Overview

overview

9

Static

static

3

2026-10-22...lc.exe

windows10-2004-x64

9

2026-10-22...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 00:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_fc060e3cc94b2fc66c5db330d7889065_cobalt-strike_icedid_satacom_stealc.exe
  • Size 99.9MB
  • Sample261023-aw6klsbs8j
  • SHA256 1c53151c5b49d5c251905aad753787f0c627f3f23853b572d7d85f5cd5708066
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 26 IoCs
  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 41 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_fc060e3cc94b2fc66c5db330d7889065_cobalt-strike_icedid_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_fc060e3cc94b2fc66c5db330d7889065_cobalt-strike_icedid_satacom_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C C:\ProgramData\Py\7z.exe x C:\ProgramData\Py\1.zip -p123 -oC:\ProgramData\Py -aos && C:\ProgramData\Py\wzxl.exe C:\ProgramData\Py\wzxl.py
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\ProgramData\Py\7z.exe
        C:\ProgramData\Py\7z.exe x C:\ProgramData\Py\1.zip -p123 -oC:\ProgramData\Py -aos
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:6012
      • C:\ProgramData\Py\wzxl.exe
        C:\ProgramData\Py\wzxl.exe C:\ProgramData\Py\wzxl.py
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks system information in the registry
        • Checks for VirtualBox DLLs, possible anti-VM trick
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3224
    • C:\ProgramData\Py\App.exe
      C:\ProgramData\Py\App.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill -F -IM quickq.exe -t
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4304
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill -F -IM quickq-browser.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3612
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill -F -IM typeperf.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3816
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill -F -IM quickqservice-*
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache.dat" "C:\Users\Admin\AppData\Local\QuickQ\cachebak.dat"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1980
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache6.dat" "C:\Users\Admin\AppData\Local\QuickQ\cachebak6.dat"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2752
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\cachebak.dat" "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache.dat"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3064
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\cachebak6.dat" "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache6.dat"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5320
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe /select,"C:\Users\Admin\AppData\Local\QuickQ\QuickQ.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2340
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4172
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1856

