gh0strat | 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2

Analysis

max time kernel
151s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
Size 106.0MB
Sample260824-varjsa1bpg
SHA256 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2
MD5 14ae4de065de6bfc376d12469ba4077a
SHA1 fced4987cb78c96b22a8d195a72e6bff358ac51c
SHA512 6c604b9db62630cf20b58492b01b9f5e658f9c91e09fcc76b8b7eb1548bab83e75fc881242e2b18db56c350cdef848420468f62d4cdc570a60cb50f1e4d78f84
SSDEEP 3145728:vO9QNvN0Qh5cgk7J85r/eLQC+Nqk4EWq07m:G9Q5N0icBdUr/Qx+N0Em7m
TLSH
T149383316BA9988FCC699C070C30B4B726A75B0CA1B316DFF46C4CA743E766F51B38619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat purplefox rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4988-199-0x000000002C780000-0x000000002C93E000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4988-199-0x000000002C780000-0x000000002C93E000-memory.dmp	family_gh0strat

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/4988-199-0x000000002C780000-0x000000002C93E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c59f-50.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-123.dat	UPX
behavioral2/memory/4664-127-0x0000000073EF0000-0x0000000073FAA000-memory.dmp	UPX
behavioral2/memory/4664-191-0x0000000073EF0000-0x0000000073FAA000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c5af-123.dat	acprotect

Executes dropped EXE 19 IoCs

pid	Process
3452	erGnOCbSSOddbbP.exe
1152	erGnOCbSSOddbbP.exe
3564	DriverDetail.exe
4664	ToDeskSep.exe
3288	LearnSeek.exe
4728	LearnSeek.exe
5584	LearnSeek.exe
2696	TutorSteer.exe
1096	UpdateSteer.exe
2968	LearnSeek.exe
4628	UpdateSteer.exe
1588	LearnSeek.exe
5800	StartDirect.exe
4192	StartDirect.exe
400	StartDirect.exe
4336	SessionSummarize.exe
5300	UpdateSteer.exe
5588	DriverDetail.exe
4988	DriverDetail.exe

Loads dropped DLL 3 IoCs

pid	Process
4664	ToDeskSep.exe
4664	ToDeskSep.exe
4664	ToDeskSep.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1480	tasklist.exe
3192	tasklist.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c5af-123.dat	upx
behavioral2/memory/4664-127-0x0000000073EF0000-0x0000000073FAA000-memory.dmp	upx
behavioral2/memory/4664-191-0x0000000073EF0000-0x0000000073FAA000-memory.dmp	upx

