1589afc495d55fa2ff495e3e843783d69fbb6d348c58167d1f1fcab64d658bd0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Size 50.4MB
Sample260415-mc32laew9s
SHA256 1589afc495d55fa2ff495e3e843783d69fbb6d348c58167d1f1fcab64d658bd0
MD5 4e582a66bd71ee2df682dbc050ecec43
SHA1 6f552dac1013fd3c4ed6a0f9469491285de877fc
SHA512 9883e084a9714c3422d11ad1029ecb09c39abb9657bbf9911a83e617f07bb2d4de721341a385aeb7952593006837402567862c86c6d00fe25aa443e790241004
SSDEEP 1572864:IsDryaT87B7OmZhG+w/+syi6U3Di6kVh4VY/ibtd7y5S:jDr+BdZgv/+synU3GZh4Kh4
TLSH
T17DC73381ACDBC9B5FC13093A12A80DD16385ECDD2BF504DA9B4327C97CF889BC9455AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe
4676	powershell.exe
3024	powershell.exe
4900	powershell.exe
2888	powershell.exe
784	powershell.exe
1724	powershell.exe
2400	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3096	tsetup-x64.exe
1820	tpg.exe
3748	tsetup-x64.tmp
800	GameBox.exe
2528	GameBox.exe
3152	Telegram.exe

Loads dropped DLL 5 IoCs

pid	Process
800	GameBox.exe
800	GameBox.exe
2528	GameBox.exe
2528	GameBox.exe
3152	Telegram.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
800	GameBox.exe
800	GameBox.exe
2528	GameBox.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\__tmp_rar_sfx_access_check_240665296	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\tpg.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\tsetup-x64.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\tsetup-x64.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\DuiLib_u.dll	tpg.exe
File created	C:\Program Files (x86)\GameBox.exe	tpg.exe
File created	C:\Program Files (x86)\Utility.dll	tpg.exe
File created	C:\Program Files (x86)\user.dat	tpg.exe
File opened for modification	C:\Program Files (x86)\tpg.exe	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Config\Dynamic\Account.cfg	GameBox.exe
File opened for modification	C:\Program Files (x86)\DuiLib_u.dll	GameBox.exe
File opened for modification	C:\Program Files (x86)\GameBox.exe	GameBox.exe
File opened for modification	C:\Program Files (x86)\user.dat	GameBox.exe
File opened for modification	C:\Program Files (x86)\Utility.dll	GameBox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x002000000002b28a-6.dat	innosetup
behavioral2/memory/3096-24-0x0000000000560000-0x0000000000638000-memory.dmp	innosetup
behavioral2/memory/3096-90-0x0000000000560000-0x0000000000638000-memory.dmp	innosetup
behavioral2/memory/3096-296-0x0000000000560000-0x0000000000638000-memory.dmp	innosetup

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x00140000000256dc-15.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg\shell	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tdesktop.tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\ = "URL:TonSite Link"	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3152	Telegram.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
800	GameBox.exe
800	GameBox.exe
4900	powershell.exe
4900	powershell.exe
2888	powershell.exe
2888	powershell.exe
784	powershell.exe
784	powershell.exe
1724	powershell.exe
1724	powershell.exe
2528	GameBox.exe
2528	GameBox.exe
2400	powershell.exe
2400	powershell.exe
5076	powershell.exe
5076	powershell.exe
4676	powershell.exe
4676	powershell.exe
3024	powershell.exe
3024	powershell.exe
2528	GameBox.exe
2528	GameBox.exe
3748	tsetup-x64.tmp
3748	tsetup-x64.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3152	Telegram.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3748	tsetup-x64.tmp
3152	Telegram.exe
3152	Telegram.exe
3152	Telegram.exe
3152	Telegram.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3152	Telegram.exe
3152	Telegram.exe
3152	Telegram.exe
3152	Telegram.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
800	GameBox.exe
2528	GameBox.exe
3152	Telegram.exe
3152	Telegram.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3096	4800	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	80
PID 4800 wrote to memory of 1820	4800	2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	81
PID 3096 wrote to memory of 3748	3096	tsetup-x64.exe	82
PID 1820 wrote to memory of 800	1820	tpg.exe	83
PID 800 wrote to memory of 4900	800	GameBox.exe	84
PID 800 wrote to memory of 2888	800	GameBox.exe	86
PID 800 wrote to memory of 784	800	GameBox.exe	88
PID 800 wrote to memory of 1724	800	GameBox.exe	90
PID 2528 wrote to memory of 2400	2528	GameBox.exe	93
PID 2528 wrote to memory of 5076	2528	GameBox.exe	95
PID 2528 wrote to memory of 4676	2528	GameBox.exe	97
PID 2528 wrote to memory of 3024	2528	GameBox.exe	99
PID 3748 wrote to memory of 3152	3748	tsetup-x64.tmp	102