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          1.zip
          • Path C:\ProgramData\Py\1.zip
          • Size 1.4MB
          • SHA256 b018e3798b6de8b11fd2f600856006b2ca1436bc51393183d6ebed37f1f261c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.dll
          • Path C:\ProgramData\Py\7z.dll
          • Size 1.8MB
          • SHA256 899cd73d7fc60e1c1c35c7de0f5bed3dc69bfe2cecbd48014d868a347970a0b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe
          • Path C:\ProgramData\Py\7z.exe
          • Size 564KB
          • SHA256 95fff19b73eff77c87c0d7bd32822e43fb90dd2932459f962eb532d8dfb6ba53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UserDict.pyc
          • Path C:\ProgramData\Py\lib\UserDict.pyc
          • Size 8KB
          • SHA256 d36cf2c38412fe4adea3e1bb662d29fcaf614e9f90a604ccf6febcfb8a01ffbd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          codecs.pyc
          • Path C:\ProgramData\Py\lib\codecs.pyc
          • Size 31KB
          • SHA256 82970853b3d7c326fe3174c397f04d98562db51888f5342855660d0bc35404af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          copy_reg.pyc
          • Path C:\ProgramData\Py\lib\copy_reg.pyc
          • Size 4KB
          • SHA256 7d324feda1acef82f87537c930dbb043d7ae8d706271132812a95393b2b49ee8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __init__.pyc
          • Path C:\ProgramData\Py\lib\encodings\__init__.pyc
          • Size 4KB
          • SHA256 c93a8fe450b92cd1b056839117b208b2456dfebec531d542107ceab371f0ae5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aliases.pyc
          • Path C:\ProgramData\Py\lib\encodings\aliases.pyc
          • Size 8KB
          • SHA256 493f812c6c8c0b836f945313bfa077a1a19e66d807388727e3b324caf0a8ea78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          linecache.pyc
          • Path C:\ProgramData\Py\lib\linecache.pyc
          • Size 3KB
          • SHA256 70dddd17922278faf4b62bb2528299343c5ba4723933ea3aed33a5dd8d685920
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          locale.pyc
          • Path C:\ProgramData\Py\lib\locale.pyc
          • Size 42KB
          • SHA256 9fa7011a44b8733536f5b14f75b6ef0b6e06392afee306d27f7fd35babd0f7aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntpath.pyc
          • Path C:\ProgramData\Py\lib\ntpath.pyc
          • Size 11KB
          • SHA256 7207eff14b843ecbeb5427cbcb419e6bfeb4b620dd8df757e94bce01708d3852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          os.pyc
          • Path C:\ProgramData\Py\lib\os.pyc
          • Size 23KB
          • SHA256 1a4fdaf511de15f69923d571a13e7c96986c98bfd4bd88994cee841d8a8f9e6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          re.pyc
          • Path C:\ProgramData\Py\lib\re.pyc
          • Size 12KB
          • SHA256 197fb00e526c3cf919576ec21fcc273c2e22810c26a7fb0933dd789e66ef0912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\ProgramData\Py\lib\site-packages\_ctypes.pyd
          • Size 104KB
          • SHA256 7691f0ed13272fe3af7fc06edf7eda7f1898530b11fbcc1134da2a2f7a357769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __init__.pyc
          • Path C:\ProgramData\Py\lib\site-packages\ctypes\__init__.pyc
          • Size 19KB
          • SHA256 e3a4409e94dd9c8c5e06976f1b91e8721aae7007d04d4b48f673e040047ba1fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _endian.pyc
          • Path C:\ProgramData\Py\lib\site-packages\ctypes\_endian.pyc
          • Size 2KB
          • SHA256 ae6dee595bc44d9a397fb1b12c42169376b6029b03c4c2974261860f53dde426
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          site.pyc
          • Path C:\ProgramData\Py\lib\site.pyc
          • Size 14KB
          • SHA256 413bb74919598a515c158de03c91afa2692ca727ee982dba469333d72ae4f647
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sre_compile.pyc
          • Path C:\ProgramData\Py\lib\sre_compile.pyc
          • Size 11KB
          • SHA256 081e24cd871105eef96bbaa73bf76e3bc4497f4c6fba33350f4cf3a2abbc7816
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sre_constants.pyc
          • Path C:\ProgramData\Py\lib\sre_constants.pyc
          • Size 5KB
          • SHA256 16cabda1ec6ca4ca608e531dd9ebebb50cb62eed064291acd8dcb003b9537c66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sre_parse.pyc
          • Path C:\ProgramData\Py\lib\sre_parse.pyc
          • Size 19KB
          • SHA256 4e0c61ec85364ce0bc87f599299705f1d04e21caaa48cead5701b2cdba6497d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stat.pyc
          • Path C:\ProgramData\Py\lib\stat.pyc
          • Size 2KB
          • SHA256 eadd24ec05edd3477134ea23612b025c1806cbe410c0231c0cca2d143028a275
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          struct.pyc
          • Path C:\ProgramData\Py\lib\struct.pyc
          • Size 3KB
          • SHA256 ba4252cd47cba13e815c02ac75be6962f3f1efec3188cc9a12cebce925936f5c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          types.pyc
          • Path C:\ProgramData\Py\lib\types.pyc
          • Size 2KB
          • SHA256 83fc8633ba9c87318386b1458c64c6f874e7885e64486c27a12825168282367c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          warnings.pyc
          • Path C:\ProgramData\Py\lib\warnings.pyc
          • Size 7KB
          • SHA256 22fa4afa561dbd4f4491fe763eb774e16de8bd654420c89d924a17e70d7a1fd8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python25.dll
          • Path C:\ProgramData\Py\python25.dll
