c4deb83ef667a813a7a5ef8ea4558f3c306686103b38528a73490c3b77d464ac

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_c11bd605a7bfa93e3f43e71cce1cd05d_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Size 17.3MB
Sample260925-yyvg5awbqa
SHA256 c4deb83ef667a813a7a5ef8ea4558f3c306686103b38528a73490c3b77d464ac
MD5 c11bd605a7bfa93e3f43e71cce1cd05d
SHA1 dc1aa5e2f3b4af0ed8938c0b2659478a99d0b3ac
SHA512 2c6b47f242201d141af88bca7ea204f01129250701d184a6480e29940ee17458740f2963526409d3edf25c6b77949665ded6e2650b5706d600b7840c76bb06c9
SSDEEP 393216:E8eID199lWxZ5FF49KLVddlAKcGPbrOmHpR9k+8LgQlwzVKN:E8R9l6z4wLjcGTaz1Hp
TLSH
T1700733623152AE79C41683371581E7B2E47DBD05A524A345FFF89E0B3B70FA2D20A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5248	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5892	cmd.exe
5408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_c11bd605a7bfa93e3f43e71cce1cd05d_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4784	findstr.exe
4888	PING.EXE

Kills process with taskkill 33 IoCs

defense_evasion

pid	Process
2288	taskkill.exe
2708	taskkill.exe
2688	taskkill.exe
944	taskkill.exe
6140	taskkill.exe
3488	taskkill.exe
3364	taskkill.exe
2892	taskkill.exe
1668	taskkill.exe
1560	taskkill.exe
2804	taskkill.exe
4196	taskkill.exe
1156	taskkill.exe
252	taskkill.exe
5008	taskkill.exe
2564	taskkill.exe
6040	taskkill.exe
840	taskkill.exe
4444	taskkill.exe
3056	taskkill.exe
2868	taskkill.exe
5868	taskkill.exe
2580	taskkill.exe
1732	taskkill.exe
3244	taskkill.exe
1072	taskkill.exe
3880	taskkill.exe
1528	taskkill.exe
5364	taskkill.exe
5072	taskkill.exe
4460	taskkill.exe
4656	taskkill.exe
4348	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4888	PING.EXE