C:\Users\Admin\AppData\Local\Temp\2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4e582a66bd71ee2df682dbc050ecec43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\tsetup-x64.exe
  "C:\Program Files (x86)\tsetup-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\is-LEINL.tmp\tsetup-x64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LEINL.tmp\tsetup-x64.tmp" /SL5="$502BC,50246006,826880,C:\Program Files (x86)\tsetup-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
      "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:3152
- C:\Program Files (x86)\tpg.exe
  "C:\Program Files (x86)\tpg.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\GameBox.exe
    "C:\Program Files (x86)\GameBox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4900
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:784
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1724

C:\ProgramData\client\GameBox.exe
C:\ProgramData\client\GameBox.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client\Utility.dll'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DuiLib_u.dll

Path C:\Program Files (x86)\DuiLib_u.dll
Size 489KB
SHA256 d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2
MD5 0b98bd6bf1956a04d626bf45c8a8f24f
SHA1 4d33a107a39071d5f3dfb0d5e6665920eea1ecf0
SHA512 6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed
SSDEEP 6144:OoFzDmi3RUAaMhq6hWvuK05XptWEWb3KMYqdQoE40:xpcshqjvuKcXWQqOj
TLSH
T1B3B49F2236E181B9C993D3379B2C9F38ED7A74404675864B73DD0E667A27A90CA113F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameBox.exe

Path C:\Program Files (x86)\GameBox.exe
Size 1.4MB
SHA256 dda4924824054c574b5a7c96b2e30f7fb6e643b510db8288b1a6721fa7ff463a
MD5 f69465ef1bc5fcfd30a667a4eec19c66
SHA1 70074fd04a8fe4804421b215b3f13252c2fe31de
SHA512 7445615aa9798315f13da7a354898f4463792d1292dfea3be398e782964bad16150791bb07e6a9e6dbf9372657c3ca5afa3cc8eb8d3d039e846a67fdd889af83
SSDEEP 12288:r6RC8u9TNaeezx1xfeUsB2ut5kUMSvYTXvqyKaKi0PPX5W1G+HWZx3O62:r6c8uAA9txXYea4PQWpO6
TLSH
T1C5653B79BEE18AB1D4866277A5DC9910E5E7F8628F2019CF77CC8A4E4F126C05CB16C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utility.dll

Path C:\Program Files (x86)\Utility.dll
Size 1.2MB
SHA256 c46439480e2afeb63612791640a80a968e67974f992ee67cfbd13b0076603ae4
MD5 e8ec174181a2294a6a9f2ddd4f3d86d5
SHA1 eb0f7dc1daa0c77233dfd4cc3a9db02e98a9d83d
SHA512 fa367af2bdf4a6858c187c768716bd49c05e4be3a9d02e8408a26d4cbaf74c5d774f75244739b6fbda2b5b0f34551c0fca46c323005ecc7be6723e25e444c205
SSDEEP 24576:Y8nc7TLHqr1Ax7wEiGT/ZlvtQ8K9eFY6QsqRVjjczvJ77IaEVeUcniRn+Kf:Yec7TLNx7dZrQ7eFYfFxjGEJ4xs+Kf
TLSH
T14B4533A38D7AE056F85830B46DF2BA646073CAD450A6D2FE7982B414DD1EEF13835F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tpg.exe

