stealc | 59374e72382a7ae14321a17f5f46e5793e7813c638ea93fb240f6f4046dce73c

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
18/01/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.cmd
Size 29B
Sample260118-egyzfaet2c
SHA256 2bdfb6a368c2ec0a98d7420653fa4c6304acf09ec0bb26214ec9095631e7b1b7
MD5 4ed0a94ac7f2cdaa1d5e87e06722ef6f
SHA1 f73430325434d2fb3b16d7aa25b8e97008053c4f
SHA512 a1cb279b756fb05293fe33897779a5589d84e90c5e9e1a9fcce9b34f315ca961e90a45384c47eda8a3c53eb3c4cd6292e511b2b5366f622a48e0b67c4259797d
MD5 SHA1 SHA512

Score

10^/10

build1 discovery execution stealc persistence spyware stealer upx

Malware Config

Extracted

Family

stealc

Botnet

build1

http://213.176.73.149

Attributes

url_path
/29720ecfce2545cd.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Executes dropped EXE 4 IoCs

pid	Process
2148	ODMw.exe
4704	ODMw.exe
4304	ODMy.exe
3344	lua.exe

Loads dropped DLL 3 IoCs

pid	Process
2148	ODMw.exe
4704	ODMw.exe
4304	ODMy.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
14	raw.githubusercontent.com
23	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3344-702-0x00007FF7CE8E0000-0x00007FF7CEA04000-memory.dmp	upx
behavioral4/memory/3344-718-0x00007FF7CE8E0000-0x00007FF7CEA04000-memory.dmp	upx
behavioral4/memory/3344-756-0x00007FF7CE8E0000-0x00007FF7CEA04000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Setup\Scripts\ErrorHandler.cmd	luajit.exe
File opened for modification	C:\Windows\Setup\Scripts\ErrorHandler.cmd	luajit.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	lua.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	lua.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4068	schtasks.exe
2592	schtasks.exe
4660	schtasks.exe
4852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	lua.exe
3344	lua.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2544	2776	cmd.exe	78
PID 2544 wrote to memory of 2592	2544	luajit.exe	80
PID 2544 wrote to memory of 4068	2544	luajit.exe	81
PID 3448 wrote to memory of 2428	3448	Setup.exe	85
PID 2428 wrote to memory of 2224	2428	cmd.exe	88
PID 2224 wrote to memory of 4704	2224	cmd.exe	90
PID 2544 wrote to memory of 900	2544	luajit.exe	91
PID 900 wrote to memory of 4852	900	luajit.exe	92
PID 900 wrote to memory of 4660	900	luajit.exe	93
PID 900 wrote to memory of 2996	900	luajit.exe	96
PID 900 wrote to memory of 3344	900	luajit.exe	97
PID 3344 wrote to memory of 3008	3344	lua.exe	98
PID 3344 wrote to memory of 3008	3344	lua.exe	98
PID 3344 wrote to memory of 2680	3344	lua.exe	100
PID 3344 wrote to memory of 2680	3344	lua.exe	100
PID 3344 wrote to memory of 3096	3344	lua.exe	102
PID 3344 wrote to memory of 3096	3344	lua.exe	102
PID 3344 wrote to memory of 4404	3344	lua.exe	104
PID 3344 wrote to memory of 4404	3344	lua.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\luajit.exe
  luajit.exe resource.txt
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc daily /st 11:03 /f /tn AdobeCreativeCloud_ODMw /tr ""C:\Users\Admin\AppData\Local\ODMw\ODMw.exe" "C:\Users\Admin\AppData\Local\ODMw\resource.txt""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc daily /st 11:03 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\luajit.exe
    "C:\Users\Admin\AppData\Local\Temp\luajit.exe" "C:\Users\Admin\AppData\Local\Temp\socket3.lua"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc daily /st 11:02 /f /tn TaskScheduler_ODMy /tr ""C:\Users\Admin\AppData\Local\ODMy\ODMy.exe" "C:\Users\Admin\AppData\Local\ODMy\socket3.lua""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4852
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc daily /st 11:02 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\luajit.exe
      "C:\Users\Admin\AppData\Local\Temp\luajit.exe" "C:\Users\Admin\AppData\Local\Temp\socket3.lua"
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\lua.exe
      "C:\Users\Admin\AppData\Local\Temp\lua.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4404

