xworm | 89955ba038453d67183cca7f001b450ef8b8737f92ccd67739d0444104e5962a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 354KB
Sample260731-ybcc2a1vds
SHA256 89955ba038453d67183cca7f001b450ef8b8737f92ccd67739d0444104e5962a
MD5 0095b0b6207c84c25ab91f6b11b6a0ba
SHA1 77f2d425121275a5cdbd008298d050cd30e71662
SHA512 10ae8af08034a6c5b0f2043f23da286aa5a94d73f1e7fadb575a4493ac8d27284a159e667c8c7884d5adec15f8a3740ed307e1dd430009f893093946af4d0aaa
SSDEEP 6144:jFLTjxYMATKo9SjY9tIu10H0UYRQGyyfTaVFRV3:dTjsR9tIuC0UYFv2
TLSH
T19A741722A6D83CE9E57A827CDB7347C1D72ABC060760D6CF13D019662E3B6D1793A790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V7.4

37.130.81.97:7006

Attributes

install_file
USB.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44c-452.dat	family_xworm
behavioral2/memory/3172-454-0x0000000000410000-0x0000000000426000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44c-452.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3172-454-0x0000000000410000-0x0000000000426000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Downloads MZ/PE file 6 IoCs

flow	pid	Process
15	3164	WinHCheck.exe
17	3164	WinHCheck.exe
25	5160	WinHCheck.exe
30	5160	WinHCheck.exe
7	636	2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe
8	636	2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 15 IoCs

pid	Process
4900	seto.exe
3524	seto.exe
3164	WinHCheck.exe
4828	python-3.12.3-amd64.exe
2260	python-3.12.3-amd64.exe
1904	python-3.12.3-amd64.exe
2296	RockstarWorker.exe
1332	PSEXESVC.exe
2864	RockstarWorker.exe
620	PSEXESVC.exe
4172	RockstarWorker.exe
2040	RockstarWorker.exe
2044	RockstarWorker.exe
3172	RockstarLauncher.exe
5160	WinHCheck.exe

Loads dropped DLL 2 IoCs

pid	Process
3524	seto.exe
1904	python-3.12.3-amd64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4456	wscript.exe

Drops file in Windows directory 53 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFD736CF9FBEAABB5B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9012.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA04C66CF662F8470.TMP	msiexec.exe
File created	C:\Windows\PSEXESVC.exe	RockstarWorker.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_mjofv1py.4o4.psm1	powershell.exe
File created	C:\Windows\PSEXESVC.exe	RockstarWorker.exe
File created	C:\Windows\PSEXESVC.exe	RockstarWorker.exe
File opened for modification	C:\Windows\PSEXEC-USJNCXJL-53B1E538.key	PSEXESVC.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5989bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5989bd.msi	msiexec.exe
File opened for modification	C:\Windows\PSEXEC-USJNCXJL-2960991C.key	PSEXESVC.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_db0flpkq.if4.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uua4vh4r.een.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_g5rmujvl.wxr.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE51724B4ACC355F2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF98251DD8ADAC45DA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B854913F45EDB14.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5806FA763A122467.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tlp1ctqe.onf.ps1	powershell.exe
File created	C:\Windows\PSEXESVC.exe	RockstarWorker.exe
File created	C:\Windows\Installer\e5989b8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD04749D404AE138D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5A5E802101795AF5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3spjd2qy.u2f.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dgcsshlx.ndr.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yzbwr5xk.pjc.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_n5x4c5sc.x14.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\e5989b8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEDBCF4F1A55686CF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5989c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9533.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rtprxsjc.dpu.ps1	powershell.exe
File opened for modification	C:\Windows\PSEXEC-USJNCXJL-28E2A654.key	PSEXESVC.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qg2u3gle.vfl.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DF3093416BAAD31066.TMP	msiexec.exe
File opened for modification	C:\Windows\PSEXEC-USJNCXJL-B2B91ADB.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	RockstarWorker.exe
File opened for modification	C:\Windows\PSEXEC-USJNCXJL-B1FC1BB4.key	PSEXESVC.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_d25ujvjr.fm5.ps1	powershell.exe
File created	C:\Windows\Installer\e5989bd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8EA7DA1B7683AA54.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5673A3F51AB21308.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF92DE8DA537EC7B34.TMP	msiexec.exe
File created	C:\Windows\Installer\e5989c1.msi	msiexec.exe
File created	C:\Windows\Installer\e5989c2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE7A6997CA8BC398F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B5F.tmp	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1040	powershell.exe
5468	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.3-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.3-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.3-amd64.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5108	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	RockstarWorker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	RockstarWorker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	RockstarWorker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}"	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\ = "{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}"	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Version = "3.12.3150.0"	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\DisplayName = "Python 3.12.3 Executables (64-bit)"	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\ = "{8EB1F259-1326-4583-B383-F5C3D7C93D7D}"	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Version = "3.12.3150.0"	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.3-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.3-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\DisplayName = "Python 3.12.3 Core Interpreter (64-bit)"	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\Version = "3.12.3150.0"	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.3150.0"	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.3 (64-bit)"	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\ = "{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}"	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents	seto.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.3 (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	seto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\DisplayName = "Python 3.12.3 Development Libraries (64-bit)"	seto.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.3-amd64.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
1040	powershell.exe
1040	powershell.exe
1040	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
5928	powershell.exe
5928	powershell.exe
5928	powershell.exe
1940	powershell.exe
1940	powershell.exe
1940	powershell.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3524	seto.exe
Token: SeIncreaseQuotaPrivilege	3524	seto.exe
Token: SeSecurityPrivilege	3424	msiexec.exe
Token: SeCreateTokenPrivilege	3524	seto.exe
Token: SeAssignPrimaryTokenPrivilege	3524	seto.exe
Token: SeLockMemoryPrivilege	3524	seto.exe
Token: SeIncreaseQuotaPrivilege	3524	seto.exe
Token: SeMachineAccountPrivilege	3524	seto.exe
Token: SeTcbPrivilege	3524	seto.exe
Token: SeSecurityPrivilege	3524	seto.exe
Token: SeTakeOwnershipPrivilege	3524	seto.exe
Token: SeLoadDriverPrivilege	3524	seto.exe
Token: SeSystemProfilePrivilege	3524	seto.exe
Token: SeSystemtimePrivilege	3524	seto.exe
Token: SeProfSingleProcessPrivilege	3524	seto.exe
Token: SeIncBasePriorityPrivilege	3524	seto.exe
Token: SeCreatePagefilePrivilege	3524	seto.exe
Token: SeCreatePermanentPrivilege	3524	seto.exe
Token: SeBackupPrivilege	3524	seto.exe
Token: SeRestorePrivilege	3524	seto.exe
Token: SeShutdownPrivilege	3524	seto.exe
Token: SeDebugPrivilege	3524	seto.exe
Token: SeAuditPrivilege	3524	seto.exe
Token: SeSystemEnvironmentPrivilege	3524	seto.exe
Token: SeChangeNotifyPrivilege	3524	seto.exe
Token: SeRemoteShutdownPrivilege	3524	seto.exe
Token: SeUndockPrivilege	3524	seto.exe
Token: SeSyncAgentPrivilege	3524	seto.exe
Token: SeEnableDelegationPrivilege	3524	seto.exe
Token: SeManageVolumePrivilege	3524	seto.exe
Token: SeImpersonatePrivilege	3524	seto.exe
Token: SeCreateGlobalPrivilege	3524	seto.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3424	msiexec.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4900	636	2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 4900 wrote to memory of 3524	4900	seto.exe	95
PID 4828 wrote to memory of 2260	4828	python-3.12.3-amd64.exe	101
PID 2260 wrote to memory of 1904	2260	python-3.12.3-amd64.exe	102
PID 636 wrote to memory of 2296	636	2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 1332 wrote to memory of 1040	1332	PSEXESVC.exe	107
PID 1040 wrote to memory of 2864	1040	powershell.exe	109
PID 1332 wrote to memory of 4980	1332	PSEXESVC.exe	111
PID 1040 wrote to memory of 4172	1040	powershell.exe	114
PID 1332 wrote to memory of 5928	1332	PSEXESVC.exe	115
PID 1040 wrote to memory of 2040	1040	powershell.exe	117
PID 1332 wrote to memory of 1940	1332	PSEXESVC.exe	118
PID 636 wrote to memory of 2044	636	2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe	120
PID 1332 wrote to memory of 5468	1332	PSEXESVC.exe	122
PID 3164 wrote to memory of 3172	3164	WinHCheck.exe	125
PID 4456 wrote to memory of 1960	4456	wscript.exe	129
PID 1960 wrote to memory of 5108	1960	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_0095b0b6207c84c25ab91f6b11b6a0ba_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:636
- C:\ProgramData\RockstarGames\seto.exe
  "C:\ProgramData\RockstarGames\seto.exe" /quiet InstallAllUsers=0 PrependPath=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\Temp\{C3E674E4-4621-416C-B6A7-D104FE7C9141}\.cr\seto.exe
    "C:\Windows\Temp\{C3E674E4-4621-416C-B6A7-D104FE7C9141}\.cr\seto.exe" -burn.clean.room="C:\ProgramData\RockstarGames\seto.exe" -burn.filehandle.attached=584 -burn.filehandle.self=740 /quiet InstallAllUsers=0 PrependPath=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\ProgramData\RockstarGames\RockstarWorker.exe
  "C:\ProgramData\RockstarGames\RockstarWorker.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -File "C:\ProgramData\RockstarGames\hider.ps1"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2296
- C:\ProgramData\RockstarGames\RockstarWorker.exe
  "C:\ProgramData\RockstarGames\RockstarWorker.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -File "C:\ProgramData\RockstarGames\rights.ps1"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2044

