Overview

overview

9

Static

static

3

2026-10-21...lc.exe

windows10-2004-x64

6

2026-10-21...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 4.5MB
  • Sample261022-sebysads5w
  • SHA256 7c83388493e6d72ab3c7e360e41d0dcd6d42fb97b92d09ed96454abfa7884b17
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 47 IoCs
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 47 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 47 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 58 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 47 IoCs
  • Detects executables containing common artifacts observed in infostealers 47 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 47 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Modifies Windows Firewall 2 TTPs 18 IoCs
    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Maps connected drives based on registry 3 TTPs 8 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 15 IoCs
    defense_evasion
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 54 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 18 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5688
    • C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" /speechrt 5688
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe"
        3⤵
        • Maps connected drives based on registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" /speechrt 4576
          4⤵
            PID:3516
          • C:\Windows\SYSTEM32\netsh.exe
            netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" enable=yes profile=any
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:2352
          • C:\Windows\SYSTEM32\netsh.exe
            netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" enable=yes profile=any
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:1304
          • C:\Windows\SYSTEM32\netsh.exe
            netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:4688
          • C:\Windows\SYSTEM32\netsh.exe
            netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:2112
          • C:\Windows\SYSTEM32\netsh.exe
            netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:4572
          • C:\Windows\SYSTEM32\netsh.exe
            netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:1088
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /Create /F /TN "SpeechRuntime" /SC ONLOGON /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4648
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /Create /F /TN "SpeechRuntimePulse" /SC MINUTE /MO 30 /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5260
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /Delete /F /TN "SpeechRuntime"
            4⤵
              PID:5992
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
              4⤵
                PID:4800
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\arv_uninstall_240852937.ps1"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4192
            • C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe"
              3⤵
              • Maps connected drives based on registry
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:4216
              • C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" /speechrt 4216
                4⤵
                  PID:4312
            • C:\Windows\SYSTEM32\netsh.exe
              netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" enable=yes profile=any
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Time Discovery
              PID:6128
            • C:\Windows\SYSTEM32\netsh.exe
              netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc.exe" enable=yes profile=any
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Time Discovery
              PID:2400
            • C:\Windows\SYSTEM32\netsh.exe
              netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Time Discovery
              PID:3700
            • C:\Windows\SYSTEM32\netsh.exe
              netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Time Discovery
              PID:944
            • C:\Windows\SYSTEM32\netsh.exe
              netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Time Discovery
              PID:4892
            • C:\Windows\SYSTEM32\netsh.exe
              netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Time Discovery
              PID:4364
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /Create /F /TN "SpeechRuntime" /SC ONLOGON /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4472
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /Create /F /TN "SpeechRuntimePulse" /SC MINUTE /MO 30 /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5852
            • C:\Users\Admin\AppData\Local\Microsoft\756B1A95\7803AAF0.exe
              "C:\Users\Admin\AppData\Local\Microsoft\756B1A95\7803AAF0.exe"
              2⤵
              • Executes dropped EXE
              PID:2196
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /Delete /F /TN "SpeechRuntime"
              2⤵
                PID:5036
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
                2⤵
                  PID:4780
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\arv_uninstall_240803500.ps1"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5700
              • C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
                C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
                1⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious use of WriteProcessMemory
                PID:2792
                • C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /speechrt 2792
                  2⤵
                  • Executes dropped EXE
                  PID:4956
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Time Discovery
                  PID:2428
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Time Discovery
                  PID:5092
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Time Discovery
                  PID:6140
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Time Discovery
                  PID:4900
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Time Discovery
                  PID:6052
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Time Discovery
                  PID:2876
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /Create /F /TN "SpeechRuntime" /SC ONLOGON /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2400
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /Create /F /TN "SpeechRuntimePulse" /SC MINUTE /MO 30 /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1392

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Process Injection

                    1
                    T1055

                    Process Hollowing

                    1
                    T1055.012

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Debugger Evasion

                    1
                    T1622

                    Impair Defenses

                    1
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Process Injection

                    1
                    T1055

                    Process Hollowing

                    1
                    T1055.012

                    Credential Access

                    Discovery

                    Debugger Evasion

                    1
                    T1622

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    2
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    System Time Discovery