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ExploreDescribe\1_LearnSeek.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\powrprof.dll	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\ExecuteContributorRapid	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_StartDirect.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\wsc.dll	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\wsc_proxy.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_StartDirect.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_UpdateSteer.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_TutorSteer.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_TutorSteer.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\SuperviseDistributorMajestic	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_LearnSeek.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_DriverDetail.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\LearnSeek.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\UpdateSteer.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_UpdateSteer.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\SuperviseDetail.sys	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\SuperviseDetail.sys	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\StartDirect.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\UpdateSteer.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\wsc.dll	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\ExecuteContributorRapid	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\1_LearnSeek.xml	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_DriverDetail.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\powrprof.dll	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_LearnSeek.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_SessionSummarize.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_SessionSummarize.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\LearnSeek.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\StartDirect.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\SimplifyAim\ToDeskSep.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\wsc_proxy.exe	erGnOCbSSOddbbP.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\UpdateSteer.wrapper.log	UpdateSteer.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\UpdateSteer.wrapper.log	UpdateSteer.exe
File opened for modification	C:\Windows\UpdateSteer.wrapper.log	UpdateSteer.exe
File created	C:\Windows\1_LearnSeek.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\powrprof.dll	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\SuperviseDetail.sys	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\UpdateSteer.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\LearnSeek.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\SessionSummarize.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\StartDirect.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\StartDirect.wrapper.log	StartDirect.exe
File created	C:\Windows\DriverDetail.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\LearnSeek.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\StartDirect.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\TutorSteer.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\wsc.dll	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\wsc_proxy.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\StartDirect.wrapper.log	StartDirect.exe
File opened for modification	C:\Windows\StartDirect.wrapper.log	StartDirect.exe
File created	C:\Windows\UpdateSteer.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erGnOCbSSOddbbP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverDetail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TutorSteer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SessionSummarize.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverDetail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erGnOCbSSOddbbP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDeskSep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverDetail.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe
3564	DriverDetail.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	3192	tasklist.exe
Token: SeRestorePrivilege	3452	erGnOCbSSOddbbP.exe
Token: 35	3452	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	3452	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	3452	erGnOCbSSOddbbP.exe
Token: SeRestorePrivilege	1152	erGnOCbSSOddbbP.exe
Token: 35	1152	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	1152	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	1152	erGnOCbSSOddbbP.exe
Token: SeDebugPrivilege	3288	LearnSeek.exe
Token: SeAssignPrimaryTokenPrivilege	3288	LearnSeek.exe
Token: SeIncreaseQuotaPrivilege	3288	LearnSeek.exe
Token: SeSecurityPrivilege	3288	LearnSeek.exe
Token: SeTakeOwnershipPrivilege	3288	LearnSeek.exe
Token: SeLoadDriverPrivilege	3288	LearnSeek.exe
Token: SeSystemtimePrivilege	3288	LearnSeek.exe
Token: SeBackupPrivilege	3288	LearnSeek.exe
Token: SeRestorePrivilege	3288	LearnSeek.exe
Token: SeShutdownPrivilege	3288	LearnSeek.exe
Token: SeSystemEnvironmentPrivilege	3288	LearnSeek.exe
Token: SeUndockPrivilege	3288	LearnSeek.exe
Token: SeManageVolumePrivilege	3288	LearnSeek.exe
Token: SeDebugPrivilege	4728	LearnSeek.exe
Token: SeAssignPrimaryTokenPrivilege	4728	LearnSeek.exe
Token: SeIncreaseQuotaPrivilege	4728	LearnSeek.exe
Token: SeSecurityPrivilege	4728	LearnSeek.exe
Token: SeTakeOwnershipPrivilege	4728	LearnSeek.exe
Token: SeLoadDriverPrivilege	4728	LearnSeek.exe
Token: SeSystemtimePrivilege	4728	LearnSeek.exe
Token: SeBackupPrivilege	4728	LearnSeek.exe
Token: SeRestorePrivilege	4728	LearnSeek.exe
Token: SeShutdownPrivilege	4728	LearnSeek.exe
Token: SeSystemEnvironmentPrivilege	4728	LearnSeek.exe
Token: SeUndockPrivilege	4728	LearnSeek.exe
Token: SeManageVolumePrivilege	4728	LearnSeek.exe
Token: SeDebugPrivilege	5584	LearnSeek.exe
Token: SeDebugPrivilege	1588	LearnSeek.exe
Token: SeDebugPrivilege	5800	StartDirect.exe
Token: SeDebugPrivilege	4192	StartDirect.exe
Token: SeDebugPrivilege	4628	UpdateSteer.exe
Token: SeDebugPrivilege	2968	LearnSeek.exe
Token: SeDebugPrivilege	1096	UpdateSteer.exe
Token: SeAssignPrimaryTokenPrivilege	1588	LearnSeek.exe
Token: SeIncreaseQuotaPrivilege	1588	LearnSeek.exe
Token: SeSecurityPrivilege	1588	LearnSeek.exe
Token: SeTakeOwnershipPrivilege	1588	LearnSeek.exe
Token: SeLoadDriverPrivilege	1588	LearnSeek.exe
Token: SeSystemtimePrivilege	1588	LearnSeek.exe
Token: SeBackupPrivilege	1588	LearnSeek.exe
Token: SeRestorePrivilege	1588	LearnSeek.exe
Token: SeShutdownPrivilege	1588	LearnSeek.exe
Token: SeSystemEnvironmentPrivilege	1588	LearnSeek.exe
Token: SeUndockPrivilege	1588	LearnSeek.exe
Token: SeManageVolumePrivilege	1588	LearnSeek.exe
Token: SeAssignPrimaryTokenPrivilege	5800	StartDirect.exe
Token: SeIncreaseQuotaPrivilege	5800	StartDirect.exe
Token: SeSecurityPrivilege	5800	StartDirect.exe
Token: SeTakeOwnershipPrivilege	5800	StartDirect.exe
Token: SeLoadDriverPrivilege	5800	StartDirect.exe
Token: SeSystemtimePrivilege	5800	StartDirect.exe
Token: SeBackupPrivilege	5800	StartDirect.exe
Token: SeRestorePrivilege	5800	StartDirect.exe
Token: SeShutdownPrivilege	5800	StartDirect.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1480	3680	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	89
PID 3680 wrote to memory of 3192	3680	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	92
PID 3680 wrote to memory of 3452	3680	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	94
PID 3680 wrote to memory of 1152	3680	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	96
PID 3680 wrote to memory of 3564	3680	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	98
PID 3564 wrote to memory of 4664	3564	DriverDetail.exe	101
PID 5584 wrote to memory of 2696	5584	LearnSeek.exe	107
PID 400 wrote to memory of 4336	400	StartDirect.exe	124
PID 5300 wrote to memory of 5588	5300	UpdateSteer.exe	127
PID 5588 wrote to memory of 4988	5588	DriverDetail.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq ZhuDongFangYu.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq kxescore.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe
  "C:\Program Files (x86)\ExploreDescribe\\erGnOCbSSOddbbP.exe" x "C:\Program Files (x86)\ExploreDescribe\\SuperviseDistributorMajestic" -p[)+99PKgFXpJExploreOrganizerGentle "-oC:\Program Files (x86)\ExploreDescribe" -y
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe
  "C:\Program Files (x86)\ExploreDescribe\\erGnOCbSSOddbbP.exe" x "C:\Program Files (x86)\ExploreDescribe\\ExecuteContributorRapid" -x!1_DriverDetail.exe -x!KKaInQAGAiYgkAv -x!1_TutorSteer.exe -x!1_SessionSummarize.exe -x!ddzg -x!jvcgj -x!hjbjl -x!1_UpdateSteer.xml -x!1_UpdateSteer.xml -x!1_StartDirect.xml -p17]28hrRQLlhPromoteNegotiatorKnowledgeable "-oC:\Program Files (x86)\ExploreDescribe" -y
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\DriverDetail.exe
  "C:\Windows\DriverDetail.exe" -ExploreDescribed Explore -ExploreDescribeS Describ -ExploreDescribeP 1110
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Program Files (x86)\SimplifyAim\ToDeskSep.exe
    "C:\Program Files (x86)\SimplifyAim\ToDeskSep.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4664

