salatstealer | 5443928a7d2098008bccd89bcdff03e4a5ad834a9ea8e5ac114f1f15b6a12646

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SystemFix.exe
Size 3.8MB
Sample261102-hldqvafy2w
SHA256 5443928a7d2098008bccd89bcdff03e4a5ad834a9ea8e5ac114f1f15b6a12646
MD5 22eb216bc0770ff01b55e7e502d39b36
SHA1 f8e39597e93ca8b588d2bedfaf406965e51d087b
SHA512 2416ba4edb3c2d72e6f79fb76f8ca75ba6c4d366b240bcb17212aeb25c654931dd262a479ddce8a8782652a2ca97fe6aa4ddf8679b39f5d871b5aa6b214b6415
SSDEEP 49152:EshgJjJeX+EGu/4IMhvTpLRVk3OJKwK3vHEWt1WEbheKuL/9TKlvYP:EJM52htFJKwufsVKuLlwYP
TLSH
T192062338E6E428F5D77BA275895A2B0AD66B3C1387A197DF63C00A672E135D0CF39350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 17 IoCs

resource	yara_rule
behavioral2/memory/2140-99-0x0000000000850000-0x00000000014A5000-memory.dmp	family_salatstealer
behavioral2/memory/2140-100-0x0000000000850000-0x00000000014A5000-memory.dmp	family_salatstealer
behavioral2/memory/2140-102-0x0000000000850000-0x00000000014A5000-memory.dmp	family_salatstealer
behavioral2/memory/2140-103-0x0000000000850000-0x00000000014A5000-memory.dmp	family_salatstealer
behavioral2/memory/2140-104-0x0000000000850000-0x00000000014A5000-memory.dmp	family_salatstealer
behavioral2/memory/2140-111-0x0000000000850000-0x00000000014A5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-113-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-114-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-115-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-116-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5772-132-0x00000000009A0000-0x00000000015F5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-149-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-150-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-151-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-152-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-153-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer
behavioral2/memory/5088-154-0x0000000000990000-0x00000000015E5000-memory.dmp	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
2140	SystemFix.exe
5088	dllhost.exe
5772	dllhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5bc-4.dat	upx
behavioral2/memory/2140-13-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/2140-99-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/2140-100-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/2140-102-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/2140-103-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/2140-104-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/5088-112-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/2140-111-0x0000000000850000-0x00000000014A5000-memory.dmp	upx
behavioral2/memory/5088-113-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-114-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-115-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-116-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5772-124-0x00000000009A0000-0x00000000015F5000-memory.dmp	upx
behavioral2/memory/5772-132-0x00000000009A0000-0x00000000015F5000-memory.dmp	upx
behavioral2/memory/5088-149-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-150-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-151-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-152-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-153-0x0000000000990000-0x00000000015E5000-memory.dmp	upx
behavioral2/memory/5088-154-0x0000000000990000-0x00000000015E5000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe	dllhost.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\f1ff498e-e1b6-0210-9aae-2d01a9478ee1	SystemFix.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\WmiPrvSE.exe	SystemFix.exe
File opened for modification	C:\Program Files (x86)\Google\f1ff498e-e1b6-0210-9aae-2d01a9478ee1	SystemFix.exe
File opened for modification	C:\Program Files (x86)\Google\dllhost.exe	SystemFix.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3328	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemFix.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemFix.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemFix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2140	SystemFix.exe
2140	SystemFix.exe
2140	SystemFix.exe
2140	SystemFix.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
1880	powershell.exe
1880	powershell.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeIncreaseQuotaPrivilege	2756	powershell.exe
Token: SeSecurityPrivilege	2756	powershell.exe
Token: SeTakeOwnershipPrivilege	2756	powershell.exe
Token: SeLoadDriverPrivilege	2756	powershell.exe
Token: SeSystemProfilePrivilege	2756	powershell.exe
Token: SeSystemtimePrivilege	2756	powershell.exe
Token: SeProfSingleProcessPrivilege	2756	powershell.exe
Token: SeIncBasePriorityPrivilege	2756	powershell.exe
Token: SeCreatePagefilePrivilege	2756	powershell.exe
Token: SeBackupPrivilege	2756	powershell.exe
Token: SeRestorePrivilege	2756	powershell.exe
Token: SeShutdownPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeSystemEnvironmentPrivilege	2756	powershell.exe
Token: SeRemoteShutdownPrivilege	2756	powershell.exe
Token: SeUndockPrivilege	2756	powershell.exe
Token: SeManageVolumePrivilege	2756	powershell.exe
Token: 33	2756	powershell.exe
Token: 34	2756	powershell.exe
Token: 35	2756	powershell.exe
Token: 36	2756	powershell.exe
Token: SeIncreaseQuotaPrivilege	2756	powershell.exe
Token: SeSecurityPrivilege	2756	powershell.exe
Token: SeTakeOwnershipPrivilege	2756	powershell.exe
Token: SeLoadDriverPrivilege	2756	powershell.exe
Token: SeSystemProfilePrivilege	2756	powershell.exe
Token: SeSystemtimePrivilege	2756	powershell.exe
Token: SeProfSingleProcessPrivilege	2756	powershell.exe
Token: SeIncBasePriorityPrivilege	2756	powershell.exe
Token: SeCreatePagefilePrivilege	2756	powershell.exe
Token: SeBackupPrivilege	2756	powershell.exe
Token: SeRestorePrivilege	2756	powershell.exe
Token: SeShutdownPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeSystemEnvironmentPrivilege	2756	powershell.exe
Token: SeRemoteShutdownPrivilege	2756	powershell.exe
Token: SeUndockPrivilege	2756	powershell.exe
Token: SeManageVolumePrivilege	2756	powershell.exe
Token: 33	2756	powershell.exe
Token: 34	2756	powershell.exe
Token: 35	2756	powershell.exe
Token: 36	2756	powershell.exe
Token: SeIncreaseQuotaPrivilege	2756	powershell.exe
Token: SeSecurityPrivilege	2756	powershell.exe
Token: SeTakeOwnershipPrivilege	2756	powershell.exe
Token: SeLoadDriverPrivilege	2756	powershell.exe
Token: SeSystemProfilePrivilege	2756	powershell.exe
Token: SeSystemtimePrivilege	2756	powershell.exe
Token: SeProfSingleProcessPrivilege	2756	powershell.exe
Token: SeIncBasePriorityPrivilege	2756	powershell.exe
Token: SeCreatePagefilePrivilege	2756	powershell.exe
Token: SeBackupPrivilege	2756	powershell.exe
Token: SeRestorePrivilege	2756	powershell.exe
Token: SeShutdownPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeSystemEnvironmentPrivilege	2756	powershell.exe
Token: SeRemoteShutdownPrivilege	2756	powershell.exe
Token: SeUndockPrivilege	2756	powershell.exe
Token: SeManageVolumePrivilege	2756	powershell.exe
Token: 33	2756	powershell.exe
Token: 34	2756	powershell.exe
Token: 35	2756	powershell.exe
Token: 36	2756	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2140	4076	SystemFix.exe	89
PID 4076 wrote to memory of 3328	4076	SystemFix.exe	90
PID 3328 wrote to memory of 616	3328	cmd.exe	92
PID 616 wrote to memory of 5988	616	net.exe	93
PID 3328 wrote to memory of 2756	3328	cmd.exe	94
PID 2756 wrote to memory of 2256	2756	powershell.exe	97
PID 2756 wrote to memory of 3116	2756	powershell.exe	98
PID 3116 wrote to memory of 3224	3116	net.exe	99
PID 2140 wrote to memory of 5088	2140	SystemFix.exe	101
PID 5088 wrote to memory of 1880	5088	dllhost.exe	102
PID 5088 wrote to memory of 5772	5088	dllhost.exe	104

