salatstealer | 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT9).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
MD5 4d6ced8c4790b06aba64d176a2ba5e9a
SHA1 4ea98386b069cc339e301da4ce8c777a81fb0111
SHA512 71a6234afd9e08d6999d90b765bba7781063a8e76fee8e8793be0a17b31e4bcea4342da6e4eefd4e7e42ce1edf39d9c1c58120af79e56b45d8337ec8b082c099
TLSH
T170616A93E00DDF46B48D6C7EF89BA5B52017C8872CD6D852539789F8C44EDAE5C4F085
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 11 IoCs

resource	yara_rule
behavioral30/files/0x000200000001ee0e-6877.dat	family_salatstealer
behavioral30/memory/4476-12281-0x0000000000830000-0x0000000001487000-memory.dmp	family_salatstealer
behavioral30/memory/4476-12282-0x0000000000830000-0x0000000001487000-memory.dmp	family_salatstealer
behavioral30/memory/4476-12287-0x0000000000830000-0x0000000001487000-memory.dmp	family_salatstealer
behavioral30/memory/2336-12290-0x00000000001C0000-0x0000000000E17000-memory.dmp	family_salatstealer
behavioral30/memory/2336-12291-0x00000000001C0000-0x0000000000E17000-memory.dmp	family_salatstealer
behavioral30/memory/2336-12292-0x00000000001C0000-0x0000000000E17000-memory.dmp	family_salatstealer
behavioral30/memory/836-12308-0x00000000007E0000-0x0000000001437000-memory.dmp	family_salatstealer
behavioral30/memory/176-12328-0x0000000000150000-0x0000000000DA7000-memory.dmp	family_salatstealer
behavioral30/memory/2336-12342-0x00000000001C0000-0x0000000000E17000-memory.dmp	family_salatstealer
behavioral30/memory/2336-12368-0x00000000001C0000-0x0000000000E17000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
73	2616	powershell.exe
74	2616	powershell.exe
75	2616	powershell.exe
76	2616	powershell.exe
77	2616	powershell.exe
106	3248	powershell.exe
107	3248	powershell.exe
108	3248	powershell.exe
109	3248	powershell.exe
110	3248	powershell.exe
112	3248	powershell.exe
113	3248	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
113	3248	powershell.exe

