solaris_loader | 1fc4d0391340886199bdc18c663fdcb6bbaabfddacb1c7dac7da9e1f45a86393

Analysis

max time kernel
15s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe
Size 69.1MB
Sample261027-qzcpps115n
SHA256 1fc4d0391340886199bdc18c663fdcb6bbaabfddacb1c7dac7da9e1f45a86393
MD5 7dbc301e3b4d2899c12576693696858e
SHA1 5c0402c2ba82d4e5ac1e8c49c91a1713efaac962
SHA512 ed38a14bad50c5050e3b1943f3af8f331ab1c0f0e2351d22bda5b7db18cfc21371b31faab449e5335cedc057036778d6fcd35fe40cbd5f55eeeb8b45ed22f2ff
SSDEEP 1572864:mPR7r9Ci23WEWgBEC86HziOrtRgaYgjghHh5for5LqiwFKY:Qdr9Ci23nEC86HziuJ8h5fo1GzFKY
TLSH
T1C5F7336BA294BC80C90380760AC05BBCC7A5B53D5176D8FDE7A625CAB92D371073BF91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run defense_evasion discovery downloader execution solaris_loader stealc svcstealer installer loader persistence stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Extracted

Family

solaris_loader

Version

196.251.107.186
192.162.199.186
196.251.107.163

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/5396-2-0x0000000140000000-0x00000001400D5000-memory.dmp	family_stealc_v3

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 14 IoCs

resource	yara_rule
behavioral2/memory/4316-317-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-344-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-356-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-360-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-372-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-376-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-386-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-414-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-435-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-451-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-455-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-478-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-505-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4316-521-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 5 IoCs

resource	yara_rule
behavioral2/memory/4348-37-0x000001FB47E20000-0x000001FB47E23000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/2848-99-0x00000000031A0000-0x00000000031E5000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/2848-104-0x0000000005E30000-0x0000000005E75000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/2848-314-0x0000000003230000-0x0000000003275000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/2848-312-0x0000000003230000-0x0000000003275000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects executables Discord URL observed in first stage droppers 14 IoCs

resource	yara_rule
behavioral2/memory/4316-317-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-344-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-356-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-360-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-372-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-376-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-386-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-414-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-435-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-451-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-455-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-478-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-505-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/4316-521-0x00007FF761020000-0x00007FF766743000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Executes dropped EXE 11 IoCs

pid	Process
2428	1y2b7i3f.exe
1924	wxcdsp4y.exe
4160	0dgdmn55.exe
2480	m54lsb9i.exe
5492	0dgdmn55.tmp
1204	dccadcabdbc.exe
3796	wxcdsp4y.exe
712	winhost.exe
4316	FastRunner.exe
4948	dumkw.exe
3268	dumkw.exe

Loads dropped DLL 1 IoCs

pid	Process
5492	0dgdmn55.tmp

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\dccadcabdbc = "\"C:\\ProgramData\\dccadcabdbc.exe\""	wxcdsp4y.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\dccadcabdbc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wxcdsp4y.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\dccadcabdbc = "\"C:\\ProgramData\\dccadcabdbc.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Component Manager = "C:\\Users\\Admin\\AppData\\Roaming\\nqfyw\\dumkw.exe"	m54lsb9i.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FastRunner.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4248 set thread context of 5396	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	89

