Overview

overview

10

Static

static

10

2026-07-23...yn.exe

windows10-2004-x64

10

2026-07-23...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 15:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe
  • Size 5.2MB
  • Sample260723-te8s7afn3x
  • SHA256 969621dd866c7dbe5d8c377a8251024b0d4c2f46cb4b702fffc3184755c2c544
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojanupx

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • UPX dump on OEP (original entry point) 5 IoCs
  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 43 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3212
    • \??\c:\users\admin\appdata\local\temp\2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6052
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1817634 "__IRAFN:c:\users\admin\appdata\local\temp\2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe " "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-1875162379-3804078649-638427191-1000"
        3⤵
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:252
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\Momdm.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1492
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\Moser.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5660
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motccgp.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5888
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motmodem.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3040
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motodrv.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5452
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motousbnet.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2348
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motport.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1444
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motusbdevice.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2568
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motusbser.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5156
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /PATH "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver" /SW /F /SA /SE /LM
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:260
        • C:\Windows\SysWOW64\CMD.exe
          CMD.exe /D /A /C RMDIR C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0 /S /Q
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:4908
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2496
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3700
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5008
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5460
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5960
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3864
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1788
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bfc41a05-c096-e543-a5a0-b57cb94f7e26}\momdm.inf" "9" "4afc847db" "0000000000000160" "WinSta0\Default" "0000000000000164" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:380
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b47dfc7b-a9f0-e446-9bde-9d49d6e1f8a6}\moser.inf" "9" "4f865e8b7" "000000000000018C" "WinSta0\Default" "0000000000000188" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3576
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3d1ac748-eecb-3c46-8d78-7a4e35b61aee}\motccgp.inf" "9" "46ddf057b" "0000000000000188" "WinSta0\Default" "0000000000000190" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:6116
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{eac5fa66-cf1b-4441-aac6-0ad64f68e270}\motmodem.inf" "9" "4338675c3" "0000000000000188" "WinSta0\Default" "0000000000000190" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:1600
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{79e04dec-4d4c-3840-b719-5e9148733c51}\motodrv.inf" "9" "4da09a283" "0000000000000190" "WinSta0\Default" "0000000000000178" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1588
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8bc6945c-f9bd-9746-b2be-769b2aa79c61}\motousbnet.inf" "9" "4cb309793" "0000000000000178" "WinSta0\Default" "0000000000000194" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:5544
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f7541719-76a7-d74c-bd1e-bd007662dd88}\motport.inf" "9" "4029cdaf3" "0000000000000194" "WinSta0\Default" "000000000000019C" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:5052
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ac8d44f0-1cb1-164f-abc5-6b318f35338e}\motusbdevice.inf" "9" "4c63360e3" "000000000000019C" "WinSta0\Default" "0000000000000190" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:1908
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6b52b649-7035-b14b-930d-8f3e72bfdad3}\motusbser.inf" "9" "45b11c1af" "0000000000000190" "WinSta0\Default" "00000000000001A4" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:1308