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3300

C:\Users\Admin\AppData\Roaming\WinHCheck.exe
C:\Users\Admin\AppData\Roaming\WinHCheck.exe
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164
- C:\ProgramData\RockstarGames\RockstarLauncher.exe
  "C:\ProgramData\RockstarGames\RockstarLauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:3172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645.log" InstallAllUsers=0 PrependPath=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\python-3.12.3-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645.log" InstallAllUsers=0 PrependPath=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1904

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -File "C:\ProgramData\RockstarGames\hider.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\ProgramData\RockstarGames\RockstarWorker.exe
    "C:\ProgramData\RockstarGames\RockstarWorker.exe" -accepteula -s powershell.exe -EncodedCommand UgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAUgBvAGMAawBzAHQAYQByAEgAZQBhAGwAdABoACcAIAAtAE4AYQBtAGUAIAAnAFMARAAnAA==
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2864
- - C:\ProgramData\RockstarGames\RockstarWorker.exe
    "C:\ProgramData\RockstarGames\RockstarWorker.exe" -accepteula -s powershell.exe -EncodedCommand UgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAUgBvAGMAawBzAHQAYQByAEwAYQB1AG4AYwBoAGUAcgAnACAALQBOAGEAbQBlACAAJwBTAEQAJwA=
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:4172
- - C:\ProgramData\RockstarGames\RockstarWorker.exe
    "C:\ProgramData\RockstarGames\RockstarWorker.exe" -accepteula -s powershell.exe -EncodedCommand UgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAVwBpAG4AQwBoAGUAYwBrACcAIAAtAE4AYQBtAGUAIAAnAFMARAAnAA==
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -EncodedCommand UgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAUgBvAGMAawBzAHQAYQByAEgAZQBhAGwAdABoACcAIAAtAE4AYQBtAGUAIAAnAFMARAAnAA==
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -EncodedCommand UgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAUgBvAGMAawBzAHQAYQByAEwAYQB1AG4AYwBoAGUAcgAnACAALQBOAGEAbQBlACAAJwBTAEQAJwA=
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -EncodedCommand UgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAVwBpAG4AQwBoAGUAYwBrACcAIAAtAE4AYQBtAGUAIAAnAFMARAAnAA==
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -File "C:\ProgramData\RockstarGames\rights.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5468

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
PID:620

C:\Windows\system32\wscript.exe
"wscript.exe" "C:\ProgramData\RockstarGames\expe2.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\ProgramData\RockstarGames\expe2.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im pythonw.exe
    3⤵
    - Kills process with taskkill
    PID:5108

C:\Users\Admin\AppData\Roaming\WinHCheck.exe
"C:\Users\Admin\AppData\Roaming\WinHCheck.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5989bb.rbs

Path C:\Config.Msi\e5989bb.rbs
Size 8KB
SHA256 68a63fd38608c56b849704fcc60bac07531fa38ad1c95c1567387c65d377f1f8
MD5 61829743d1bbc523835f69e78cc4b83a
SHA1 529762170a9c3f90991ebb88d4bd4eb84e5dae3b
SHA512 638ef66a810652037f791c27737ee1f4d5a45a96adb78290733b35c79717991dd22297c2d4d1d5513bfa1065446106ead31275c6eb48b85d5bd82e44c97da1f1
SSDEEP 96:TmVUz1jIA+rteC8zVDUcxJXBIZhCsTlsUcxJXBIZhC6jIVBQTgTlwTIxltaaFJwz:Kqz5I8CywatBIZUIJatBIZU1fSdpt8O
TLSH
T1D8023501B2A8D2E2D8DA2335831F0F1237A6D3D6D250738B155E827C6F4B7DC9A5D19A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989c0.rbs