C:\Users\Admin\AppData\Local\Temp\SystemFix.exe
"C:\Users\Admin\AppData\Local\Temp\SystemFix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\binder_4076\SystemFix.exe
  "C:\Users\Admin\AppData\Local\Temp\binder_4076\SystemFix.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Program Files (x86)\Google\dllhost.exe
    "C:\Program Files (x86)\Google\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\binder_4076\SystemFix-Security.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$b64 = [IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\binder_4076\sf_embedded.b64'); $code = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($b64)); Invoke-Expression $code"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\System32\Dism\dismhost.exe
      C:\Windows\System32\Dism\dismhost.exe {A98A5CC4-47D8-42DF-AEB1-BCA9DD602197}
      4⤵
      Drops file in Windows directory
      PID:2256
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" accounts
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 accounts
        5⤵
        
        PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Password Policy Discovery

T1201

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 897a30fa068f5264a0e2b6be1a39c4dabdad72ebf1009b5ce6cfd1849c83a90e
MD5 423bf1c7e95bea5b4902ee6ff8b88f6d
SHA1 9f9ca0705655ed6fe48b46f44e97e08b4d99c6cc
SHA512 b290f16b8accfe1587fe285700f23201f6e69781b4abfa844bf80851c6a12411f58a941fab9904f078be099da79771ca6891522a428e9ce6ce41958bdd9f61c8
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUx4aT/JKO8nvwAOdB4V3CNBQkj2jaVcklr:iKLmShYoNz8KMSfKQ1EflJnpY9qiUDrr
TLSH
T156637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yadqozuz.iau.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yadqozuz.iau.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SystemFix-Security.bat

