salatstealer | 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT7).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
MD5 a8efa3ed6068b339fd86951c80e84c2f
SHA1 19b7620ecab1c14492f9576defcecadb6589edf5
SHA512 3aba9edd1a5369486b647d60c003bf098d9d45decc76c9a251543934e5ceaae3966c52d6af562a6c733177212d7c5e32534dcd8207d1e1975a8cadaacf3f3f8d
TLSH
T1CD513793F00DDE46B68EA83EFC9AA5F52017C8C35CD6D462539789E8C84EDBE4D4E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral26/files/0x000700000002440b-7414.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
53	4392	powershell.exe
54	4392	powershell.exe
55	4392	powershell.exe
56	4392	powershell.exe
57	4392	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2752	Setup-TaasfKQdEtTesVxb.exe
1892	Setup-TaasfKQdEtTesVxb.exe
1712	agent_kppynYKV.exe
540	agent_pPFkTuUy.exe
2928	Setup-TaasfKQdEtTesVxb.exe
4832	agent_TJGKGvIr.exe
1756	services.exe
4404	Setup-TaasfKQdEtTesVxb.exe
2144	agent_pzkOZbVk.exe
2008	services.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4280	certutil.exe
4496	certutil.exe
3192	certutil.exe
3348	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\services.exe	services.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_TJGKGvIr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_pzkOZbVk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_kppynYKV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_pPFkTuUy.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1712	agent_kppynYKV.exe
1712	agent_kppynYKV.exe
1712	agent_kppynYKV.exe
1712	agent_kppynYKV.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
4392	powershell.exe
4392	powershell.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe
1756	services.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	720	winws.exe
Token: SeBackupPrivilege	720	winws.exe
Token: SeDebugPrivilege	720	winws.exe
Token: SeDebugPrivilege	4392	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4976	4600	cmd.exe	89
PID 4600 wrote to memory of 4280	4600	cmd.exe	96
PID 4600 wrote to memory of 2752	4600	cmd.exe	97
PID 4600 wrote to memory of 4496	4600	cmd.exe	101
PID 4600 wrote to memory of 1892	4600	cmd.exe	102
PID 2752 wrote to memory of 1712	2752	Setup-TaasfKQdEtTesVxb.exe	103
PID 1892 wrote to memory of 540	1892	Setup-TaasfKQdEtTesVxb.exe	105
PID 4600 wrote to memory of 3192	4600	cmd.exe	106
PID 4600 wrote to memory of 2928	4600	cmd.exe	107
PID 2928 wrote to memory of 4832	2928	Setup-TaasfKQdEtTesVxb.exe	110
PID 1712 wrote to memory of 1756	1712	agent_kppynYKV.exe	112
PID 4600 wrote to memory of 3348	4600	cmd.exe	113
PID 4600 wrote to memory of 4404	4600	cmd.exe	115
PID 4600 wrote to memory of 720	4600	cmd.exe	116
PID 4404 wrote to memory of 2144	4404	Setup-TaasfKQdEtTesVxb.exe	118
PID 1756 wrote to memory of 4392	1756	services.exe	119
PID 1756 wrote to memory of 2008	1756	services.exe	121
PID 4392 wrote to memory of 6136	4392	powershell.exe	124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT7).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4976
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Roaming\RevokeGet\agent_kppynYKV.exe
    C:\Users\Admin\AppData\Roaming\RevokeGet\agent_kppynYKV.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Adobe\services.exe
      C:\Users\Admin\AppData\Local\Adobe\services.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4392
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6136
    - - C:\Program Files\Google\Chrome\Application\services.exe
        