C:\Windows\LearnSeek.exe
"C:\Windows\LearnSeek.exe" install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\LearnSeek.exe
"C:\Windows\LearnSeek.exe" start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\LearnSeek.exe
"C:\Windows\LearnSeek.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\TutorSteer.exe
  "C:\Windows\TutorSteer.exe" -EraseSpecifyd EraseS -EraseSpecifyS pecify -EraseSpecifyP 1023
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2696

C:\Windows\UpdateSteer.exe
"C:\Windows\UpdateSteer.exe" install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\LearnSeek.exe
"C:\Windows\LearnSeek.exe" install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\UpdateSteer.exe
"C:\Windows\UpdateSteer.exe" start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\LearnSeek.exe
"C:\Windows\LearnSeek.exe" start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\StartDirect.exe
"C:\Windows\StartDirect.exe" install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5800

C:\Windows\StartDirect.exe
"C:\Windows\StartDirect.exe" start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2648

C:\Windows\StartDirect.exe
"C:\Windows\StartDirect.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SessionSummarize.exe
  "C:\Windows\SessionSummarize.exe" -ComprehendGeneralized Comprehend -ComprehendGeneralizeS Generalize -ComprehendGeneralizeP 1111
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4336

C:\Windows\UpdateSteer.exe
"C:\Windows\UpdateSteer.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Windows\DriverDetail.exe
  "C:\Windows\DriverDetail.exe" -ExploreDescribed Explore -ExploreDescribeS Describ -ExploreDescribeP 1123
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\DriverDetail.exe
    C:\Windows\DriverDetail.exe -ExploreDescribed Explore -ExploreDescribeS Describ -ExploreDescribeP 1194
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1_LearnSeek.xml

Path C:\Program Files (x86)\ExploreDescribe\1_LearnSeek.xml
Size 465B
SHA256 c94abecda046656c4c7c22119545c37ec0bc5d960af6ed7d376fa644022ab734
MD5 ca9239108e7474efd714eded7447ccec
SHA1 8acbaea6a525ac8b55fa45d8594c73390a9f01ba
SHA512 5be71fa6845737f970cfd43f71720188e728317d1c1eba924da7f896aeffb405ee8564ba0069b88782bd3a45be1c30aa94b6842797525d858d1eafebc4be86f9
TLSH
T17EF0272409C6A9A329399069FE21E3291812D28890C82AC2B9D58702618A9D969FBF06
MD5 SHA1 SHA512 TLSH

Submit Download

2_DriverDetail.exe

Path C:\Program Files (x86)\ExploreDescribe\2_DriverDetail.exe
Size 12.2MB
SHA256 15f23022f9b591d56d8d962c595ba93cdc37a1f35f98bf3ca09ee927819179a7
MD5 7771af1017fcf37c05fce252690b940f
SHA1 7da82cb06a101a673d8a02936427f5791cdd1390
SHA512 4c7457c8582ea69ed4bfd17c2296f475a65989cd9d9db43db88dbe0e2d1fc79c5021be4d5fb85670ee19b0ec4c573e63e4dd901660fe0dc7fd75fa98d8b4b145
SSDEEP 98304:aHqqqrzZe5K/ZD6IUot1ZhwWGbqSKn9uLR4SbjpWvdyb8VRLYI7sKdWeJ+JnbO9j:oqVFu6Cxzyta6Z8p79Y
TLSH
T125D62950F9CB55F5DE03283044AB526F67305D098F21EBDBDB247BAAF833A911E36648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_LearnSeek.xml

Path C:\Program Files (x86)\ExploreDescribe\2_LearnSeek.xml
Size 424B
SHA256 17ed8ab7df13943414cc6bdf25e9d1710c9739e5177da3a3b60c586cd1ca658d
MD5 dd22be4f56d4e171bb9b9f48a87cf4b3
SHA1 48a747c5836dfefff3c86794fad06f81104b6402
SHA512 6a1743ce4898c7b34a0dce1dfcb9c7b2328e2da5364bcd96193d06b90b6c8041814d15c72086407c02a4456cc31ee246fb72e369e359964356560ffc924e3711
TLSH
T1DCE0AB500AC679F30C799456F922D3263862D38419D83ED1BAD20B0725CA5C9A8FFF02
MD5 SHA1 SHA512 TLSH