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
6044	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0dgdmn55.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FastRunner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FastRunner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0dgdmn55.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dgdmn55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dgdmn55.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000c00000001c5a3-29.dat	innosetup
behavioral2/memory/4160-53-0x00000000009F0000-0x0000000000AF6000-memory.dmp	innosetup
behavioral2/memory/4160-315-0x00000000009F0000-0x0000000000AF6000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1924	wxcdsp4y.exe
1924	wxcdsp4y.exe
2428	1y2b7i3f.exe
2428	1y2b7i3f.exe
2480	m54lsb9i.exe
2480	m54lsb9i.exe
4948	dumkw.exe
4948	dumkw.exe
6044	wmic.exe
6044	wmic.exe
6044	wmic.exe
6044	wmic.exe
3268	dumkw.exe
3268	dumkw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4604	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeDebugPrivilege	2480	m54lsb9i.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeDebugPrivilege	4948	dumkw.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeIncreaseQuotaPrivilege	6044	wmic.exe
Token: SeSecurityPrivilege	6044	wmic.exe
Token: SeTakeOwnershipPrivilege	6044	wmic.exe
Token: SeLoadDriverPrivilege	6044	wmic.exe
Token: SeSystemProfilePrivilege	6044	wmic.exe
Token: SeSystemtimePrivilege	6044	wmic.exe
Token: SeProfSingleProcessPrivilege	6044	wmic.exe
Token: SeIncBasePriorityPrivilege	6044	wmic.exe
Token: SeCreatePagefilePrivilege	6044	wmic.exe
Token: SeBackupPrivilege	6044	wmic.exe
Token: SeRestorePrivilege	6044	wmic.exe
Token: SeShutdownPrivilege	6044	wmic.exe
Token: SeDebugPrivilege	6044	wmic.exe
Token: SeSystemEnvironmentPrivilege	6044	wmic.exe
Token: SeRemoteShutdownPrivilege	6044	wmic.exe
Token: SeUndockPrivilege	6044	wmic.exe
Token: SeManageVolumePrivilege	6044	wmic.exe
Token: 33	6044	wmic.exe
Token: 34	6044	wmic.exe
Token: 35	6044	wmic.exe
Token: 36	6044	wmic.exe
Token: SeIncreaseQuotaPrivilege	6044	wmic.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 5396	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4248 wrote to memory of 5396	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4248 wrote to memory of 2428	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4248 wrote to memory of 1924	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	91
PID 1924 wrote to memory of 2848	1924	wxcdsp4y.exe	81
PID 2428 wrote to memory of 4348	2428	1y2b7i3f.exe	58
PID 2428 wrote to memory of 4408	2428	1y2b7i3f.exe	59
PID 2428 wrote to memory of 6060	2428	1y2b7i3f.exe	79
PID 2428 wrote to memory of 2848	2428	1y2b7i3f.exe	81
PID 4248 wrote to memory of 4160	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	92
PID 4248 wrote to memory of 2480	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	93
PID 2480 wrote to memory of 1984	2480	m54lsb9i.exe	94
PID 2848 wrote to memory of 1432	2848	explorer.exe
PID 2848 wrote to memory of 5248	2848	explorer.exe
PID 4160 wrote to memory of 5492	4160	0dgdmn55.exe	98
PID 2848 wrote to memory of 1328	2848	explorer.exe
PID 2480 wrote to memory of 2036	2480	m54lsb9i.exe	101
PID 2480 wrote to memory of 4356	2480	m54lsb9i.exe	105
PID 4248 wrote to memory of 4316	4248	2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe	107
PID 2848 wrote to memory of 1060	2848	explorer.exe
PID 2480 wrote to memory of 2848	2480	m54lsb9i.exe	81
PID 2480 wrote to memory of 2848	2480	m54lsb9i.exe	81
PID 4948 wrote to memory of 200	4948	dumkw.exe	110
PID 4948 wrote to memory of 2848	4948	dumkw.exe	81
PID 4948 wrote to memory of 2848	4948	dumkw.exe	81
PID 4316 wrote to memory of 4604	4316	FastRunner.exe	112
PID 4604 wrote to memory of 1492	4604	msedgewebview2.exe	113
PID 4604 wrote to memory of 936	4604	msedgewebview2.exe	115
PID 4604 wrote to memory of 936	4604	msedgewebview2.exe	115
PID 4604 wrote to memory of 936	4604	msedgewebview2.exe	115
PID 4604 wrote to memory of 936	4604	msedgewebview2.exe	115
PID 4604 wrote to memory of 5608	4604	msedgewebview2.exe	116
PID 4604 wrote to memory of 2300	4604	msedgewebview2.exe	117
PID 4604 wrote to memory of 2300	4604	msedgewebview2.exe	117
PID 4604 wrote to memory of 2300	4604	msedgewebview2.exe	117
PID 4604 wrote to memory of 4624	4604	msedgewebview2.exe	118
PID 4604 wrote to memory of 4624	4604	msedgewebview2.exe	118
PID 4604 wrote to memory of 4624	4604	msedgewebview2.exe	118
PID 4604 wrote to memory of 4624	4604	msedgewebview2.exe	118
PID 4604 wrote to memory of 4624	4604	msedgewebview2.exe	118
PID 4316 wrote to memory of 6044	4316	FastRunner.exe	119
PID 3268 wrote to memory of 1680	3268	dumkw.exe	122
PID 3268 wrote to memory of 2848	3268	dumkw.exe	81
PID 3268 wrote to memory of 2848	3268	dumkw.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:6060
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_7dbc301e3b4d2899c12576693696858e_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\system32\notepad.exe
      C:\Windows\system32\notepad.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\1y2b7i3f.exe
      "C:\Users\Admin\AppData\Local\Temp\1y2b7i3f.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\wxcdsp4y.exe
      "C:\Users\Admin\AppData\Local\Temp\wxcdsp4y.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\0dgdmn55.exe
      "C:\Users\Admin\AppData\Local\Temp\0dgdmn55.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\is-77918HCMEV.tmp\0dgdmn55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-77918HCMEV.tmp\0dgdmn55.tmp" /SL5="$901D0,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\0dgdmn55.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\m54lsb9i.exe
      "C:\Users\Admin\AppData\Local\Temp\m54lsb9i.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
        5⤵
        