Path C:\Program Files (x86)\tpg.exe
Size 2.0MB
SHA256 24e1aaf389427e3b20891f9e05469b41a5aa7ec36aa68bdea4a8bc797bb2ba52
MD5 3078a9f9a1b43a434729350448754d80
SHA1 ee2d87821099d191de19c142046f86f045e21cb3
SHA512 22bb219703491a777d1974bb506f47e96ac2cf90db9dc44c5218df783d6208fa24716f16856c77d79f4d363584bd3311687a04c91613d118c3e49ab7b86d1a56
SSDEEP 49152:QRqcZoKm7X7HMgT6e07687XnkGbB1SIQmbfDpO59lWF3:V7X7ND0mYXF1PBIrwF3
TLSH
T1F8A5333392A49B73F6AB67B84492D17B5F66AF1425D5E187D0D93F873A330C3860E40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tsetup-x64.exe

Path C:\Program Files (x86)\tsetup-x64.exe
Size 48.9MB
SHA256 e4ab08b640ca75cff0ad367e7ed0ce1c8bc5b936a895d0f206cee2f0dee386e7
MD5 d19502943032baa5c4e7a3af56cf8039
SHA1 f4c29c45119281e3f8b88c4a2be7dae43228c21c
SHA512 371ecbdd9265eecdff5f4f2f7c70c3945b04bfe4323caa7753916e61a6e2a0a982faf64a9382d27e452c8cab5dc8a9a3baa6c9803f06dafb522665d554d3a97c
SSDEEP 1572864:3eRyxGgYa1QTbc59tABsbCbBLDo/KJjTt4U+9:35GglQ/c59bdCj6Uo
TLSH
T1A8B733A2B2CBE53FE40D573B09B1A14590F7A2A1B426BD1797E488DCCF255912E3F213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.dat

