1589afc495d55fa2ff495e3e843783d69fbb6d348c58167d1f1fcab64d658bd0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Size 50.4MB
Sample260415-mc32laew9s
SHA256 1589afc495d55fa2ff495e3e843783d69fbb6d348c58167d1f1fcab64d658bd0
MD5 4e582a66bd71ee2df682dbc050ecec43
SHA1 6f552dac1013fd3c4ed6a0f9469491285de877fc
SHA512 9883e084a9714c3422d11ad1029ecb09c39abb9657bbf9911a83e617f07bb2d4de721341a385aeb7952593006837402567862c86c6d00fe25aa443e790241004
SSDEEP 1572864:IsDryaT87B7OmZhG+w/+syi6U3Di6kVh4VY/ibtd7y5S:jDr+BdZgv/+synU3GZh4Kh4
TLSH
T17DC73381ACDBC9B5FC13093A12A80DD16385ECDD2BF504DA9B4327C97CF889BC9455AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5904	powershell.exe
436	powershell.exe
5564	powershell.exe
4892	powershell.exe
2044	powershell.exe
1544	powershell.exe
2968	powershell.exe
5088	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe

Executes dropped EXE 6 IoCs

pid	Process
4540	tsetup-x64.exe
668	tpg.exe
5472	tsetup-x64.tmp
1580	GameBox.exe
4304	GameBox.exe
2348	Telegram.exe

Loads dropped DLL 5 IoCs

pid	Process
1580	GameBox.exe
1580	GameBox.exe
4304	GameBox.exe
4304	GameBox.exe
2348	Telegram.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1580	GameBox.exe
1580	GameBox.exe
4304	GameBox.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Config\Dynamic\Account.cfg	GameBox.exe
File created	C:\Program Files (x86)\tpg.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\tsetup-x64.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\tsetup-x64.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\DuiLib_u.dll	tpg.exe
File opened for modification	C:\Program Files (x86)\DuiLib_u.dll	GameBox.exe
File opened for modification	C:\Program Files (x86)\GameBox.exe	GameBox.exe
File opened for modification	C:\Program Files (x86)\user.dat	GameBox.exe
File opened for modification	C:\Program Files (x86)\Utility.dll	GameBox.exe
File created	C:\Program Files (x86)\__tmp_rar_sfx_access_check_240656093	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\tpg.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\GameBox.exe	tpg.exe
File created	C:\Program Files (x86)\Utility.dll	tpg.exe
File created	C:\Program Files (x86)\user.dat	tpg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0007000000024486-6.dat	innosetup
behavioral1/memory/4540-23-0x0000000000E50000-0x0000000000F28000-memory.dmp	innosetup
behavioral1/memory/4540-120-0x0000000000E50000-0x0000000000F28000-memory.dmp	innosetup
behavioral1/memory/4540-300-0x0000000000E50000-0x0000000000F28000-memory.dmp	innosetup

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000024482-16.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\ = "URL:TonSite Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\URL Protocol	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\shell	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tdesktop.tonsite\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\tonsite\DefaultIcon	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2348	Telegram.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1580	GameBox.exe
1580	GameBox.exe
436	powershell.exe
436	powershell.exe
5564	powershell.exe
5564	powershell.exe
4892	powershell.exe
4892	powershell.exe
2044	powershell.exe
2044	powershell.exe
4304	GameBox.exe
4304	GameBox.exe
1544	powershell.exe
1544	powershell.exe
2968	powershell.exe
2968	powershell.exe
5088	powershell.exe
5088	powershell.exe
5904	powershell.exe
5904	powershell.exe
4304	GameBox.exe
4304	GameBox.exe
5472	tsetup-x64.tmp
5472	tsetup-x64.tmp

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	5904	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5472	tsetup-x64.tmp
2348	Telegram.exe
2348	Telegram.exe
2348	Telegram.exe
2348	Telegram.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2348	Telegram.exe
2348	Telegram.exe
2348	Telegram.exe
2348	Telegram.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
668	tpg.exe
1580	GameBox.exe
1580	GameBox.exe
4304	GameBox.exe
2348	Telegram.exe
2348	Telegram.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 4540	5716	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	84
PID 5716 wrote to memory of 668	5716	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	86
PID 4540 wrote to memory of 5472	4540	tsetup-x64.exe	87
PID 668 wrote to memory of 1580	668	tpg.exe	88
PID 1580 wrote to memory of 436	1580	GameBox.exe	89
PID 1580 wrote to memory of 5564	1580	GameBox.exe	91
PID 1580 wrote to memory of 4892	1580	GameBox.exe	93
PID 1580 wrote to memory of 2044	1580	GameBox.exe	95
PID 4304 wrote to memory of 1544	4304	GameBox.exe	98
PID 4304 wrote to memory of 2968	4304	GameBox.exe	100
PID 4304 wrote to memory of 5088	4304	GameBox.exe	102
PID 4304 wrote to memory of 5904	4304	GameBox.exe	104
PID 5472 wrote to memory of 2348	5472	tsetup-x64.tmp	117