        PID:1984
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security Scanner"
        5⤵
        
        PID:2036
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security Scanner" /tr "C:\Users\Admin\AppData\Roaming\nqfyw\dumkw.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\FastRunner.exe
      "C:\Users\Admin\AppData\Local\Temp\FastRunner.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4316.2788.4683552570501985469 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4604
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView /prefetch:4 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe79d75fd8,0x7ffe79d75fe4,0x7ffe79d75ff0
        6⤵
        
        PID:1492
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        6⤵
        
        PID:936
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        6⤵
        
        PID:5608
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        6⤵
        
        PID:2300
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c /prefetch:1
        6⤵
        
        PID:4624
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4596 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        6⤵
        
        PID:2104
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4704 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        6⤵
        
        PID:1748
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView" --webview-exe-name=FastRunner.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4708 --field-trial-handle=1724,i,13375149264328364692,16995376361552546984,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d1ca878d6e1032aaa56633cb07edd1f578ff032c
        6⤵
        
        PID:3876
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        5⤵
        Queries system WMI classes for hardware identifiers
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6044

C:\ProgramData\dccadcabdbc.exe
"C:\ProgramData\dccadcabdbc.exe"
1⤵
- Executes dropped EXE
PID:1204

C:\Users\Admin\AppData\Local\Temp\wxcdsp4y.exe
"C:\Users\Admin\AppData\Local\Temp\wxcdsp4y.exe"
1⤵
- Executes dropped EXE
PID:3796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:712

C:\Users\Admin\AppData\Roaming\nqfyw\dumkw.exe
C:\Users\Admin\AppData\Roaming\nqfyw\dumkw.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:200

C:\Users\Admin\AppData\Roaming\nqfyw\dumkw.exe
"C:\Users\Admin\AppData\Roaming\nqfyw\dumkw.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0dgdmn55.exe

Path C:\Users\Admin\AppData\Local\Temp\0dgdmn55.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1y2b7i3f.exe

Path C:\Users\Admin\AppData\Local\Temp\1y2b7i3f.exe
Size 57KB
SHA256 eb4c2dc7db21d6a8a889c74c7b90eaac0e095205063ae3e348a400e253c6bdd8
MD5 51242d1f06d41c80ea8c6fa541be3d6e
SHA1 a01f91e44b2a59f24b9e9c72e46e2207b6f86526
SHA512 bc7bde4ea9431f0e7c5345ea9cd1da7ec2f6a27da9f0bcfbd86b15dcfb2df3f416603d29986b849668b5e85c73678b76ad518d98cdecc6b8ae504a284fd90ff6
SSDEEP 1536:sKWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:sKm5dAppRdX0jlP1wT0E
TLSH
T184433A58A6DE624DD836D4B5D6A5D333FBA3F8427235974F0132C91E0F22B26BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dgdmn55.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-77918HCMEV.tmp\0dgdmn55.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-HGJ6DR99GS.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m54lsb9i.exe

