salatstealer | 913d1f1c9adc4bffc6e0157ae4a0f31018f28e98f6a12012b833f7f0d08bfccd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader/Loader by Sexsoldier.exe
Size 20.2MB
Sample260502-ptpxeafy21
SHA256 913d1f1c9adc4bffc6e0157ae4a0f31018f28e98f6a12012b833f7f0d08bfccd
MD5 4608ac2409b690dd007d354671419697
SHA1 7b21ebbf93fc0a16cefafd938cb2e2dea263ba4b
SHA512 959cdb01ed08056c628c8e31070e57a2e23175fac83cff44ae61f0f8489759d81945da0f595ab7e3495e4f7dee11d56c58d4b963ff1e5219f692a5d101ccb795
SSDEEP 393216:PFVy9ZgnnWzDp8tfOwiEaeczzTAQcFed+VZRQL+XOmJmEPlJnrGvBkOpzdrQ:vmZKCDplFVvhdeRAEtJilzy
TLSH
T1C72733636B71B172EA9F08B489625721A6E6B7B1D731C91F7800018D41F7BF79E8138B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 19 IoCs

resource	yara_rule
behavioral27/memory/2092-77-0x0000000000E00000-0x0000000001A57000-memory.dmp	family_salatstealer
behavioral27/memory/2092-78-0x0000000000E00000-0x0000000001A57000-memory.dmp	family_salatstealer
behavioral27/memory/2092-86-0x0000000000E00000-0x0000000001A57000-memory.dmp	family_salatstealer
behavioral27/memory/5056-90-0x0000000000830000-0x0000000001487000-memory.dmp	family_salatstealer
behavioral27/memory/4964-91-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-92-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-93-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/1492-115-0x0000000000CE0000-0x0000000001937000-memory.dmp	family_salatstealer
behavioral27/memory/4404-126-0x00000000002C0000-0x0000000000F17000-memory.dmp	family_salatstealer
behavioral27/memory/4964-152-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-153-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-157-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-158-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-159-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-160-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-161-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-162-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-163-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer
behavioral27/memory/4964-164-0x0000000000DB0000-0x0000000001A07000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
45	1816	powershell.exe
46	1816	powershell.exe
47	1816	powershell.exe
48	1816	powershell.exe
53	1816	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Loader by Sexsoldier.exe

Executes dropped EXE 9 IoCs

pid	Process
1048	Loader by Sexsoldier.exe
2092	svchost.exe
828	conhost.exe
4880	svchost.exe
4240	svchost.exe
4964	RuntimeBroker.exe
5056	OfficeClickToRun.exe
1492	RuntimeBroker.exe
4404	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Program Files (x86)\\Windows Media Player\\RuntimeBroker.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemAutoLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\SystemData\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OfficeClickToRun.exe"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral27/files/0x0007000000024319-17.dat	upx
behavioral27/memory/2092-32-0x0000000000E00000-0x0000000001A57000-memory.dmp	upx
behavioral27/memory/2092-77-0x0000000000E00000-0x0000000001A57000-memory.dmp	upx
behavioral27/memory/2092-78-0x0000000000E00000-0x0000000001A57000-memory.dmp	upx
behavioral27/memory/4964-85-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/2092-86-0x0000000000E00000-0x0000000001A57000-memory.dmp	upx
behavioral27/memory/5056-89-0x0000000000830000-0x0000000001487000-memory.dmp	upx
behavioral27/memory/5056-90-0x0000000000830000-0x0000000001487000-memory.dmp	upx
behavioral27/memory/4964-91-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-92-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-93-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/1492-100-0x0000000000CE0000-0x0000000001937000-memory.dmp	upx
behavioral27/memory/1492-115-0x0000000000CE0000-0x0000000001937000-memory.dmp	upx
behavioral27/memory/4404-121-0x00000000002C0000-0x0000000000F17000-memory.dmp	upx
behavioral27/memory/4404-126-0x00000000002C0000-0x0000000000F17000-memory.dmp	upx
behavioral27/memory/4964-152-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-153-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-157-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-158-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-159-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-160-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-161-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-162-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-163-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx
behavioral27/memory/4964-164-0x0000000000DB0000-0x0000000001A07000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\5dd688e5-4181-7049-a751-4fb4c839e541	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe	RuntimeBroker.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader by Sexsoldier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2092	svchost.exe
2092	svchost.exe
2092	svchost.exe
2092	svchost.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
1816	powershell.exe
1816	powershell.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe
4964	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4964	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1048	2384	Loader by Sexsoldier.exe	82
PID 2384 wrote to memory of 2092	2384	Loader by Sexsoldier.exe	83
PID 2384 wrote to memory of 828	2384	Loader by Sexsoldier.exe	84
PID 828 wrote to memory of 4880	828	conhost.exe	85
PID 2092 wrote to memory of 4964	2092	svchost.exe	90
PID 4964 wrote to memory of 1816	4964	RuntimeBroker.exe	100
PID 4964 wrote to memory of 1492	4964	RuntimeBroker.exe	102
PID 4964 wrote to memory of 4404	4964	RuntimeBroker.exe	105
PID 1816 wrote to memory of 4460	1816	powershell.exe	107