C:\Windows\System32\oobe\Setup.exe
C:/Windows/System32/oobe/Setup.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Setup\Scripts\ErrorHandler.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\ODMw\ODMw.exe" "C:\Users\Admin\AppData\Local\ODMw\resource.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Users\Admin\AppData\Local\ODMw\ODMw.exe
      "C:\Users\Admin\AppData\Local\ODMw\ODMw.exe" "C:\Users\Admin\AppData\Local\ODMw\resource.txt"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4704

C:\Users\Admin\AppData\Local\ODMw\ODMw.exe
C:\Users\Admin\AppData\Local\ODMw\ODMw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148

C:\Users\Admin\AppData\Local\ODMy\ODMy.exe
C:\Users\Admin\AppData\Local\ODMy\ODMy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0C4755A5-47C6-B231-CA5D-AE29729516A1.txt

Path C:\ProgramData\0C4755A5-47C6-B231-CA5D-AE29729516A1.txt
Size 64B
SHA256 ee9b54752bfe271bdc98591e153f563ad2a67e870586f9987ce75fbeaa89f01f
MD5 985ca746b0f87241bf14495ee500bd51
SHA1 f79c70b524163d2bbb2769f3172b865ea343bc92
SHA512 d22ad5fd717f2a453904f982cab08c4386fe81990ed615e9532e53471c4f2e265a6a01dc45cf7501d2b7400a7627f53023a2bda69579ee7ff153e3add62aa449
TLSH
T188A002C10628536D35963C470964DDFE3BA48FA09AEEFD26F090C5976C17B16F452146
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 2KB
SHA256 1b4c19afa768540521ff0eaae93fbbf08af9a07fae36a4e8ce6ee6b2afe96c62
MD5 afb68ffa6787be6f550247818bcd6f32
SHA1 3e31a495a80998423ea18c7d8b9082c36d02a65a
SHA512 77feab31d92f67e4e905f7ab96372b6d21209e099622b95b28bce9302158c1228e26087d2063561f66ca2d710cbb08f6c6f7f8e7c8a1f581e92a4bb4d59dd939
TLSH
T1884129D3C888193485CD89267BE0D6723C6AF4A10DD1A1E6EC8DE55B084FAA5A73A908
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 315B
SHA256 7e7b9bd7986e32dd0a437be3525668582a0f00947bec8ad01d1272f8e17670d5
MD5 1b347624cf5a266ac2141a3689a476ff
SHA1 42b244561a1e7669115b90fa1bcbf9cd4b9fbaa8
SHA512 39f384db90bd293aa5d995223d5606cde43e3646b211db97cad9da74753b15f165a4a06ef14623180ba1dbe1d00f7b9bae1b44bb7f95e7e54e564603a0ffef9a
TLSH
T156E072366A5D96F6B2134F2A4AE19037BA30301E94EA024E382985C3094672DC407418
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 35d3498f98fff2fae0ffe407d5d6c23dfa3c5c43b23f8abcc078d12a93457e6f
MD5 d8c75a170df5ae35c2f758d10996dc4e
SHA1 a59a764bbaa865a68d073a1ce8e9082f782d528d
SHA512 900d44c0d92cb1e9cb2125d4d2c7a1efc32ba31f159cc5ee78158f336465cbd258cf398b4c7b9cf5bd174b80d3fd98138005162268b6fcacce0f4a897ba5c716
TLSH
T18A31C64B4F2F0D800F7B4CCE98E0C85A2DF9A390BD997D17A389CA1A7A093E1076040A
MD5 SHA1 SHA512 TLSH