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	252	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	1732	taskkill.exe
Token: SeDebugPrivilege	6140	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	4460	taskkill.exe
Token: SeDebugPrivilege	3244	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	5248	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 5892	1416	2026-09-25_c11bd605a7bfa93e3f43e71cce1cd05d_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	89
PID 5892 wrote to memory of 5908	5892	cmd.exe	91
PID 5892 wrote to memory of 4668	5892	cmd.exe	92
PID 5892 wrote to memory of 1776	5892	cmd.exe	93
PID 5892 wrote to memory of 2524	5892	cmd.exe	94
PID 5892 wrote to memory of 5424	5892	cmd.exe	95
PID 5892 wrote to memory of 5408	5892	cmd.exe	96
PID 5408 wrote to memory of 4344	5408	cmd.exe	97
PID 5892 wrote to memory of 4784	5892	cmd.exe	98
PID 5892 wrote to memory of 4888	5892	cmd.exe	99
PID 5892 wrote to memory of 840	5892	cmd.exe	100
PID 5892 wrote to memory of 2580	5892	cmd.exe	102
PID 5892 wrote to memory of 944	5892	cmd.exe	103
PID 5892 wrote to memory of 4444	5892	cmd.exe	104
PID 5892 wrote to memory of 3364	5892	cmd.exe	105
PID 5892 wrote to memory of 252	5892	cmd.exe	106
PID 5892 wrote to memory of 2892	5892	cmd.exe	107
PID 5892 wrote to memory of 2708	5892	cmd.exe	108
PID 5892 wrote to memory of 1732	5892	cmd.exe	109
PID 5892 wrote to memory of 6140	5892	cmd.exe	110
PID 5892 wrote to memory of 5072	5892	cmd.exe	111
PID 5892 wrote to memory of 2288	5892	cmd.exe	112
PID 5892 wrote to memory of 3488	5892	cmd.exe	113
PID 5892 wrote to memory of 1668	5892	cmd.exe	114
PID 5892 wrote to memory of 5008	5892	cmd.exe	115
PID 5892 wrote to memory of 1560	5892	cmd.exe	116
PID 5892 wrote to memory of 4460	5892	cmd.exe	117
PID 5892 wrote to memory of 3244	5892	cmd.exe	118
PID 5892 wrote to memory of 2688	5892	cmd.exe	119
PID 5892 wrote to memory of 2804	5892	cmd.exe	120
PID 5892 wrote to memory of 1072	5892	cmd.exe	121
PID 5892 wrote to memory of 4656	5892	cmd.exe	122
PID 5892 wrote to memory of 2564	5892	cmd.exe	123
PID 5892 wrote to memory of 4348	5892	cmd.exe	124
PID 5892 wrote to memory of 6040	5892	cmd.exe	125
PID 5892 wrote to memory of 4196	5892	cmd.exe	126
PID 5892 wrote to memory of 3880	5892	cmd.exe	127
PID 5892 wrote to memory of 3056	5892	cmd.exe	128
PID 5892 wrote to memory of 2868	5892	cmd.exe	129
PID 5892 wrote to memory of 1156	5892	cmd.exe	130
PID 5892 wrote to memory of 5868	5892	cmd.exe	131
PID 5892 wrote to memory of 1528	5892	cmd.exe	132
PID 5892 wrote to memory of 5364	5892	cmd.exe	133
PID 5892 wrote to memory of 5248	5892	cmd.exe	134
PID 5892 wrote to memory of 2756	5892	cmd.exe	135
PID 5892 wrote to memory of 1992	5892	cmd.exe	136
PID 5892 wrote to memory of 5780	5892	cmd.exe	137
PID 5892 wrote to memory of 4920	5892	cmd.exe	138
PID 5892 wrote to memory of 5756	5892	cmd.exe	139
PID 5892 wrote to memory of 5768	5892	cmd.exe	140
PID 5892 wrote to memory of 5896	5892	cmd.exe	141
PID 5892 wrote to memory of 4740	5892	cmd.exe	142
PID 5892 wrote to memory of 1324	5892	cmd.exe	143
PID 5892 wrote to memory of 1276	5892	cmd.exe	144
PID 5892 wrote to memory of 2816	5892	cmd.exe	145
PID 5892 wrote to memory of 2972	5892	cmd.exe	146
PID 5892 wrote to memory of 6048	5892	cmd.exe	147
PID 5892 wrote to memory of 4540	5892	cmd.exe	148
PID 5892 wrote to memory of 5808	5892	cmd.exe	149
PID 5892 wrote to memory of 4336	5892	cmd.exe	150
PID 5892 wrote to memory of 4864	5892	cmd.exe	151
PID 5892 wrote to memory of 2356	5892	cmd.exe	152
PID 5892 wrote to memory of 1632	5892	cmd.exe	153
PID 5892 wrote to memory of 1544	5892	cmd.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-09-25_c11bd605a7bfa93e3f43e71cce1cd05d_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_c11bd605a7bfa93e3f43e71cce1cd05d_amadey_elex_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ATM\INSTALLER\start.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "c:\atm\drvsp\exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1776
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "5\.0\. 5\.1\. 5\.2\. 6\.0\. 6\.1\. 6\.2\. 6\.3\."
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\setx.exe
    setx path "c:\atm\drvsp\exe;c:\atm\drvsp\exe;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;" /M
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg Query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language" /v "InstallLanguage"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\SysWOW64\reg.exe
      Reg Query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language" /v "InstallLanguage"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4344
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"0804" c:\ATM\myping.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM diag.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM IO_Test.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Router.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Diaginit.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHC81Driver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CIM300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CDM300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yhsiudriver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SIU300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHDrOKIUsbAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHVdaApp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CabcMainte.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TTU300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHTTU_EXE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yhSPSIUCABC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yhrouter.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM COLS.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM WatchProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHMonitor.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHHelper.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YHZip.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM FirmwareManager.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CABC_pc_lrae.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CABCLogFile.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CduCapSetTool.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM LogRead.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ResolveFramePlat.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM StartCabcDIPL.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Upgrade tool.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM UpgradeHeadGen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SPDeposit.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TestTool.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PowerTestRecycle.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5364
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"diag.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"IO_Test.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"Router.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5780
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"Diaginit.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHC81Driver.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"CIM300.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"CDM300.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"yhsiudriver.exe" c:\tasklist.txt
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"SIU300.exe" c:\tasklist.txt
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHDrOKIUsbAgent.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1276
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHVdaApp.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2816
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"CabcMainte.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"TTU300.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6048
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHTTU_EXE.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"yhSPSIUCABC.exe" c:\tasklist.txt
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"yhrouter.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4336
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"COLS.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"WatchProcess.exe" c:\tasklist.txt
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHMonitor.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHHelper.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1544
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"YHZip.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"FirmwareManager.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"CABC_pc_lrae.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6060
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"CABCLogFile.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"CduCapSetTool.exe" c:\tasklist.txt
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"LogRead.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2192
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"ResolveFramePlat.exe" c:\tasklist.txt
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"StartCabcDIPL.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"Upgrade tool.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"UpgradeHeadGen.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"SPDeposit.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"TestTool.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"PowerTestRecycle.exe" c:\tasklist.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