C:\Users\Admin\AppData\Local\Temp\Loader\Loader by Sexsoldier.exe
"C:\Users\Admin\AppData\Local\Temp\Loader\Loader by Sexsoldier.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\Loader by Sexsoldier.exe
  "C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\Loader by Sexsoldier.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1048
- C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\svchost.exe
  "C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe
    "C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4460
  - - C:\Program Files\Google\Chrome\Application\RuntimeBroker.exe
      "C:\Program Files\Google\Chrome\Application\RuntimeBroker.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4404
- C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\conhost.exe
  "C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\conhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
    "C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4240

C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loader by Sexsoldier.exe

Path C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\Loader by Sexsoldier.exe
Size 16.0MB
SHA256 b79fe947040b74064ca1051b2891b71adb39ab5f0eef3cc673332bf55b280cf2
MD5 d53ff43a1c04264a9b1ab27b7edc962f
SHA1 aaab9a1aeddbb9c8a94fe5576092abd804630924
SHA512 679dfeccef5134c30be41ae1be27e125b5ca794b23594fa9fa8fd0c399de04978fb7478bc2ef7ee0d9472ccdb5fd8b188d2e7e69063ee1c7170a234967f64b8b
SSDEEP 393216:hFVy9ZgnnWzDp8tfOwiEaeczzTAQcFed+VZRQL+XOmJmEPlJnr:1mZKCDplFVvhdeRAEtJ
TLSH
T10A073373AF70F132FFD740B4A9829722A666BBB5A132810FAC10469D45F435BEA407D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\conhost.exe
Size 729KB
SHA256 671bc85a8d8709362a69d47b16b4f76bfbfbf6ea2e271458d4554093196d536a
MD5 efe86deaa564621d6495f5f821e1b5e4
SHA1 afbca53851cfe91c5414e37c6fd189ed30daf959
SHA512 ef068a284f7a9fe689a86784ac3a4991fbaf4b7ee8d777ee395223de9569dc32050abf9e27e0f49c94b743f2b1e0918b31b61d67ed847db36cc385c4e0297b27
SSDEEP 12288:QofGfpuiX1PhfSkR4YZTS312OhFcuffl8hYybAeUmIcO210weZqFM+:QofmPFiISFdTZfl4bAeUmB0NL+
TLSH
T108F4E08927E667D7D41E0EB2853705DCAAF5C1B2CB84CDBF3449502886A7FF64C9720A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\MergedApps_0e85b0e9-d18c-4a81-bbd2-f5361d6cdbf5\svchost.exe
Size 3.4MB
SHA256 38153939c017d389a48b9e7f7aa6de1b61c2fa7ce0077f73c349faf010792cdb
MD5 87f6dc76bc4cb93b0a507f517365ceca
SHA1 672f1938157a6b45e56f0e7c3bf7a1d02e36365e
SHA512 4507580db176bb2b056fdd28b67644774fa265e54c78c8ed1a8bacc08bb49fbb594a0758f2c847dc1b9263b1168d9fac8f0693b981b1dcce2fd74a191d49bfb3