Path C:\Config.Msi\e5989c0.rbs
Size 12KB
SHA256 48a59a6e11018b17084aad255eefa7549570fd5252a4320ef14648f3eeff2dc1
MD5 cb85ea0a19681f8de225618bdcae101e
SHA1 23332e0006076296fabd8363183f298ec3aa44bf
SHA512 ce4fd807bad1cde66523494d3542105e0310ecb936286e9074ef77f208e7a27a8561d0422d0416bb51929370ddcdb816df1d30d1652170a5cf288b4f5e96e0df
SSDEEP 384:lFvvvX1bowzcfl8rT+zY2+8E4oECGoEfFXrSMrFQJ43xstW7ko25CFeCn:lFvvvXtowzcfl8rTGxo2oed
TLSH
T17F423503B690C7C1D896577DCB171B1433E7E1E87E01234F485E466CAF07B999AEE186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989c5.rbs

Path C:\Config.Msi\e5989c5.rbs
Size 14KB
SHA256 9811dacceacfcf78ec9a7606b44d096f54375ec76449b052b28a7ff18f5e01bb
MD5 7bf22d8990f005051bde6c24ad2771a6
SHA1 3806f49b46bc7fec779d3edfa866cdcedaea57d6
SHA512 bc99a296ea354770a454a31beecb92a3fc9561ea5c07d88e341a818bb98387558d4146650cbb4e6bf6142c272a2c75b5f7d214baf73f0463055943ba5bc90c1b
SSDEEP 384:lziOREwZjR+w211Xm2iIBWWwPYqnNuR8IjTFQjZ/MWfxy7soy:llE++k0agofxN
TLSH
T1FD624503B2A4C7D1D896533ECA271B2477D3E1E8BE05038F406D956CAF07B996DEE14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989c7.rbf

Path C:\Config.Msi\e5989c7.rbf
Size 100KB
SHA256 15b41a488c356c0e331facdea6c836a6cec021f12d5fde9844e7ca4a1aa0361a
MD5 3d44212bba2d7a88d6c83ce8523bba88
SHA1 62ea5374c17b0f2f88f7d4a6c03b592393dba6f8
SHA512 89297f1fbe811b23a38fc3dbc22989dfb9faf97960c65f1f0f43be710204b32f41f33ef0bb893815db71c4462d04b52f686b40801f6d4cbd8e529d740618ac67
SSDEEP 1536:35NIKbuEYE+9z2wp+FavGmhMn+IhzZtzE/yZRg7Sy7xZ:35NIKbuAs0FNmhMn+IhNO/yZRgF
TLSH
T138A3E44A6A1E85A0C4748471037B87F65B2D2E22A9C3C68D63C57F16EA7C2C1F909B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989c8.rbf

Path C:\Config.Msi\e5989c8.rbf
Size 99KB
SHA256 3373ac4a982e454a865fe13735bbc89a5c8279764051b6d4359211533b92bd2f
MD5 9495073209d324b0da226eaf8e5ed8de
SHA1 9556dc9b2aecb25d2e963589f2906456470cbb49
SHA512 0677f1a93b73d8dd8605a660e41b5f4d570aee8021ba1563a094aaf901ad3dd600f9dafa24f36103b46c80d22b27ab9f69c540b3d4c1025f4efea1687795c752
SSDEEP 1536:iq4lfPahIxHHWMpdPa5wiE21M8kJIGFvb1Cwr/W5sD7SyJzxB:iq4lfSSwMpdCq/IM8uIGfZ/W5sDD
TLSH
T1F9A3F551E62DBCCDE51CC4354A75E0F25E24EC3176C0A15EA3F6BF0629712A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989c9.rbf

Path C:\Config.Msi\e5989c9.rbf
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989ca.rbf

Path C:\Config.Msi\e5989ca.rbf
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989cb.rbf

Path C:\Config.Msi\e5989cb.rbf
Size 36KB
SHA256 e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419
MD5 b52c821c7750804295e23b9e94525085
SHA1 ee762ae623c98f53c89a0d8f4143c6c61ab807d8
SHA512 b5d680ce02ed9677ed905fa3257925bae1e80ece565d161b50a94a479b409d10b7f1b8340675b257900c856d8c3e37abacbf818287b56c5a72b97b1e5bbeaed5
SSDEEP 768:ofTr69CItDmXPkVDXz/kSsixKioLU68RfKoMlPLZ1FDYzGBAcTQgug3qfF:oX69CItQPkVDzDsioLU6EfKoILZ1FYwE
TLSH
T1D8F2D66EBF0903734AE1C2517E96A8C9F31DA13E375B1954306CD10C2B3B929A3BF569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989cc.rbf

Path C:\Config.Msi\e5989cc.rbf
Size 1.6MB
SHA256 a15b65d338884ef6b8b99ea300405a293dfec362610e79b8d19755112624210e
MD5 3a2f081757c87fe3f9745f2e857755fa
SHA1 0d49e71b9e0ffaa4f4dc8dcb45a95baa664038e7
SHA512 21f9968546c590d9f8a87333345f6086725905ba2724e5ca5f8f8e1165c20703906fda8e1d0bf59517abe8b166b80f47380e70bb535713a1e7e313b673f21fbd
SSDEEP 24576:7F4Hmo/1VMkuFLvq1o/1lw2xRQACqw/guOogEtYQfB:7F4Go/1VMkuFLvq1w1lwaRNY/IEhB
TLSH
T1E0850A5AA64F93B20673415DE1AEF39EE31680B8231D15427CACE1DE22059EC937F79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989cd.rbf

Path C:\Config.Msi\e5989cd.rbf
Size 74KB
SHA256 150c470f9943b806b44312efdec85755f22f8d7d52b31f93a9af3c43e8627381
MD5 b35f68a3086562c4d5453faad5a3474e
SHA1 673904ff9b305a6600e47ad715289122ec0b046a
SHA512 6ec80921942b3bd3c85ef24a2de5454a34a3ad11a1bc69b601aea7b873e318073c0b2d78c26685999f78ec64a86282c08c53ab8d77e41c661ae968ea52c08176
SSDEEP 1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
TLSH
T1CA73C3A33B9EBEDEE8A089B16B76C1D72D54FC554646200FB0B1BB1670752A3381DD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989ce.rbf