Submit Download

2_SessionSummarize.exe

Path C:\Program Files (x86)\ExploreDescribe\2_SessionSummarize.exe
Size 9.9MB
SHA256 b7eb202fad4999c32f833161c344ad2426fd54fd7aee7a91811b3c8ba0ccf0e1
MD5 e0ac075f7e9774bc1bab287292f8a077
SHA1 80281c8724f1e056bf23f18596a0f4d558daa577
SHA512 a0937ed1ed3e043dc5e686eff36fd935b7e676f08e4160f8d8579e9d2bee07de55ac8e678baba59c580d2d5541f4c93a8cd75825151c5659ae924bbf8167a9c8
SSDEEP 49152:LLmTrfh8J5EM0dWZ3yS+47IjoDWqtRJK7A0En1+DojvftDDysXB2ClSj4YSRZ1BQ:fmTrqMM0dW5n+4ItcpJfXBvnTswC
TLSH
T19FA62950FA9B50F5DE031930449B627F27346D058B28DBC7DE20BEA9F87BAA1193325D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_StartDirect.xml

Path C:\Program Files (x86)\ExploreDescribe\2_StartDirect.xml
Size 469B
SHA256 11b2b40329450cf42b075c69389f740474bce752e1baa59562ef5f046dcf1ebb
MD5 f00cfbdaecbe9684843a04efeb6447bf
SHA1 1ff9d2cf9b064c1764a0dbc14b7905f0a6337082
SHA512 8ce4129f0495e53dd007d30485f12b5404eed454e3c16c3eac4bcfb4025949092c3273fe6cbc1a9397072afde1e42dc2091b498568d70579c4a7182e929b1016
TLSH
T1BBF097B114D271FA1C3DA862FF336BE981B2E381744918A172E50B438040CCA89DBF4B
MD5 SHA1 SHA512 TLSH

Submit Download

2_TutorSteer.exe

Path C:\Program Files (x86)\ExploreDescribe\2_TutorSteer.exe
Size 9.9MB
SHA256 beecad9cd86f32084f422bf06760ee2686f0095642c1d3458f141524240b21a4
MD5 45a6d923eaafb741f49eccaadbe9f8ef
SHA1 0b88a7388dc62ff35e8dc72c8a63381487b986bc
SHA512 42d10be24c2b5596562bad15f3daecbce92585865d39bf640dd9ab8b405ab6cc384f83ba8cae2149bdb559cb0999365ae057c6bc33b7df66e03be2910289ca7f
SSDEEP 98304:SuPPmotUSjhS0WGc4Sa0wjdzOcnuI8vesty+BWCR:hPxtcNaldzf58vFty+wE
TLSH
T135A61A40FA9B40F1DA031A71549B627F67346D068B38CBC7DF50BE9AE87B6921D2311E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_UpdateSteer.xml

Path C:\Program Files (x86)\ExploreDescribe\2_UpdateSteer.xml
Size 441B
SHA256 2fc86edf1592d1d4bd9e7dcaafe97ba2f8ba3e95f8915e8e93349898403d194f
MD5 9d938b6e441efce791a4669af9f66d36
SHA1 e0d38e675ef9211a75092917f221a5d478bad036
SHA512 de22c5096209a6e33e6cf29b9e11f9a9e193e90d6f628157c35a80d05ff2214549343d3c496316d32df4e8223408499b40b04dfa69f0fa27b6f39cb22604a696
TLSH
T1B5F05C8208C67BE6A83F40467C3296152962E3E4D0440890B2E245035980ADD6C3FF03
MD5 SHA1 SHA512 TLSH

Submit Download

ExecuteContributorRapid

Path C:\Program Files (x86)\ExploreDescribe\ExecuteContributorRapid
Size 6.8MB
SHA256 b7a6fab3421800952647cfe8e41c0d4542a363c31a39e0a6c931f93d57a02f34
MD5 4f238ec42aeae2e07f1e08b6aeaeccfb
SHA1 22bdc841db2dac507a99f2fb1fd1ec8d88df66af
SHA512 102bad9d35f51c7273aa52f70d6e49087a3b7d2c3b46c83303726b2b18bd242caccac0b818ea4bcce449ee6cf1b7ffbb7b39ece7cbb83f5b1ac367010103128a
SSDEEP 196608:xus7uGIYQZIdlqaj1Zqd3ZUZ2O1r9vf0xGeCMD:xuKdBYUZ2O1eD
TLSH
T173663373B478DAE766340A56A81803F52DBAC4DF0D091BA6E15888FB46CF84FBD75138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuperviseDetail.sys