Path C:\Users\Admin\AppData\Local\Temp\m54lsb9i.exe
Size 357KB
SHA256 776d0938c28d05163fa083ed1455b462b1266c22b81506071981af1b368764af
MD5 5c679871fa1161cdf87b4dbd05dbd19d
SHA1 00f1213b9cc91f8d14d42c79bd5a006fe4a08e78
SHA512 5edfabaf1aed9e0be9e3d40d1ccd2fcd95bdc48d9348459bbe16a77a7050ad8a4a1794d29a6463c021ee14223a78dd5aebc67338faedf7786089f8ba4a1d95bf
SSDEEP 6144:DLjOMiQPoDjo4ZYOVKS2bwJz8RmQf0WIiEnm2j7ZvINkn0srBQVM+5:DAQgDjoOktsORmQf07iSvN0hs
TLSH
T19074F147FAF432E9E1264678C4750E06A73AF4BD0A348D6F035C42696F366E19D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxcdsp4y.exe

Path C:\Users\Admin\AppData\Local\Temp\wxcdsp4y.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a43a544-5abf-4205-ade0-318206fb7651.tmp

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\3a43a544-5abf-4205-ade0-318206fb7651.tmp
Size 15KB
SHA256 55055de081824529576f6cfd88ce32c445c580dd881c00c071169f00c018efdf
MD5 0d19cc048d68c7ec0d5335b1cadf657c
SHA1 c237ab935a12259865917ebc8a11697832dd9f65
SHA512 4a60a8daa831e95212be93a18d5f18fd8491ce691fe7657b0eee5c775321db000bf6cf00108ec33b1179bf0903915075e5d9b62c59d98b9745857a875b73e244
SSDEEP 384:g+OBqImmJvGBLx3NaFMJFaNBS+c3L/zkg6rL:ZcvGtlNQODzav
TLSH
T131729D772C656E332CEBC60ABE8A2347CB65A293C0D57BD4DDEC9F0E112B1940352C96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

470c7946-03ab-4583-9183-49a7bb717094.tmp

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\470c7946-03ab-4583-9183-49a7bb717094.tmp
Size 2KB
SHA256 f576d6e8b8543b9e7cfcf46a1104ccc004512b83741c7e43d2a86fb0ea9d1faf
MD5 b2155af2b47e2613c7f3d610e094acb8
SHA1 629b648db8ac3c0d93aa4e7ccf8a8e9db587d7db
SHA512 8d4d225e5563744acbc54d6c0ace0dd9d31e38f324fb9f61351178f1bc3a8ff9bd11a0fad41a8b6943c9e36de361b4265253b40545620c593a963bef1fb6332b
TLSH
T1065163737C28AF379AE69A45B94A3A13CE7990519A932F508AED0B1C01D729C5305CA7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f66394e4b1e9481505affb933e7354bd85f0092db3c16c703811908df5c6af5f
MD5 9e001094b389de3eb28dc981f662153a
SHA1 5af19f81bf07efcbcb7ed7de3d547b471d229588
SHA512 cc2c9cc33e50f654f0c6b25be943d1dc29de73de7229d3a0bfcefcd41543cfae160724baa2ba64fc76c946e15aef5e13b4dee773e42a5f1a0d473155dda42654
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9382902ca4111b2dc9f35a25d5515ca12f6253ad27a4f49ff3596d088fb4d35a
MD5 5cb061b07327409f7f2d2b1dc617e2ba
SHA1 c249775babd41e08d660ab1e7781c6b276b902ea
SHA512 4f6ea40cd5a06314bf9ad5c14f190501e73303153b83b7d0c6052c9002c455be232c615da3ca629f65816df201cd1d19094fdd2b3eb1ed613e7ce6a6c931dba9
TLSH
T1D4D0121B7B414174C82021331802A50C0502D90B5289C040943C855D1FA46901907841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

503646b0-d65f-4a06-a863-21eb9d655f46.tmp

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\503646b0-d65f-4a06-a863-21eb9d655f46.tmp
Size 6KB
SHA256 871fc9b5ad1242621401235318446af1a55ff71eba25c5be28527cb3f5b001e0
MD5 855f85ecb06cf0551930c60981d98f5c
SHA1 0cc9d169e87806e52611ddd16d00c7329a46189a
SHA512 96f8b04ce158e0d02f0cb58cb02eeaa9fd070cabd7e3020a6f5ca3b643c19c2de8a643275d56dafbcf99352a03dd0705540741dc91ba28373437ffdb5fc44675
SSDEEP 96:st2//dfdMoGqGmZb93kkGo5h16Z528s7/x+6MhmuecS2L8S1eje1rK+gRSO4J+2z:st0h9j6oKrsV+F2mjQjP2+G6K
TLSH
T1BDD196026E28BD7B4CCBF119FE257A16E2F5A07161D51E48EBFD4A2C04DB6DC621780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98ee1ade-6ee4-4945-a8e1-8d6951004aff.tmp