Path C:\Config.Msi\e5989ce.rbf
Size 76KB
SHA256 fda28a734788a3f175cb6aed4daeb5f05f0e49f6a272ccd2051ba337f7b3b42f
MD5 b1c9980131a3f20e344aa3aa2c8dea49
SHA1 0fe02f0ed5e56bbe7e4e98b1dca061ed17fbf5c7
SHA512 84ca107ace44fa1964c6c1ea93fc767bde88363339fc426a3d660da53c84bade14f1fae99c494483bf2b5312938d84b0c1733c85e82592b8ffe8a28f76186a3a
SSDEEP 768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
TLSH
T11A73C4473AAE92A9E9F05130577783F31B2C2DAA51A0E10AB5917B45B63C1E3790DF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989cf.rbf

Path C:\Config.Msi\e5989cf.rbf
Size 81KB
SHA256 c4ec1845a5724b2a83500f3bd940355e2fe26efc6b4fe6c208365359a6130da1
MD5 1a8230030d821cf8ea57ce03aaead737
SHA1 12656788b1fbe4d2375ecc2989a4d9da69caa0d6
SHA512 af6356dc67249e724ae30f65ddefb4e53c6f2703da32fd5f135598bbd6189bee70950242f52985478de99979d1271eec9f4e2981a29a9bc02c673e9b668fd0c1
SSDEEP 1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
TLSH
T1B58326433B4EBEE4E89423B1647AC5971E64ED6910C2259FF0C5BB0736B95A3380CE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989d2.rbs

Path C:\Config.Msi\e5989d2.rbs
Size 8KB
SHA256 bc04440e859b07d7abce027899828eaaa4822deda2286b3f38176b983e99f625
MD5 622e03567d01297f7f599921ee5c8ee3
SHA1 2e8afed545e666e97344a15aa46b67c59cb614bd
SHA512 2bf043aee66556fa575196dde45a5b7cdf7d93973923be8b59382c2d0214ef99e046d50e53b5d2c162adcce473922e4fb9b6550c7382d18e7504be15221d86ca
SSDEEP 96:1mVUz1Es/pQw8RnxnXJ4kxww8RnxUXJ4kCjn9VXVBQbQHdwH/m3p7xwKx7uC3wEl:YqzaHRxXJ4keRxkJ4kQ913w/XG
TLSH
T1ED023202A268D3E3DCD92335431B0B123797D39AD35453CB205E967C6F4F78C9AAD29A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989d3.rbf

Path C:\Config.Msi\e5989d3.rbf
Size 66KB
SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
MD5 79b02450d6ca4852165036c8d4eaed1f
SHA1 ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA512 47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416
SSDEEP 768:dHmHXV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0y3:dHmHXDmF61JFn+/O4hIjL017Sy/bxe
TLSH
T1C3637052BB54F8A3DBFA69FC39D199CD542B12CC872584ECA57893D30E1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5989d4.rbf

Path C:\Config.Msi\e5989d4.rbf
Size 6.6MB
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
SSDEEP 49152:77dFcaC296MwQx0AWOO5JqSEShouly4XUV/x3aOvi5lnX79DxW/En8tdFNPhD2SI:7Z+aCnAh8lRA4jvE0ivHHDMiEBaw
TLSH
T1C4666B267258C0A9C96790B0CD13C6CAE7B27C51BF50430B30EAB75E2F737A6975A349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RockstarHealth.pyw

Path C:\ProgramData\RockstarGames\RockstarHealth.pyw
Size 830B
SHA256 62a7eddeac181bed5e7960934f1202864c1b3e2fb7a3f850d35fc6ffc078fbc2
MD5 28b785631835e93f97c135da9536e374
SHA1 2459cd14aaaed7f3a8902b6fa455be1d6a14bc29
SHA512 c526da7724fec74e8a61654db5efa6a6d16a48436a4d01765123b12ad3fa054445e651e0d7e7a0c7cfbcad7595ba9e97e3b2d12091dfee29efc15fbba429144c
TLSH
T1AF0141CAED3C066472F6007A260594976EAA02104B5E6D79FFE1CEA13C6F530813D966
MD5 SHA1 SHA512 TLSH

Submit Download

RockstarLauncher.exe

Path C:\ProgramData\RockstarGames\RockstarLauncher.exe
Size 69KB
SHA256 bd51a4cf45bc8c941b8881419942d6046bc73efc9f913f90da481341111debee
MD5 34675ce3f93d943edacc07ebb0cf1258
SHA1 f2033ed09eae02f5e29f076c5a1b6c1deca6c5a5
SHA512 b578dc74b70c99b3b5a5c372eccddea8e10438d28c421f9386b8f41984e01347b62b4bab25d5f478b1b202d237c44f6d75d83c4bffba7d6c5fcf7cb320645950
SSDEEP 1536:Ro9RumFYzvTNrWCbuJnimUkb+6a1qJE/Wop13acOqLSII+63:WPrFCTICbulUkb+6SqfoD5OqLSI83
TLSH
T11E636B393BA24126F1BF5FB4C9E13762C779AD235602969F70C03E7A76138858D812F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RockstarWorker.exe

Path C:\ProgramData\RockstarGames\RockstarWorker.exe
Size 813KB
SHA256 edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef
MD5 db89ec570e6281934a5c5fcf7f4c8967
SHA1 0098c79e1404b4399bf0e686d88dbf052269a302
SHA512 c0b9723c1ebe946b7bfb36525dcc6063518c2a534ff5a9921dd84e3dd519ab670b83bd70cd4ed78843a411b573b9869b8fb527f8bd67cfe9fa7630717f6cad30
SSDEEP 24576:szZTjAVZibdc56dh0lhSMXlGTEzGASe3n1/:0ZTkZOcbyEz8e3nJ
TLSH
T13D058C1173E505F9E5B7A6348CB64616EB737C050B30D69F03A4866A5F33AD09F3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

expe2.bat

Path C:\ProgramData\RockstarGames\expe2.bat
Size 229B
SHA256 848e6ffced373b248db29643547c48928e3761f4bed16d070449930b5c05a488
MD5 0d000e5d8872535dcbf982c21e822f11
SHA1 45393bdf9563d137c34cf405ca707db57e8c1ea5
SHA512 4d81f6d08efa7480f057df32000cef04adb544e7144ff620551b1600711576a138ecea958ce30bc8ce0bd962745188c697e22f9d02e15a8d90284551ac41a6f0
TLSH
T186D0A75196638DE054C712DF4568E780B19ED1B13AC4179150274016FD4072C94FA34D
MD5 SHA1 SHA512 TLSH