C:\Users\Admin\AppData\Local\Temp\2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Program Files (x86)\tsetup-x64.exe
  "C:\Program Files (x86)\tsetup-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\is-8DCU7.tmp\tsetup-x64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8DCU7.tmp\tsetup-x64.tmp" /SL5="$50064,50246006,826880,C:\Program Files (x86)\tsetup-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
      "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2348
- C:\Program Files (x86)\tpg.exe
  "C:\Program Files (x86)\tpg.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Program Files (x86)\GameBox.exe
    "C:\Program Files (x86)\GameBox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5564
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2044

C:\ProgramData\client\GameBox.exe
C:\ProgramData\client\GameBox.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client\Utility.dll'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DuiLib_u.dll

Path C:\Program Files (x86)\DuiLib_u.dll
Size 489KB
SHA256 d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2
MD5 0b98bd6bf1956a04d626bf45c8a8f24f
SHA1 4d33a107a39071d5f3dfb0d5e6665920eea1ecf0
SHA512 6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed
SSDEEP 6144:OoFzDmi3RUAaMhq6hWvuK05XptWEWb3KMYqdQoE40:xpcshqjvuKcXWQqOj
TLSH
T1B3B49F2236E181B9C993D3379B2C9F38ED7A74404675864B73DD0E667A27A90CA113F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameBox.exe

Path C:\Program Files (x86)\GameBox.exe
Size 1.4MB
SHA256 dda4924824054c574b5a7c96b2e30f7fb6e643b510db8288b1a6721fa7ff463a
MD5 f69465ef1bc5fcfd30a667a4eec19c66
SHA1 70074fd04a8fe4804421b215b3f13252c2fe31de
SHA512 7445615aa9798315f13da7a354898f4463792d1292dfea3be398e782964bad16150791bb07e6a9e6dbf9372657c3ca5afa3cc8eb8d3d039e846a67fdd889af83
SSDEEP 12288:r6RC8u9TNaeezx1xfeUsB2ut5kUMSvYTXvqyKaKi0PPX5W1G+HWZx3O62:r6c8uAA9txXYea4PQWpO6
TLSH
T1C5653B79BEE18AB1D4866277A5DC9910E5E7F8628F2019CF77CC8A4E4F126C05CB16C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utility.dll

Path C:\Program Files (x86)\Utility.dll
Size 1.2MB
SHA256 c46439480e2afeb63612791640a80a968e67974f992ee67cfbd13b0076603ae4
MD5 e8ec174181a2294a6a9f2ddd4f3d86d5
SHA1 eb0f7dc1daa0c77233dfd4cc3a9db02e98a9d83d
SHA512 fa367af2bdf4a6858c187c768716bd49c05e4be3a9d02e8408a26d4cbaf74c5d774f75244739b6fbda2b5b0f34551c0fca46c323005ecc7be6723e25e444c205
SSDEEP 24576:Y8nc7TLHqr1Ax7wEiGT/ZlvtQ8K9eFY6QsqRVjjczvJ77IaEVeUcniRn+Kf:Yec7TLNx7dZrQ7eFYfFxjGEJ4xs+Kf
TLSH
T14B4533A38D7AE056F85830B46DF2BA646073CAD450A6D2FE7982B414DD1EEF13835F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tpg.exe

Path C:\Program Files (x86)\tpg.exe
Size 2.0MB
SHA256 24e1aaf389427e3b20891f9e05469b41a5aa7ec36aa68bdea4a8bc797bb2ba52
MD5 3078a9f9a1b43a434729350448754d80
SHA1 ee2d87821099d191de19c142046f86f045e21cb3
SHA512 22bb219703491a777d1974bb506f47e96ac2cf90db9dc44c5218df783d6208fa24716f16856c77d79f4d363584bd3311687a04c91613d118c3e49ab7b86d1a56
SSDEEP 49152:QRqcZoKm7X7HMgT6e07687XnkGbB1SIQmbfDpO59lWF3:V7X7ND0mYXF1PBIrwF3
TLSH
T1F8A5333392A49B73F6AB67B84492D17B5F66AF1425D5E187D0D93F873A330C3860E40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tsetup-x64.exe