                    1
                    T1124

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    7803AAF0.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\756B1A95\7803AAF0.exe
                    • Size 23KB
                    • SHA256 09f7126cdf6c01693504752fac277666042ade07e0d879c9bbae93609a7abc3c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SpeechRuntime.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
                    • Size 4.5MB
                    • SHA256 7c83388493e6d72ab3c7e360e41d0dcd6d42fb97b92d09ed96454abfa7884b17
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SpeechRuntimeInput.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntimeInput.dll
                    • Size 313KB
                    • SHA256 5d77c16f8f1ebd967d9b8f15578ebfefe223500eaf741754cb2f4ddb0cfb3572
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SettingsCache.db
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SettingsCache.db
                    • Size 46KB
                    • SHA256 605814f49e3ac16cf7e61f160a2237318e023021fe7e75f5d13138d7a5baaaf8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WindowsTextService.stop
                    • Path C:\Users\Admin\AppData\Local\Temp\WindowsTextService.stop
                    • Size 4B
                    • SHA256 6c45cb72a36e63d522aa54ed8adbd7a29a989474f2f77e0458af8800564ef3cb
                    • MD5 SHA1 SHA512
                    Submit Download

                    __PSScriptPolicyTest_c2dkxxdn.h1s.psm1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2dkxxdn.h1s.psm1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 507B
                    • SHA256 e7ece7bf1f73264a0b79c0f39a6a01a2361d4a91af14817c980e56758ad67a4d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 121B
                    • SHA256 3a19c248b69a2f2e13c99a81b59c975a5ec0666da434d5333eb802931f1fc6e2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 522B
                    • SHA256 c42eca7ffe46a97fd007bcb4b28cc2db59b4d2f374ab1137f0551c76a402a852
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 530B
                    • SHA256 b859f8fc979925041d2739f878838648204a8c09e4d8744a39ced9758f07f8aa
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 607B
                    • SHA256 65ced67f8e6ed5fe42445d9eb6067b31b4a7459710c2d9a95d213086cddb8ba0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 617B
                    • SHA256 092e9831d38334d4491fb3a97c100084f57c9f634e85cc6bcfec20e293b22fd1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 129B
                    • SHA256 ea7b1e1a225338a09e6c33beb2cdf9468ccc94672ea49a98fc1e897fd37c8a5f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 723B
                    • SHA256 c484077cfd056f30557eb16b447026d61b3175f0f1768b1cd89792187ddc388c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 776B
                    • SHA256 366fce7b7622157a25d986a12a91449285de4a94fafdc98ed82ba20a85e7f6c0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 941B
                    • SHA256 7b79e9d977c7bd05e187d8aba9ae7606e97246ccab1337324763e5a16cf20beb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 beef72d689fc12b4b9b6f3c78a706b443822d29e4f9d5540d3dead7a55d7297f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 216B
                    • SHA256 9391d323d7aa7ec1d237c98ae9608eda35705c6de0d1e3d82f40ea162631645a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 bc96dfa298d1bb550fac71fb7ce575668c1bd6a1e6bf7f8179bfe72f9a5a3fa7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 629c77fbf9d2ebe1d9d3e777e53de4be4d88d5a7efa4f437944f2dfc1014ce64
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 83B
                    • SHA256 702a4d9bba0885ac38ec34ff45d3bee185f1e40e8252caf8f66cf3bd02b32ecc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 5fc063b214df667240e2dab3651e82e6df7ef813fbad1a74c79d81a3fbc99624
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 6c38e8e52ce83c3447619c46b5e44cad5ab2a9c8022a202941df517277c00d10
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 20a7578b2d5a1dde2bfc8904f6e3c89674ab231e3339384d30a4c090404eb750
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 6dd1f27c18fbce5afe09f50a480898841399bdfdabc42cb8ed0009f4d6ca87de
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 645ee324f335ca717fc637e02a96615681270176abc5bbd9ebb237046954a175
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 16ffca13d76de1bc9f5ca2fd1d548f248d51caee3dc082efea22ff40a393d2c3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 67dc06fdc2a95ac49fc0be4463126403aee5aaaa89a2493190cd35099d37c822
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 54d66832f38f6cd048e53870484098fcce20611035100bcc67143a7ce9075e97
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 936019ffdc9b3dcc1da4b4304d7371ea5dbf10b1450997dcaf69247595ec0673
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 57239734118f04c297412c6dbeb55dae58bb51eaebc4b27fff4e90972d17de9d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 627d5c585419563ed5daa4d7fdf5a6b4480cd1779ac3724d1b62ca151f46b51a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 629c4b76d79889a6523c6c20c7b70b4d0b246be4a12f6c93da008d9152f2262b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 f74413a3968606fa8434cee6c2e64b216ab6e2c34eb640c0d99d0850261ffe03
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 1KB
                    • SHA256 6abdca451b23c2a8ce1c8165e0068112dbad33d86f32c987240c1c8515d7e044
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 e582edd51aa703a4609c45c1bd1a68ef1a7cd9cd94a53f49e6036e7a8a62d5e7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 d59703ac0302006c67a8834a62a3db89574983fcd9525f6e50aef777bfe9fbdd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 30043b91d7400dc91fd42054ea05b3c4844c427e2bfbd82df506e40cfb31320c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 d04b71a48037492f58f60e03139e40ffe180b756c2cb531ea2557c971d83d3bf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 4ecd17f6124af7ea93c75006fa456634172d58cf9cf014f96e73ab125f1c116f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 496fd64029e72e9f33eece2f9695e246cbff700bd8ddd6a5643454da6f3eea5f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 d4ea26a7b694000ae82038157e7cc46a01d46c0fd856050228948e60207326e2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arv_boot.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
                    • Size 2KB
                    • SHA256 5192dbc19ee3084a27a3052dc966baf36e31fa6f46cad9cb993ce574897b20c5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    arvion-hide-ok.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\arvion-hide-ok.txt
                    • Size 194B
                    • SHA256 a032e6ea3602592b1ef521b59cda5c26b1a9a5ff6cfc140f4329aaf6d1508a0e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/2792-244-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-124-0x00007FFD72020000-0x00007FFD72283000-memory.dmp
                    Download