Submit Download

expe2.vbs

Path C:\ProgramData\RockstarGames\expe2.vbs
Size 115B
SHA256 33bd233371770bc0381ef5e5c42d59f96e0222801684dc6170cd639f93c70acf
MD5 25874c1b0bde93f97f7347c055c4fbfc
SHA1 f5cb361aa8bb8aced90338ebc153c98d5e03a43a
SHA512 2a56422b7a9219b9b68b3f7e5d665193b95352f7d8550cdada2f8736cb18c0011a6e2373ddbdee8b49373582ea4b4d676a8fb11d204fdcca2a0cdce7a3dd5530
TLSH
T134B01218DC6FC390988BC1F103748B3C978CE5C32371AC2757C8864D8254A90533C6AE
MD5 SHA1 SHA512 TLSH

Submit Download

hider.ps1

Path C:\ProgramData\RockstarGames\hider.ps1
Size 615B
SHA256 a2dcb741538d1bf4b4547ab10dec57b21ef8f331ca4ad883228b58dbfbb577b4
MD5 cd5d942867dcc09270f9c65e07534c0c
SHA1 ed7483277c8e396106f4dd70009aa2a2e8b59928
SHA512 584389e10b92273d4a4de3c70e2dd9aa77cc2209d10ff5e4396a314207d6310548920a3a857d09c4d09975170175b07db804395e5bca16b6c53d25be02516aa6
TLSH
T185F08101DF7A4A1968F6132048498910FD4F131F22767102B5FDB7105F709EDC579A5E
MD5 SHA1 SHA512 TLSH

Submit Download

rights.ps1

Path C:\ProgramData\RockstarGames\rights.ps1
Size 3KB
SHA256 1b9519656f5a6911b51347b0162ec870518cc731d1ead9238176943b8d6345db
MD5 ff94baaa40450e140d7fc47611b8f941
SHA1 db644da04f51c9f8ce89fd21795f18a8dc9432a2
SHA512 5695e3aa4b736a4934f5689924846bcfa2042ae302180cb9be5db8963327a3cac2ebbfc050bbd989668c55ad8c8a41de41ebb248ccacee5343dcaa3129fcf580
TLSH
T17471DE71B315E3B018B08755EE31C639A52E912760026B1972FCF281FF3169DCBBD99A
MD5 SHA1 SHA512 TLSH

Submit Download

seto.exe

Path C:\ProgramData\RockstarGames\seto.exe
Size 25.5MB
SHA256 edfc6c84dc47eebd4fae9167e96ff5d9c27f8abaa779ee1deab9c3d964d0de3c
MD5 c86949710e0471a065db970290819489
SHA1 b1207fba545a75841e2dbca2ad4f17b26414e0c1
SHA512 0e19181bc121518b5ef154fecc57a837e73f36143b9cb51114bd3f54056bc09977abc1e4ef145a03344d9ad2b8e49faa483b4ef70e4176af2bc17a8e5a3cd4ac
SSDEEP 786432:QqJaMb8rrFiWxc+HI9gEPYZG07rn7EBFsMEbi:FmrrFiEHHEPYtrFtbi
TLSH
T1B747337390941332FAF00873B928A5307D6CAA681764887EF2D4F96D7E7588707F71A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
Size 5.4MB
SHA256 be85ed56ef964b7d4aca64fc0d789ccb978c36b721561dd89a2075fc7390e5e5
MD5 4ea23d87301816a67d64b3476c2b2ed2
SHA1 777d24c6feda83c33b26128b69848d63e3df74db
SHA512 cd1ae5ad76ecf9bb714a0279303cd963fdbbd53bcf5acc248dfde27cb66b24620401cdcdb4fcb0080511f97ecb655336aeece4823979f22a4c11ec39eae5bb8e
SSDEEP 98304:QJ1mwJE7iUwRftk6hf174Lmzfjk7PuiHoF+YJigbZcGXS/T:q1mwJew9tk6n4LsjklHdYJRZcGXS/
TLSH
T1F64633417BD51B62E3D7C431E0ED978A2B466CE49F4F1A0B9CB4F48A2E71B4902C479B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lib_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
Size 7.3MB
SHA256 7d2088ea77398fffb1fd67b40cab095701da20129003d8739de66dd86251acad
MD5 fd5431e6083171b53293ec1576422f5a
SHA1 b8568002c743cd936a63ff1b943c794c9441c0f3
SHA512 784490076895f55998c641a3ae5d1ba386f50a71b476da7a2df15fb7ebe62b4703ae785224fea2fe3e94b12002ee89d9e790aec7d6175650f62c19407a5ca5a7
SSDEEP 196608:ZBK/ISjQKd3Jd4I03EWbOskSRypx3FPApNVkmdU:WZjQKd3JdG3EWH4p4pomd
TLSH
T1BA763315E412BBE2EA433DBE1C51E7490F6ACCDCB71988034DB6F62C6FB5B05438859A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}v3.12.3150.0\core.msi
Size 1.9MB
SHA256 305c4d92ba8630cf32d415d6bdcc718c198777a9ccd45e0df0fb4afb5b77f264
MD5 0313d79650e9ee46b3702a3875f07ee7
SHA1 751818c3bc1cdef131731e2567932dfa55011a19
SHA512 0f914f3f3e7dcb3a3e3aa795c12eb030e7633a5223196faf99f177649e4b584bb63b56e47539a9cf873b3ad91056e0f47fb663f36b350f3a57fb2d347b81ae80
SSDEEP 49152:es756XKtm0K8LEDscyhi8QcGErqNlHl6Rtl+f+wiMwI:H75mK4aisHzGHzcdwiBI
TLSH
T1EA9533A2EEE18824E275033499FDCBB147F65CC1DF7141960A65F28E1AFBC9532EB094
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exe.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}v3.12.3150.0\exe.msi
Size 716KB
SHA256 d6b1e5357a33d3f3bf96b1701c65063443e3e5fcd6289767dc247d5f58b54322
MD5 a516dd8aeb75201d9d5c5a0498496368
SHA1 52327a0b7d620ce1edf8a283dff96da4a2a7a742
SHA512 658ac24dd0ef57ff15e582f1b8e061b86607fcb636bca3444826c04413d769037da8d98648fb23dc3a5a8560e8c8019bc34478f5855ea8bb531b69e2d1aff255
SSDEEP 12288:If5FXfmsQ4aXUfmq/6kp4ela6Di3LCMN7G307QTUe0ozwbtzKsxDbT:Ifr+sQDXwy5ya6+3LCMNak7WUCMX
TLSH
T11BF4230655857E29C8C602364F9DD2B6AB6AEE2E075316532728F32C0F31D57B663BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}v3.12.3150.0\launcher.msi
Size 540KB
SHA256 fe16a99f84a7302b13b2515526b06060680518a0d15430eac47fd940ec19806d
MD5 1f72320dd99b6622c6904b477bc0430e
SHA1 edd85e821fc44265e70c032be9b04cd88577b9be
SHA512 618f70529cfd21b44795d1daf3e593d05ec5071084857cfbded75afe6417b2b95c0fe158d9c2133a093c468d67702ed6042ae9fca6414bf7d96125fa563b6dae
SSDEEP 12288:xW97nJ6PC8WUq/A+VwCgZZ6bLGpxBl/J7vf:Wd6uHthYgLGt1J
TLSH
T1DAC40252BA2C7DE1C4099631447AE6771A15DC29AEC0E18B73E6BF1C2D326D3F3611B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{575FEF7A-71FE-437E-91B0-D3838C1026DA}v3.12.3150.0\test.msi
Size 5.3MB
SHA256 5545b777454f47cf693fa7df9827afa88f8f56c7851de3b80061674776362891
MD5 0104cd40ea85c59c5f234af7b78bb5f0
SHA1 5b395446c2ab57e68ca960e2a45493b30b9e6a22
SHA512 aab7fb2933b106e6cdf302c0e1b63c891c2ab798b733775c428867bcc1de6460f8eefa4dc49141d11ac9de22741285d19ffd0faae3c87f5d7552724b95726aa5
SSDEEP 98304:xklvSsD1nLgSowrj5wFPeXRiF2hy5yCxMjzivT96/bKx31r74ogTTs0dyAZ:xkpnLgOrGeBiYhyZCeLkWx1/cMJAZ
TLSH
T1EF4612A1E8234AC3F693BDBDEC9543791D26FCC9AE00A4478F31725C0F75BA842C5A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}v3.12.3150.0\dev.msi
Size 384KB
SHA256 af5661b0b8c3ba01241306e86308e82b81d0220448ed6e65ddc1b0ac76677e1c
MD5 13ae8be55b1c804e9d7201a5a9c1eec5
SHA1 fbbdd498ee15c7ba21557481fff912b2339a11a1
SHA512 7f10b00ffbcce87b2bcff5000b7ef429966efa69b5df69edfe17ab229e823a24642ce87b9c0640ab8533119da41200c698812b9f03cd97d5af54c9e78e8caec2
SSDEEP 6144:SqnFRycQ6xvHcv43nOpr0RJ7+DQiZ710Pp1GTJdfwP1BkxihDIlITO:xFoctHcSnOpUCRh0x1qJyXkEhM+TO
TLSH
T1C684E1929D2C8F36CA47643D204DE7646D192C9F0B4350819C65F28CAE73E8DE25F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