          • Size 2.6MB
          • SHA256 bf147f31d831ee13f867bf8db5bc17ab3fc5e6d71fbd7aa9fcc3e8c94448bd4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wzxl.exe
          • Path C:\ProgramData\Py\wzxl.exe
          • Size 24KB
          • SHA256 d4d4b20842d23027f3b76084cb3ae15139b94a4bf5be83287e3914e1e44271d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wzxl.py
          • Path C:\ProgramData\Py\wzxl.py
          • Size 585B
          • SHA256 6b9cd796bffb057da5a2d521594a9c3966d25c2580c148a5a029b4d4de6e59b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          xxx.bin
          • Path C:\ProgramData\Py\xxx.bin
          • Size 1KB
          • SHA256 00facc9f5395305fed2a38d5dd61c2b8fed2469955a29684815db9d82ba786f9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          QuickQ.exe
          • Path C:\Users\Admin\AppData\Local\QuickQ\QuickQ.exe
          • Size 2.0MB
          • SHA256 834a190d6131a9fb3f9fee7f32f72f2a91972cb930580035c1e14b5f3d0b0c22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QuickQ.lnk
          • Path C:\Users\Admin\AppData\Local\QuickQ\QuickQ.lnk
          • Size 1KB
          • SHA256 fab3ee8b272055fc6ccdce9113f9c1bde51b6c68557f33bffe4fb535c75cb78f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GB2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\GB2.png
          • Size 1KB
          • SHA256 c8fbdfc0e4bc554b9ebab492b2186606aa569f607bb2a9d0f124f1640e4fb49a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MY2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\MY2.png
          • Size 1KB
          • SHA256 796a62631ea832521f25ca76fca6c05eb1911388b6142c2b2c898f30f47b2592
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ST2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\ST2.png
          • Size 1KB
          • SHA256 9548cf138cd950a8adc1a98f47dce45930b3673d4da97aa4c84dbe0784acf2c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VN2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\VN2.png
          • Size 643B
          • SHA256 f430d4dec0b55af36153f78c842f96ec029d985cc9a96d6b87806b6a81431291
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WK2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\WK2.png
          • Size 436B
          • SHA256 459f8de9c47db11553c1f1f5a4eb93e295bb20d0ec668bbf3a216767ebc36a91
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          YN2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\YN2.png
          • Size 353B
          • SHA256 25ce6ae4e3e4771cbf3dbedb281c38ad502994dbb5cc1ca99cae0bdf6dd3774a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          YS2.png
          • Path C:\Users\Admin\AppData\Local\QuickQ\img\static\country\YS2.png
          • Size 703B
          • SHA256 b1bc013edd81b06599bfd8776ba45ad0928166072e66662f4f240fbea1c09213
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ar.pak.info
          • Path C:\Users\Admin\AppData\Local\QuickQ\locales\ar.pak.info
          • Size 742KB
          • SHA256 d0b585f25524b300bc67a510bb9674558656656d97a145ea13ae43aad3b7b9a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\Users\Admin\AppData\Local\QuickQ\notification_helper.exe
          • Size 829KB
          • SHA256 2c34c2d86dcfc53b615aafee832ed8f2e7ca2c933042b09f6c46d3dde519669b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          quickq_winproc.exe
          • Path C:\Users\Admin\AppData\Local\QuickQ\resource\win32\winproc\35\quickq_winproc.exe
          • Size 23KB
          • SHA256 01b2e339f7205794e3708cebf66db7bb4940e7ae82497244307ff9561a001986
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          quickq_winproc_64.exe
          • Path C:\Users\Admin\AppData\Local\QuickQ\resource\win32\winproc\35\quickq_winproc_64.exe
          • Size 23KB
          • SHA256 9db5f4b9ddd00abd44decce002f6a23d5efffe00afddeaf84f5a31611ffc95dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InstallOptions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\InstallOptions.dll
          • Size 14KB
          • SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LangDLL.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\LangDLL.dll
          • Size 5KB
          • SHA256 6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\System.dll
          • Size 11KB
          • SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\ioSpecial.ini
          • Size 719B
          • SHA256 eed900eae21ff4f04ea3654c03e54a58c0bd5eeece892bad1166f5a99b519615
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\ioSpecial.ini
          • Size 542B
          • SHA256 7ffab8f4d16d955fd8ba1c0b42027180f985ed5c157107a86d13a933e945cca8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\ioSpecial.ini
          • Size 542B
          • SHA256 16d0a6751d63887ec6b6320b95454cda69b7082d532bcd9122f89ae9c68baf5e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\ioSpecial.ini
          • Size 679B
          • SHA256 0b9606bbb8cb99ebd0414be8d02159f11098b025d967853a490343eeaf65ccd8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\modern-wizard.bmp
          • Size 25KB
          • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\nsExec.dll
          • Size 6KB
          • SHA256 b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsc4983.tmp\nsis7z.dll
          • Size 436KB
          • SHA256 98f425f30e42e85f57e039356e30d929e878fdb551e67abfb9f71c31eeb5d44e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3224-67-0x00000000001C0000-0x00000000001C1000-memory.dmp
          Download