salatstealer | 0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (FAKE TLS AUTO ALT).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2
MD5 6545370a3d960f825186816b546b2bf2
SHA1 397fcb6722760551b1154c9f77de5ad751760d63
SHA512 de312677efa8c70f2b3d31560e762e85f1cecb3c2b33e1a25f10576ee235edfc4b21d5e825d132acc1784bdb8f91bf8f164b79dd048f869bd6a77c6c5702c6d1
TLSH
T1BE715D93E00DDE47F68D683EFC5FA6A52027C8832CD2C851839B84E8D84EDBE5C4E584
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 4 IoCs

resource	yara_rule
behavioral32/files/0x001500000001daff-7498.dat	family_salatstealer
behavioral32/memory/4900-14342-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral32/memory/4900-14343-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral32/memory/4900-14344-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
79	3220	powershell.exe
80	3220	powershell.exe
81	3220	powershell.exe
85	3220	powershell.exe
86	3220	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
5096	Setup-TaasfKQdEtTesVxb.exe
1388	Setup-TaasfKQdEtTesVxb.exe
4756	agent_tHlHUnqe.exe
896	agent_XDPKlYmv.exe
60	Setup-TaasfKQdEtTesVxb.exe
2720	agent_yoQqszJa.exe
2300	Setup-TaasfKQdEtTesVxb.exe
1204	fontdrvhost.exe
4368	agent_nWnchpCB.exe
3608	fontdrvhost.exe
4192	fontdrvhost.exe
4900	agent_dyPvlVkM.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1944	certutil.exe
1424	certutil.exe
5072	certutil.exe
1780	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral32/files/0x0005000000000731-14339.dat	upx
behavioral32/memory/4900-14341-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral32/memory/4900-14342-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral32/memory/4900-14343-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral32/memory/4900-14344-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral32/files/0x000300000000073f-14348.dat	upx
behavioral32/files/0x000300000000073f-14350.dat	upx
behavioral32/memory/4900-14349-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral32/memory/3056-14351-0x00000000001D0000-0x0000000000E27000-memory.dmp	upx
behavioral32/files/0x000300000000073f-14347.dat	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe	fontdrvhost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\fontdrvhost.exe	fontdrvhost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3768	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Setup-TaasfKQdEtTesVxb.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_XDPKlYmv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_yoQqszJa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_nWnchpCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_dyPvlVkM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_tHlHUnqe.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4756	agent_tHlHUnqe.exe
4756	agent_tHlHUnqe.exe
4756	agent_tHlHUnqe.exe
4756	agent_tHlHUnqe.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
3220	powershell.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
3220	powershell.exe
3220	powershell.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
1204	fontdrvhost.exe
4900	agent_dyPvlVkM.exe
4900	agent_dyPvlVkM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	536	winws.exe
Token: SeBackupPrivilege	536	winws.exe
Token: SeDebugPrivilege	536	winws.exe
Token: SeDebugPrivilege	3220	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4856	3768	cmd.exe	85
PID 3768 wrote to memory of 1944	3768	cmd.exe	91
PID 3768 wrote to memory of 5096	3768	cmd.exe	92
PID 3768 wrote to memory of 1424	3768	cmd.exe	99
PID 3768 wrote to memory of 1388	3768	cmd.exe	100
PID 5096 wrote to memory of 4756	5096	Setup-TaasfKQdEtTesVxb.exe	101
PID 1388 wrote to memory of 896	1388	Setup-TaasfKQdEtTesVxb.exe	106
PID 3768 wrote to memory of 5072	3768	cmd.exe	109
PID 3768 wrote to memory of 60	3768	cmd.exe	110
PID 60 wrote to memory of 2720	60	Setup-TaasfKQdEtTesVxb.exe	112
PID 3768 wrote to memory of 1780	3768	cmd.exe	113
PID 3768 wrote to memory of 2300	3768	cmd.exe	114
PID 3768 wrote to memory of 536	3768	cmd.exe	115
PID 4756 wrote to memory of 1204	4756	agent_tHlHUnqe.exe	117
PID 2300 wrote to memory of 4368	2300	Setup-TaasfKQdEtTesVxb.exe	119
PID 1204 wrote to memory of 3220	1204	fontdrvhost.exe	120
PID 1204 wrote to memory of 3608	1204	fontdrvhost.exe	122
PID 1204 wrote to memory of 4192	1204	fontdrvhost.exe	125
PID 3220 wrote to memory of 1308	3220	powershell.exe	127
PID 1388 wrote to memory of 4900	1388	Setup-TaasfKQdEtTesVxb.exe	131