Path C:\Program Files (x86)\tsetup-x64.exe
Size 48.9MB
SHA256 e4ab08b640ca75cff0ad367e7ed0ce1c8bc5b936a895d0f206cee2f0dee386e7
MD5 d19502943032baa5c4e7a3af56cf8039
SHA1 f4c29c45119281e3f8b88c4a2be7dae43228c21c
SHA512 371ecbdd9265eecdff5f4f2f7c70c3945b04bfe4323caa7753916e61a6e2a0a982faf64a9382d27e452c8cab5dc8a9a3baa6c9803f06dafb522665d554d3a97c
SSDEEP 1572864:3eRyxGgYa1QTbc59tABsbCbBLDo/KJjTt4U+9:35GglQ/c59bdCj6Uo
TLSH
T1A8B733A2B2CBE53FE40D573B09B1A14590F7A2A1B426BD1797E488DCCF255912E3F213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.dat

Path C:\Program Files (x86)\user.dat
Size 2KB
SHA256 dc96f0c19f5e065c3b591abb106845f0d134e79ee97b8f7c2e4e6150dcdad2ae
MD5 df104f94282c25008f8d2f831605b713
SHA1 bcfbbd7910207238b00e11b25f09d12912669f63
SHA512 424b8a676fe890d31333929a62202330b772e86b316031874ec061aaffe6098dda95bb62493840eab6b4b4f86c1c8c8443132945243b25ca2a89b6150fc07cf7
TLSH
T17F416DE4421E821349631C0F0D2DB3E17D6CB60188A304FE991DCD4957F18D25193FD7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 036f1b5bc67c670bccb1efa8b04909dc240aac9031421ad7862bf97d435c5fcd
MD5 127ccbe6fca7c9293262290b55078b65
SHA1 b5572bbbf0f6d67744fa8b005ff043b8dde5fb98
SHA512 08ed9914618e9449962fddeacee0cb6c8208f3f10de1eb808dafeef4bc097d496868f537dd07514f8b789e90d041261a21fec1a68b1895852b657209bd13ff49
SSDEEP 384:xsf+BQ91c5zqzJNpLo9hOrjNY1pDiEz+xborL+nUMtkKkki0SO1:2fpcA7p8hOrjNEWxxsGUmiki0H
TLSH
T1E282196D220F1AD7C66623B4C42747EBDEF09ECE834447DD274A1D2A05E676A80D94FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0ff36621f4015633c24b916ed7ad5d246ee0931094b0b6340d83434e65b111ba
MD5 fa31298099f5b68ddc29bc645627aa68
SHA1 0d203f8ef3644f2418572049df0bfe269c07a95b
SHA512 b3ca20c8e46a7fbebbe0874f60b68642f5d72b98e3d5a4303393728e7c953c5cfa49172834cbf1380eb290621b94dc5a62d6b5d9698cb9444ade1f501dd93c5f
SSDEEP 384:N6+BI916pzJhbizf5Sto9o21NY1pHGZcifE6z2oEWleL+nUQkki0SO1:sR421Do21NEZifxz2oE8Uzki0H
TLSH
T16F82075E222F16ABD26623F4943743DBEDF09ECBD30483CE2749492A05D667684E94F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 bf1839058757606fec1f1735f45bac3bee105f6362ac216a7e0138d203391a96
MD5 695f1161bb50e3b240b45f7122b4a0a5
SHA1 a5cdc1f60fb30091b1d6da65bcddc9ba45ff0b00
SHA512 54ab291cb3840d9ed8ef345a714d6ea1f00e5834a35f085c94dc0e60147dc11d275145a61db96e6e893a6acffdf4e62ecd4290e1d9264b0faec4afef1927eb6f
SSDEEP 384:Usf+BLuaVEqfUdbHwyy8zFOheIoWE/+SVFM+O26jh1k7yYtqZxQ:hfEuaVVfUGy1zFOheI4/TOT/LZxQ
TLSH
T15482DC13839E2BD4C91FCFAEEAD6242ACE79337B4314E6870364B24615FB141EE1B211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_evuyv0iu.byj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evuyv0iu.byj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tsetup-x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8DCU7.tmp\tsetup-x64.tmp
Size 3.3MB
SHA256 9febfcd1ea14dc3a6f81b82b196992edadd5dfc5262a1046b3e0d5e806d0f4d0
MD5 d00c48772a5aad54ca403bdcf532d431
SHA1 5c15cc5bec95daff5e75a85c6cec08cfd176f6b8
SHA512 d3a8da6c80ba02144fa1c22188238ed9487b0175d44c4934725881cebfa4d9f50d780335f9cab201d7bf01b4c8257caa5236c371051986533384b589845abe65
SSDEEP 49152:fuAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKLz333j:fuAK6XMXhKAWwLsXa2333
TLSH
T10CF55C23F34D603EF06A1A399D379658583B7A606916CC5797FC3A4C8F361802E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 948391923b76d0c7623f6a3f4e8b04d5e30f2735aa5eeb6717eb2869ca6ff772
MD5 678333cfa4857799cf84084012780756
SHA1 826e5d1ca915012de35ded7c848c82ecc23d9158
SHA512 f90345334e4b6fa84e4cfac9e6ae0e13fedb095f72bf5c4ca0d51d8a5adb5eb6a74496980b773988543b973c56dd2e2f7aefdfae5fb78609d0ad63e0fff538f8
SSDEEP 384:w6+Bm9i+cr6BizJkyStZ1QMjK6seYUME/h03SoZtfYwv4jEekud0gd0tkKhD:xMWoeVtZ2MjNzrqSQbmEeiCu3
TLSH
T12782E66E611F16C3C48513B8E117051FE8F2DD8D531A13D8BB2E9F3B8AAC69E913D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d396acb14ee781c61ba91f4960111a12c7bf35fef4c8796a74c9682c9613722b
MD5 0aa5ea88bf513c335a571d76fac0517e
SHA1 3e8cbe0b9e3aa391cf213d3e803a6a3b2aa750e3
SHA512 ff37d52f2af5c820f14adb2f5d33f9dea074c6201ebc737378995e74b346cbd377216b458c56d74e535370a1716649c78394f6b70124c3c5569aa94b055c0633
SSDEEP 384:66+BG991JKR/zJthh3kukEl321NY1pHG3opzMZbXdbkuJ+nUukKhi0SO1:nJJ6rhhuER21NECHZbXdbgUuri0H
TLSH
T1618229AD221F3AD7C0A523B8D43643DBE9B08DCE930007DD2A491D3B06DE76684B95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 1d137c1cd6711d292720fc21ce5f11fec871e2ceaa60f73b813e82dd86e5137c
MD5 fe40c980b7d875032bc0a9e2b50922fe
SHA1 c5b74fa77ac8ec3b8943d64321716e1ee308e41d
SHA512 566704adfcf0e3b14fefd914d0e740c6db681d352bd8122af93bee12381641a8c57b81c274b6c46b344f3298da5966f67bedf80a59655a4a6a1b12d34ca65b00
SSDEEP 384:u6+B/91d/TsxbIjewkuFIeY1pDGZcifEzM5evEdbp+nU+Vhi0SO1:rkdwZOquFIeEdifH5OEdbYU+ri0H
TLSH
T1D782086E611F2ADBC4A613B8C43743DFE9F09DDFC30407DD6648192B06C976A94B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-47-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Download

