salatstealer | 7f71f5eb68ffa1edabad0f3a632a27c2fb7ece34e5ee32f1e07d7fc18107b6a8

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f71f5eb68ffa1edabad0f3a632a27c2fb7ece34e5ee32f1e07d7fc18107b6a8.bin.bat
Size 12.7MB
Sample261030-n29fcaby21
SHA256 7f71f5eb68ffa1edabad0f3a632a27c2fb7ece34e5ee32f1e07d7fc18107b6a8
MD5 5da12b60d5b062f2547cea11e9fe09d9
SHA1 c2ce2e5f6dccfaa35b3dae4d0b71b3316f73b20c
SHA512 48eabdb421891bf31299b848804f9d88f172f62f88364bfd3bf366d13e037f15761c9277e8c0c2bf095b08b2702cd90fd8b726375ff8763d151c74dc92fcaa7d
SSDEEP 49152:GYJZB1zf1AShb/lCG17d1wXhQ1+DxnSstWu5Ju2WrTmBGS4as+hQ8jxK9pXYHdzq:t
TLSH
T1C9D69C322603BCFA3F6E6EC599142D404C4D3D974254C9A4BE4EF8B3A6DE1486FAE474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 13 IoCs

resource	yara_rule
behavioral2/memory/4520-13147-0x0000000000260000-0x0000000000EB4000-memory.dmp	family_salatstealer
behavioral2/memory/4520-13148-0x0000000000260000-0x0000000000EB4000-memory.dmp	family_salatstealer
behavioral2/memory/4520-13156-0x0000000000260000-0x0000000000EB4000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13157-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13158-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/4956-13176-0x0000000000AA0000-0x00000000016F4000-memory.dmp	family_salatstealer
behavioral2/memory/2032-13197-0x00000000008D0000-0x0000000001524000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13204-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13205-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13206-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13207-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13208-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer
behavioral2/memory/5600-13209-0x0000000000FD0000-0x0000000001C24000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe	updater_coZtdjVV.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe	csrss.exe