Submit Download

329EA15F8B27CFCE05E452D2372A42FD_8A99D31D672D577F3208852CE03ACBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329EA15F8B27CFCE05E452D2372A42FD_8A99D31D672D577F3208852CE03ACBF1
Size 472B
SHA256 1c01324356343d9920d8d46ccb43f9243c54bbdb7308f26ab889926d79fecc36
MD5 1761ac8ecfda6c7eaf32a48af9e03060
SHA1 22f1062a4d0df2bec1ed197d90bb719959de7cba
SHA512 d2281cfcfc3f1b8f42aacef82e849b63e4bbfa365f675402f7febda3f185a66a138b98103928c2aa65dbfc55905355f8c06b8dc3bbf8566f7d64cae6e0e71bea
TLSH
T1C6F0D42AA4718DA57E545C4C3DF94F3F9C74527304F2D20EB031C965C5E36586D91F00
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 1KB
SHA256 05ccee44e49f84b0e3b431cc9a33803b65011583e36a0df04c20e15d9cf39859
MD5 ef9f9224490c0104130ca39f7b1ede0e
SHA1 85171a9f6667caf37cf2850409fee565d63d5f55
SHA512 829704150cba3680c8167818ebb49db92938fd32eb58cae727594a858d428716bb3c63711bfc3d00742238fcaf6407799f1c9fc15b82c8864376e809eac7d8d4
TLSH
T13F311BE37B68B812AE150D45CCFC87725C7071B7B8540C7C3878811B9057FB4586B80D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 701ad1e8d2b1bc5aff552f3b5cea7cc30e39c8df0c6af1b7bd6f5cb5d20cf1a4
MD5 f568653565855d2df75ac72109d22f36
SHA1 de656cd8a29d81dc5109784f34fc76508e785dae
SHA512 d2cb5836f601959c4a91e54e4e0593457b77badd35d45336e2ba53b1aca86edd31017f346ba8829e831594a3310c73fbfa1ff4527fbac3204293ba32db280415
TLSH
T1671121C24EF8A081C9E74761CAE8C1317DB474C62DFB30C818C2C482289A75C6F0543F
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 471B
SHA256 f47024b00bcfceb6f638245cd318f9340b201fbeab92a524baf8604ad323ddbb
MD5 72d863ab8d164ef6da70d7734b7f9d46
SHA1 df61da98c35e1c4bb71c2180acee93fb5800b379
SHA512 51e2e84b3acaba75d2b694ca4814c8ede7ef7bfa4a272389ff2e830d4f6a486f4f4d6842fdb3414318a0f8453f4c98aaa40013a2f991c8fffef5a4abe0e0906a
TLSH
T135F05451107CF850166B28ED60B5447D3430942500920D0DC1289CF124D0EBDF19342B
MD5 SHA1 SHA512 TLSH

Submit Download

E2CA974EFE3C296B6BCA23A2BFFE08DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2CA974EFE3C296B6BCA23A2BFFE08DE
Size 281B
SHA256 cc80a069f0b9a4855898bba4b4a486a9fe88c3fc07274f08bda6083428a15045
MD5 ffc42e501e44355466a3316f4d18c77a
SHA1 27d921d08a124b14e9857d9d32045e6afd609b2a
SHA512 32152196d359f127e30d525960f362d59a436676292876e965d491a1a0046dd3a46272a8eae2d7d22f28f37c635b48ed9148f118501ade2507548307d428991e
TLSH
T16AD02B7229FEA4533C7BFD21C4D8D538310314BB23FA550E3E0AC6175400D6D6E42654
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 488B
SHA256 1ed4398ecb163063ca58e82ac242e3a0a5a7abcf1e27a6b01310a187b2b177c0
MD5 651dfe8d3bbbc721e6eba0424bc850b1
SHA1 6feb78ecced9d7874a4e8f8e03ea179c6d2c9125
SHA512 2100c799ee150607b7356de56729b8ea163c6de8dcf1d7e66b5286e0a57440ee7cbeac469e0f7aed39133b6426fb27b127541a85e1b3003906129425bb0b4f49
TLSH
T1F2F05C283AEE402CF577FDB582CA947A581AF2036C400DB6069007056D13F019D32910
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 31e785b62df01ddd86cfa6527fdbc9118582e1a5dbd545cb46536567cb93cd1f
MD5 b88f6ea01747ccc1be0c7a270b5f1d77
SHA1 0e7fc2b4a7db4bbbb34638db605bc35e503df86a
SHA512 1056408195413e9a0bf27fb8738a18ffb07be691b3a38913ffc4a01d54a6265f1a3c99ba0457f2f3dd7fc2706089f727c1ae254937aedefc61eaee6dbbedfd2c
TLSH
T10DF02B3C1EBDD0FDF136CA7C46C9F2E26E16F222785446F616A10B8DAA02F405C9247C
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 001b46f40f9de58ae8203849b075299d2e139400d2547b41726e1cd2fe212feb
MD5 f4ed238f38aae5887c535b712263e816
SHA1 d6373ef4684b43f3b0f550af1613adb9f8db99e3
SHA512 0629cd94b9af30a85298c9b7d1e12e4f34bea7b4499584b5d38c28f1782dbb3ddfef93ded6a4ce460d59d09f1225049cc0252ab7a85e7d406069cc42642002f7
TLSH
T13DE026045EB9512CF431DA395EDEF96707BFE222346A43F012E94B08B782A512D969F1
MD5 SHA1 SHA512 TLSH