path.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}v3.12.3150.0\path.msi
Size 48KB
SHA256 54847c7c60c3175cb14d7db9f99a41990b9a70aa5dc4962a5f473a4b21dd0fc4
MD5 8e4eba05cc115966b2c66c661c3abed1
SHA1 fe562e8a7c96c5dedce3a14e07758759ec0e7a83
SHA512 96b76b3c2b4419ff0dbcef46004c3ac5ad7b169478d5576ca094e1c2b14b9a8e0e58d868f197f8d00aca242cf86b744d8732f8f6138d3ea3f9e69911cfee8638
SSDEEP 768:c/YiJd9M1Ck1LM9M1CqfU5YiSyvrsxvAMxkE:9iJQ1r1117f+7SyDkvx
TLSH
T11A234B2777041632D8461B31665F93B99F356C988EE281A3325AF34C2F71A8173FA6F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcltk.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}v3.12.3150.0\tcltk.msi
Size 3.4MB
SHA256 a9d405cee5c448d7153a43ad57a86ded824944cda4955d8b355e0d26c5b456f7
MD5 ed16a4089da4bcd79ebfc28fdfe70cf2
SHA1 421705221bf68fa0ffaa3238e970d372e04977d8
SHA512 bb9b2e0183f1a78cb3a8c39fe4cae2705dff21569fe4cf998d3c3d013db2a6e269bd6c09858f5a1c64e4a84a37f128d29504a1e73f429dc290b6789e07df7c3f
SSDEEP 98304:jX5pvn55yH9KlsEmBaqRf8Zk/8wzY65pKY:j3vn55ds3Tf8Zk/FzL5p
TLSH
T11BF512E67E5319C7D6C37E3B65969F091932FCBAA54E2388AC35BF0C2CB05479208647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Python 3.12.3 (64-bit)_20260731203645.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645.log
Size 79KB
SHA256 6f3c8d02f56e9a4662a64b7a0f1373ca2cbf4df4ffdcfffbe1cdc01a460d907d
MD5 72dad2d68a6b70e600db83ae1edb95f1
SHA1 5d610b0c72a0b59cd441c71ceb2dfb0c6a902768
SHA512 af3ecf3f7a8a9281e02742de6dab86db03c2192e4b82a175d837b5d50daf26d917a429cb7fdfe6021991fa73cae86e60738f685f467d67f45d71d6ee9c817a8a
SSDEEP 192:ngpOW6y9uzADwaBW0gbgQVIktoeeGPoGfV/NVIS0O4HPiVPNNNjQQr9ZJcriMkwY:aBW0gsQVU8RIWVFqb1IzE6lJSoeCu0jf
TLSH
T1D8832F1E62DD291C69918B39C91649E6D993F21C6AC0CDB46F369DCC13C483F8ABF274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Python 3.12.3 (64-bit)_20260731203645_000_core_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645_000_core_JustForMe.log
Size 1KB
SHA256 5b67d567a068614b0676aff60f90513f043ea7631259113686348802cdf9b15c
MD5 cc211453d20b136e47a0cbf09b718682
SHA1 2285233c9f8da12d297de3da81e713101c0282cf
SHA512 4600decd7d178478aa33ade49cb9ff24391758242e28fd6e72c2d7d56f0e55750f618ed0f9c192affb437d6f84aa2d9ee917332e0340d7e07cdbf6d5c26e391f
TLSH
T16F41F6641EE40846F1B75787AEF7C1162B33FCD2B835CF4C238483190A6BD0999787AA
MD5 SHA1 SHA512 TLSH