Executes dropped EXE 18 IoCs

pid	Process
2084	Setup-TaasfKQdEtTesVxb.exe
3672	agent_lTboUyJc.exe
3568	Setup-TaasfKQdEtTesVxb.exe
2180	agent_LUivChBg.exe
3572	Setup-TaasfKQdEtTesVxb.exe
1848	fontdrvhost.exe
3876	Setup-TaasfKQdEtTesVxb.exe
1692	agent_QDUzGCxN.exe
520	agent_kPVSbBXc.exe
2376	fontdrvhost.exe
3404	fontdrvhost.exe
4476	agent_rNTfoiwy.exe
2336	TiWorker.exe
836	TiWorker.exe
176	TiWorker.exe
5012	Host.exe
5060	svhost.exe
1404	ExtExport.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
932	certutil.exe
1976	certutil.exe
456	certutil.exe
4556	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral30/files/0x000300000001e05a-12277.dat	upx
behavioral30/memory/4476-12279-0x0000000000830000-0x0000000001487000-memory.dmp	upx
behavioral30/memory/4476-12281-0x0000000000830000-0x0000000001487000-memory.dmp	upx
behavioral30/memory/4476-12282-0x0000000000830000-0x0000000001487000-memory.dmp	upx
behavioral30/memory/4476-12287-0x0000000000830000-0x0000000001487000-memory.dmp	upx
behavioral30/memory/2336-12289-0x00000000001C0000-0x0000000000E17000-memory.dmp	upx
behavioral30/memory/2336-12290-0x00000000001C0000-0x0000000000E17000-memory.dmp	upx
behavioral30/memory/2336-12291-0x00000000001C0000-0x0000000000E17000-memory.dmp	upx
behavioral30/memory/2336-12292-0x00000000001C0000-0x0000000000E17000-memory.dmp	upx
behavioral30/memory/836-12298-0x00000000007E0000-0x0000000001437000-memory.dmp	upx
behavioral30/memory/836-12308-0x00000000007E0000-0x0000000001437000-memory.dmp	upx
behavioral30/memory/176-12327-0x0000000000150000-0x0000000000DA7000-memory.dmp	upx
behavioral30/memory/176-12328-0x0000000000150000-0x0000000000DA7000-memory.dmp	upx
behavioral30/memory/2336-12342-0x00000000001C0000-0x0000000000E17000-memory.dmp	upx
behavioral30/memory/2336-12368-0x00000000001C0000-0x0000000000E17000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\7e8b3975-a9c3-e138-ef93-29cf3a4175a9	agent_rNTfoiwy.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\explorer.exe	agent_rNTfoiwy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\TiWorker.exe	TiWorker.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\TiWorker.exe	TiWorker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\27298a85-31c1-eeba-011f-bd1d10ae8531	agent_lTboUyJc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\fontdrvhost.exe	fontdrvhost.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\ExtExport.exe	svhost.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\27298a85-31c1-eeba-011f-bd1d10ae8531	agent_lTboUyJc.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\TiWorker.exe	agent_lTboUyJc.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe	agent_lTboUyJc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe	fontdrvhost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3328	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Setup-TaasfKQdEtTesVxb.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_lTboUyJc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_QDUzGCxN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_rNTfoiwy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_LUivChBg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TiWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_kPVSbBXc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TiWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TiWorker.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Setup-TaasfKQdEtTesVxb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3672	agent_lTboUyJc.exe
3672	agent_lTboUyJc.exe
3672	agent_lTboUyJc.exe
3672	agent_lTboUyJc.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
2616	powershell.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
2616	powershell.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
1848	fontdrvhost.exe
4476	agent_rNTfoiwy.exe
4476	agent_rNTfoiwy.exe
4476	agent_rNTfoiwy.exe
4476	agent_rNTfoiwy.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
3248	powershell.exe
3248	powershell.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe
2336	TiWorker.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2940	winws.exe
Token: SeBackupPrivilege	2940	winws.exe
Token: SeDebugPrivilege	2940	winws.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2268	3328	cmd.exe	85
PID 3328 wrote to memory of 456	3328	cmd.exe	89
PID 3328 wrote to memory of 2084	3328	cmd.exe	90
PID 2084 wrote to memory of 3672	2084	Setup-TaasfKQdEtTesVxb.exe	93
PID 3328 wrote to memory of 4556	3328	cmd.exe	94
PID 3328 wrote to memory of 3568	3328	cmd.exe	97
PID 3568 wrote to memory of 2180	3568	Setup-TaasfKQdEtTesVxb.exe	99
PID 3328 wrote to memory of 932	3328	cmd.exe	107
PID 3328 wrote to memory of 3572	3328	cmd.exe	108
PID 3672 wrote to memory of 1848	3672	agent_lTboUyJc.exe	113
PID 3328 wrote to memory of 1976	3328	cmd.exe	115
PID 3328 wrote to memory of 3876	3328	cmd.exe	116
PID 3328 wrote to memory of 2940	3328	cmd.exe	117
PID 3572 wrote to memory of 1692	3572	Setup-TaasfKQdEtTesVxb.exe	119
PID 3876 wrote to memory of 520	3876	Setup-TaasfKQdEtTesVxb.exe	120
PID 1848 wrote to memory of 2616	1848	fontdrvhost.exe	122
PID 1848 wrote to memory of 2376	1848	fontdrvhost.exe	124
PID 1848 wrote to memory of 3404	1848	fontdrvhost.exe	126
PID 2616 wrote to memory of 3332	2616	powershell.exe	130
PID 2084 wrote to memory of 4476	2084	Setup-TaasfKQdEtTesVxb.exe	133
PID 4476 wrote to memory of 2336	4476	agent_rNTfoiwy.exe	136
PID 2336 wrote to memory of 3248	2336	TiWorker.exe	138
PID 2336 wrote to memory of 836	2336	TiWorker.exe	140
PID 2336 wrote to memory of 176	2336	TiWorker.exe	142
PID 3248 wrote to memory of 3836	3248	powershell.exe	145
PID 3248 wrote to memory of 5012	3248	powershell.exe	147
PID 3248 wrote to memory of 5060	3248	powershell.exe	148
PID 5060 wrote to memory of 1404	5060	svhost.exe	149