Path C:\Program Files (x86)\ExploreDescribe\SuperviseDetail.sys
Size 470KB
SHA256 9ec2208d18ddd14080991962c4eb303e099c0aa03ec29c0b2bff64278971a040
MD5 3515c05c62754981ddd41f01b04e28b4
SHA1 05e33b78c7099a6a566733cd0092a2b1a3387d0e
SHA512 ac56601f72ce898671f26c76e0e626316840e6ade987ead118c7a59e1431caf87573db057adbfb7f31e6945906755fdba35d6f8592d405b235a8043d5d3c55ae
SSDEEP 12288:i0UDgQt0+0lPGqVKUZQyMgOEpxkeAsmJqk6Ro0xvNKj0:i0UDLtn05fsUWyMdEpK4mggQ
TLSH
T10DA433BE1E497C01245CE9C74B370E9063ACCAD97F19A6A26B524478E1C6E1F123F4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuperviseDistributorMajestic

Path C:\Program Files (x86)\ExploreDescribe\SuperviseDistributorMajestic
Size 6.8MB
SHA256 df57a83b5a029ec3aab81e185c5163d3969408fcfea93828006340f2a395e09d
MD5 cf6c9d03a0f696bf96a3661df442f59b
SHA1 06bdf242cdbdb6e6a6ed36d30ab06aca74146ad9
SHA512 f87c313eede49a1d20383c0c64c08f64928812a1075e6802d8483365c5faa9654ef82fb1b93d4c5e47e9a31def242ed8d20fe4c14f44a4b5251c35285c35de6b
SSDEEP 196608:KEVo7HmlavpQUtfZjbGMDfxxFITfvnYqU9xhW9Gf:uDKaRQUtJv9xFI7nYn9Bf
TLSH
T13766337CAC90D3EB838896D9065BD815C91D5AFBC42644E7E74F98E6B913380CEF422C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSteer.exe

Path C:\Program Files (x86)\ExploreDescribe\UpdateSteer.exe
Size 606KB
SHA256 7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664
MD5 4e85cc36adc996c3ddd3a9825d4b7f73
SHA1 e5aa0e5db7d9fd27e2a0484f3fd6c322fc5ee97f
SHA512 2d7b7c5eb54cf68a218fca7239c0e194af0b81796e621bc039edccea64b60a202670a47af207988467a8c25584cef96a6652f52d53464ce3cf01006c680f2980
SSDEEP 6144:HcNM+RCns3iTVqKxGE5eYHM2GevEYlm3NI0vHhaL3gEXm//mAm+snmFMuImPSyqj:8NvRWVqceY1Emm9t2QEQmNONI
TLSH
T1F4D427103BF8961BF2BE37B1A97006249BB4F956E7BAE74F598415AC1C637008D2137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erGnOCbSSOddbbP.exe

Path C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe
Size 577KB
SHA256 06654d17334fa342f62d42bd805c8bc6da8105612d9ff45c45b8f092a7c46e17
MD5 0fe04f5747f21419bc96e130b2068238
SHA1 558279fe10e5dc98419c3d7e138a569e7ca59011
SHA512 a76fe81d96b1c4af92f4cee5ec567cee1393960bccf290963541e50df0b5286154878de577f7e383b5c0a75a4e134b71243e4e6154ab10ddda0d7a3a4c1a939b
SSDEEP 12288:YdyZcuzXeA53PgZ/C8Qdi7cP/ruuX56cEnjsFMfVS63TLR2Ry:YdCLeSE/CDdigHrvkJnjsFMN73TLRWy
TLSH
T18CC49F163AE5C07EC6521530CB1E6BB590FE83680B3248C767C45E6D2B349E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powrprof.dll

Path C:\Program Files (x86)\ExploreDescribe\powrprof.dll
Size 386KB
SHA256 48fd5d505685f86b64bb57d06255145c3892f5a0b575bf69f1553bb7755e36d1
MD5 fb761ccef534d74c038eb2bb06d92520
SHA1 5ca25ad5f758867b74e588d1762f4f4a0dd85c38
SHA512 a02455ecb16ca0baf95a72e199686906bbb5cf085edba93528c4c1606277f5fbc5ee7598f81f4d520d95ae7bd831fb18b85546033a15cdfa1736c501a62ee3e8
SSDEEP 6144:vzsGQm3VKUPObloEs5kDph0lhSMXlBXBWHt07CiTzl:gGl3VKUPOrph0lhSMXlCa5TJ
TLSH
T1C784AF10F5C6D072E15E0A70A9789FA94B3E9D508BDA29CB77985CB74E301C1AB35B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsc.dll

Path C:\Program Files (x86)\ExploreDescribe\wsc.dll
Size 3.7MB
SHA256 1c3f2530b2764754045039066d2c277dff4efabd4f15f2944e30b10e82f443c0
MD5 00f206b3dfc921f0c696b0c346e39fc9
SHA1 fbfdc8bbff6225cebcc4f005c985159096b0d709
SHA512 98fc6510a9c7bf1b511e5c00c4e8b16f2e28f4204f2c557988d2e16107abbc3138e7624e33620bd7c854cc0487a82f9a6fd23932b83e68c7d8d20fe1ce50e1f0
SSDEEP 98304:FvDRuz3nnji9jnZOUhrjOuf9q9hmbwdy:FvDRu7nj4jnZOmrjOufo99
TLSH
T172067E1076078426E4DF12F19A78576BD63CEEE50B7140C783E5AAED0D528C36B32BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsc_proxy.exe