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Modify Registry

        3
        T1112

        Subvert Trust Controls

        2
        T1553

        Install Root Certificate

        1
        T1553.004

        SIP and Trust Provider Hijacking

        1
        T1553.003

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe 
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_02d6215f8e7b4c5e5929bdea73824deb_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe 
        • Size 5.1MB
        • SHA256 251946d9ed21d9220dd9d47b05b4639e6bdf2e1364c329f31ff6434b54e2b78c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Chimera.ico
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Chimera.ico
        • Size 32KB
        • SHA256 9216a46311c9375b1bfaf86b89b1b93998dd0404ee6b15a62c7a62983af63d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Momdm.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\Momdm.inf
        • Size 43KB
        • SHA256 0646feaae0d978ebe68a278708d0d0691d89da94f194d0567ea8be1ec7a26118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Moser.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\Moser.inf
        • Size 1KB
        • SHA256 1ac3e6ac8a9fd170a24fec86fb55b8e8d228b23cc4a7cc620b2f99c8c5662d37
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motccgp.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motccgp.inf
        • Size 24KB
        • SHA256 bc731c471b4801e06fb9e41d4b6bc706f44861589350990978c761588237e6ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motmodem.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motmodem.inf
        • Size 68KB
        • SHA256 23f9486ca35caeb546f75b7cf151e28cd64c8dd75385fb6fb976822da7653caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motodrv.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motodrv.inf
        • Size 118KB
        • SHA256 e56fc4c097d0b150b19baa876486a71a562e7e68d146d04ea3cfd59831ae934e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motousbnet.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motousbnet.inf
        • Size 32KB
        • SHA256 2dc1f174521bb18126d9eed14c4a3a2e5a8cc555db6a6a50f5eeb41bebdc78b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motport.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motport.inf
        • Size 17KB
        • SHA256 50ba3ed7c09570bdfc95d3ef581bfc3496b0bbb6b2b9bb988b4897ef75c68a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motusbdevice.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motusbdevice.inf
        • Size 6KB
        • SHA256 c0fc3d0ff13d3bccede79360d920c61b8271316ba1cea14e2f7fe5422871c15a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motusbser.inf
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Driver\motusbser.inf
        • Size 2KB
        • SHA256 e0d7cbb52d9a6cef7d89b31b43dc851ea453487aeb516590366a802d6a334c32
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dpinst64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
        • Size 1022KB
        • SHA256 11ec2ba6a62b443457424ae93cc66382d630d488147dafcfc16b7876bedc2db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        irsetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
        • Size 1.3MB
        • SHA256 748d48d246526e2a79edcde87255ffa5387e3bcc94f6ca5e59589e07e683cd80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lua5.1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
        • Size 326KB
        • SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 5KB
        • SHA256 023484f818d85fa162b4c31ac8fa3604103bc2923ab57fd4011fa9f868bb9e98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 6KB
        • SHA256 50b74305caf464c0868e7847746b61ca6878bba3181f11d4822a46514e0a12ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 10KB
        • SHA256 b6534c8759de816d2a7d584e8d0fcac488293e117f568c763186abc7444def4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 12KB
        • SHA256 ab244c810199778a67681e20beefacec116fb8336ec1023386a8218738769c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 15KB
        • SHA256 8098fa5d793b60c3143428ce502762cbae6dbe87d9ff02cfb2e0fd6bc127f482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 15KB
        • SHA256 ab9a59664f3ac69ec30a3222a38ebc92f82b1d66d774717089306c04a30969cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 17KB
        • SHA256 c10b2815dfbaf7d986eaf44e35ea34f9b1a61623b8146d266b47deaaec583282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 20KB
        • SHA256 68389b36ef87498541e968aae632827111718fecf525e59ef9fea1e8e2d88542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 23KB
        • SHA256 4cfe7c43326cb5b3e696ebd6e7c6819c549262833eb1d8cb1a15341a97616307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DPINST.LOG
        • Path C:\Windows\DPINST.LOG
        • Size 27KB
        • SHA256 96eafa16843c2ceb2d9be0867cf3b6525452079ff59ee5bf0b1674f8ae6cd3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        explorer.exe
        • Path C:\Windows\Resources\Themes\explorer.exe
        • Size 135KB
        • SHA256 4ae44472316b82b7e0e114901fc521cc38637598fa8c8e84c521f5f6d70677c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 b72e83db087e53ff51efe495a0262e68e23e9aaa5693c9a6d42449466d60e2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spoolsv.exe
        • Path C:\Windows\Resources\spoolsv.exe
        • Size 135KB
        • SHA256 43dab671d4caf49179577d4ffbc698341083b8a8e7af21c3c85a445c6496452f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Windows\Resources\svchost.exe
        • Size 135KB
        • SHA256 9a64941f50307f97e3e696a326e7adc5d3107ff44768883e5c6e7e3dc8ac5b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 f25e17d5083db9ea7ff87c9053781d04068641d35a8e173c085de184daddc6f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 8830bc9f1be4b3ab7e29dc84e4e87f5ecbc69c5efb5551b5546c209d3965ab9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 8419cfe8d49099397adff47b6bb4f386a56ee7ed67e9948e3c51ed3e5442c909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 9dba48e982730afeace2bb6d3a0d90d98994bf2c509420ee7b5f098a78f081cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 e88d8ed7ca8f085508157b299adf0adaeafc8e5bee395985d4b2699b7f0ebc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 e633a10f0ffab84902dac182d63e0dfb8d006c48d52bdf5f3deb77514bd35e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 fb36e0dbaa85bf248475a6795809860f18e66e627c7ce846170e934cfc29183d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 081576bb3770e1ca2bc65003a251e5ea1c47c3140d7fad93a59ca6c93a1718c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        momdm.inf_amd64_cc4485dc10ab041c.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\momdm.inf_amd64_cc4485dc10ab041c.ini