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (FAKE TLS AUTO ALT).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4856
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Roaming\CompareImport\agent_tHlHUnqe.exe
    C:\Users\Admin\AppData\Roaming\CompareImport\agent_tHlHUnqe.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Users\Admin\AppData\Local\Adobe\fontdrvhost.exe
      C:\Users\Admin\AppData\Local\Adobe\fontdrvhost.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1308
    - - C:\Program Files\Google\Chrome\Application\fontdrvhost.exe
        
        "C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4192
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Users\Admin\AppData\Roaming\HideJoin\agent_XDPKlYmv.exe
    C:\Users\Admin\AppData\Roaming\HideJoin\agent_XDPKlYmv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Users\Admin\AppData\Roaming\DismountUse\agent_dyPvlVkM.exe
    C:\Users\Admin\AppData\Roaming\DismountUse\agent_dyPvlVkM.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4900
  - - C:\Program Files (x86)\Internet Explorer\TiWorker.exe
      "C:\Program Files (x86)\Internet Explorer\TiWorker.exe"
      4⤵
      PID:3056
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Roaming\InitializeMove\agent_yoQqszJa.exe
    C:\Users\Admin\AppData\Roaming\InitializeMove\agent_yoQqszJa.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2720
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_nWnchpCB.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_nWnchpCB.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4368
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TiWorker.exe

Path C:\Program Files (x86)\Internet Explorer\TiWorker.exe
Size 1.9MB
SHA256 156df73804f13cc13384fd76f6472f7dbae99f055c96d89395a973ab5134dae9
MD5 aa2fecc0e3925c0a94b50146e0743f56
SHA1 af8669fe0a68eba8691fc80cd5571bf40db3bf4d
SHA512 6e4c0b8518e29b1e1d00799dee3acdaab1edf318903da7cc8f9457a304cc297e7dc5ae715eca2808ec038f521a5d2ff3d7ad94f27a0fb81dbf3f7e8ca8e10fc8
SSDEEP 49152:kBC27+0pkNXxH0wbMFuFYElNjjqj+xtPjyRU/tjXE:ICaZpkH/byuFxzPj5U
TLSH
T1E89533564D2C8A7EF62E70B6D727188C6D81C20D832B61ACF8490B534BF97B5BE724C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiWorker.exe

Path C:\Program Files (x86)\Internet Explorer\TiWorker.exe
Size 1.7MB
SHA256 893495f19daff62f1c0f5741ba7068009888d555ec9de2417c509f412f9ae648
MD5 6b1c1694e822c9484e48a7cebc2d41e0
SHA1 17cc4ad8420af512976c6ea9dc91a18dc8cb1165
SHA512 e7a885e094de77a5a10f62a43fa0975d650fefdbd610a87cd70325617f58ce4bfc1e0dbd28fc6f95ec0a920c6e4e5b203fc830ec62559d3e5b2083dbe188c79b
SSDEEP 49152:kBC27+0pkNXxH0wbMFuFYElNjjqj+xtPjyRU/tK:ICaZpkH/byuFxzPjk
TLSH
T15A8533565E1C89AFF62E75B2D61624887C80C20D836FA19CF8890B530BF87B6BD715C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiWorker.exe