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\98ee1ade-6ee4-4945-a8e1-8d6951004aff.tmp
Size 6KB
SHA256 6282b8d919b61d348cd09928a5f085f73ae366b02b94e7c0945b9d254d49393f
MD5 7598d48f6d833e2f766f036acd042b68
SHA1 a15a7c40f8062427f47b37d6d7362e7c3645e295
SHA512 827ee566783b108c82dd51d1beafa197e148b94ac21ca755a24baf79eadd4c5a6f69ae09a7049ae799fb3d747ce47cbbd5dd9cdbff9d6fa2945295e47f231241
SSDEEP 96:st2//dfdMoG7mZb93kkGo5h16Z528s7/x+6MhmuecS2L8S1eje1rK+gRSs1J+28U:st0hDj6oKrsV+F2mjQjPZ+G6K
TLSH
T15AD186016E28BD7B4CCBF119FE257A06E2F5907160D51E58EBFC462C04DA6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 d36c866b672e914c5a97bb6e5e2ec073e44d5def4b2806aa535c6e4441711573
MD5 1c653b5a0f1fb2a352fb10862cd5dc96
SHA1 fcc4868aefe3be48ee829406f5a576bc4b45a13b
SHA512 14635532c2d89ecddeebba02c933a95edecb381e4fa4f6a80a3a67abc41f66ff85ab13a31b3bc78b7308f0e4d1bf647d8c3d5ce5788f7f0be2e570697f3e6c07
TLSH
T16EB001A986421892C218867479E6A1403532CD5DC22729226AA092B69A7E3848646629
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 56f6cab57f69dc13795adb3342c259e814bd3083051bb852357e85a7f1146be9
MD5 9df2d75b924ef0f428d2619fdf59c834
SHA1 75a0220e0134e3d068cce03ef65f89eda9fe1123
SHA512 12410c7236e08097e69289ec0f46c357aaea7ae1c8e4809820dad76582ddf9127568c370bec6cbcaa228d1f7cad8f17caea99a251aa9c2ce731720f760693abd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

af690ddc-9d6f-4a2f-8bfe-4a261e6816aa.tmp

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Network\af690ddc-9d6f-4a2f-8bfe-4a261e6816aa.tmp
Size 821B
SHA256 aea4ef585948b82c299ee3f78112ef3fe6d84b5efc1620455ca3f7e5797504b4
MD5 ee10852939b219e161057fc3f6c19bc2
SHA1 ce3ac1067c42a01a49a0545fd3cb4d45503649d2
SHA512 d248b2ed30631040daf2c39e9a01752e96f5f911bfe85768c6f902e2e0cec0e2a73f2b6cf838ca7f8e7ebad07f0d0843dfbb18222839323bc48e4f444f8589e3
TLSH
T157016FB6C3D4C67D894563E426243827CD2E141912282D27DDEAEBEA9BE2071DB1060F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\Local State
Size 1KB
SHA256 ea7f4c90782e1911b3dd3c760800e954cdbce32024e7d4b2b6031f583af59729
MD5 5a53acf328a4ea5999f0142052b207aa
SHA1 3a288718fda60eb7d5b9ad342d5215aaa523a497
SHA512 61af8d00f02aba72544d501fdd58760f2abd64a769bd16444e5ab70a2465cc938a658c802e20dd1f231d4a574e26c004c7fb4e79640307a4bb87633b67a4b6af
TLSH
T11C2165F3E8A85F32BDD6A686654A76079D30405B81524F409AEE0A1C02D73CC923DCB3
MD5 SHA1 SHA512 TLSH