Executes dropped EXE 5 IoCs

pid	Process
1000	vcomp140.exe
4520	updater_coZtdjVV.exe
5600	csrss.exe
4956	csrss.exe
2032	csrss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4276	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000000439-13144.dat	upx
behavioral2/memory/4520-13146-0x0000000000260000-0x0000000000EB4000-memory.dmp	upx
behavioral2/memory/4520-13147-0x0000000000260000-0x0000000000EB4000-memory.dmp	upx
behavioral2/memory/4520-13148-0x0000000000260000-0x0000000000EB4000-memory.dmp	upx
behavioral2/memory/5600-13155-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/4520-13156-0x0000000000260000-0x0000000000EB4000-memory.dmp	upx
behavioral2/memory/5600-13157-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/5600-13158-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/4956-13166-0x0000000000AA0000-0x00000000016F4000-memory.dmp	upx
behavioral2/memory/4956-13176-0x0000000000AA0000-0x00000000016F4000-memory.dmp	upx
behavioral2/memory/2032-13182-0x00000000008D0000-0x0000000001524000-memory.dmp	upx
behavioral2/memory/2032-13197-0x00000000008D0000-0x0000000001524000-memory.dmp	upx
behavioral2/memory/5600-13204-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/5600-13205-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/5600-13206-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/5600-13207-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/5600-13208-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx
behavioral2/memory/5600-13209-0x0000000000FD0000-0x0000000001C24000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\c9d8ca2b-5d52-02a4-fc70-cb2178812b5d	updater_coZtdjVV.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\smss.exe	updater_coZtdjVV.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe	csrss.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\csrss.exe	csrss.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3676	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater_coZtdjVV.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater_coZtdjVV.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	csrss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	csrss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	csrss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	csrss.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcomp140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater_coZtdjVV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4520	updater_coZtdjVV.exe
4520	updater_coZtdjVV.exe
4520	updater_coZtdjVV.exe
4520	updater_coZtdjVV.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
1308	powershell.exe
1308	powershell.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe
5600	csrss.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeIncreaseQuotaPrivilege	1308	powershell.exe
Token: SeSecurityPrivilege	1308	powershell.exe
Token: SeTakeOwnershipPrivilege	1308	powershell.exe
Token: SeLoadDriverPrivilege	1308	powershell.exe
Token: SeSystemProfilePrivilege	1308	powershell.exe
Token: SeSystemtimePrivilege	1308	powershell.exe
Token: SeProfSingleProcessPrivilege	1308	powershell.exe
Token: SeIncBasePriorityPrivilege	1308	powershell.exe
Token: SeCreatePagefilePrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1308	powershell.exe
Token: SeRestorePrivilege	1308	powershell.exe
Token: SeShutdownPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeSystemEnvironmentPrivilege	1308	powershell.exe
Token: SeRemoteShutdownPrivilege	1308	powershell.exe
Token: SeUndockPrivilege	1308	powershell.exe
Token: SeManageVolumePrivilege	1308	powershell.exe
Token: 33	1308	powershell.exe
Token: 34	1308	powershell.exe
Token: 35	1308	powershell.exe
Token: 36	1308	powershell.exe
Token: SeIncreaseQuotaPrivilege	1308	powershell.exe
Token: SeSecurityPrivilege	1308	powershell.exe
Token: SeTakeOwnershipPrivilege	1308	powershell.exe
Token: SeLoadDriverPrivilege	1308	powershell.exe
Token: SeSystemProfilePrivilege	1308	powershell.exe
Token: SeSystemtimePrivilege	1308	powershell.exe
Token: SeProfSingleProcessPrivilege	1308	powershell.exe
Token: SeIncBasePriorityPrivilege	1308	powershell.exe
Token: SeCreatePagefilePrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1308	powershell.exe
Token: SeRestorePrivilege	1308	powershell.exe
Token: SeShutdownPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeSystemEnvironmentPrivilege	1308	powershell.exe
Token: SeRemoteShutdownPrivilege	1308	powershell.exe
Token: SeUndockPrivilege	1308	powershell.exe
Token: SeManageVolumePrivilege	1308	powershell.exe
Token: 33	1308	powershell.exe
Token: 34	1308	powershell.exe
Token: 35	1308	powershell.exe
Token: 36	1308	powershell.exe
Token: SeIncreaseQuotaPrivilege	1308	powershell.exe
Token: SeSecurityPrivilege	1308	powershell.exe
Token: SeTakeOwnershipPrivilege	1308	powershell.exe
Token: SeLoadDriverPrivilege	1308	powershell.exe
Token: SeSystemProfilePrivilege	1308	powershell.exe
Token: SeSystemtimePrivilege	1308	powershell.exe
Token: SeProfSingleProcessPrivilege	1308	powershell.exe
Token: SeIncBasePriorityPrivilege	1308	powershell.exe
Token: SeCreatePagefilePrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1308	powershell.exe
Token: SeRestorePrivilege	1308	powershell.exe
Token: SeShutdownPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeSystemEnvironmentPrivilege	1308	powershell.exe
Token: SeRemoteShutdownPrivilege	1308	powershell.exe
Token: SeUndockPrivilege	1308	powershell.exe
Token: SeManageVolumePrivilege	1308	powershell.exe
Token: 33	1308	powershell.exe
Token: 34	1308	powershell.exe
Token: 35	1308	powershell.exe
Token: 36	1308	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4276	3676	cmd.exe	91
PID 3676 wrote to memory of 1000	3676	cmd.exe	92
PID 1000 wrote to memory of 4520	1000	vcomp140.exe	93
PID 4520 wrote to memory of 5600	4520	updater_coZtdjVV.exe	95
PID 5600 wrote to memory of 1308	5600	csrss.exe	96
PID 5600 wrote to memory of 4956	5600	csrss.exe	98
PID 5600 wrote to memory of 2032	5600	csrss.exe	100
PID 1308 wrote to memory of 2524	1308	powershell.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f71f5eb68ffa1edabad0f3a632a27c2fb7ece34e5ee32f1e07d7fc18107b6a8.bin.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp" "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\vcomp140.exe
  "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Microsoft\updater_coZtdjVV.exe
    C:\Users\Admin\AppData\Local\Microsoft\updater_coZtdjVV.exe
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe
      C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe
      4⤵
      Executes a file named after a Windows system binary
      Executes dropped EXE
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1308
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - C:\Program Files\Google\Chrome\Application\csrss.exe
        
        "C:\Program Files\Google\Chrome\Application\csrss.exe" -
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater_coZtdjVV.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_coZtdjVV.exe
Size 3.4MB
SHA256 0a9d56f0d7971548402fb30123e978e8c2d6156c180a707e242212f72325df3d
MD5 01c24f88d18f2315665dd09402d64714
SHA1 2e5f88385f8dd31cfd4bacc452a65a5b503250c2
SHA512 9c5187bfe1d2b42c5cdb01de6f04167c6cd5bfdc991d419e19767d147bee0c000e767e1d2f5b18a86f0d1accf5de572730ffe0f8356d5d7a088a1f223d1a6c7d
SSDEEP 98304:uBQeLe5jCnW24oLq//Z3xfNyCXISNUKGyzt:pO2wuV/nN1fH
TLSH
T171F5331ECF0B9912E1A5CB7E050D671F8AD8B60BF6AD45E6A23B69F89F16138350C10D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jfzjq2jl.ctg.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jfzjq2jl.ctg.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vcomp140.exe