Path C:\Program Files (x86)\user.dat
Size 2KB
SHA256 dc96f0c19f5e065c3b591abb106845f0d134e79ee97b8f7c2e4e6150dcdad2ae
MD5 df104f94282c25008f8d2f831605b713
SHA1 bcfbbd7910207238b00e11b25f09d12912669f63
SHA512 424b8a676fe890d31333929a62202330b772e86b316031874ec061aaffe6098dda95bb62493840eab6b4b4f86c1c8c8443132945243b25ca2a89b6150fc07cf7
TLSH
T17F416DE4421E821349631C0F0D2DB3E17D6CB60188A304FE991DCD4957F18D25193FD7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5342d733f34b9109b39a8e3c8f83ad5d0a61d8a86754df6b0934053edd898a1e
MD5 ebc194891612f3a192d4e4a64caedb24
SHA1 2569cdc1c876db165ffa25e7498ba2402c9ad889
SHA512 0d65d8b1a55a32961508c038e72716694bd72e3bc809ad7f80ebed38537646289e1d54823099c63be4e4153cf35da557ed0cc09d9cb5feda94dcc97d0f5f3d8d
SSDEEP 384:nL3HhY1SGDmId+uRHEMbROuH/fh5HnHtYatXWHZO9VRbaAnYE8apDU1C:LWSZIdFRP93NRGHZwD+32UM
TLSH
T12B9218A9221F2657E46613B4E0270B8BFDF0AECEC34453DE27191D3B45CB666C0A95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 36ae8ccef8fde56cb7cc0c895df5c4b98bd47c924eb369e6db3534666e54fed3
MD5 cfd655f9bd764c887873f3116ae0c902
SHA1 1ed7a9c1fa6cf3e6e47c2b481cf10fe51de6c7fc
SHA512 81948f601cb2a215f9b26854fb6d537c1fa030f8400ffa6f9bf792187d4f1de4996bc1864488f6ee0956d0d5b50855f35352a96db15e9d4c7ff2ee749250b6f8
SSDEEP 384:dL3HhRSS51A8q6FRHEMEtb0zNPYatJZeNO9lrRr+AnYEzkapDU1C:VrSS5Lq6RPEd6PRJUNwl9r+3cbUM
TLSH
T1399209AD321F36D7C4A913B4D027079BEEB0DEDE430813DEA71A597705CE66240AA5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 9403852728910c2c51a386b16e47262bbccb51f7bf287500071a581e667d69f4
MD5 14a2cc2c20a8f33a2f25433822a9654e
SHA1 1da23f5ddcda5ae8c3fe169c13c3db8b07ea04f6
SHA512 cb3c2a77a422fa17318fe2f648efed4093da90fda0c76449a6eb4c8a96bcf553736ebf41f1390d1cb331dcc12515ff532767c050075784e5eb567ab44c320fd4
SSDEEP 384:EL3HhsSS1xT9KbpeuiUmHnnNjjs2xtguNrCU59B9Jsu0iFpX:qySSjoNJifNjj7xtg2rCWB9Jsu0M
TLSH
T15892C4AE711F22C3C88553B8D107010FE8F2DE8D431A12D9BB2E9E7B89AC65E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_r02iaz0j.2gn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r02iaz0j.2gn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tsetup-x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LEINL.tmp\tsetup-x64.tmp
Size 3.3MB
SHA256 9febfcd1ea14dc3a6f81b82b196992edadd5dfc5262a1046b3e0d5e806d0f4d0
MD5 d00c48772a5aad54ca403bdcf532d431
SHA1 5c15cc5bec95daff5e75a85c6cec08cfd176f6b8
SHA512 d3a8da6c80ba02144fa1c22188238ed9487b0175d44c4934725881cebfa4d9f50d780335f9cab201d7bf01b4c8257caa5236c371051986533384b589845abe65
SSDEEP 49152:fuAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKLz333j:fuAK6XMXhKAWwLsXa2333
TLSH
T10CF55C23F34D603EF06A1A399D379658583B7A606916CC5797FC3A4C8F361802E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 07299006874d328907c84a98f06a7b115ed170ddf777e6c1c87859012965ba6d
MD5 255c589a51acc52f30762107bdef9c0a
SHA1 b7774f02cba1473a6eac28020faa62adcb8a74dd
SHA512 07fdbfd74fe5add4284a0f6962b948ec2e71456108b4048d96609b1c2059c6463b10737cab711a86f9e7af12e29646208cdb17565ffc064ac45dd29a78dabd5a
SSDEEP 384:JL3HhRSS1Skp8LC+ZMRnNPjs2xtgiN+aY1999Jwu0iF1X:RrSSHp821fPj7xtgy+ai99Jwu04
TLSH
T19792C5AE711F22C3C88553B8E106050FE8F2DE8D431913D9BB2E9F7B89AC59E817D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 8baefb036667490633158b1c147d68c9699df58b22ff8493df465bda134de8cf
MD5 762b89ab0fe6e0069257423911fb1f55
SHA1 9fe90264eb4a0bdc822444272a9162d71682b5bc
SHA512 4a190798bb6ffe4d67e75c81b690fd087fadaeb5f1c38813afec17438117061d560b6f4b5ba1f6eca97b8c1c8d83beff86a4be7fb0fbf96614d8f0b9994eaeba
SSDEEP 384:xL3HhRSSpsi5UFRHEM7saeSb6F/tjsaazbHgLfO9JroAnYEduapDU1C:5rSS5cRP7Djslj6H6fwJ03iUM
TLSH
T1769229AD221F26ABE4A513B4C027079BFEF0DECEC30453EE57195D3B058B6A184A54EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 b2d69079be9113bd48bf1f339fd62fee4c1d135f7fec628c01221ea99c191954
MD5 7b13a00d0629c1aa0bca36e882b3554e
SHA1 ab519078f58406bf0eb9871eec8fb87e13e77224
SHA512 ca6d817da3f0c4b273c5e52446c641a5e8fcbb6fd6dea8075df6c61ba070804edb28ad1c0a984567c2a29895ee948846562b776f4e13e4b31cc24b99d7bc7331
SSDEEP 384:hTHhR2SpSMUWWR3nB8V9dWczHBjsatJGgtJnS6l+5nYEYapDU1C:t2SgMU9RRcdjNJGUJnZl+miUM
TLSH
T1279228A9222F26D7D9A613B4C027178BEEF0CECFC38412EE17195E3705DA66184A50FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-120-0x000000006F460000-0x000000006F4AC000-memory.dmp