Submit Download

329EA15F8B27CFCE05E452D2372A42FD_8A99D31D672D577F3208852CE03ACBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329EA15F8B27CFCE05E452D2372A42FD_8A99D31D672D577F3208852CE03ACBF1
Size 402B
SHA256 6dd7436585c49a6ec3851de843b2f3d3c8f83d8b9a944471673979f5290cd77b
MD5 53296e4816bece8880eb6276f57ac460
SHA1 18473f729ec0f411f0e00a4ce6e51eb24661783c
SHA512 ade285bdc7755e3552448f786ab539e843921b0d9cfb92cc2765b238e1da1f3e3a19bb367ad3abb77546b4c3139ef0cb42003426ba64428c10989aa036d84fab
TLSH
T156E0262431FF514FF1B2ADBD0FC6AB0185B7E9A2500947E610B10349FE427008CD282A
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 482B
SHA256 5cb0186f9bd3424488253ad80f0c843ddf2dc19a58717294353a854e66a99f89
MD5 3f3c09934f687703f8a38c757c3d8710
SHA1 685e1694c661055e9bc2e0b6768abb591c6a2f92
SHA512 334b69971baa9bb98867ecc31c0a65177012b8c2a66f450a14b7badbf64eafcad9f8c8ca0adaa825a84535ea35e408de70d6cb01a8d5c92702c853a062e20d3c
TLSH
T1AAF0AB381AB9902DE4339D368AECE569F938F211340802A31523070B2D53F428D91A3E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 d17f767d14856b8b93530a9d3be018e8449b7f9e344ea19903c9bbc06da10d5a
MD5 bcda17ef557ef41e096761bdbaf6efd6
SHA1 b485a9ac25cbcd02899585dfb61212abf1b3f9a5
SHA512 16f9a40d4fcd2c204465bfb4369e1779c4c2fa821b3de86d48c6a41c4ecbe041bb4efd62f043b03bc4c56fcbb16df2dbfb68f58b4b934ac015090343933fab4f
TLSH
T189F0AB2006D2485EF332ABB485F4D369BD0CF6533609CC7A25A61E0AFE03F040E1143D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 412B
SHA256 44b5d8890a07e310766da83acd8481c873398e1aa1a3dca80246f5a8055726dd
MD5 3bbf9116afec102628697d26da653935
SHA1 2993c3ef965c3c735618f3570f39adcf992d4cd8
SHA512 6cc5c7767350d9cd0cf1bd3dcca1038a776891dd773113e5e84b3392d196aa30cb8378518c37d6ae0c6f708752ed2881dcccef8cb35cc3181d3a8b42779fe77f
TLSH
T113E0202815FB412DF9F5D57CABD5F431D96DF226242AA77015C41F04BB53700DD13929
MD5 SHA1 SHA512 TLSH

Submit Download

E2CA974EFE3C296B6BCA23A2BFFE08DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2CA974EFE3C296B6BCA23A2BFFE08DE
Size 492B
SHA256 393a8818203956624c523e996c897d027da5cea0d39fa0ec08de161f84499687
MD5 a701ee429bd65b4d75098e930b4d804f
SHA1 a181bfe22d926fb6ef42663bec330d8f333483bc
SHA512 3f8bda9c965f0ab356f790daa2aad1a5d54bf40bdb2ef9c41a9832f9e1f79e1512d5104ac019eac888f4f506eaa46be99a8c84ab1952d9b6c8a9c354853999e8
TLSH
T11EF0551E18B94128F132D839C2C8A235B862E0262C2542B201D76704EFC2B006D5262B
MD5 SHA1 SHA512 TLSH