Submit Download

Python 3.12.3 (64-bit)_20260731203645_000_core_JustForMe_rollback.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645_000_core_JustForMe_rollback.log
Size 1KB
SHA256 b2d84a9ef3f30ddea544c3e1b481b3fbaf95dba570b3d5c7bfce5436d7efa5d5
MD5 f5d5aff53e259b28d915e626b9c0c3b3
SHA1 8ea8c97d6e0b93b39624694c7e2dc2e21142693a
SHA512 c7c5fe31e7f7411f27b58d0ece99d7fb23ba5e24faaea9c9bf20d649efa28c2b8fb0db9662480127f929ff4f54ccff52c9b474e20bf29f452433893ec87109f4
TLSH
T1703108A41BE40846F1B657479EF3C052AA33FCD278358F4D6385931A46AAD046CBC7AB
MD5 SHA1 SHA512 TLSH

Submit Download

Python 3.12.3 (64-bit)_20260731203645_001_exe_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645_001_exe_JustForMe.log
Size 1KB
SHA256 0596d9a5baa1234c72e79cab6a1e7c08f0380d782c974bf7550f37045672c177
MD5 5d8cb0e885eb5711bb96897f5167d8f2
SHA1 e5fa8f94fa4fa68820d5811fa6f9c9941257f391
SHA512 06e638ad5e71452af502c31d267ac2b5588849da3e4c86b54a070a75127898ac5b549ef7c76816a55d8ea2085300636520559f089bb92f22219eaaa3b8b279e2
TLSH
T13241C3A41EE40945F2BA5647DEF3C0159B33FCE2A835CF0C238592594A67D056C787BE
MD5 SHA1 SHA512 TLSH

Submit Download

Python 3.12.3 (64-bit)_20260731203645_001_exe_JustForMe_rollback.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645_001_exe_JustForMe_rollback.log
Size 2KB
SHA256 64554e3af5194e8b0d12d2dde13c7ff95540604166d5f3c32145cddf07a67cb9
MD5 948c468a1d6079feb7b52ec9fe340c55
SHA1 d91346d02e8c141d7ba9eadfecf586cf96261124
SHA512 68210ff5b11500fa89a99a436b77491d197e3fe5e364002029105d9fd6fe9edeb9e78041da16539a5a872d65c4b9989db1ef655b48c52b4595c2568fa9407a18
TLSH
T1D851F8681EF84C45E5B697479EF3C0126933FDC278358B0D23C9871E069AD0568BD7AA
MD5 SHA1 SHA512 TLSH

Submit Download

Python 3.12.3 (64-bit)_20260731203645_002_dev_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.3 (64-bit)_20260731203645_002_dev_JustForMe.log
Size 1KB
SHA256 3ec40e6b724a7da6629648c571e0780c1bd142881a6074b7ab30c6a630053b94
MD5 d8217a8e12efa3e662d4848b1704e072
SHA1 90301819d5538b765d5dd97a3cc1895f07bd8699
SHA512 2502066f21a0c7109d2bdd926595b4e32f01cb0a5c226296e856c24c3f954de43e2c72be8a7103013778f2a03cb4fa5c0aa0dcefca950794e68f06bdee1d8b77
TLSH
T1AD41C4681AE50945F2B69787DEF3C0116A33FCE66836CF0C23C492190A67D056C797BE
MD5 SHA1 SHA512 TLSH

Submit Download

Python 3.12 (64-bit).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\Python 3.12 (64-bit).lnk
Size 1KB
SHA256 253d4d035224908d80c7b5d627c950cffd98e42993a849fa03542e0073583e96
MD5 683ce7ebca637d9a72c2d5993faec791
SHA1 e0685177ecc4d43a590170371257aaf1162302f9
SHA512 d1137e1df44eb19923148740d08c3e362fa032a9d64f41726b229ded73b486cad2b80865926ea64d8ed8daeeac5eecb1576e40d5df36d931d3145f173d98a52b
TLSH
T18931101D27E4A325E2A4F2F844EF26398232FC61DB11DF0C0062538C29A6602F908F7F
MD5 SHA1 SHA512 TLSH

Submit Download

WinHCheck.exe

Path C:\Users\Admin\AppData\Roaming\WinHCheck.exe
Size 256KB
SHA256 31b7c84f0cd9bd1da3c9b01bc85da630cf59995290e23aeb99ea6335aad3df40
MD5 dc9efc9d5eb6891f00086e2d9d53c189
SHA1 6646febe2b18b500ac77169677942b57d0da6f4c
SHA512 1a18d53f51dcc568afd7ac18d65e885487e6e18f3dafe701fcca77f443c55be1f51c426dd6121dbac359b743e3f2110985d717ce7e93d782159b01e4fa997425
SSDEEP 6144:7FZgqzfouPEN/ORDA7BMmZqzckaa9kb1:RZbENGRDIMU8ckaa+
TLSH
T12B445B15B7A40CF9EA77877DC9C24906DA72BC564760EACF03908AE64F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXEC-USJNCXJL-28E2A654.key

Path C:\Windows\PSEXEC-USJNCXJL-28E2A654.key
Size 16B
SHA256 1c1d22c7544959759176558971e042fd7b57ba11d7bb0faedd45bef99ff397a1
MD5 0255aebb1932aa1c33b68d707fa20f65
SHA1 37e68d7338766c514fa6a83c92d9998c101478a2
SHA512 5f11c58462952f38caf21edca58c878694d54b207b9f525d68fc6e78f6b9e894d2fde8e6ce433294d2545c6549b5a1adeebbefb2c625f594a54077da4c81bdf7
MD5 SHA1 SHA512

Submit Download

PSEXEC-USJNCXJL-2960991C.key

Path C:\Windows\PSEXEC-USJNCXJL-2960991C.key
Size 16B
SHA256 21c36808d6889aab8c42c8abf081e7c0a3dc0435ca24820d27b43817a16cdd91
MD5 db9ae6cf6111e887af4160100dbfd6ce
SHA1 96b082a99cf1f9744b1c059fbd0ef06dce2b4ff0
SHA512 f291152e8059a3941f4f955b29905f8b12c85c586db93cab8679854c2c563feed1fbfe73cd1e2e95b25ae1664635e4e0b3921d03f0bdc292a9cbacbac9e65fe6
MD5 SHA1 SHA512

Submit Download

PSEXEC-USJNCXJL-53B1E538.key

Path C:\Windows\PSEXEC-USJNCXJL-53B1E538.key
Size 16B
SHA256 3324898e62205e48cdbacac7c1f803eeb25eaf95ad66634363c01c8c2575276d
MD5 f9263af95669a0db9281e35c826b445e
SHA1 fb8b75798d826b8cf6ab6edb23a154455a708365
SHA512 4f257866f56ffe59ba191b093cbb85d1cf6d8c1ae0a79a600cb85832cc3f8fcf26a25c6abdfa8fd8c16149ccf62bd123b5d3c962440ea3f9f57f58aa79b21395
MD5 SHA1 SHA512

