salatstealer | 9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8

Analysis

max time kernel
299s
max time network
303s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/07/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rufus4.14.exe
Size 15.3MB
Sample260716-t2pc3ac18v
SHA256 9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8
MD5 23285f10bb9b3002a24d3dbf865f07e1
SHA1 fcb14e821e391defa8096c553066e5f555280de0
SHA512 0e82a5465cab0131eee3e459e553facf64cee7a5743672f2ea914ccc8ee1182c59b723499c9229ae5ff0f168a2a8dfa54ea78b51580717c8ba56c260b2cbe821
SSDEEP 393216:+YiDfDg8c66kbdzaDfZbHIl395Ppi70ij9ryRYaZbhknk4RrdapeQa:+Yib0jPmdW75ol37x65chaH
TLSH
T17AF6332567B044EAE0BFAB7DD014E525E5B230640B83E65BD3EC978BEF032E02675761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery salatstealer stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 10 IoCs

resource	yara_rule
behavioral2/memory/2216-105-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-104-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-106-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-108-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-107-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-109-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-122-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-123-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-126-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer
behavioral2/memory/2216-127-0x0000000003020000-0x0000000003C7D000-memory.dmp	family_salatstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	rufus4.14.exe

Executes dropped EXE 2 IoCs

pid	Process
5040	rufus-4.14.exe
2216	runner_ea99c6c5.exe

Loads dropped DLL 6 IoCs

pid	Process
3860	rufus4.14.exe
3860	rufus4.14.exe
3860	rufus4.14.exe
3860	rufus4.14.exe
3860	rufus4.14.exe
3860	rufus4.14.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rufus-4.14.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	rufus-4.14.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	rufus-4.14.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	rufus-4.14.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	rufus-4.14.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000028616-43.dat	upx
behavioral2/memory/5040-67-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/2216-84-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-103-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-105-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-104-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-106-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-108-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-107-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-109-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/5040-120-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/5040-121-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/2216-122-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-123-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/5040-125-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/2216-126-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/2216-127-0x0000000003020000-0x0000000003C7D000-memory.dmp	upx
behavioral2/memory/5040-128-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/5040-130-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/5040-131-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/5040-152-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/5040-175-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx
behavioral2/memory/5040-176-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runner_ea99c6c5.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	rufus-4.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rufus-4.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rufus-4.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	rufus-4.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	rufus-4.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	rufus-4.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	rufus-4.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	rufus-4.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	rufus-4.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	rufus-4.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	rufus-4.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	rufus-4.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	rufus-4.14.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rufus-4.14.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000f3699f3b25e3dc01028dd2d62ce3dc01aeb5f3f14015dd0114000000	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	rufus-4.14.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	rufus-4.14.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rufus-4.14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	rufus-4.14.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	rufus-4.14.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	runner_ea99c6c5.exe
2216	runner_ea99c6c5.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe
Token: SeLoadDriverPrivilege	5040	rufus-4.14.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5040	rufus-4.14.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5040	rufus-4.14.exe
5040	rufus-4.14.exe
5040	rufus-4.14.exe
5040	rufus-4.14.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 3860	460	rufus4.14.exe	82
PID 3860 wrote to memory of 5040	3860	rufus4.14.exe	83
PID 3860 wrote to memory of 2216	3860	rufus4.14.exe	85

C:\Users\Admin\AppData\Local\Temp\rufus4.14.exe
"C:\Users\Admin\AppData\Local\Temp\rufus4.14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Users\Admin\AppData\Local\Temp\rufus4.14.exe
  "C:\Users\Admin\AppData\Local\Temp\rufus4.14.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Users\Admin\AppData\Local\Temp\bundle_a26ujo_1\rufus-4.14.exe
    "C:\Users\Admin\AppData\Local\Temp\bundle_a26ujo_1\rufus-4.14.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\bundle_a26ujo_1\runner_ea99c6c5.exe
    "C:\Users\Admin\AppData\Local\Temp\bundle_a26ujo_1\runner_ea99c6c5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2216

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2548

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svc_74333cb8.log

Path C:\ProgramData\svc_74333cb8.log
Size 659B
SHA256 d6866bbf0e6d80eb6f0e3d465bf9242789be750be9d3fa391d2946d4c7744a83
MD5 d9355df1fc7a7a5f0bc2399bf43e6db1
SHA1 81ffefb6b329e7ce7d2dd33d15f38e7bbe745868
SHA512 db33997a6879fa1863121ef7f61bb529631f1040ac7abb5e46fdabc8ff9fff572d375a3bb050afcb5c29a8aaead82523dc92cf2f9fcc75493d8cd76c75447c7d
TLSH
T1A7010D0030B8B3B56CA1E33194947B16607E7EDE741E14B66532B10C938DCAEB8888E4
MD5 SHA1 SHA512 TLSH