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT9).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2268
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:456
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Roaming\Mozilla\agent_lTboUyJc.exe
    C:\Users\Admin\AppData\Roaming\Mozilla\agent_lTboUyJc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe
      "C:\Program Files (x86)\Windows Sidebar\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2376
    - - C:\Program Files\Google\Chrome\Application\fontdrvhost.exe
        
        "C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3404
- - C:\Users\Admin\AppData\Roaming\UnlockSuspend\agent_rNTfoiwy.exe
    C:\Users\Admin\AppData\Roaming\UnlockSuspend\agent_rNTfoiwy.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\TiWorker.exe
      C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\TiWorker.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3248
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Host.exe"
        6⤵
        Executes dropped EXE
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\svhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Program Files\Windows Multimedia Platform\ExtExport.exe
        
        "C:\Program Files\Windows Multimedia Platform\ExtExport.exe"
        7⤵
        Executes dropped EXE
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\TiWorker.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\TiWorker.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:836
    - - C:\Program Files\Google\Chrome\Application\TiWorker.exe
        
        "C:\Program Files\Google\Chrome\Application\TiWorker.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:176
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Users\Admin\AppData\Roaming\ReceivePop\agent_LUivChBg.exe
    C:\Users\Admin\AppData\Roaming\ReceivePop\agent_LUivChBg.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2180
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:932
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Users\Admin\AppData\Roaming\PublishOut\agent_QDUzGCxN.exe
    C:\Users\Admin\AppData\Roaming\PublishOut\agent_QDUzGCxN.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1692
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Roaming\ReceivePop\agent_kPVSbBXc.exe
    C:\Users\Admin\AppData\Roaming\ReceivePop\agent_kPVSbBXc.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:520
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts,md5sig --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 a2713765a423c4127e825d5c850f69325e6f6fc3aa9a6d24930bf55bb0c3fe7b
MD5 8b570ab506bf67f280a15aa8ea5c9645
SHA1 30fe1b55ce9b7f87dceea9777d7a3ae91077fa8b
SHA512 11fb7ee1470ff9008bdc793ffc2b683dc25a266f34e2c5060a4f429dde6e010b14c8fec5e46347cdf4de115870e3fa5f1cd1a31174bfc779341bd963c678aa05
TLSH
T196518E303161A9D84D435F1205286ED5A3EF478AAFAC9F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 1a0d07cdcb614e4410aba4d4b83a610af755583f739fbbad56e46e8b14c71ab0
MD5 6fc23b9212e34feb6d29c61e047a9594
SHA1 457b5cb2e09bd1b14914130a48e8778f4e8ae620
SHA512 108197662420369d5cddf7cbf56018c080d12ea05e2c026305d65013cd0cc6736ff55adc9e44a91179b3d7cf14e34ceac61651e129916a9ef0e1c226024e75e4
SSDEEP 384:Msf+hFak9i+qG3+MZi7k+qoTTHbK6seYbne6x/xozLYbLU0GP5ot9KtwA/9JIgIe:pfAEQ/JRoTTHbN+nFkY/X2ot9mjIe
TLSH
T18EA2F75E618F16C3C4861378D10A041FE4F29E8D431A2BD8BB2F8F7B4AAC67F6179548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