Submit Download

PSEXEC-USJNCXJL-B1FC1BB4.key

Path C:\Windows\PSEXEC-USJNCXJL-B1FC1BB4.key
Size 16B
SHA256 ded2b27fba94fb7f04ed35b491a58381a5c0c9cc85048d6bdf41009cbbe55cfb
MD5 fb406b3069df459a6be04c09358d95d3
SHA1 c3ec17cf1a387fa11770d9bbe594b85bfa1cb6df
SHA512 9e3f2e36a4f8c9b72f868709a273b8b2eb98d18316f2ae533e86dab1a6ada5e72defefa4105454aad4c36928c84068f1871a28c842d87ba8c8414d53bb35f6ed
MD5 SHA1 SHA512

Submit Download

PSEXEC-USJNCXJL-B2B91ADB.key

Path C:\Windows\PSEXEC-USJNCXJL-B2B91ADB.key
Size 16B
SHA256 9b5ffae95bedfeb7f3d59caccce49b16199003346f53be48887d15fd595fe770
MD5 e837aa8eb109efeea9a3590c99b9716d
SHA1 32c1da09a03f7e36fc09ae500a2f12128efaa0d4
SHA512 69b09ba198ca21a6b53d2b15034cf76c3fccd7c9715b5af96e31ad61ff6e3cebc9abb58063c07744c01c190e035751bc654165819a20c4e325ad3788b738668f
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 236KB
SHA256 9d00158489f0a399fc0bc3ce1e8fc309d29a327f6ea0097e34e0f49b72a85079
MD5 07c6b4756715d73304ec0ebc951dddad
SHA1 eeafa71946e81d8fe5ebf6be53e83a84dcca50ba
SHA512 9d75d8aadae68e04dff9473cc007162ae21be0c5dbf33ac7ffb65ab2140b03300a04935b2b37cdeaba093791cdce20b4ebba2eff89d501d1a2b6a70fa5a01e8b
SSDEEP 3072:1wNKkqbkWm7S6pUAkedcykd0Q+7JM73bf9UFZ62VWYecf34CyWl2ePjQwX:1HksJmO6GANcDaQ+c3y2Yecf35358wX
TLSH
T122346A15B3E90CF9F9B7673588B14602EA767C114B34D69F03A0865A5F33AD0ED39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tlp1ctqe.onf.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_tlp1ctqe.onf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{323D5FBB-0D88-475F-B6E1-623F513E872C}\.ba\PythonBA.dll
Size 675KB
SHA256 17e381ff07daf726967a8c4c66eeb4e8e2a56f9b722bde953827ce7971460e0b
MD5 74bbd9179465851bc0145bf1ca37c73a
SHA1 09fdc7061d81f2a2fa548169f2239cdc2e76979d
SHA512 d5b99d4264c39740fcfad886168054070f7b0144cd1dad9bf858e8b72c6fef90a07da8ae1a4e9554645da84dd69e823a6259a0c30214b343b4e48ab81fa382d4
SSDEEP 6144:5A5Qm1qiZkcnTmvFlcEwjPpt2rFxHdaAIbOSQjbB/ZUprz5ug5Q/UsPkT4VE:5SQmsi6cCv7FxHdaj9ak5ug590E
TLSH
T11FE48E1174C08271EDF620BB46BCB63996ADE1B00334D9CB17C85AEBEA215C29F37657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{323D5FBB-0D88-475F-B6E1-623F513E872C}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pip_JustForMe

Path C:\Windows\Temp\{323D5FBB-0D88-475F-B6E1-623F513E872C}\pip_JustForMe
Size 268KB
SHA256 997b2b1075c601f52e7a0db7c6563374308824e499dbde2a72029c71cbd0c33e
MD5 9f6cf7c339d6592c69eed4669d153b6d
SHA1 1df46ef4afb3672d35eb5154b2edb930d6ef8e13
SHA512 883832dff6d7b03e86176bd2d75913ba690dbfd8784e570689a7050f7fffe48aa85ea0f301625869bbaa47e0d5edbe8da77f3cbe4fb69ecce6abbc3c0735264e
SSDEEP 3072:ip3AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIv:ivAVt07kub3jcA/2c9u0AIYs
TLSH
T136449E227490543EEAFA0932A57ED670AF3DFE241760C4AEC344B91E5E704C067B7B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seto.exe

Path C:\Windows\Temp\{C3E674E4-4621-416C-B6A7-D104FE7C9141}\.cr\seto.exe
Size 858KB
SHA256 ebee7043423bc83b3e8c8dde159e660cf15b376e248c3f8385b5076b85083614
MD5 d6958b9b90d2667936691080102ecc18
SHA1 c8e252d4926c81b4143aaeb89957662464eb3cd4
SHA512 f49059a69df60cf3f6fb22787ff02809e5a8190777fa81c8672c14f9f104b2b7b1cb339a2773facb6dc450bcb51c4a0f80099fb0e992f7226c9ebcc56cf040e5
SSDEEP 12288:y5mWukhI2jFMSjysAS9X/GsfTDYrGiXGEcNBrLLQN1BrOihPs7s50QvDFZvAoSdm:y5mWpI2jFM5sFzfTpiXGFNKnF2G7vA4
TLSH
T1EA15AE32A5A14072F7F10573BA289530BD6CAF282750C9AEE3D4BE1D3E7449167B7293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-350-0x0000026E7CC70000-0x0000026E7CC92000-memory.dmp

Download

memory/1904-443-0x0000000000F40000-0x0000000000FC9000-memory.dmp

Download

memory/2260-444-0x0000000000F40000-0x0000000000FC9000-memory.dmp

Download

memory/3172-454-0x0000000000410000-0x0000000000426000-memory.dmp

Download

memory/5468-386-0x000001FC6C050000-0x000001FC6C06E000-memory.dmp

Download

memory/5468-448-0x000001FC6C380000-0x000001FC6C4C1000-memory.dmp

Download

memory/5468-446-0x000001FC6C2B0000-0x000001FC6C2D4000-memory.dmp

Download

memory/5468-445-0x000001FC6C2B0000-0x000001FC6C2DA000-memory.dmp

Download

memory/5468-442-0x000001FC6BD30000-0x000001FC6BD3A000-memory.dmp

Download

memory/5468-387-0x000001FC6C070000-0x000001FC6C122000-memory.dmp

Download