start.bat

Path C:\ATM\INSTALLER\start.bat
Size 1KB
SHA256 5d431d3f0c0ce187025a7b903612e875b2d27185f9f8f13e92e6773092accf6b
MD5 7bbab560a82985be5784c529626d0b64
SHA1 f832f2073de36021c39ecbcc8f35ed0295b2341e
SHA512 67198c3b4e90614762bfd824637323772a98bfd503f567b4c36a45354e2c1ee9a73782a870e900b7ce2a550426c6ee291082635ca178664050b9d6b14d99e1aa
TLSH
T1E031888AA8D10C6D950862FED27F180BCBC851470B00BFD4CFE700C966AB79A5297C6F
MD5 SHA1 SHA512 TLSH

Submit Download

C81Cancel.txt

Path C:\ATM\TOOLS__\CDU2\RUBSPDeposit\Tool command Library\NoLimit\C81Cancel.txt
Size 83B
SHA256 cfbc4f185d3a9348e4dbdfa5e122a58e32bd8063cc0405dbda669506b3188295
MD5 2da457e416c95444da81fef8760e8c15
SHA1 609a4d6d920c11f23bb8dcfe26985df85df277dc
SHA512 22c7ae09891785910296e333684da7e707b5d3728ba512a5cad5e85611a64168086bd90ee794511f09fd6f5c1ca564d452806315e679240ab85f01dc193d178f
MD5 SHA1 SHA512

Submit Download

C81DepositModeSet.txt

Path C:\ATM\TOOLS__\CDU2\RUBSPDeposit\Tool command Library\NoLimit\C81DepositModeSet.txt
Size 92B
SHA256 a82d058d80be1a66d07b93813178f61f8cf603f8cc667e1cca9265fbda441d16
MD5 13a1e815da5a68a4066fb6ad186392c9
SHA1 333ffd3d0330e704ac40b8574fd8495e0df36e6f
SHA512 00fd9619901e6be23c024e5175b3013837cf740f8db7275eb2350e589d8e604000417dcae1df28e82adeba5ec70a0b56bf9651a1870bef717bfa9749641b7bc9
TLSH
T1D1B0020366489645C64245C5C74471571704D052D1C180CD7B3140409208C470445396
MD5 SHA1 SHA512 TLSH

Submit Download

C81DispenseModeSet.txt

Path C:\ATM\TOOLS__\CDU2\RUBSPDeposit\Tool command Library\NoLimit\C81DispenseModeSet.txt
Size 95B
SHA256 a085331cf85562af834ecceaa130961e469b29a680f965209d961009e93e2c5e
MD5 741856eb63ca10bd6e5c5645e9c640a5
SHA1 78893b41193db5cb12589eb1a3c4e6a73b0ab8cd
SHA512 bfa4b243fcf50ff2800ee46e7eb38324d7fb7b47b0851e263cc44ac53cd23737bbfa5215ec1c6fd7b9b58032e8256f2d2fe3af85d8bb6fed911d953077976be5
TLSH
T16BB0020367884644C64041D5C74475572704D091D4C180CDAB314440910CD430445356
MD5 SHA1 SHA512 TLSH