memory/436-81-0x0000000006930000-0x0000000006951000-memory.dmp

Download

memory/436-60-0x000000006F300000-0x000000006F34C000-memory.dmp

Download

memory/436-59-0x0000000006830000-0x0000000006862000-memory.dmp

Download

memory/436-69-0x00000000074F0000-0x0000000007593000-memory.dmp

Download

memory/436-68-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/436-70-0x0000000007C20000-0x000000000829A000-memory.dmp

Download

memory/436-71-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/436-72-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/436-73-0x0000000007840000-0x00000000078D6000-memory.dmp

Download

memory/436-74-0x00000000077C0000-0x00000000077D1000-memory.dmp

Download

memory/436-75-0x00000000077F0000-0x00000000077FE000-memory.dmp

Download

memory/436-76-0x0000000007800000-0x0000000007814000-memory.dmp

Download

memory/436-77-0x0000000007900000-0x000000000791A000-memory.dmp

Download

memory/436-78-0x00000000078E0000-0x00000000078E8000-memory.dmp

Download

memory/436-44-0x0000000002940000-0x0000000002976000-memory.dmp

Download

memory/436-57-0x0000000006260000-0x000000000627E000-memory.dmp

Download

memory/436-45-0x00000000054F0000-0x0000000005B18000-memory.dmp

Download

memory/436-56-0x0000000005E40000-0x0000000006194000-memory.dmp

Download

memory/436-48-0x0000000005C00000-0x0000000005C66000-memory.dmp

Download

memory/436-46-0x00000000053C0000-0x00000000053E2000-memory.dmp

Download

memory/436-58-0x00000000062A0000-0x00000000062EC000-memory.dmp

Download

memory/668-122-0x0000000000570000-0x00000000005AB000-memory.dmp

Download

memory/1544-185-0x0000000005F30000-0x0000000005F41000-memory.dmp

Download

memory/1544-175-0x0000000004AC0000-0x0000000004B0C000-memory.dmp

Download

memory/1544-176-0x000000006F220000-0x000000006F26C000-memory.dmp

Download

memory/1544-184-0x0000000005C90000-0x0000000005D33000-memory.dmp

Download

memory/1544-186-0x0000000005F70000-0x0000000005F84000-memory.dmp

Download

memory/1544-174-0x0000000004460000-0x00000000047B4000-memory.dmp

Download

memory/1580-253-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1580-136-0x0000000074460000-0x00000000747FE000-memory.dmp