Submit Download

json[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P1OMTLNX\json[1].json
Size 314B
SHA256 c5eb61018e3b3adb4db7729b4b390544bd10e0dee8d1fad6a4b5aec33650ac6d
MD5 b1c4dfab235de94cfc00978ddc7a15ca
SHA1 b4cd33ec77cd5b870d27876cd0364c72d5b6a433
SHA512 e01b82cab4c95b74d036b1cd7b091de24af2729d00d88cd236b509210bfbe7004ef6f5f148b998c9f8b699935a8f35999f487f4135f089b9ceea0743f2118be8
TLSH
T145E0CD3A04B03DBF5F2152D4300BDCEC2B6D151157E748917D9D591C5599756B05D02F
MD5 SHA1 SHA512 TLSH

Submit Download

lua51.dll

Path C:\Users\Admin\AppData\Local\ODMw\lua51.dll
Size 3.4MB
SHA256 c7a657af5455812fb215a8888b7e3fd8fa1ba27672a3ed9021eb6004eff271ac
MD5 4ebd617a3ad9a9619172bd14a902a400
SHA1 270f66d2c84ee86ff4b07c6220c51abd4897b5f0
SHA512 b008a00d7e57ef4786b14f28aee3880318820dd85d66539263a3f68b547e89bce8db32ad422d4eae6795219ec3ddcd72e7780aed9e725ed3c171d11492e47571
SSDEEP 24576:QXEeYq+Fjb1h2Ac9qJqvqj+OhbaijGPDX732ywPKpQlABQFi8ePj40RvzinxO4xS:EEDv/2Ac9qB+OR4n3xBQKvjGQe11Fgl
TLSH
T129F54B49A7D1995AF112C2708E9B4375372BE410333B9FE76F8AE2203CD7AD8DD95602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.txt

Path C:\Users\Admin\AppData\Local\ODMw\resource.txt
Size 333KB
SHA256 b1ec642be9b19043d37d0079339ce2326a4b50dab81e482b3a3fa3137f8dc088
MD5 9110e3e0df38bb9988ce65d45e79abb1
SHA1 27d23084acaf8c8dba3ce16e411cce7736c5618a
SHA512 ac69327db399953a34dbff8258524a9201f9dd2a95f6fdcfa87d3fef3e51a0ff07f208e4b8a397a46da828b73fdcd106881feaf15852b9543184b0446f9fdaf9
SSDEEP 6144:O+MzxKqO0AyP9oOe9mS6fOejKzNBt+sKOrfY:IAqZ7e9mjKzNBV/M
TLSH
T1DC74B6E4604C09F419FBC255DC2BADCB52B9E5F54386AF6B0F3CE1A97160266CBCC816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ODMy.exe

Path C:\Users\Admin\AppData\Local\ODMy\ODMy.exe
Size 834.1MB
SHA256 dd73ad3c35e2036943d9cc5f8ff461c2bad2614edd766fe5b96397667ae005bb
MD5 8ab3d5e660bfb46b84e320fbfda3d14a
SHA1 fd25d47f3915125da042b580048ba2b4578b455b
SHA512 80243bca972c10a56c8a471f2b8e97cc7cf303fb00d44260e23696beefeaf808aa68002340034f96136612b4a38801f2de64e8a4ec8e5027e1019ef64faf619a
SSDEEP 25165824:7clY/iOlsAlg4+fR2lwE+q0uK7xrU445dYloK/OAqX:7tKOmAYfRm7i7xQ4MA9GN
TLSH
T1B999339274CF8F4EF8C56EB296C45FD72E5BC1EA11F530EA232D549E82AFC8E5412448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