Submit Download

c88c5678-6adb-4768-b1a7-73a3d04804af.tmp

Path C:\Users\Admin\AppData\Roaming\FastRunner.exe\EBWebView\c88c5678-6adb-4768-b1a7-73a3d04804af.tmp
Size 3KB
SHA256 9323642d692fe9e70fcb555496fa5122b305f58ea705ee802fba7c69a771b63e
MD5 7e676bac397b306235410021b747228a
SHA1 5529312164f2b7c05ba98ae545b5c431d530b637
SHA512 9f1339310e80dbb4d12d5b49328c9e6aeb278ad55bd90511749c9c8a5f314ba7ba1b75467d07ded67bf2716ed12d26c26752fb22fedeaac3342c093311570b68
TLSH
T1EA6183737D74AA375EE3DA45B98A2B06EBA58023E9963F94CAEC0E0C01D73D81351C57
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_1252003336\manifest.json
Size 102B
SHA256 4a918873dddefc4e395c8a9f8580c8f03c9a37512eb7da6e6454730be756fdac
MD5 bbd743ed25bbba94c85d6d7310c4fd45
SHA1 d19550c1895576761ab76f3ba9bb813511002bd8
SHA512 070aad3473150ba7388e2305f3d5dff14c69a4b468609fa38e1411e575d271d63cc1bf4083d63372b4d244ee5031bd40933f5f68f041c9650999509666e219e1
TLSH
T1B0B01220EC10B4B30004436C0C6CC3C073272F032C4079180DE59F84E90E9DBE071529
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_755082929\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-332-0x00000239839E0000-0x0000023983A0F000-memory.dmp

Download

memory/936-148-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp

Download

memory/1204-85-0x00007FF75BB50000-0x00007FF75BB6E000-memory.dmp

Download

memory/1204-86-0x00007FF75BB50000-0x00007FF75BB6E000-memory.dmp

Download

memory/1924-26-0x00007FF6A41E0000-0x00007FF6A41FE000-memory.dmp

Download

memory/1924-36-0x00007FF6A41E0000-0x00007FF6A41FE000-memory.dmp

Download

memory/2104-418-0x00007FFE9C800000-0x00007FFE9C801000-memory.dmp

Download

memory/2104-417-0x00007FFE9C7C0000-0x00007FFE9C7C1000-memory.dmp

Download

memory/2848-312-0x0000000003230000-0x0000000003275000-memory.dmp

Download

memory/2848-41-0x0000000002860000-0x0000000002867000-memory.dmp

Download

memory/2848-67-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-66-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-65-0x0000000002E70000-0x0000000002E71000-memory.dmp

Download

memory/2848-63-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/2848-104-0x0000000005E30000-0x0000000005E75000-memory.dmp

Download

memory/2848-64-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-314-0x0000000003230000-0x0000000003275000-memory.dmp

Download

memory/2848-98-0x0000000003100000-0x0000000003140000-memory.dmp

Download

memory/2848-81-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-99-0x00000000031A0000-0x00000000031E5000-memory.dmp

Download

memory/2848-68-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-302-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-69-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-87-0x00000000059B0000-0x00000000059B1000-memory.dmp

Download

memory/2848-71-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-97-0x00000000030F0000-0x00000000030F1000-memory.dmp

Download

memory/2848-32-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/2848-33-0x0000000002830000-0x0000000002855000-memory.dmp

Download

memory/3796-91-0x00007FF6A41E0000-0x00007FF6A41FE000-memory.dmp

Download

memory/3876-487-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-489-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-490-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-479-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-481-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-488-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-486-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/3876-485-0x000002391F300000-0x000002391F301000-memory.dmp

Download

memory/4160-53-0x00000000009F0000-0x0000000000AF6000-memory.dmp

Download

memory/4160-315-0x00000000009F0000-0x0000000000AF6000-memory.dmp

Download

memory/4316-451-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-356-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-376-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-414-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-372-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-521-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-360-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-505-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-435-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-317-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-455-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-386-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-478-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4316-344-0x00007FF761020000-0x00007FF766743000-memory.dmp

Download

memory/4348-37-0x000001FB47E20000-0x000001FB47E23000-memory.dmp

Download

memory/4348-43-0x000001FB47FF0000-0x000001FB47FF7000-memory.dmp

Download

memory/4408-45-0x0000017F67A80000-0x0000017F67A87000-memory.dmp

Download

memory/4624-223-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp

Download

memory/5396-2-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5492-343-0x0000000000150000-0x00000000005B0000-memory.dmp

Download

memory/5492-359-0x0000000000150000-0x00000000005B0000-memory.dmp

Download

memory/5492-316-0x0000000000150000-0x00000000005B0000-memory.dmp

Download

memory/5492-434-0x0000000000150000-0x00000000005B0000-memory.dmp

Download

memory/6060-47-0x0000022BD1FC0000-0x0000022BD1FC7000-memory.dmp

Download