Submit Download

C81Init.txt

Path C:\ATM\TOOLS__\CDU2\RUBSPDeposit\Tool command Library\NoLimit\C81Init.txt
Size 110B
SHA256 35bfee446367d1b445d0589d2009b809c513103bd501b36de0dadff080c078a3
MD5 b19d55209369c23af521bdedf5421745
SHA1 47f1dba4af3e426240d9d495cfcf00263d715618
SHA512 baca5c18c9f6b07742d25f0bb4f85936b89d4f1bef91b7499e089651e72fb6f4f2ec28340a2d33f722d8f3b7090d285537169c59a59da1eec51c698107612483
TLSH
T11EB0020263480AC4C64045D1C744B5571B86D0D290C1808D9F7152C09508C4328293A6
MD5 SHA1 SHA512 TLSH

Submit Download

YH6040~1.CAT

Path \??\c:\ATM\DRVSP__\DEVDRV~1\YH6040~1.CAT
Size 3KB
SHA256 cece1d9781d6a7337382231e2502105343cf0e33b6c4204a3d6b64f36d364837
MD5 33800da8b23f656831a7dd755f061e41
SHA1 e10d7b09b283ece6a13c205b10a6479c9c33b045
SHA512 84ca47b6deec6db0eb3601aaf3da4a53f486a1b868c8174a5ec0a66134c4cd048a36b1019fe1ee8c3dac9ff749593bdd3061e03137c108b565075cb319e9ac85
TLSH
T12B61E03616DE02B1906BC9F1EFF5A4DFE422EAB7E4005F7D219733614A41242B39E91E
MD5 SHA1 SHA512 TLSH

Submit Download

YH6040~1.INF

Path \??\c:\ATM\DRVSP__\DEVDRV~1\YH6040~1.INF
Size 2KB
SHA256 3742c681b132b74d9c1da3291734ad6cd8a9b86affa204b6440544ab40e31b52
MD5 21a4c692536c3abb244d10cf2edd2659
SHA1 c803a0e4f8003d2d208a488905882a08009d0287
SHA512 cc10d8796fba5a36d5db7032dc9210ce0a9b87b064c069023171fea483da9d8acaf81699b1367475728188063e60360a918b8392dda49b3711928c3c9f04f2e1
TLSH
T157519D9C1F0B6C303983EB2E5B430EE5E6A52140D188A278F5DBB0599FDDB48222D17B
MD5 SHA1 SHA512 TLSH

Submit Download

YH6040~1.INF

Path \??\c:\ATM\DRVSP__\DEVDRV~2\YH6040~1.INF
Size 2KB
SHA256 a25b286e85f5569cca3913e92e3688aa3f3d1f7cfae9b290439ce52b2776e1b2
MD5 c8958543ca6d713274ce29a76c520579
SHA1 bfe24d34872d9ba498b8af8f6431ab85d7188dd5
SHA512 024f143205cb5f93bb483a0e9ab14a289b0815e14f2a6831f32972a1594ecac22bb8743764655866958e585d828c7d6cb08641d17226282bbd1bc0886c74ad82
TLSH
T1A151889C1F4B6D303993EB2E07430EE5F65421409288A238F5DBB5A59FDDB4C222D5BB
MD5 SHA1 SHA512 TLSH

Submit Download

DEVCON~1.EXE

Path \??\c:\ATM\DRVSP__\DEVDRV~3\DEVCON~1.EXE
Size 80KB
SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
MD5 3904d0698962e09da946046020cbcb17
SHA1 edae098e7e8452ca6c125cf6362dda3f4d78f0ae
SHA512 c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea
SSDEEP 1536:MP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7W:MePOYe4bu1epDh8RW
TLSH
T16A83A50263E94619F1F77A346AB652311E777C95AE3CC68E0298915D1FE3E80CC74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTAL~1.BAT

Path \??\c:\ATM\DRVSP__\DEVDRV~3\INSTAL~1.BAT
Size 1KB
SHA256 a5326ecef529d05add7c8a9f2879290a927a93a68c8ed8b6dcdb01869f3d738c
MD5 ba49193c089e194d1c4cc361b43f2a91
SHA1 4cca40ec238414811642d121b71956d24db1e9cb
SHA512 78606ae13a33b9775dd1958cc51921bdba361ddc26da4f9e77d187918d6fe4e8868dd53d347142af93ed7227ba9b0844bb5d8b8b1bf945a17ebb638595ce9e98
TLSH
T19331FE7F386F95114B219608C0B5B09FEC0719560644F9F85AE020D8CA5F2EDEB27879
MD5 SHA1 SHA512 TLSH