SSDEEP 49152:0n4tarRn4GQhDUPmOw0pgZZ+m8BJ8g1gAIO36mO5fg1rYgDGSdz4rOhKx47QLwnI:s9Vn4G6QPAZ+FB71RIOKZfoECESSYwN
TLSH
T197F5336F2B177403DD5B56B84A69A32C1AE1F3BACF79A2D921A8D0CF04594C7BDD7008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dbgw1ped.cfp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbgw1ped.cfp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 c7b918c0275bd3c3ee64af086d37e4a1184f856e8a25fdb13f7b48648645ffbe
MD5 1993de71af0cd48fee4582eb76b8eae7
SHA1 ed3615fe388c04edbe628727d277585a3dd632e7
SHA512 d76495c368a191e0f5a6faa03bfe46f4bae04037af52090de309c13e71032171fef8a015e34f6d810535b7ca11cbc14efdb24da38765a7d85959ae62854ef17e
TLSH
T1F911E03C57BD91FBA883036FD768FE5989A131706B54EA5CB7298048B044C3C76D3586
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 b49e92b0038731299d296989942bea4cb9fdea970134591e9b6a36f54ed3ac17
MD5 41a4753e2bae62b5bef5b7a2c186481c
SHA1 795fa73a93af45af05992f38ae6a864dab502897
SHA512 7663af52572320ec6f56df517713293a532919fb3e56e0ad1e70781c53ad85bf1bf33459f8cdba7815db6de93a8ad1420e01fbcecfb63bf15705ac82bbb1d698
TLSH
T1DF21EA3C57BD91FBB983036FC76CBE964D9135716B60EF5CA7298088B040C3C6AA3446
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 acf2074f897a854c39945259f86046c2764af30eecf646214465a6fa6409c10f
MD5 3b78df9858f60c4be48ad2d155141a0f
SHA1 4b369c9d3a9f070f0ded44c4ae9a65d173df9d9f
SHA512 6d27520125a64bcde34394d9358d732d9605f6deec342051942f2139dc443ade29b246403842021f13ea8280fee15d36cd1c397e34a1b9d232e142159b63ffcb
TLSH
T1A931D93C57BD91FBA983036ED768BF964D9135706B64EF5CA72980887040C3C69A748A
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 4f97355368bcf77c8b9a90921c0bbdc085faa0b123c931f67f66f627e190378a
MD5 2a2a77c092212868ed572c90b12b12b3
SHA1 5c661292f266f0bff88a2d1199071c4102810393
SHA512 c72b598863c81fd4e94788ba3d49f7642d444b3fa3d34e82ec3668f47fa7d023e263efa292472d9d52afa2cd336ee81ddc4dc5b4b5caee26ae283c72c5bcd53c
TLSH
T10F31072D57BC91FBB99302AFC76CBF964D9135716B24EF48A72D9088A040C3C6973485
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_tracking.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_tracking.txt
Size 33B
SHA256 e5aaa28531e93a25cec8b98a7a86e5de3612bc0a359ed1a07739801b59929e32
MD5 062dfce36c2b23e603eab248a5bc081c
SHA1 04e1e49afd7ec2b54744269edc24155397649ca4
SHA512 72acda1c83520345ee63ec7319348e10ab26f234c98889471fae849059c91f44c3bff572b158e82415411d52ab9b7979f7099fd71324e1092a5f745c22d894aa
MD5 SHA1 SHA512