Path C:\Program Files (x86)\Internet Explorer\TiWorker.exe
Size 1.6MB
SHA256 d9c0c175613d77c28c136f98f1995af51cb9f83f7a1d243b459d58058cd402b8
MD5 01708a53055fbc7cbcaf22247813ded7
SHA1 8eae30b0ab9744b9bf111d59be89c1aa053c6539
SHA512 2c665f5d08a80eb596e58558972037d65590de4bd7923c6c339635a6b01175f3a32af0b02e40efeee6b9e4e1e0395401e91ac5cf7df95d203ebc34918b026b4a
SSDEEP 49152:kBC27+0pkNXxH0wbMFuFYElNjjqj+xtPjyQ:ICaZpkH/byuFxzPjT
TLSH
T1F27533525E1C89BFF76E75B18A6628593C81C20D835FA15CFC860B170BF83B6BDA15C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 3.7MB
SHA256 0789db6f0fa301888bac0920df8be066cd366257e6b7e5959b86490a0ef82db1
MD5 3dce82ff784b172f60fdc85a5d65bd01
SHA1 25592208ef6499f547da2e361bed2ba6da203f1d
SHA512 fa9e08762f0327247a564c7e6ef02aa5ebba3b482c239632b23534f05cc69b08871f58c45074cb85b07b04057e238966ae0a38617cf158146a933bdd996b519c
SSDEEP 24576:/WGFfV1rYAAl7g0YLtIim/hEaK4uJEieJpmWMQSfun4ryHIb04oab:/LJr0gPLhmOcuOJplhxnDTk
TLSH
T154062B3506A778BC39BC3D86B4121D4D5D9D3A0F157A830AB7C534BA63AD4E8CE28E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.3MB
SHA256 31391e040e3263504443ad9399f1cdf8d7c8204efa3789c9afcb59da01803d85
MD5 85ad9dead6c0143cc4630fa5df2891e7
SHA1 831047e4df969e6bffa3f66adb46774383bcbc4f
SHA512 5891900f3b74fc1cef785192bb114e2e5aa239c2cf61a2d3f5572eb968fbb24f1c1717d86476221971aa356a416e746db8d27abc453de8728620f630081a0442
SSDEEP 49152:/LJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwp5:U
TLSH
T15BE6CF320643FDBD3FAD3D85E0012D495D5D7A1B22A89249FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 12.6MB
SHA256 5150199e0a73fa479ef01487b6632af56fde2028760e120c60e6c83c8362a4ee
MD5 1f51b35e34dedffd0f25d675c778a01b
SHA1 77d1a49b6a79116be1cb7ea24756b85952406417
SHA512 52589bee63293ecac0a2f7f85f4446aae1721358a22d2e60d09e6d91c8aaa51b4ca4796d638d7dfdfb40cb9d341d5d1582b6d4d9a84f7d6e1c9af8cca1f2dab5
SSDEEP 49152:ccuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8U:J
TLSH
T1E6D6CF320243FDBD3F6D2D85E0053D451D9D7A1B62A8D299FB8D30BA62EA564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 e09913812424a95767a774796b885be327f8d2a862a709fd990e9588032abe00
MD5 f72e8ffb737c993820e50c0a22d65f65
SHA1 cc3e3861cf63ae74311382e7269a5bc73a246031
SHA512 15586771978b3fe9e295d0781b594692ea9b4c56b873a5fabd9967e4310008985ff4a44c670728afd9e5183637d5a0de4d5e182fcc9ed7415b293c5b3142cdb0
SSDEEP 384:xVyOVYUssvqPfv0cAqsVrCe9kkdwPVkIR:xiU9yxAqsVrXkkdwPVkIR
TLSH
T1A792D7340AEB78BC34AC7D8778220E4C6D5D270D257A570B57C471FAA3AD4ECCA2593A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 d8eccfe1ae6ec6e4a7f865688fe1760856033db69e133417e03679e60859c79e
MD5 47715b1ddc196dbb2f50b7a3bb7d9366
SHA1 e4bede47168a0bd15dbfb2cd4c144c2eb2518819
SHA512 f87aa4dab947035b1b77b568e1e2206babe7ca2e71826dda6250d11afff37d701f81f50227719aa866d43483452524d997707ec963dd92aa3174b4d29462584b
SSDEEP 768:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZGl9+e:lV9utQVN65vt6j6Uam
TLSH
T11DB24C304FE328BD399C7C5175205DEC6D6C2F8B1465030A97C978FAA2985BC8E29C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 1.2MB
SHA256 a7daef8468badcc809f09843d3c7ca1cc8a07f4bc65b6b002edf22cee8c76ba9
MD5 b109ad1829727f13bf768bd73d6ba2b8
SHA1 f3f7bcd8c1c5a8ea3d100111f31011b60fc91544
SHA512 c9cbd093745238761dfa26c878726fc1f59b547f9f257f335291e6fdb0426f9d9463d3e3557047b6948437781926916ab22a73d67b823d58c2d76c3476d536dc
SSDEEP 12288:WB7+vyLEo24shPMavd20WDWm3Iw8Cb5IBy+Gm/imxy:WYAAl7g0YLtIim/hy
TLSH
T17145293906A774BC38BC7D4675120D4D6D9D2B0E157A430767C530BEA3AD8E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.8MB
SHA256 e07cb61c17640835915f4a8916cfda7765f71af9e19014f02dcaa2a4ff8b1274
MD5 0720cf8b49d5d856f77127d7cb589e23
SHA1 e3102037589cb1de4b7e060b9a5051a6d0ecf0b0
SHA512 a203b5a00ffc865c73fa1677558e9dbcdad7e19dbe036966d4f004e3f5fcbf703bef451783333fcbaab6a47acdd92e73111de1c24c7ecbab1e9880ffb9f945e4
SSDEEP 49152:W0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneI:P
TLSH
T1C9E6BE320643FDBD3FAD3D85E0012D455D9D7A1B22A89259FB8930BA63ED5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2dlufss3.fpl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2dlufss3.fpl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_tHlHUnqe.exe