Submit Download

INSTAL~1.EXE

Path \??\c:\ATM\DRVSP__\DEVDRV~3\INSTAL~1.EXE
Size 28KB
SHA256 5dda0e217068e5ebf2d3e88d8ee8682706162c01a2732b636f794a2819ce822f
MD5 a22973be060094c2f6a1bcaa3e67b845
SHA1 39e77ea83ed59bb3047d7976c8732bb8bff770bf
SHA512 2d9442221eec0cd1848c8fbcebcc248e42c0b644db5e44013010c25e09a0f4eaf2047a454b6a8c2ee12c3c2cceaa59e1570133044a4637e3fefeb42e6e5c2b3b
SSDEEP 384:1QwDTajSeszjpWO3/ke/mlCzvc6y0zjBarrTruAoz:11aj8jpJ3/ZDvNQjuAo
TLSH
T1B2D27C237C924573D48296B660B98F1AE73F56620F62C493CB546B6A3E302D0BE37347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETSIG~1.EXE

Path \??\c:\ATM\DRVSP__\DEVDRV~3\SETSIG~1.EXE
Size 24KB
SHA256 ecdf60191726aa534998f8ba27f97ddd9786131e65ce62cf196b31af34a1649d
MD5 8ccb2b13c8eeee4d7a471d5f16ce7e17
SHA1 673bb0f9b91def89a1c69a21c23aafdfb0590e2a
SHA512 90091c99e20069ca45475c61805428151615cde773ab70920f5d95623ed49715154e1fd5159e86f840c25e95a12677461872d074be3ee0752a7d227adb5a1e30
SSDEEP 384:IzSX5A5RvXxJBIgsmlMgguyyFZjrumoZ:IzSXGPBLI8y0Znumo
TLSH
T144B25AA7B8D54363E481C1B168F4BF46977F42670A3854A3A7506E9B2E396D09C3F323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WDFCOI~1.DLL

Path \??\c:\ATM\DRVSP__\DEVDRV~3\amd64\WDFCOI~1.DLL
Size 1.6MB
SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
MD5 4da5da193e0e4f86f6f8fd43ef25329a
SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
TLSH
T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINUSB~1.DLL

Path \??\c:\ATM\DRVSP__\DEVDRV~3\amd64\WINUSB~1.DLL
Size 979KB
SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
MD5 246900ce6474718730ecd4f873234cf5
SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
TLSH
T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFUP~1.DLL

Path \??\c:\ATM\DRVSP__\DEVDRV~3\amd64\WUDFUP~1.DLL
Size 2.1MB
SHA256 015f26bbcd619a0b67b5eaa985b69582bac27d5cbca99ce747a76532fcde4aff
MD5 ebf9ee8a7671f3b260ed9b08fcee0cc5
SHA1 d9688d1849a86dd209732529375c6ada272ff8fd
SHA512 ea869026b73b4c3d0249beb1fe81efc8b2686d66c5ddf916d314c21989e68a12191efc2a32ef13caf2676327159e95fc4e69100fc09df5a7bbf5c019ea383dd8
SSDEEP 49152:nFSDIHkg+yf6+ZsYx6h8hL8RWVtma96U1wrfjKClR4:FvHkWpsYxQgttBJ1wLXli
TLSH
T14BA52342ABB80021E5F2AF70A9B946A29B70F405473593DF2360C5986E737D1DE39B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path \??\c:\ATM\DRVSP__\DEVDRV~3\devcon.exe
Size 76KB
SHA256 fce41056259d5585c9eb97ebc957aacee7a5cabea6bd77789a37c5bc8abc6aa3
MD5 e277efb43c05c7dd60ae43a1fca472cb
SHA1 74912b3881ec8beaa2ecc5f301f1e7d1e6387249
SHA512 420546267a3374602ad69f32775b6180a1ce64f0fa23823883f8b71233bf08445ec9d3fa68f984b2a0407b2d5a19c17270f9ef5f0509449646b2c2eb46c88470
SSDEEP 768:k0rhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkA:R+KY04RMmSCYmBiF4O7WT
TLSH
T1FB73A80223E89619F1F33A3469B562310E7B7CA19E3CD68D0289915D5BF3E90DD74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WDFCOI~1.DLL