Path C:\Program Files (x86)\ExploreDescribe\wsc_proxy.exe
Size 55KB
SHA256 bd4635d582413f84ac83adbb4b449b18bac4fc87ca000d0c7be84ad0f9caf68e
MD5 06807d8d7282959ce062f92a708d382f
SHA1 ff2d55a844c1fd37b3841cefa7e2d21de5fa8bac
SHA512 fa3a37034c631410b04a520337c0c45b53e667daf9d793512a4f6e096778503f2a6708bcf2e06a3eafe269845fe72e64cc95bf580ca8f65171d1d22ff931b478
SSDEEP 384:1wwgWTQGUdyG46/PygAYdoB30uRVHDOhFHMszTkak4FJZEuV9TUUhX7veFh9ZsZm:1yGI/PzmESYUawSgUhaFhe5DGwhMf
TLSH
T19643A4125E101911D86A0A30E05DBA1E1A337FF75A30926B3A39FCDDFE6C77B2464B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp808C.tmp\System.dll
Size 12KB
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp808C.tmp\nsNiuniuSkin.dll
Size 287KB
SHA256 33e460a080a621cda7896e96b6f1beee802b485cf99e18b27463cd362c484b08
MD5 bb0cdff5ac2d64723007a0b4f7962a02
SHA1 410889522ee8ea7308b054f71bc4cab078295e06
SHA512 b4dc2614f01f5f01d5dec9e6a41e072d01e924d8a94ac0dc1050399fd1dc3cc8d53d7ccf162d750d166fca200771b0850191b30c7caada8edea9ba6d686e2402
SSDEEP 6144:EfuMPhou62ZrZxAxgGTpMayh91VDrH10nCRwbDB0Q5MeKxhwNsN:M3hC2lZxAxSpRbWnmADBpM+iN
TLSH
T15A5422462F7D6833F8FC0E3A76844625B513E253A431C4C912BDDB80E97572B6B8A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nsp808C.tmp\skin.zip
Size 733KB
SHA256 6c979c5efd4bca0ea050f24c2a063ce88d3fc02dfa4bc11f3bdb169da6e0875b
MD5 121c40b2f8f3407211a14efec60088d3
SHA1 36bb7a0d4132f10cb165eb2b388489d7b9b3057c
SHA512 23efc5b5c0ccc25ec568557f9e7a9a8237fbc86a9ccec7214b7e68482171c6a8077a8a1ffc123ce0078ec2771b00b0494a713289a2215919625e1911a5608266
SSDEEP 12288:Hw+KAT8alkacATdefeWU/hK4lTp+77YTStyx038GusKjWU/yK4lTDPaGWzMIMrwc:Hw+KATNTcATofe5/hh0zs+8sKj5/yhlt
TLSH
T1E4F423B7F052FEEBD8E6A7BC381E010AFB92575E8635E3339846C4C94B5A784CD20615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 801B
SHA256 b2baf2df8a8536e0e79230813bdaa7bff57974ecb68f2757a9250930f380478a
MD5 e9a146d6251a5c646bb0c4b0de11053c
SHA1 0e3cb419c4f65fba0cb6aeaaaacafdc59a7c2eeb
SHA512 0014c0d1f33ec837775cf861c93eac9ce183e5cbe822b5054b89eef70495379c11ae0c922a81bc40d46afa50fbed9d6d19212e47a4d5778daf4682666457805b
TLSH
T1A101482202FC143B6B6E164B83068F567B06F120E78634713A70D149468522A5DF97EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 865B
SHA256 4902a288bf1f81020515490178f1bd6b3411985b53ac2314edd613406bd80b2f
MD5 844ab3e8fef48dda01a3acd1bba73d4b
SHA1 02a8a3e25657fdef1573f8cc2e42d07741ba82fc
SHA512 e955797d482273b4d06163fb8770707ba97e8c466c0fe200bca948ae4289f3640049dc8998970e2dea127d9e2afe0d588f93511c3be74f100e199bbae0dc04eb
TLSH
T19211592202FC143B6B6E164B83068F967F02F120F78630713A71E049468523A6DF97FC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 1013B
SHA256 e0f87927647ad1a794a01601ef3bf464f389372ef999646dc59a26a5ed3cba99
MD5 c82885c63166cec5c8b3521bf003b2d1
SHA1 62507a735ee1e5ce522f846fb96ef0cb0e6733e4
SHA512 70fe3d76cb1fce4e12ecab24b3a589bf2a59a61065d56e7951666aab2f657e5fdfa5703c5a604ad535589dc84436600a4df63d8bd8c992236650ec2b505ae9d9
TLSH
T12111366202FC157AAF6E1A4B830A8F967F02F520F78630313A31E449458127A6DF93FC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 1KB
SHA256 0398fa053e8c6e7502206597a05b8446ca8dc5dcaec8f005b4fbac67c276ae68
MD5 c1f2b46883f15c8ee6bfed35875fff42
SHA1 eefe92b1c5b9f68126fa925f172245ecef339914