Path C:\Users\Admin\AppData\Roaming\CompareImport\agent_tHlHUnqe.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_dyPvlVkM.exe

Path C:\Users\Admin\AppData\Roaming\DismountUse\agent_dyPvlVkM.exe
Size 3.4MB
SHA256 18e4b49fd7e15ca846c6346ce58268ff206974eefde55ef5998a2e9cd3b203e2
MD5 4bcf896b2ce2408e8ac04bba1465a488
SHA1 02d86ea709f605fff40c08ebfffa204de4201736
SHA512 7d7d45441619cb9fcf6e5e3981147b1a721d9da5126ba6902af207782294c3f0f5b0f19342acae2a17d6bfd49f5758d4cfb58b88ca32033a057ed387e3a645e7
SSDEEP 98304:ICaZpkH/byuFxzPj5YYzNxI8/OeL/fTOD:ICaUH/byuzj5YYzNxb3O
TLSH
T116F53311896ECB6FF53674B78B12A42A1D41C25EC36B106DF84908135BE8BF77A734CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-14267-0x00007FF913E70000-0x00007FF914172000-memory.dmp

Download

memory/536-14271-0x00007FF913E70000-0x00007FF914172000-memory.dmp

Download

memory/536-14270-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/536-14268-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3056-14351-0x00000000001D0000-0x0000000000E27000-memory.dmp

Download

memory/3220-14307-0x0000000007B70000-0x0000000007BE6000-memory.dmp

Download

memory/3220-14325-0x0000000007F70000-0x0000000007F7E000-memory.dmp

Download

memory/3220-14305-0x0000000006880000-0x00000000068CC000-memory.dmp

Download

memory/3220-14306-0x0000000006DA0000-0x0000000006DE4000-memory.dmp

Download

memory/3220-14297-0x0000000006220000-0x0000000006574000-memory.dmp

Download

memory/3220-14308-0x0000000008270000-0x00000000088EA000-memory.dmp

Download

memory/3220-14309-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Download

memory/3220-14311-0x00000000700C0000-0x000000007010C000-memory.dmp

Download

memory/3220-14310-0x0000000007DB0000-0x0000000007DE2000-memory.dmp

Download

memory/3220-14312-0x0000000070590000-0x00000000708E4000-memory.dmp

Download

memory/3220-14320-0x0000000007DF0000-0x0000000007E0E000-memory.dmp

Download

memory/3220-14321-0x0000000007E10000-0x0000000007EB3000-memory.dmp

Download

memory/3220-14322-0x0000000007F10000-0x0000000007F1A000-memory.dmp

Download

memory/3220-14323-0x0000000007FE0000-0x0000000008076000-memory.dmp

Download

memory/3220-14324-0x0000000007F40000-0x0000000007F51000-memory.dmp

Download

memory/3220-14304-0x0000000006860000-0x000000000687E000-memory.dmp

Download

memory/3220-14326-0x0000000007F80000-0x0000000007F94000-memory.dmp

Download

memory/3220-14327-0x0000000008080000-0x000000000809A000-memory.dmp

Download

memory/3220-14328-0x0000000007FB0000-0x0000000007FB8000-memory.dmp

Download

memory/3220-14333-0x00000000080B0000-0x00000000080D2000-memory.dmp

Download

memory/3220-14334-0x0000000008EA0000-0x0000000009444000-memory.dmp

Download

memory/3220-14290-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/3220-14287-0x0000000002F00000-0x0000000002F36000-memory.dmp

Download

memory/3220-14288-0x00000000059E0000-0x0000000006008000-memory.dmp

Download

memory/3220-14289-0x0000000005970000-0x0000000005992000-memory.dmp

Download

memory/3220-14291-0x00000000061B0000-0x0000000006216000-memory.dmp

Download

memory/4900-14344-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4900-14343-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4900-14349-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4900-14342-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4900-14341-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download