Submit Download

svc_74333cb8.log

Path C:\ProgramData\svc_74333cb8.log
Size 1KB
SHA256 fcd9c6add8272b0d1f3ffce7e704416a019516f2a5d4a1e0028c155046298e28
MD5 f2f99ce612f5c97645325121f32defc2
SHA1 d624becb594575cc72a9a10c172ce42f0d8ffcb8
SHA512 0fde46696d3e9215ce139c2438059ad68f987f01a8da297ef2ee132414313f967517b104960d3231cbc9fd3880849ffc2608fc9ec64f668e253011a97c2c7b5d
TLSH
T165114B0031BCB3F67CA8E27594943B95607B7FCE754E24B9A532E509938DC9EA4C89E0
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\_bz2.pyd
Size 81KB
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
TLSH
T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\_ctypes.pyd
Size 120KB
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
TLSH
T10BC36C0B2358109AEB674078C5B35E47DB71B859171087CF0264C69E2F63BA36E7F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\_decimal.pyd
Size 248KB
SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
MD5 20c77203ddf9ff2ff96d6d11dea2edcf
SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
SSDEEP 6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
TLSH
T10B446C66A2490CA4DE77807498974B57F7B278944320D3CF43A4CAA73F576A323BD748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\_hashlib.pyd
Size 63KB
SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
MD5 d4674750c732f0db4c4dd6a83a9124fe
SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
SSDEEP 1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
TLSH
T1A8537C06A78440A5C467837DD9D30EABE272F4405751A7EF4368C28E2F237C3A7B67A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\_lzma.pyd
Size 154KB
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
TLSH
T171F32992A394F0E6F3628C78D6624F57D6F57809031092DA02CC976D2B1FB759E2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\_socket.pyd
Size 77KB
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
SSDEEP 1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
TLSH
T137736B12A69050A9D27380BAC5635F63F770F48057D593CF1264CA6E1F23782AE7EBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\base_library.zip
Size 859KB
SHA256 4bf1b2c937d680135c4d1e1c062f2d489b16f6f6f6357072707a44a4728dd505
MD5 e12b1a03f8daa4fafcbf5ae3b779e088
SHA1 de2f11f36ac1a6743a427db75cdc85173ec81c78
SHA512 0ab44f5cd3b50e1078d34909f47be970a90ccbe001907623d3849304e33aa66c29f8a62184e9839344ecffef4297053699cb135564fd366fa9a6f60396b120eb
SSDEEP 12288:rWdZMNKgYJuS+EQ2QT6uB7k8A4a2YLfpEESNlWy5Vwxic:eMNKgYJ1+jxLa2wfpETV5Vwxic
TLSH
T1F9153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
TLSH
T1CEF58C5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF18B681780F13BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\python310.dll
Size 4.3MB
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
TLSH
T102267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runner_ea99c6c5.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\runner_ea99c6c5.exe
Size 9.1MB
SHA256 9d2f3d3801788b6e46a2b7e4b61c4eaf3bece5642994e998961421ee6268ddf1
MD5 1f22c61b7b238f5b0ac540c322445f96
SHA1 90c8bfbeb669f5bbf6bd21dd43f1bf55033cf92c
SHA512 c1162aa2941e7f60192a3aeddd30ce4a893536a5291fdcc1cb5e9cf004dd09b0db7ea0afd0a0798f3621a10c00a38d891e00ac810a91e0c2feb46493058a13c7
SSDEEP 196608:EBJSMpINGSh5tshpDq/VpIJ7MxdHq/VpIJ7MxdHq/VpIJ7MxdHq/VpIJ7Mxdw:EBzpIYGsW/Vpu7M2/Vpu7M2/Vpu7M2/G
TLSH
T1F9A6F1133BFEB05EEA6B97B4946462418625FC770D92908975CC148B4F9B9007EFC3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\select.pyd
Size 29KB
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
TLSH
T1FED2AF47AB506C42D8238572A4D68E16E935B6A14B20C3DF332DC26D1F227C277BB36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI4602\unicodedata.pyd
Size 1.1MB
SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
MD5 81d62ad36cbddb4e57a91018f3c0816e
SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
SSDEEP 12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
TLSH
T16E355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rufus-4.14.exe

Path C:\Users\Admin\AppData\Local\Temp\bundle_a26ujo_1\rufus-4.14.exe
Size 1.9MB
SHA256 9fcad316c82ba3d0c3130c9f43fb0fe147e9eb62e1bf830716a0bbb6c58d24ee
MD5 ca5f973b64a77c8b43fbb28152fe2492
SHA1 e8cbc48c1b12d0650d74611a3a702d8ebdb311e7
SHA512 e56abc30641cc231944be90443590f6a71d84b8e4489e643d37a46599a1f2f3173b7ef38ce40f30a1075558a5f827730fd310e477c9603f5005098f379ceeee5
SSDEEP 49152:t+/VDPuKlLmr6PNt85s2ToFkeJCFat05Yq0LdEIXhNaPRAUrD:t+nlWt5TCFJCFpq5dEasyE
TLSH
T19F9533D1183CBD8BD0895F72956D5A70A236A5CC4C668B37A24BFFCD85E32853EF1026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2216-126-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-122-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-103-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-105-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-104-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-106-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-108-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-107-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-109-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-127-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-123-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/2216-84-0x0000000003020000-0x0000000003C7D000-memory.dmp

Download

memory/5040-121-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-125-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-67-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-120-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-128-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-130-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-131-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-152-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-175-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download

memory/5040-176-0x00007FF7C7E30000-0x00007FF7C83DE000-memory.dmp

Download