d951e7dd395da46531932
SHA1 304d81c1b48e16533ef691a9c965818136b9583c
SHA512 19a79d90883103302bddbac8a765c6a5196fb78c223d911633285b4ba44ebffa9c64690102498e3bef5991dba0f28847473a44d4f9aa7d637a4c4d3f1efea12e
TLSH
T1BC6112EEA8719D2D74D016912E08E461EFE2FF0365E6026FB87C354C973B12278BA1D5
MD5 SHA1 SHA512 TLSH

Submit Download

stprinter.cat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\stprinter.cat
Size 17KB
SHA256 eb61a0e06bf8c69597f9bb1909e3eb4f926e49800c3f9721fda3007993da5ee7
MD5 2dac6568b843ebdc5c98598ca32918be
SHA1 e7740e4be7f71a82adbb6e5224d33534e237614c
SHA512 1bc8aa82e68911f5ee1835d19cf49a736c1c35c2f6b4fcd48c3c6fcf7ff6958400d1e815c5e891e172af9035232175bb00e8a21f5a0590f02dc683f45a6c3d8b
SSDEEP 192:fNDJbjaXGStblM2wk0mev6/9IDRfupdYpJIBbIgx+4lMrp2/CsECw8nYe+PjPVhc:n3dw75xa1Sw8nYPLVhtOUez
TLSH
T1D382636E15AD02A3A19BC4B25BCAE47FF8359E6BF4444ABE30DB27600AC1741774DC2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stprinterx.cat

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\stprinterx.cat
Size 19KB
SHA256 84e1a32b4975e92477cf6a36d8931921da735ef988e0c09a2b056f2904541b1e
MD5 1d56a3f8d7f5dab184a8cc4feddaa173
SHA1 75d291cb96fdc05d54c962f1cb08796ee439b22f
SHA512 fb58167a98d9309a703f06d5c6414ab707b37e90a26bfc1c0812b10381c116fa6c7c26ac30fc8570b8f87186775bc64e7af6d409a7d213fc3b4b76b0b7a76fb6
SSDEEP 192:UelM68cpgw3otOCxH50u4RkeelMpSfpd/CJHJ2elMSJfApwtNJKGT1hvJNMvIqvQ:EWtO5smIwg9Zh3q8pUclGNbc
TLSH
T1DA9251B2355E07C6E09368F41685F52F987E6B4F841052BD75AF73384CA1B84F72AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

streamer1.cab

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\streamer1.cab
Size 18.8MB
SHA256 5d6fdd96df2f145040ff18cc16c43e7c805f5e88bff8ae06aaf50f689dd16f68
MD5 9f691900880d11497c5a4daad39fd1af
SHA1 1d46a01b9415f4b9fb912164fbc5233172c8e1f1
SHA512 7f71de65d3d8ede39a8d5f434440143c9bc042eddecb5215cadef1f78c4b53b45716a6f7d0a8460006d67a26e34ba8a16421267351a33f8be47ae8c48e80034c
SSDEEP 393216:oA6V6y07YgW3UHQzaXSVqkQJY7PTiDvXnaQhqfkQIITC65MAAya5biUTtF:o1r023UvzkUYaDvXhqfrRu6eBPTD
TLSH
T17D17338BD9E56424D362943DFB50E62FF5F8C08B8AC5C0E8E766A33543E1622DD22D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swresample-6.dll

Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\swresample-6.dll
Size 188KB
SHA256 d3a11ea18bae423148cb3d73cbec6559e34fdf5780f47f485dff1ed756de91f1
MD5 5a19831d198462e3c28417d21ad8b2fa
SHA1 c713a0f6957cf4bdd70eee5c735d55738a804ed0
SHA512 ffc3cb2764eb7bf09e082ef57ce36c734a8f1736153ff8b0411d174bba14ed8f824c2a6129ee9a39b7d495766c1d073a4a03e1c381434fb59f97b0d2da3a4672
SSDEEP 3072:916pX9gv6aPnoHr6KzQ+En7BccIksi7mllD55oxvBPLMqTOcDUiIb6LD1:91acrnNKU7n7KJlh5CxvDUQ1
TLSH
T17A1423731CC8E548EBE695B872C0A96B6EB7F8B160D0C3C8330D86F197E934967D5294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd2_request_5641431b2be530.bat

Path C:\Windows\Temp\bd2_request_5641431b2be530.bat
Size 160B
SHA256 b9ddfb9bf8a22ec46406a5dfc30f6eb9a702d34f4b1cc25fc8ff3e17398c3469
MD5 1ddefa586a228f17f9a22abe0dc01fc1
SHA1 45ac686cd80938b052b00c12629a21f599c5b2c0
SHA512 244136ee36d42e8662a0080c6d7e3a9cee1a0658ac57876dd1fd652dcee84a79b74cb73b163fd88b19f19b0ed1680c8a4d5dc33cbadba39fef63b4099acbb663
TLSH
T1E8C08CE644E69A84230025961BD7A24881B1AD98BF9A09311B14691AB1C4A0ED1E334E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-587-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/216-320-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/216-837-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/216-836-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/216-588-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/216-332-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/216-245-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/1660-217-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/1660-792-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/1660-365-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/1660-219-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/1660-364-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/1660-318-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/1660-317-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/1660-310-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/1660-316-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/1660-826-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/1660-825-0x00000000732C0000-0x0000000073458000-memory.dmp

Download

memory/1660-793-0x0000000072D90000-0x00000000732BE000-memory.dmp

Download

memory/4144-340-0x0000000072020000-0x00000000720CF000-memory.dmp

Download

memory/4144-253-0x00000000720D0000-0x00000000723B7000-memory.dmp

Download

memory/4144-251-0x0000000072020000-0x00000000720CF000-memory.dmp

Download

memory/4144-483-0x00000000720D0000-0x00000000723B7000-memory.dmp

Download

memory/4144-484-0x0000000072020000-0x00000000720CF000-memory.dmp

Download

memory/4144-338-0x00000000720D0000-0x00000000723B7000-memory.dmp

Download

memory/4144-842-0x0000000072020000-0x00000000720CF000-memory.dmp

Download

memory/4144-841-0x00000000720D0000-0x00000000723B7000-memory.dmp

Download