373370261

Path C:\Users\Admin\AppData\Local\Temp\373370261
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Local\Temp\Host.exe
Size 2.6MB
SHA256 038f1f914d23573dd748f6b58c5ffdf2f1fb964147462e1db98355d66817367a
MD5 e4de572f830fa13c574e044c7c07b920
SHA1 8d04c3833e810d1079d0dacd8dbad6beaf121d88
SHA512 39b47e4607dc7b8cfd7bfd70aed969018b0c64d375732e042114ff1bbee397d2cd48bab146e0182591cbeb59a2d74b5274ef4f1fe674cc5c4ecbe1d96a8bed93
SSDEEP 49152:kv+R04d52qB5Fb32Ir37m0oL1kocLHgAew9r71xi9C8e9E7uuhP6Rupm4mhD:kv204TdBTmIrLmnjAHlxi9CpG7dSP4ID
TLSH
T13CC533D639694764D422C8704F98CF131A1E3CF58BE192EF8AEBD4706398AF4C278597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 ff5392c2bfc36f0028fd05f4222f985011e443016845e19991f285660a8a0851
MD5 8551e2a639412e16dc20a8b5b3b02bc6
SHA1 55903e036c90e6369340e5c99d6fba24dfd32c49
SHA512 7502be078b1faf1b185e6b9b335c14d18c7647147ab9ecd62c0999b589d3fa944b79ddbd7451cf83255c2bcec45d49bbde2c9f868ea7f36a36d5a9be210f974e
SSDEEP 384:nGa45t0cGwPdrYLYSZURqcxvRzCwPa4F9KVDgfZ8+sZ4Si8jgS:nh82b8Mm8l4vli5R
TLSH
T15FB2D83985AB747D357C3CA239120D9E4DCD1E2E20351323ABC539B9A75DD9CCE29938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.6MB
SHA256 c711512a5c73c6bfba599d2ee1687470f8328f96dfee2235d1c69c8316f4d5cd
MD5 216a0c21c50edcf4a3fca757881d6858
SHA1 9c2d2e28753697c9e9883f653f5035f0b97c6ea1
SHA512 cf3ec7d4b212b8f1b4b803cf3804b704c91408bda3e5f4c8dc0f780677761f34b14ea87e9d18d7bc4294b81f72adcc19d396f615377a8b8084e54f763708c49c
SSDEEP 49152:KgPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHnead:s
TLSH
T1C5E6BE320243FDBD3FAD3D45E0012D455D9D7A1B62A8D299FB8930BA63E95A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 b41732cca74eb7311f5fa6283096887c4bc25cabbb61475caef645c4ac1b9045
MD5 fe57f9404d83aa57142a6b98a4ebc14b
SHA1 7dd408a5c19e2bc9baf56f572c55ad1dbfdd1a3d
SHA512 9ec03d62e3f0ee63275e232fbf6c1c41c2c5a575552df72bd77fd7c3eef5ab9716be2a0f1752561ebf01b7a579882ae6702f30ddea35a2f3f67ec448b87438f5
SSDEEP 384:RjhTTFNguTj40HMPzXgwwx+DRQ1ffbD6ZpP1e2IOJEhyjnjBDeK9U/fCBGoz4eE1:pt3A0H4zwZxkQVTD0PqwEsjjQK9uCkS2
TLSH
T10A92D04900740DBE00628AB27E9FFD3D635B40098C06B51493A72D54BF91E6F3E69F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 4.1MB
SHA256 e5f26ea1f5f13247a08c8270ef88bef3fe4bbc537b9dd4216a498ca166824b98
MD5 9948ec14011952f7f3b300931a0c3106
SHA1 1b2b5f3e6203f172cf6b5f0b0fc0cf5d3c69af4a
SHA512 e45df4a19ecbf0cb17bfb5ad17206176e0826674f5edda3ae13e1dede4111710ba42655a8dc309d4d94cde74b0f2d32575c7e50ed5b72a106d611ec74a4edea7
SSDEEP 49152:bxhdm727DJi5y3SkSIIGo0subUVLhmXTjdzLooMjsMiAAPCCm:w
TLSH
T1BA162232DF0FED2E766ABB5CE05B2DA61F3F2927D154E08DDA2490B612D9600CD4B874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_li5kpv2t.d3h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_li5kpv2t.d3h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 6.7MB
SHA256 ac0ef032165f08ebf92702b3c401b801e944638c81e979e29473897c69c35dff
MD5 08f7cc298a5c451af370ae2a7759b6da
SHA1 28109b5fd27a45821ff3e264888cd55f6eeb96f0
SHA512 b9229b7f27f54b02166d58e040967457a966d6a41e42b8c6cc9ff50b1eb18ab82823d2deb2d04499f85ccbcb6d19303f941921159010648dc46b716d84e34703
SSDEEP 49152:CcZ0I7oUdU9IhX7sv1vLUflOAKky1p8jGnHO71RJ0yHfUFXqCLOrj5IAcrwL1EK9:CcK+j94iDyq9iyHfC1L21NtyE
TLSH
T137665B07EC9554E9C0AE9134CA729653BF627C884B3123D72B50F6283F76BD0AEB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_lTboUyJc.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\agent_lTboUyJc.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_rNTfoiwy.exe