        "C:\Program Files\Google\Chrome\Application\services.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2008
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Users\Admin\AppData\Roaming\CompressAssert\agent_pPFkTuUy.exe
    C:\Users\Admin\AppData\Roaming\CompressAssert\agent_pPFkTuUy.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:540
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Roaming\WaitTrace\agent_TJGKGvIr.exe
    C:\Users\Admin\AppData\Roaming\WaitTrace\agent_TJGKGvIr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4832
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Users\Admin\AppData\Roaming\RedoDisable\agent_pzkOZbVk.exe
    C:\Users\Admin\AppData\Roaming\RedoDisable\agent_pzkOZbVk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2144
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=syndata --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=syndata --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 c6ae37219d87205624358e5439c00d8eb33d0d5ab9ba70aecbe157f4789671e5
MD5 b6c993e9fad6ede6c624c32ce764c2fd
SHA1 767465a58371c84f6ab3423ef84b360479ff2c3a
SHA512 89aca08de20d4b5278644c745cdd98c44b01429eba1ca1c108f5de77095b4f9c71bcf53a3ed4999e3ea996ef7126e9b546d15d631048949d03452dcff93e7e85
SSDEEP 384:UziORGCaDtKVytlyq2cTc73ri6Na6ZQTtCVG56vjkyP:WiGG9tqy/J2cTYDn6TkXr3P
TLSH
T1A192F8380AF770BD76BC7D4579100E9D8DAC1A0A5876434B13CA31F6B66C5DCCE28A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.0MB
SHA256 47901bea276346482089311f45fbbc77e011b13fb48729bab2c9743f91f4eb53
MD5 987f6f8c9dde2123e51152edbdf49868
SHA1 492b9ab0aee2a9f8787a9e28169d3d7ec412212d
SHA512 a313fae37e1a9ba026d3724176a476b10b6159a34c1c92f2635e145faf3fa833326a551814d6b072c7685749ecc848f710c81f3273f91187a32771360c4d7be5
SSDEEP 49152:Nr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHnZ:U
TLSH
T132E6BF320643FDBD3FAD3D45E0012E455D9D7A1B62A89249FB8930BA63ED5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 12.2MB
SHA256 4684818afc12fe880fc3c23db3743e073d2b71723aeecdb35c26f852e212e5a3
MD5 6e15e0141bb80722b4e5c1ab551e473d
SHA1 b8cc719d5918e457c95772ac5ee24680c7eccd76
SHA512 3ebf5f04708dc598dfab6e803358ca3e8b05883addec6aa502a1073220ca1f19d8a2740e81af8cbcfbfbecc63872a761c77c0eae713097d86a371c0aedfd8489
SSDEEP 49152:yOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaK:d
TLSH
T147D6CF320243FDAD3F6A2D45D0053E411D9D7A1B62A8D299FF8D30BA62EA564DE3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 25be81cd70d97436bb96460c23c3333bc6b0d7986778ff752eee29e6aaec59d2
MD5 7e5ac2ad00c89e818a413bbedc609e98
SHA1 d981fdb657ed346a8681c76aaaf2bfe8204f8fee
SHA512 22b0884eff4ca3739c95086df48eabaa25a672b6d4a5581e222ced567069946504206ed9091829b952e5ea556315128d32b4da3adba889f39d055d0abc499090
SSDEEP 384:1TdihxTOJA8CNnLTnDMmkKl6+opr1JV8auZvqTepAl/k:1TdolOK8sXnwGSJV8amvqSpAG
TLSH
T13392C776022FB4BD342C7C4959135E4E1E4E670D227F970AA785707E93AA4E48F08F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 4a8fb71982eafb5634fb6d12ca91e24ff428ec058e0c7c97e0401609a67db50a
MD5 8dfae67c57c6a2a153b398512c29bfec
SHA1 65557876b2d9a631de4394d0fa54dedd331717d7
SHA512 583cd0982f2ab852d63443040a5c5efad56f25fe48379812a35607a6a10bca6d7fac934a31889c65d80a2c3d67c46e170723f20af754f445e60ebdd774eb0d88
SSDEEP 384:KKrFXKF/eap3aG+OuejacLFx32YgajNMrhkZkwgDpWKiHWvdw:KUKMao1peVpV2YHX/gD0nHW1w
TLSH
T18992D6380AE778BC39BC7D9261621E4C5D5D1B095566030B27C531BAB3BD8EC8E16E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 12.9MB
SHA256 14bb369d407b0f204b50a4545363a61ee2b35c6313901568f25725bf81494644
MD5 8cf9b5f2f31734d41b07d063af77a16d
SHA1 25c38eed4cbaae05a2ded4817cce7c95822b575c
SHA512 0a3b8032afa306f80537ee3b3087ece03c13b92ec257fa300149875096bc77c77b534f3dbce6a64931456b2c27508decd3e0526731fae8a8f4e2182cb18f13ee
SSDEEP 49152:OmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6Cp:b
TLSH
T192D6CF320243FDBD3FAD2D45E0052D451D9D7A1B62A8D299FB8930BA63EA564CE3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ebh1wjeb.hrz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ebh1wjeb.hrz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_kppynYKV.exe

Path C:\Users\Admin\AppData\Roaming\RevokeGet\agent_kppynYKV.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-13855-0x00007FFBF7000000-0x00007FFBF7302000-memory.dmp

Download

memory/720-13856-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/720-13858-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/720-13859-0x00007FFBF7000000-0x00007FFBF7302000-memory.dmp

Download

memory/4392-13885-0x0000000007EE0000-0x000000000855A000-memory.dmp

Download

memory/4392-13888-0x0000000070990000-0x00000000709DC000-memory.dmp

Download

memory/4392-13872-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/4392-13871-0x0000000005730000-0x0000000005796000-memory.dmp

Download

memory/4392-13878-0x0000000006020000-0x0000000006374000-memory.dmp

Download

memory/4392-13869-0x00000000057C0000-0x0000000005DE8000-memory.dmp

Download

memory/4392-13881-0x00000000066D0000-0x00000000066EE000-memory.dmp

Download

memory/4392-13882-0x0000000006700000-0x000000000674C000-memory.dmp

Download

memory/4392-13883-0x0000000006C50000-0x0000000006C94000-memory.dmp

Download

memory/4392-13884-0x00000000077E0000-0x0000000007856000-memory.dmp

Download

memory/4392-13886-0x0000000007880000-0x000000000789A000-memory.dmp

Download

memory/4392-13868-0x0000000002D50000-0x0000000002D86000-memory.dmp

Download

memory/4392-13887-0x0000000007C50000-0x0000000007C82000-memory.dmp

Download

memory/4392-13870-0x0000000005690000-0x00000000056B2000-memory.dmp

Download

memory/4392-13889-0x0000000071110000-0x0000000071464000-memory.dmp

Download

memory/4392-13897-0x0000000007C90000-0x0000000007CAE000-memory.dmp

Download

memory/4392-13898-0x0000000007CB0000-0x0000000007D53000-memory.dmp

Download

memory/4392-13899-0x0000000007DB0000-0x0000000007DBA000-memory.dmp

Download

memory/4392-13900-0x0000000008560000-0x00000000085F6000-memory.dmp

Download

memory/4392-13901-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

Download

memory/4392-13902-0x0000000007E10000-0x0000000007E1E000-memory.dmp

Download

memory/4392-13903-0x0000000007E20000-0x0000000007E34000-memory.dmp

Download

memory/4392-13904-0x0000000007E80000-0x0000000007E9A000-memory.dmp

Download

memory/4392-13905-0x0000000007E50000-0x0000000007E58000-memory.dmp

Download

memory/4392-13910-0x0000000007E80000-0x0000000007EA2000-memory.dmp

Download

memory/4392-13911-0x0000000008BB0000-0x0000000009154000-memory.dmp

Download