Submit Download

memory/828-31-0x0000000000E00000-0x0000000000EBC000-memory.dmp

Download

memory/1048-62-0x00000000063B0000-0x00000000063E8000-memory.dmp

Download

memory/1048-61-0x0000000006360000-0x0000000006368000-memory.dmp

Download

memory/1048-63-0x0000000006370000-0x000000000637E000-memory.dmp

Download

memory/1048-54-0x00000000007D0000-0x00000000017DA000-memory.dmp

Download

memory/1492-100-0x0000000000CE0000-0x0000000001937000-memory.dmp

Download

memory/1492-115-0x0000000000CE0000-0x0000000001937000-memory.dmp

Download

memory/1816-141-0x00000000076A0000-0x00000000076B1000-memory.dmp

Download

memory/1816-127-0x0000000007510000-0x0000000007542000-memory.dmp

Download

memory/1816-151-0x00000000085D0000-0x0000000008B74000-memory.dmp

Download

memory/1816-150-0x00000000077E0000-0x0000000007802000-memory.dmp

Download

memory/1816-145-0x0000000007710000-0x0000000007718000-memory.dmp

Download

memory/1816-144-0x00000000077E0000-0x00000000077FA000-memory.dmp

Download

memory/1816-143-0x00000000076E0000-0x00000000076F4000-memory.dmp

Download

memory/1816-142-0x00000000076D0000-0x00000000076DE000-memory.dmp

Download

memory/1816-94-0x00000000026B0000-0x00000000026E6000-memory.dmp

Download

memory/1816-99-0x00000000051E0000-0x0000000005808000-memory.dmp

Download

memory/1816-140-0x0000000007740000-0x00000000077D6000-memory.dmp

Download

memory/1816-101-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Download

memory/1816-102-0x0000000005070000-0x00000000050D6000-memory.dmp

Download

memory/1816-103-0x00000000050E0000-0x0000000005146000-memory.dmp

Download

memory/1816-139-0x0000000007670000-0x000000000767A000-memory.dmp

Download

memory/1816-111-0x0000000005950000-0x0000000005CA4000-memory.dmp

Download

memory/1816-112-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Download

memory/1816-113-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/1816-138-0x0000000007570000-0x0000000007613000-memory.dmp

Download

memory/1816-116-0x0000000006520000-0x0000000006564000-memory.dmp

Download

memory/1816-129-0x000000006BED0000-0x000000006C224000-memory.dmp

Download

memory/1816-122-0x00000000070A0000-0x0000000007116000-memory.dmp

Download

memory/1816-124-0x0000000007340000-0x000000000735A000-memory.dmp

Download

memory/1816-123-0x00000000079A0000-0x000000000801A000-memory.dmp

Download

memory/1816-137-0x0000000007550000-0x000000000756E000-memory.dmp

Download

memory/1816-128-0x000000006B950000-0x000000006B99C000-memory.dmp

Download

memory/2092-86-0x0000000000E00000-0x0000000001A57000-memory.dmp

Download

memory/2092-32-0x0000000000E00000-0x0000000001A57000-memory.dmp

Download

memory/2092-77-0x0000000000E00000-0x0000000001A57000-memory.dmp

Download

memory/2092-78-0x0000000000E00000-0x0000000001A57000-memory.dmp

Download

memory/2384-0-0x0000000000100000-0x0000000000108000-memory.dmp

Download

memory/4404-126-0x00000000002C0000-0x0000000000F17000-memory.dmp

Download

memory/4404-121-0x00000000002C0000-0x0000000000F17000-memory.dmp

Download

memory/4964-157-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-159-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-91-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-164-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-163-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-93-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-152-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-153-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-85-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-158-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-92-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-160-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-161-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/4964-162-0x0000000000DB0000-0x0000000001A07000-memory.dmp

Download

memory/5056-89-0x0000000000830000-0x0000000001487000-memory.dmp

Download

memory/5056-90-0x0000000000830000-0x0000000001487000-memory.dmp

Download