Path C:\Users\Admin\AppData\Roaming\UnlockSuspend\agent_rNTfoiwy.exe
Size 3.4MB
SHA256 18e4b49fd7e15ca846c6346ce58268ff206974eefde55ef5998a2e9cd3b203e2
MD5 4bcf896b2ce2408e8ac04bba1465a488
SHA1 02d86ea709f605fff40c08ebfffa204de4201736
SHA512 7d7d45441619cb9fcf6e5e3981147b1a721d9da5126ba6902af207782294c3f0f5b0f19342acae2a17d6bfd49f5758d4cfb58b88ca32033a057ed387e3a645e7
SSDEEP 98304:ICaZpkH/byuFxzPj5YYzNxI8/OeL/fTOD:ICaUH/byuzj5YYzNxb3O
TLSH
T116F53311896ECB6FF53674B78B12A42A1D41C25EC36B106DF84908135BE8BF77A734CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 6KB
SHA256 80917c63182934f427852d24009eb45a67b3a6249640b73b9b802ed70c99bfa5
MD5 b9f9df0332fb852acf354a3f8eafb5fd
SHA1 3cbd075cb30932bb72d597d3ed0fa5677c593c38
SHA512 f9979d8fb19aae1474c5714bc6f314e7511b48794847ab5ed7284a337c872a67ec64e414c07eceda47e9027fda564590574406baacd4c6f79e43db2cd9ae3175
SSDEEP 96:FBnBBGBnBSB4BTB4BzB4BWB4BQB4B6B4BzB4B7B4BqtB9B0BidBylBOBFBKDBDBp:FBnBYBnBSB4BTB4BzB4BWB4BQB4B6B4J
TLSH
T18CC10D230E5643F9695AD840E962CA5DDA6372A9170EF4147A3F70E3BB0B30B64FD94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 eb81488d12290599a6e25ded53148f6b97fe7ff3bd3690b5009eccb009189e25
MD5 f79b40edfb44246ee321062b6ea51ca3
SHA1 d79227403dbd5066e98e4d9b0f475e90a95f2d30
SHA512 40262664355a98489ccba3ef4543095fe1e43e8ea80cbfe921284a4b527c428b07431f800f5952178af7a57ec544fc8d7c0ca4739de4d4b240d92784e85d0971
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneLHMwiGdgbnH/:53gbq3gbq3gbY3gbq3gbq3gbH/
TLSH
T11E328129B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 9440895316f8f03c08f6282ec28f35982aec367dbe92aab55b7e5ab7447880ed
MD5 c0deff754a5f465b01dfc360a82e8b7c
SHA1 32ff8bf4907f493b2326184a844647c9deb59f94
SHA512 a02bb9bfc244a88199afd5d80aa91bc24ed75f3969eaa683c91e8dff0808bdc84e159f1827a7fdaff4567c47546ef3fc2d88bd9bb65311f15db71330eb382d4b
SSDEEP 192:53gbq3gbE7ct6/G3gbY3gbq3gbE4444444m3gbEPz:53Iq3IScr3IY3Iq3Iy3Iw
TLSH
T1C4623A39B1942F775C9446E8CFE038C26B809B794116A037A5C5FEABB279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/176-12328-0x0000000000150000-0x0000000000DA7000-memory.dmp