Path C:\Users\Admin\AppData\Local\Temp\binder_4076\SystemFix-Security.bat
Size 45KB
SHA256 75e957ee9a1df1e7da088698195717f4b22b8d7602304fb88faec3ad5b5212b4
MD5 86caffc511a3e9d96b6e1cb337d035e2
SHA1 3108f29357904dc83d5be02e61ccd7dc87803c32
SHA512 585f0b6c74345e76f50640113d4702c63fe1eea73d91f7c3638f532ad3efd83e69f1154a83e1ba504b0f9baec86c10b2e88b00031f3a94c1eb4aa5ed4ebfbad2
SSDEEP 768:RCTylA6YCdUZlBUzpNYVflkjlIyZCc++DB45A4TlAeMU4IAzBd3MeT3unMge8R9q:Kyl7ZgyL+yZCyTMAMlnPeiYxZfQ8JsRe
TLSH
T14723AE3CCAB2FDD6036EB2E1995D3F46209C1B13A7B20BACFAC144E61858645DF3959C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemFix.exe

Path C:\Users\Admin\AppData\Local\Temp\binder_4076\SystemFix.exe
Size 3.4MB
SHA256 7e9341eac4a4102f99059e34a767568334f1be4504bceb456749cf1d70dd5f25
MD5 3ff921d8c23318f251b4605825e152cd
SHA1 52a695f42c690aed17b0f911e6cf939527018b39
SHA512 c8cf03412cd71912b772879fb0074eaa69563aeb1f70f3e8e12058ee562d2dff7d64d7c6338ea7792a5e370ed52ce6a6fda904f2170aaee83568424cee9e89b6
SSDEEP 49152:EJjJeX+EGu/4IMhvTpLRVk3OJKwK3vHEWt1WEbheKuL/9TKlvY:kJM52htFJKwufsVKuLlwY
TLSH
T1D0F533A46A9C11B7D6777F33257E35AEAE0B08F9C9CDE11A39905A2FF71240BC1D1182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sf_embedded.b64

Path C:\Users\Admin\AppData\Local\Temp\binder_4076\sf_embedded.b64
Size 23KB
SHA256 cd7eb83943546375a3fe7cc9a1b31d379de3f0a21d6a5e6610f0bc8f6d86f68c
MD5 4155f4eb026abd7237c164aa3c638f09
SHA1 514df9f43fa969001cde61e922a397214136306a
SHA512 da2385483f25b603866c7cc819d9f5323e054c601a6d8283370119cf5faba58f036575b1e78ab2d5a21ef9c71110939ba0c10fffba06a9e713cd50fbc9d19c24
SSDEEP 384:ryM0U6tGpaD2fT6yDLZacKrUZg8HYCUlaGw6Z1BH4kwfl4W6DPtarJSWGwEPLR8s:rylm6auUZnBUR3RYbflkDlaMPCM+szBP
TLSH
T1A9B2683CC9F2FDDA03AFB2E5855D3F56209C1B13A7B20BACEAC504E61858645DF36158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sf_embedded.b64