                    memory/2792-166-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-164-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-169-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-288-0x00000171E0250000-0x00000171E02A5000-memory.dmp
                    Download

                    memory/2792-185-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-165-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-199-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-193-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-208-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-156-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-225-0x00007FFD72020000-0x00007FFD72283000-memory.dmp
                    Download

                    memory/2792-167-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-236-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-245-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-289-0x00000171E0250000-0x00000171E02A5000-memory.dmp
                    Download

                    memory/2792-239-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-237-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-238-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-251-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-333-0x00000171E13A0000-0x00000171E16C2000-memory.dmp
                    Download

                    memory/2792-287-0x00000171E0250000-0x00000171E02A5000-memory.dmp
                    Download

                    memory/2792-278-0x00000171E0250000-0x00000171E02A5000-memory.dmp
                    Download

                    memory/2792-286-0x00000171E0250000-0x00000171E02A5000-memory.dmp
                    Download

                    memory/3744-109-0x0000000003660000-0x0000000003661000-memory.dmp
                    Download

                    memory/3744-75-0x0000000003F30000-0x0000000003F31000-memory.dmp
                    Download

                    memory/5688-275-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-60-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-94-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-270-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-262-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-290-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-46-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-45-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-40-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-43-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-42-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-41-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-32-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-17-0x00007FFD72021000-0x00007FFD7218A000-memory.dmp
                    Download

                    memory/5688-264-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-56-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-334-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-340-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-341-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-58-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-339-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-54-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-338-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-72-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-95-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-393-0x00007FFD72021000-0x00007FFD7218A000-memory.dmp
                    Download

                    memory/5688-76-0x000002627E370000-0x000002627E5D3000-memory.dmp
                    Download

                    memory/5688-78-0x00007FFD72020000-0x00007FFD72283000-memory.dmp
                    Download

                    memory/5688-139-0x000002627ECB0000-0x000002627ED05000-memory.dmp
                    Download

                    memory/5688-138-0x000002627ECB0000-0x000002627ED05000-memory.dmp
                    Download

                    memory/5688-141-0x000002627ECB0000-0x000002627ED05000-memory.dmp
                    Download

                    memory/5688-11-0x00007FFD72020000-0x00007FFD72283000-memory.dmp
                    Download

                    memory/5688-16-0x000002627E0A0000-0x000002627E0A1000-memory.dmp
                    Download

                    memory/5688-140-0x000002627ECB0000-0x000002627ED05000-memory.dmp
                    Download

                    memory/5688-130-0x000002627ECB0000-0x000002627ED05000-memory.dmp
                    Download

                    memory/5688-85-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-86-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-87-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-107-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5688-88-0x000002627F3C0000-0x000002627F6E2000-memory.dmp
                    Download

                    memory/5700-364-0x000001F733000000-0x000001F733022000-memory.dmp
                    Download