        • Size 415B
        • SHA256 a1a724dac361999d8ae0bc03be6dc185f5bf7c00c12ecaf7642bed77bb1d0d1a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        moser.inf_amd64_7ecca89b25541f2b.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\moser.inf_amd64_7ecca89b25541f2b.ini
        • Size 414B
        • SHA256 a8659dce56008cedbeabb4fbd63f03f16637e74504662ae23542f0542e7079ab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motccgp.inf_amd64_4b9727324084cb64.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motccgp.inf_amd64_4b9727324084cb64.ini
        • Size 656B
        • SHA256 262dde6002c6e9dca54b8e3a3b856472a1165cc07a15453b8a0dbec0f9732600
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motmodem.inf_amd64_cc78f7b2526c19d3.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motmodem.inf_amd64_cc78f7b2526c19d3.ini
        • Size 548B
        • SHA256 6f3c5a3479376665e5ed64cc54a25b9cbf39a514675148f327cc1c85eee30cec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motodrv.inf_amd64_a0be672cd3e62c3d.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motodrv.inf_amd64_a0be672cd3e62c3d.ini
        • Size 531B
        • SHA256 7c52de5b0b6fb1fea50c5a809f142be8baf9b34d848e8a2a0de5ed79de2895d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motousbnet.inf_amd64_e80608a5b8dfcfa0.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motousbnet.inf_amd64_e80608a5b8dfcfa0.ini
        • Size 780B
        • SHA256 08d652e1aeccbce2a408fd58310e65bd36a60e27858c3a143b5efdc23a03dbd4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motport.inf_amd64_60e0efb433e6dc9e.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motport.inf_amd64_60e0efb433e6dc9e.ini
        • Size 544B
        • SHA256 ffd8ae29541c2a01ad0de795f58c0b8c6f5f84df10ee137db02f3fbc624e848b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motusbdevice.inf_amd64_8c34512a56a7136d.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motusbdevice.inf_amd64_8c34512a56a7136d.ini
        • Size 563B
        • SHA256 46c713374e5445f27be25c83e9e2fb01a6bb39494aed65193d7f2c68f3cb034a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        motusbser.inf_amd64_5e8b9b5aea1768ec.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\motusbser.inf_amd64_5e8b9b5aea1768ec.ini
        • Size 309B
        • SHA256 0a3f6949e96574af43ed605ca85191636f343b5e785ab3c52cf2af0910e74d54
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\catroot2\dberr.txt
        • Size 64KB
        • SHA256 3e594fe7c99e654813ea9d299b9f5d68cbb0e3b2b847da30881e410ef9597e07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Mousbser.cat
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\Mousbser.cat
        • Size 7KB
        • SHA256 a4fb92ce46fb3b79d74969c35139e0ce7c1e0c2dca4f8eb6c77c784b15487925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Mousbser.sys
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\Mousbser.sys
        • Size 115KB
        • SHA256 8ea4401f8e049614dd2cb1e3f81d793fff71e5e9dd9b783fbce10ec3696cf638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mot_ci.dll
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\mot_ci.dll
        • Size 15KB
        • SHA256 b593647368ea2eaee005c26c22349131a3d37462959691d03944d31fa623123f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motccgp.cat
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motccgp.cat
        • Size 91KB
        • SHA256 a7f215c49afedcabcb2795bd6b8bab2d4c5384e6bdf0360c29862ce1b2f12fea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motccgp.sys
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motccgp.sys
        • Size 23KB
        • SHA256 cdc044f2fdad3b22b295528a117d93b7df464de63e421dae9c19e7a1535e3743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motmodem.cat
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motmodem.cat
        • Size 91KB
        • SHA256 0de9bc282c58a79ab681b5a93683009259ca9048f50745684a5f01346bc89193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motmodem.sys
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motmodem.sys
        • Size 31KB
        • SHA256 deb564c5079ec13042b24c5338263c82567648559549dff654ba2a1fdd14473b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motodrv.cat
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motodrv.cat
        • Size 140KB
        • SHA256 1e900ec10bd3d05270b5ba40e8c2ea07b52a78a9c23337dca8a028b02695f76b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motodrv.sys
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motodrv.sys
        • Size 52KB
        • SHA256 9e4ee267bf70fe0a43a1b994546186fd5ed6e384a7b8f905dfa81617dbef9ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        motswch.sys
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\motswch.sys
        • Size 8KB
        • SHA256 2ea39f23c49191a4651cd785a742554801a4ac59aace1993b3a30ea137b4a321
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wdfcoinstaller01009.dll
        • Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\driver\wdfcoinstaller01009.dll
        • Size 1.6MB
        • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/252-53-0x0000000000070000-0x0000000000458000-memory.dmp
        Download

        memory/252-147-0x0000000000070000-0x0000000000458000-memory.dmp
        Download

        memory/252-312-0x0000000000070000-0x0000000000458000-memory.dmp
        Download

        memory/2496-61-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/3212-62-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/3212-0-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/3700-313-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/5008-60-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/5460-314-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/5960-59-0x0000000000400000-0x000000000041F000-memory.dmp
        Download