Path \??\c:\ATM\DRVSP__\DEVDRV~3\i386\WDFCOI~1.DLL
Size 1.4MB
SHA256 7a6bf1f950684381205c717a51af2d9c81b203cb1f3db0006a4602e2df675c77
MD5 a9970042be512c7981b36e689c5f3f9f
SHA1 b0ba0de22ade0ee5324eaa82e179f41d2c67b63e
SHA512 8377049f0aaef7ffcb86d40e22ce8aa16e24cad78da1fb9b24edfbc7561e3d4fd220d19414fa06964692c54e5cbc47ec87b1f3e2e63440c6986cb985a65ce27d
SSDEEP 24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
TLSH
T1BF65234193FE0258F8F61BB0BA7CA9916A397DD25E36D48F12199C9C18B1B80DCB1773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINUSB~1.DLL

Path \??\c:\ATM\DRVSP__\DEVDRV~3\i386\WINUSB~1.DLL
Size 831KB
SHA256 ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
MD5 8e7b9f81e8823fee2d82f7de3a44300b
SHA1 1633b3715014c90d1c552cd757ef5de33c161dee
SHA512 9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
SSDEEP 12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
TLSH
T1DA051211B7A48271E4E326B486BCA1B1597DB9B10B30D4EF6782A2DD0DB53C0DA7831F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFUP~1.DLL

Path \??\c:\ATM\DRVSP__\DEVDRV~3\i386\WUDFUP~1.DLL
Size 1.8MB
SHA256 a902bb3bff785faaeb6432be76f798627a80b2cc45441e16440e46e6d7340f2c
MD5 e1bbe9e3568cf54598e9a8d23697b67e
SHA1 92e15dcab8dda0d4bf9cc9ae98e273567d3ecd57
SHA512 01a04dda0ee36196054d2cc45c9aea7c9467d9f46ee9cf354d8f93260519bd1968b340dc2be3e4ce966bbb6e332f5aa72f29edc1bfb8e8d19decba7c2df3106e
SSDEEP 49152:qHAPbyCYhUJodNcmvwwoaehBUfrQHtmr8UQm3:OWyCYhUJ0cYoa0+TQHYr6m3
TLSH
T1BD85236173A84179E9E52BB623BCA6321A3DB5301F70828F238A57DD5C743D4BD3532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D_USB1~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_BRM\D_USB1~1.DLL
Size 916KB
SHA256 6f236fea9dd00dbc24f8291819d5048c326b383e7bfec6650bde704a794f21c9
MD5 27d7dbce2896a3f95d9690ec6920ba9e
SHA1 0af06bbf5b0add6fdde933f15223c0bc31ff11d5
SHA512 3909d6508a5777f866a680ba9bde3da018bb36f3842303546672c8242861d9d9d87f8e261c49a9e3a1c0cfec2ff0cc13c4169eb94e77a3e4fc9da1f14e5b7cc8
SSDEEP 12288:LZ8Q5clARWj0SVc8sp+yFX6xDG5bR/MVgqysQmOoOaQZ0sQPVcOBBzLRqEQrWzWY:18YclkW+hbR/MHyWOoO5ucOeWzW4noq
TLSH
T19B159C51B940C535D59D0270683DBF2A11BD68F08BB085DBFFC89A2E6E701D26B34E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ERRORC~2.TXT