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.exe
Size 9.4MB
SHA256 fcaf1f466fe1574055cbc2f3d6b72080e77587204d03c513a10514f2aa40c8e7
MD5 9491f20f2e2551cd03f6041bb8903c30
SHA1 40093e09b1df9fb73ed39572189e78fc4d0e8b6a
SHA512 40cc0f1533d36cb65bcc376e7b361e826c0e5c3a10bf3e041b3cd9372c57c700eff00dcdee40666143a71f1733cb674506d97e9bb8430452f4bbaeacb2e3f260
SSDEEP 196608:JbW048ihnjBqMPxcTzfAsoiMJ19baWCQ:l29fPxcfosu7R
TLSH
T18CA69C41FECB98F6E903193001A7B26F67345D014F25CBD7EB647B2AE97B6A11833249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp
Size 12.6MB
SHA256 9f04d1219599fb2ca751249ab75d0e3800638bd4e39ce54a87596166085d584b
MD5 c8a3cc76fd16b1e665cc08d6fe2c5fe6
SHA1 9dc8d69936215cb03a61dcc95816c33a390099b7
SHA512 a4bb9c88b834e009e5d937ec19e93de16369d2ee1817ec152c791a8e1f2dd68b524a0476ad37dc8e8e7e748678ef90fc17aafbb51fb470a078147a3adc91f9c8
SSDEEP 49152:bMnpblZP1E+plFliC7DHFUBNoG3J5YCdcGfp4MmlbwfOWmGgo1KyBLQ1HfOjfJqE:P
TLSH
T11BD68D320203BDFB3B6D5EC998002E514C5D3D874398DA94AE4EB1B7BADE2185F9E474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp
Size 28KB
SHA256 1d5665fea2dabb2b14b27c858e71bd4ba7995386b49c74c16f905485a4a2e63e
MD5 c7735877c314578ae8c22b4f5e627c5e
SHA1 c532d37f6c31011c6ebf1b1a5d198b957e13fd4f
SHA512 d511d091d99a628ef8755304ffe736056c4b27d763d9ace46af841d8878c393b7f2cf08a5c241066117a4fc68e1f9cbf36705e741eed3453b5159d3d85c5d6cd
SSDEEP 384:vbuTsSPuCRcCZAgouuVtTT5o81WPQdG9NYQdQYUqgwruRzB3sL/+iyIZVhW1R3d3:Du3RMfe8YQdGld+wrI1MFKRt6cpSN3a
TLSH
T1BBD23A3502434D7F7B6CBEC69D201D8A8D8C2FC70398EE495F4EE6329E9A2184B5B075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-13164-0x0000000005430000-0x0000000005A7A000-memory.dmp

Download

memory/1308-13167-0x00000000052F0000-0x0000000005312000-memory.dmp

Download

memory/1308-13193-0x00000000076F0000-0x00000000076FA000-memory.dmp

Download

memory/1308-13190-0x0000000007560000-0x0000000007603000-memory.dmp

Download

memory/1308-13196-0x0000000008910000-0x0000000008ECA000-memory.dmp

Download

memory/1308-13195-0x0000000007B80000-0x0000000007BA2000-memory.dmp

Download

memory/1308-13161-0x0000000002850000-0x0000000002886000-memory.dmp

Download

memory/1308-13186-0x0000000070840000-0x0000000070B9B000-memory.dmp

Download

memory/1308-13194-0x00000000077A0000-0x0000000007836000-memory.dmp

Download

memory/1308-13191-0x0000000007CD0000-0x000000000834C000-memory.dmp

Download

memory/1308-13169-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/1308-13168-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/1308-13172-0x0000000005BD0000-0x0000000005F2B000-memory.dmp

Download

memory/1308-13173-0x00000000060D0000-0x00000000060EE000-memory.dmp

Download

memory/1308-13174-0x0000000006100000-0x000000000614C000-memory.dmp

Download

memory/1308-13192-0x0000000007690000-0x00000000076AA000-memory.dmp

Download

memory/1308-13189-0x0000000007540000-0x0000000007560000-memory.dmp

Download

memory/1308-13183-0x00000000070C0000-0x0000000007108000-memory.dmp

Download

memory/1308-13184-0x0000000007500000-0x0000000007536000-memory.dmp

Download

memory/1308-13185-0x0000000070630000-0x000000007067C000-memory.dmp

Download

memory/2032-13197-0x00000000008D0000-0x0000000001524000-memory.dmp

Download

memory/2032-13182-0x00000000008D0000-0x0000000001524000-memory.dmp

Download

memory/4520-13156-0x0000000000260000-0x0000000000EB4000-memory.dmp

Download

memory/4520-13148-0x0000000000260000-0x0000000000EB4000-memory.dmp

Download

memory/4520-13147-0x0000000000260000-0x0000000000EB4000-memory.dmp

Download

memory/4520-13146-0x0000000000260000-0x0000000000EB4000-memory.dmp

Download

memory/4956-13176-0x0000000000AA0000-0x00000000016F4000-memory.dmp

Download

memory/4956-13166-0x0000000000AA0000-0x00000000016F4000-memory.dmp

Download

memory/5600-13158-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13157-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13155-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13204-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13205-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13206-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13207-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13208-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download

memory/5600-13209-0x0000000000FD0000-0x0000000001C24000-memory.dmp

Download