Download

memory/176-12327-0x0000000000150000-0x0000000000DA7000-memory.dmp

Download

memory/836-12308-0x00000000007E0000-0x0000000001437000-memory.dmp

Download

memory/836-12298-0x00000000007E0000-0x0000000001437000-memory.dmp

Download

memory/2336-12342-0x00000000001C0000-0x0000000000E17000-memory.dmp

Download

memory/2336-12368-0x00000000001C0000-0x0000000000E17000-memory.dmp

Download

memory/2336-12292-0x00000000001C0000-0x0000000000E17000-memory.dmp

Download

memory/2336-12291-0x00000000001C0000-0x0000000000E17000-memory.dmp

Download

memory/2336-12290-0x00000000001C0000-0x0000000000E17000-memory.dmp

Download

memory/2336-12289-0x00000000001C0000-0x0000000000E17000-memory.dmp

Download

memory/2616-12229-0x0000000006060000-0x00000000060C6000-memory.dmp

Download

memory/2616-12247-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Download

memory/2616-12261-0x0000000007E90000-0x0000000007F26000-memory.dmp

Download

memory/2616-12262-0x0000000007DF0000-0x0000000007E01000-memory.dmp

Download

memory/2616-12263-0x0000000007E20000-0x0000000007E2E000-memory.dmp

Download

memory/2616-12264-0x0000000007E30000-0x0000000007E44000-memory.dmp

Download

memory/2616-12265-0x0000000007F30000-0x0000000007F4A000-memory.dmp

Download

memory/2616-12266-0x0000000007E60000-0x0000000007E68000-memory.dmp

Download

memory/2616-12271-0x0000000007F60000-0x0000000007F82000-memory.dmp

Download

memory/2616-12272-0x0000000008D20000-0x00000000092C4000-memory.dmp

Download

memory/2616-12259-0x0000000007CC0000-0x0000000007D63000-memory.dmp

Download

memory/2616-12225-0x00000000050F0000-0x0000000005126000-memory.dmp

Download

memory/2616-12226-0x00000000058C0000-0x0000000005EE8000-memory.dmp

Download

memory/2616-12227-0x0000000005710000-0x0000000005732000-memory.dmp

Download

memory/2616-12228-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/2616-12258-0x0000000007CA0000-0x0000000007CBE000-memory.dmp

Download

memory/2616-12250-0x0000000070250000-0x00000000705A4000-memory.dmp

Download

memory/2616-12249-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

Download

memory/2616-12248-0x0000000007C60000-0x0000000007C92000-memory.dmp

Download

memory/2616-12260-0x0000000007DC0000-0x0000000007DCA000-memory.dmp

Download

memory/2616-12246-0x00000000080F0000-0x000000000876A000-memory.dmp

Download

memory/2616-12237-0x00000000060D0000-0x0000000006424000-memory.dmp

Download

memory/2616-12245-0x00000000079F0000-0x0000000007A66000-memory.dmp

Download

memory/2616-12244-0x0000000007830000-0x0000000007874000-memory.dmp

Download

memory/2616-12242-0x00000000066F0000-0x000000000670E000-memory.dmp

Download

memory/2616-12243-0x0000000006730000-0x000000000677C000-memory.dmp

Download

memory/2940-12209-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2940-12211-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2940-12212-0x00007FFDFE6F0000-0x00007FFDFE9F2000-memory.dmp

Download

memory/2940-12208-0x00007FFDFE6F0000-0x00007FFDFE9F2000-memory.dmp

Download

memory/3248-12314-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

Download

memory/3248-12315-0x0000000070000000-0x0000000070354000-memory.dmp

Download

memory/3248-12306-0x0000000005A10000-0x0000000005D64000-memory.dmp

Download

memory/4476-12287-0x0000000000830000-0x0000000001487000-memory.dmp

Download

memory/4476-12282-0x0000000000830000-0x0000000001487000-memory.dmp

Download

memory/4476-12281-0x0000000000830000-0x0000000001487000-memory.dmp

Download

memory/4476-12279-0x0000000000830000-0x0000000001487000-memory.dmp

Download