Path C:\Users\Admin\AppData\Local\Temp\binder_4076\sf_embedded.b64
Size 43KB
SHA256 97e758f281e145aae4595fbdbed97412be6deeeafbccec30d417409f1890f4f5
MD5 79debae4f09be8e48e1bb1c20c016093
SHA1 da7d5cc0b5b50c89a4f46003b80a53f27e0a493f
SHA512 86e8127b3ed66d3ea01e30de8ffa14532b528f5326ab6b85924103010633d253ee9629c4ed471b2da99d48023b378ba3fa8bb489b0d8d03e836e644010ecf73f
SSDEEP 768:rylm6auUZnBUR3RYbflkDlaMPCM+szB4lA6TFAec64E2rldJMeT3uzMme8j9/NQj:ryl5m61MMPCCj82WlzTe4Kx1BS81sRe
TLSH
T16313AC3CCAB2FDD603AFB2E1495D3F56209C1B13A7B20BACFAC144E61854645DF3A598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 292KB
SHA256 d49ca3bc41bb47e7f99545f822cd182d8dff446ea3cbc1c0182882c5c2dd1145
MD5 29896c8caf06e04b42439d3fa704b06c
SHA1 a2f9ad4b9a2d9d475d532ede1ebcbc1dfa4015df
SHA512 f00549b58fbd1440d30c66cc2a990261d584b5035022b0b3132d75e79786aa7f0454db5ff08f26e135cedd0c8d296e5c04c43b0fb38922f7fe1ec27733becd83
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbke/9:2eCqtX/9
TLSH
T1C654C02E67EB0D31A189844372719BFD229635A3B6C8F714BA3FD12AE7C19CD4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 293KB
SHA256 611cc3854a22791b2d3f639963154b2f67f002e43aaa160c2e487a73bf722b3e
MD5 8cb62731c2f4e9ded0338a969be770b0
SHA1 7a594105a66c7823bf161d2779a1b0719e1c578f
SHA512 760a41396532f16122c29aa0170720b3573e722cf997cf4405c5ad7aa92bcba5731853b390f066a6acaa7d490957ad0b8d4fa28bbca241ae308b378769eafabb
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbke/X:2eCqtX/X
TLSH
T1A354C02E67EB0D31A189844372719BFD229635A3B6C8F714BA3FD12AE7C19CD4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 297KB
SHA256 43e1d1b5ca6a5c3733fda77f2bbc89348627da01ced9c814edb28c4440cac717
MD5 a38fcdf5a3438ee6c10f8465fb277a1f
SHA1 146c6e1fb792b40c1ff88336e6a5d6a2b055ff36
SHA512 c1e5605a36ee913db0a947af4d7dfd4ed16192f7bf283ff9dbaaab0f8ba73187c87322cd9cf8621596440291d9599a7b878f460492a18ee041acb2dc7ed9dea4
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbke/P:2eCqtX/P
TLSH
T16554CF2E67EB0D31A189844372719BFE22973593B6C8F714BA3FD12AE7C198D4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1880-145-0x0000000008230000-0x000000000824A000-memory.dmp

Download

memory/1880-138-0x00000000704A0000-0x00000000704EC000-memory.dmp

Download

memory/1880-142-0x0000000007C30000-0x0000000007C50000-memory.dmp

Download

memory/1880-144-0x0000000007DF0000-0x0000000007E86000-memory.dmp

Download

memory/1880-139-0x0000000070870000-0x0000000070BCB000-memory.dmp

Download

memory/1880-128-0x00000000062D0000-0x000000000662B000-memory.dmp

Download

memory/1880-146-0x0000000008280000-0x00000000082A2000-memory.dmp

Download

memory/1880-147-0x0000000008870000-0x0000000008E2A000-memory.dmp

Download

memory/1880-125-0x00000000059F0000-0x0000000005A12000-memory.dmp

Download

memory/1880-126-0x0000000006120000-0x0000000006186000-memory.dmp

Download

memory/1880-127-0x0000000006190000-0x00000000061F6000-memory.dmp

Download

memory/1880-133-0x00000000067E0000-0x00000000067FE000-memory.dmp

Download

memory/1880-123-0x0000000005A60000-0x00000000060AA000-memory.dmp

Download

memory/1880-143-0x0000000007C50000-0x0000000007CF3000-memory.dmp

Download

memory/1880-119-0x00000000052E0000-0x0000000005316000-memory.dmp

Download

memory/1880-137-0x0000000007BF0000-0x0000000007C26000-memory.dmp

Download

memory/1880-134-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/1880-135-0x00000000079D0000-0x0000000007A18000-memory.dmp

Download

memory/2140-13-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2140-111-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2140-104-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2140-103-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2140-102-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2140-100-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2140-99-0x0000000000850000-0x00000000014A5000-memory.dmp

Download

memory/2756-79-0x0000029EF6B40000-0x0000029EF6B5A000-memory.dmp

Download

memory/2756-80-0x0000029EF6B60000-0x0000029EF6B88000-memory.dmp

Download

memory/2756-68-0x0000029EF60C0000-0x0000029EF60E2000-memory.dmp

Download

memory/2756-72-0x0000029EF63B0000-0x0000029EF63CE000-memory.dmp

Download

memory/2756-73-0x0000029EF63D0000-0x0000029EF6482000-memory.dmp

Download

memory/2756-74-0x0000029EF6190000-0x0000029EF619A000-memory.dmp

Download

memory/2756-77-0x0000029EF6700000-0x0000029EF671E000-memory.dmp

Download

memory/2756-78-0x0000029EF66E0000-0x0000029EF66EE000-memory.dmp

Download

memory/5088-113-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-112-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-114-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-115-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-116-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-149-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-150-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-151-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-152-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-153-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5088-154-0x0000000000990000-0x00000000015E5000-memory.dmp

Download

memory/5772-132-0x00000000009A0000-0x00000000015F5000-memory.dmp

Download

memory/5772-124-0x00000000009A0000-0x00000000015F5000-memory.dmp

Download