Download

memory/1580-135-0x0000000000D40000-0x0000000000D7B000-memory.dmp

Download

memory/1580-382-0x0000000074460000-0x00000000747FE000-memory.dmp

Download

memory/1580-43-0x0000000074460000-0x00000000747FE000-memory.dmp

Download

memory/1580-251-0x0000000074460000-0x00000000747FE000-memory.dmp

Download

memory/1580-263-0x0000000074460000-0x00000000747FE000-memory.dmp

Download

memory/2044-137-0x000000006F300000-0x000000006F34C000-memory.dmp

Download

memory/2044-146-0x00000000061B0000-0x00000000061D1000-memory.dmp

Download

memory/2348-389-0x0000020B6FAA0000-0x0000020B6FDF5000-memory.dmp

Download

memory/2348-404-0x0000020B6FAA0000-0x0000020B6FDF5000-memory.dmp

Download

memory/2348-374-0x0000020B6FAA0000-0x0000020B6FDF5000-memory.dmp

Download

memory/2968-209-0x0000000005D10000-0x0000000005D21000-memory.dmp

Download

memory/2968-210-0x0000000005D60000-0x0000000005D74000-memory.dmp

Download

memory/2968-208-0x00000000059E0000-0x0000000005A83000-memory.dmp

Download

memory/2968-197-0x00000000042B0000-0x0000000004604000-memory.dmp

Download

memory/2968-200-0x000000006F240000-0x000000006F28C000-memory.dmp

Download

memory/2968-199-0x0000000004820000-0x000000000486C000-memory.dmp

Download

memory/4304-388-0x00000000733A0000-0x000000007373E000-memory.dmp

Download

memory/4304-166-0x00000000733A0000-0x000000007373E000-memory.dmp

Download

memory/4304-256-0x00000000733A0000-0x000000007373E000-memory.dmp

Download

memory/4540-22-0x0000000000F05000-0x0000000000F06000-memory.dmp

Download

memory/4540-300-0x0000000000E50000-0x0000000000F28000-memory.dmp

Download

memory/4540-121-0x00000000009D0000-0x0000000000A0B000-memory.dmp

Download

memory/4540-120-0x0000000000E50000-0x0000000000F28000-memory.dmp

Download

memory/4540-23-0x0000000000E50000-0x0000000000F28000-memory.dmp

Download

memory/4540-301-0x00000000009D0000-0x0000000000A0B000-memory.dmp

Download

memory/4892-124-0x0000000006AF0000-0x0000000006B11000-memory.dmp

Download

memory/4892-112-0x000000006F300000-0x000000006F34C000-memory.dmp

Download

memory/5088-220-0x000000006F240000-0x000000006F28C000-memory.dmp

Download

memory/5472-248-0x0000000000F00000-0x000000000125F000-memory.dmp

Download

memory/5472-281-0x0000000000F00000-0x000000000125F000-memory.dmp

Download

memory/5472-298-0x0000000000F00000-0x000000000125F000-memory.dmp

Download

memory/5472-260-0x0000000000F00000-0x000000000125F000-memory.dmp

Download

memory/5472-299-0x0000000000EC0000-0x0000000000EFB000-memory.dmp

Download

memory/5472-133-0x0000000000F00000-0x000000000125F000-memory.dmp

Download

memory/5472-134-0x0000000000EC0000-0x0000000000EFB000-memory.dmp

Download

memory/5564-101-0x0000000007390000-0x00000000073A4000-memory.dmp

Download

memory/5564-92-0x000000006F300000-0x000000006F34C000-memory.dmp

Download

memory/5564-103-0x0000000005EC0000-0x0000000005EE1000-memory.dmp

Download

memory/5564-90-0x00000000057C0000-0x0000000005B14000-memory.dmp

Download

memory/5716-28-0x0000000000460000-0x000000000049B000-memory.dmp

Download

memory/5904-237-0x000000006F220000-0x000000006F26C000-memory.dmp

Download