SHA512 6c0c27ac5ca6af9c0c35e24f806261b65e611c113c3e4553ea651575b97a58d8f0e6c64530db52b7228ff773788a76d22fac2503a2b08724c91923b07a3f6dad
TLSH
T10821252202FC157AAF6E168BC3168F9A7B06F520F79630313A70E549458427B5DF97EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 209B
SHA256 2231635fd21052fb2cf308187f8f5f68fa85bea5bef11cebaa35e5e2d9bd4d8a
MD5 3c93f6de547c212bf60aa98cd594e3a3
SHA1 9ef3204b824c19b89988b14f0b2efbc8e0911026
SHA512 eee16657c6407470c0355e5870661dca2c43b0edf1ab6fe219c349ce8b76fed443da6b931f554f4e443ea6ca9161ce15b93c7e80b9ff2a3f35547f10e366d81a
TLSH
T12AD0A9A602F810387E6A1B8F83091E86BB48B220EB822021BE20D40B45802225AF03EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 357B
SHA256 b6ff5288ef10370c485413ec65c6ecfecefe5d24b3bc2582ff0daec12970b190
MD5 94a456184e4521e71e93632c0b2568d5
SHA1 09d9f26843d3dd842c5407e6fa5a4b22dc2a2771
SHA512 2d78c86d2dc192273959ef53ec537814c6b554ad772e4e1938183183714796ffabaebae6e6aa8c60a305034ebcd4d27b4db3fd51f13073a9b88d9d7836559366
TLSH
T1EBE0D86301FC11397FAF1B5B82095F867B05F520EB5220217A30D446448036B5DF43EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 484B
SHA256 3c3e0807691cd0a35e1f81ff02d9784fa000557bf8e05b04e65b1ae54193f7c0
MD5 28ffb60d05862c8c257781d301b1e9be
SHA1 817c2ae352bae07e05dc103ef980cc48ef0c0b18
SHA512 c3fd5e3d741b992c700e4674a6479fae2ac3a386ecfbff436973c8e7bb704899361342b3abe02c3d50ce68e73321315c691bac30548b12a4b6b41008193f2e53
TLSH
T108F0546202FC117A6F6E179B921A5F9AB745F630EB4520613A30D44A458026A99F43EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 616B
SHA256 fce06c0ac93f6fbbcbbb861f3fbc7dd52cccb22fcbd1ca3cbe57630dfdedb084
MD5 68158f029adf17d7912a45291d7d806b
SHA1 4182e935aa89348dcdb09aea61c834f7ff6c14f3
SHA512 6cc02770c565815bd7cb6d34ea3b84d75fe6b80b883ced083c9c0acda853914f4e320acbf5a6ac8f804167ba2da1f682cdf6201aa0230e624052752c70483823
TLSH
T14DF0F96202FC147A6F7E164F82069F9A7B05F160EB8130613A30D505458526B6EF97EC
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 64B
SHA256 2f38c95950d29b71048eb34d072b0ee1a51bd561b3380fed1517754690fa11d4
MD5 e59b1b0d88b583fb89d25f1298cd7649
SHA1 4792bfdb8b1e6b2b7393c87c714cead115e75aa6
SHA512 9c2e9151e71950910a65f12a83e29756180bd3c7b040245648e38e5dab873cd692b9c40f6b3b722f5c1b23989406587ce35c142ec945789a0f07b26ca34a1b0e
TLSH
T106A002E312F8257E7B6D5A57525DDB94BB01F621969100311612A018846156A24B03FE
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 128B
SHA256 f31df247b6bfe8761ab4b2270a62f20696ac334573f9ca05cd84ac1705369102
MD5 46855e5e38bff62e74af5472ee6d7953
SHA1 6155d729b201fda46f98d103e3443294618ddc69
SHA512 5df5c66faaf6ab688a21a258454435cead1d99bf7b68d2130dd7953123a024b378f16e89ffacf9f8a13a326b5e0bf77704d7eb0371bb7f5d8b090745f6b2f55f
TLSH
T125B092F312F8257E7FBE5A47525DDBD4BB02F621A69110312622A058846156B34B03FE
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 343B
SHA256 9a56f5f4dbfe58f8e67e9bdcad747636a997a87794b09ae4a693d2160c621da8
MD5 9a342a12c7a493942d22459df56f2145
SHA1 da38b681c2a3cfd77a565f4ee507ae84c4558a94
SHA512 bbf2197a70fb404f999d22711aacd362dcdf1ae5d0322cf2fe456a8dd25c3773664caf446da6b52f3d47f2411b3b2902acaaeff596d9b3aac0f830dee1153720
TLSH
T11AE01AE302F911792F6F274B460E4F997701F625E24520213B71A85A498066E6DB87ED
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 411B
SHA256 65049b2b3f98c503620cc3955a88ea312cc3b684296a5ef917f60bcdc74dc077
MD5 8e94f5cd96332dc779dd0affeebbd2ca