socket3.lua

Path C:\Users\Admin\AppData\Local\Temp\socket3.lua
Size 353KB
SHA256 3992c1e3b938110954d8e0405237474738bcbdfb4d52cec531ca40208b7743b0
MD5 7c51647f6cec9ae51df31a9d2b00f103
SHA1 2b3d23325e9984372302e22a6299cf2b27097f62
SHA512 6a9c8671d297da4534f49baf2644439f9aba554da8fc11c347db5b0ca0350821e33b9b2ef983d6a9647095b5d4128516cd04c9d76a65172e36dc40b267ad0244
SSDEEP 6144:+/LC0tcvO10S9HyUNZgG2ATIeYfVnpq3e0Mdvwj5v:CLC0tcm10CSUNZgGHTIeYf1pAMd6v
TLSH
T1B774A6A1B08C0EF595FB8150DC6EAD8B52BAD5E04345AA8F0F1EE0A635E059DC3C9F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

socket3.lua

Path C:\Users\Admin\AppData\Local\Temp\socket3.lua
Size 79KB
SHA256 7ad26b86320cdc2f790e0e3cb7158ffec576960aed7b660444b274f4b86e30bf
MD5 b86a20b9fdfa52a49411167623c18a20
SHA1 cdd1f021667caf43f0437f0407a1db6a7f2ab32b
SHA512 82ff3d0598d3ae35d4018e2f64c7af36b7a1661c3d4f138b2b4c74fc3f1a15bfaaf7884e3d446faa0d0f865e08f9d4c860b2d83e52dc11ed24bdd077144de980
SSDEEP 1536:q45RBpfhcXHEDAuIp2hAkOFIexw302PbKQubtaS74mM4VC:qaHppcypIp0wVNb51704VC
TLSH
T1CE8301C050A6D4D902F1EA4EA0957B43C97002AD71BF2D3245C3CF9E77F929E7592947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

948847AFBDE84507A1ACFAE2C90E658B.json

Path C:\Users\Admin\Documents\948847AFBDE84507A1ACFAE2C90E658B.json
Size 1KB
SHA256 93c3afa8a0699fc155c21c4edb8e16560cd5dfaaab53104724ca933ec622df2a
MD5 8095b113d46a3ac2635931559070f34a
SHA1 cbb440b2a0f119c2a1c00473180c2d860bbb73cc
SHA512 0d106ead7a6a967943308a8d0d4b647d5f6c7680d6be96a6592f38c50da648417618a506b561671389387ea1decce06bc71d88de57ed7cc42cb6536195190ab8
TLSH
T12A4153E336EF778E68053382918E4A50CE94D510AFD0E7D0C2DB5ED8944E384E9E8B99
MD5 SHA1 SHA512 TLSH

Submit Download

ErrorHandler.cmd

Path C:\Windows\Setup\Scripts\ErrorHandler.cmd
Size 113B
SHA256 587efdd0d5b2acc13022ee8302c56986cb34e8a265c5a67c9d3410681fd3d5b1
MD5 67eefa73de25817e1dcafc435f67e837
SHA1 6d5aa72d226d2ad9d626b324ab09a3f38de93eab
SHA512 b547447f51d04f4ff0e3082be1a878da0836dd40bba084af79839358bc899b9cc1b455170c27faff0742d58ae6184df5c5e985a3bb6b6129014c1521bf79c1fe
TLSH
T144B0920249CACA2B0848503B0AB16648C0A088847EDD3B00C220850C329385CFCC2202
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-44-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-1-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-39-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-38-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-37-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-36-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-35-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-34-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-33-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-32-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-31-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-30-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-29-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-28-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-26-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-25-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-24-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-23-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-22-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-21-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-20-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-19-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-18-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-17-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-16-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-15-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-14-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-13-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-11-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-10-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-8-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-7-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-6-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-5-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-4-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-3-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-2-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-42-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-0-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-49-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-41-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-12-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-27-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-9-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-180-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/2544-43-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-60-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-45-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-46-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-47-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-48-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-50-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-51-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-52-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-53-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-54-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-55-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-56-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-57-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-58-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-59-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-61-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-134-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/2544-135-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/2544-136-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/2544-137-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/2544-138-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/2544-62-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-63-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/2544-64-0x000000002E940000-0x000000002E950000-memory.dmp

Download

memory/3344-702-0x00007FF7CE8E0000-0x00007FF7CEA04000-memory.dmp

Download

memory/3344-718-0x00007FF7CE8E0000-0x00007FF7CEA04000-memory.dmp

Download

memory/3344-756-0x00007FF7CE8E0000-0x00007FF7CEA04000-memory.dmp

Download