Download

memory/784-128-0x00000000057A0000-0x0000000005861000-memory.dmp

Download

memory/784-129-0x00000000062B0000-0x00000000062D5000-memory.dmp

Download

memory/784-118-0x0000000005B30000-0x0000000005E87000-memory.dmp

Download

memory/800-105-0x0000000001160000-0x00000000011DB000-memory.dmp

Download

memory/800-385-0x0000000073CC0000-0x000000007405E000-memory.dmp

Download

memory/800-107-0x0000000073CC0000-0x000000007405E000-memory.dmp

Download

memory/800-43-0x0000000073CC0000-0x000000007405E000-memory.dmp

Download

memory/800-254-0x0000000073CC0000-0x000000007405E000-memory.dmp

Download

memory/800-202-0x0000000073CC0000-0x000000007405E000-memory.dmp

Download

memory/800-246-0x0000000003730000-0x0000000003731000-memory.dmp

Download

memory/1724-137-0x000000006F460000-0x000000006F4AC000-memory.dmp

Download

memory/1724-146-0x0000000006600000-0x0000000006625000-memory.dmp

Download

memory/1724-145-0x00000000051E0000-0x00000000052A1000-memory.dmp

Download

memory/1820-102-0x0000000000780000-0x00000000007FB000-memory.dmp

Download

memory/2400-173-0x0000000004900000-0x0000000004C57000-memory.dmp

Download

memory/2400-174-0x0000000005390000-0x00000000053DC000-memory.dmp

Download

memory/2400-175-0x000000006F480000-0x000000006F4CC000-memory.dmp

Download

memory/2400-182-0x00000000060B0000-0x0000000006154000-memory.dmp

Download

memory/2400-183-0x0000000006380000-0x0000000006391000-memory.dmp

Download

memory/2400-184-0x00000000063C0000-0x00000000063D5000-memory.dmp

Download

memory/2400-190-0x0000000004770000-0x0000000004831000-memory.dmp

Download

memory/2528-257-0x0000000072F90000-0x000000007332E000-memory.dmp

Download

memory/2528-166-0x0000000072F90000-0x000000007332E000-memory.dmp

Download

memory/2528-243-0x0000000000E20000-0x0000000000E9B000-memory.dmp

Download

memory/2528-393-0x0000000072F90000-0x000000007332E000-memory.dmp

Download

memory/2528-242-0x0000000072F90000-0x000000007332E000-memory.dmp

Download

memory/2888-87-0x0000000006430000-0x0000000006787000-memory.dmp

Download

memory/2888-100-0x0000000007C50000-0x0000000007CF4000-memory.dmp

Download

memory/2888-93-0x000000006F460000-0x000000006F4AC000-memory.dmp

Download

memory/2888-101-0x0000000007F40000-0x0000000007F51000-memory.dmp

Download

memory/2888-108-0x0000000007F80000-0x0000000007F95000-memory.dmp

Download

memory/2888-110-0x00000000058B0000-0x0000000005971000-memory.dmp

Download

memory/2888-111-0x0000000006BC0000-0x0000000006BE5000-memory.dmp

Download

memory/3024-235-0x000000006F480000-0x000000006F4CC000-memory.dmp

Download

memory/3024-245-0x0000000004060000-0x0000000004121000-memory.dmp

Download

memory/3096-297-0x00000000016B0000-0x000000000172B000-memory.dmp

Download

memory/3096-91-0x00000000016B0000-0x000000000172B000-memory.dmp

Download

memory/3096-90-0x0000000000560000-0x0000000000638000-memory.dmp

Download

memory/3096-24-0x0000000000560000-0x0000000000638000-memory.dmp

Download