SHA1 2b731ba77d034a17556d8e2dceeafe5b19907541
SHA512 10d396c0852be3696c9f838fdfa2062f54ca96e7360415c8fccd0d5fbf4fb215e0c8eb4f351f09f7857f0b9b1d48366d99b1fc42762fb034c8dc20c20a3b5461
TLSH
T17CE039A202F821792F6F274B460E4FD9B701F625E24520213B71A84A499066EA9B87FD
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 831B
SHA256 f285a657f8d9e006b8d3130f8d161f9b0a426f2d7785ce917814f49076070805
MD5 fd172245469c425cdf28d22f8d603956
SHA1 529273c01b86ac3ac395398ab303a036e271f305
SHA512 741e5a0d3d27dded3f6b573593c10674850045f57caf7748735f302ee682766bc77d427b706e623bae80729d0f83ddf4203ed9c31107f356b791b18be88809e9
TLSH
T13901596701F811BE1F2E2787972A1FC57742F121B25520313A70D149498016A6DB57ED
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 64B
SHA256 cdebc869fd656fa825fee6ba52af83a317afcc04f2f36381ed07f3bca639ffde
MD5 045b1e0f873f66939f6e0eabed14a4e5
SHA1 7ee8d3221271ee7c4d063951f6feacf2ef013ebb
SHA512 d0397287fe04a8c2aea42d732d5a37bde9b3dd48ec015aee6955ef3aec97e66a3fc2c072a6926f23f47dfba8411f13bc11036b48568353b49a53950e9c3136d2
TLSH
T1D5A002E325F8257D7B6E2D47921D9B94B701F621D69500312651A148C4A167628A03ED
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 128B
SHA256 360adf189855bceac561d03c8a9d0fd2325c1ee721a654029b6e2dae729cff85
MD5 f9935e271f75e4974f7ffa9effdb7b64
SHA1 6e8832d32f8f082179dc4fc76e30e446fb8b83d5
SHA512 8fd3ca4dcee0b6adc980677161fafd11f8622544c3d1f2cde701c4aa7fbcc0b29bb7992fb546474ce977b4d18101f208a19a152fd8f36d1ad6f31deb34cdf158
TLSH
T11EB09BE335F8257D7B6E1D47521D9FD4B701F631D69900313611A008C49167628B03ED
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 632B
SHA256 c54f18a5b8786350e8cf1018f36bdb3d1bba8777f833d6d039fa7a8cd2f666d1
MD5 7f41792ab6d0a5ca47c50e364249d309
SHA1 969f2eb2c9e2e6f5af341c1331005057e6b44626
SHA512 aa987163e138bfc59cf51a82ad9d9c4fe170e4d2446bf35943fa4c7402e469d44be612404f1cc1587b66124f989dc9cfe7fbd78ebaed81cd7f318fd1257d1c82
TLSH
T1A0F0D68210F411F27A2B115F8D1B4E457390F038E56E712133F0954A9BE592EAA763D9
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 1KB
SHA256 33cc93c7d8474ad89546a481648f60e24c1feb98597744df41888f10433984bd
MD5 530c3e2265991b21d4de1d6758847ee1
SHA1 d22578254d6e64ad5760c3a13e92c20bc33d3bd9
SHA512 61ba374137d2cf8affebf4913650e1dfda9c87e8d2b94095da4cea7f29cb69d8aa07f4d190e30db6ab36507c4a9a1b0342c8392bd43a3a7616db8f1142252599
TLSH
T17F11388204F821F6AB2B155F8A174E457B95B134E259302037F0C00A9BE5E3EAD793DE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2696-84-0x000000002A240000-0x000000002A28C000-memory.dmp

Download

memory/2696-85-0x000000002A650000-0x000000002A6CE000-memory.dmp

Download

memory/2696-89-0x000000002A650000-0x000000002A6CE000-memory.dmp

Download

memory/3288-62-0x0000000000D40000-0x0000000000DDE000-memory.dmp

Download

memory/3564-54-0x0000000001950000-0x000000000199F000-memory.dmp

Download

memory/4336-188-0x000000002A3B0000-0x000000002A41D000-memory.dmp

Download

memory/4336-187-0x0000000009FB0000-0x0000000009FF3000-memory.dmp

Download

memory/4664-127-0x0000000073EF0000-0x0000000073FAA000-memory.dmp

Download

memory/4664-191-0x0000000073EF0000-0x0000000073FAA000-memory.dmp

Download

memory/4988-198-0x000000002AAE0000-0x000000002AB5D000-memory.dmp

Download

memory/4988-199-0x000000002C780000-0x000000002C93E000-memory.dmp

Download