memory/3096-27-0x0000000000615000-0x0000000000616000-memory.dmp

Download

memory/3096-296-0x0000000000560000-0x0000000000638000-memory.dmp

Download

memory/3152-363-0x0000029676CF0000-0x0000029676D9F000-memory.dmp

Download

memory/3152-364-0x0000029676990000-0x00000296769A2000-memory.dmp

Download

memory/3748-104-0x00000000011B0000-0x000000000122B000-memory.dmp

Download

memory/3748-294-0x0000000000470000-0x00000000007CF000-memory.dmp

Download

memory/3748-295-0x00000000011B0000-0x000000000122B000-memory.dmp

Download

memory/3748-290-0x0000000000470000-0x00000000007CF000-memory.dmp

Download

memory/3748-262-0x0000000000470000-0x00000000007CF000-memory.dmp

Download

memory/3748-251-0x0000000000470000-0x00000000007CF000-memory.dmp

Download

memory/3748-103-0x0000000000470000-0x00000000007CF000-memory.dmp

Download

memory/3748-199-0x0000000000470000-0x00000000007CF000-memory.dmp

Download

memory/4676-227-0x0000000004470000-0x0000000004531000-memory.dmp

Download

memory/4676-219-0x000000006F480000-0x000000006F4CC000-memory.dmp

Download

memory/4800-26-0x0000000000740000-0x00000000007BB000-memory.dmp

Download

memory/4900-68-0x0000000007920000-0x0000000007F9A000-memory.dmp

Download

memory/4900-67-0x00000000071F0000-0x0000000007294000-memory.dmp

Download

memory/4900-44-0x00000000029A0000-0x00000000029D6000-memory.dmp

Download

memory/4900-80-0x00000000064F0000-0x0000000006515000-memory.dmp

Download

memory/4900-79-0x0000000004E60000-0x0000000004F21000-memory.dmp

Download

memory/4900-76-0x00000000075F0000-0x00000000075F8000-memory.dmp

Download

memory/4900-75-0x0000000007600000-0x000000000761A000-memory.dmp

Download

memory/4900-74-0x0000000007500000-0x0000000007515000-memory.dmp

Download

memory/4900-73-0x00000000074F0000-0x00000000074FE000-memory.dmp

Download

memory/4900-72-0x00000000074C0000-0x00000000074D1000-memory.dmp

Download

memory/4900-71-0x0000000007540000-0x00000000075D6000-memory.dmp

Download

memory/4900-70-0x0000000007330000-0x000000000733A000-memory.dmp

Download

memory/4900-69-0x00000000072C0000-0x00000000072DA000-memory.dmp

Download

memory/4900-45-0x00000000052D0000-0x00000000058FA000-memory.dmp

Download

memory/4900-59-0x000000006F460000-0x000000006F4AC000-memory.dmp

Download

memory/4900-66-0x0000000006560000-0x000000000657E000-memory.dmp

Download

memory/4900-58-0x00000000071B0000-0x00000000071E4000-memory.dmp

Download

memory/4900-57-0x0000000005FE0000-0x000000000602C000-memory.dmp

Download

memory/4900-56-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Download

memory/4900-55-0x0000000005A50000-0x0000000005DA7000-memory.dmp

Download

memory/4900-48-0x00000000059E0000-0x0000000005A46000-memory.dmp

Download

memory/4900-47-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/4900-46-0x0000000005090000-0x00000000050B2000-memory.dmp

Download

memory/5076-211-0x0000000003D20000-0x0000000003DE1000-memory.dmp

Download

memory/5076-203-0x000000006F480000-0x000000006F4CC000-memory.dmp

Download