Path \??\c:\ATM\DRVSP__\EXE_BRM\ERRORC~2.TXT
Size 659KB
SHA256 e14e03400f16992abbeb0e97bd0f4dca6269e5af4f51d3122783d95ef47fafcb
MD5 b1dcbf1006be49a5c4b058f0baeb45ba
SHA1 afeb8e5a383f886b6b3d4db34c2fb4df95b29b3b
SHA512 745ecd2aa9dd2b3b10ecbfcec57862ade032c5274deda9357a4921721a6f6d583c5926d5d9ca4fe6e9a2f47bf92b79d53253a8dc30dab8b178f70b3d933669e8
SSDEEP 6144:VUz9ctNCQ5ARjLUOhUl9uKticsz9cJNme5ARaLMOhUc9uKtiEILUGESOUnQ5CDEj:mpIuAtUSwuhtLtPF3
TLSH
T186E4946AB30422371A7343F61E0A2986B5B457021B205117383EE59137F99F6EF73B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OKIBIL~1.REG

Path \??\c:\ATM\DRVSP__\EXE_BRM\Reg\OKIBIL~1.REG
Size 3KB
SHA256 183de7d840fa4675fbb3f49960472d479988b3f93e824980195e6c728050d7d7
MD5 84984acd1e55b66e903eb9fc325260b3
SHA1 331f37da44215db541f17ca3c24bc15c1155a183
SHA512 92642d9254828890193817d9fafac524997583ec83897ee353b92e9f4c6caf0733301f802ea43c30311eecb786f43723d3ab750634be61e7ee5efcfebde6a94f
TLSH
T1B56153236FFA3105B2B37682AFF6A127872576A4565B909E20D12F0E0EF1B4058136E7
MD5 SHA1 SHA512 TLSH

Submit Download

YHBILL~1.REG

Path \??\c:\ATM\DRVSP__\EXE_BRM\Reg\YHBILL~1.REG
Size 3KB
SHA256 7805945da1015cbf8782f6609c060e1704039c05d6958660e7456de941038791
MD5 3fb949b886a7567910c346d440f28547
SHA1 d44aa5e1d1e65ff2738b721b15f3b0659a392906
SHA512 76652d706967843777eada03ed192ee7d2b04ea0c21fd09279b87597492020801441841d9de75f8f582f3d05df9bf2b61c18be34ca6df5154e341cf25f4407bf
TLSH
T1AD6141236FFA3105B2B37681AFFAE537872576D4565A909E20D12F1E0EF1B4018136E7
MD5 SHA1 SHA512 TLSH

Submit Download

YHZip.reg

Path \??\c:\ATM\DRVSP__\EXE_BRM\Reg\YHZip.reg
Size 152B
SHA256 b302d801499d28b23b46c9528a05e73b4334489b496573fa58a3a21748475941
MD5 e41ef1d72e0d985d05b96e5da6841a16
SHA1 d9729e7aa3582bf88257eb192051327fef624271
SHA512 6ed4c6172b01c2aad0747706a4e75647baefc18a6f834091974ba9a82b04116c438656f0106a2625394855238187af58fe428ee52b9c877d41a1574c5513d1a8
TLSH
T12AC08CF20A124111A1A46400081D4A916BB5472A385B8A6820C8A2A033E2AEB8A2E0EF
MD5 SHA1 SHA512 TLSH

Submit Download

YH_DEV~1.REG

Path \??\c:\ATM\DRVSP__\EXE_BRM\Reg\YH_DEV~1.REG
Size 65KB
SHA256 35f852fbb701af2e6f4355e7744a70a9b83d86b97657b7434ab56f0350af4c3d
MD5 78e6b83b66c8eea4de3eb8a9e65a05fd
SHA1 6f2578ca559bf0f0502b6339ac03cf18884fd941
SHA512 ae2077b351581079b1ba6b89e8edaa888c188738a9768cf2947551461052d2b27b6fa320212cb64523c66f5bb463b80024836bf97af7596fa269122d3320998a
SSDEEP 768:F1hQP1aUOITlIPwBIHdHFWpFrlIBZoSku:7hW1aUOmlIPwBIHV8bxKoSku
TLSH
T1BB53F43EDBE4212EE2B2CC40CED2893397566D52161FD89A24D61F5E02D35827C52BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

putty.reg

Path \??\c:\ATM\DRVSP__\EXE_BRM\Reg\putty.reg
Size 1KB
SHA256 666398a1cca2e3a7893fcaa429618691472d9536e4cb0c6d0c62432457bd208d
MD5 46f2bb042c7f2a5802fc3816c1849fc6
SHA1 3dbe36bc330ca10b734c98de1d3f24fa7ac58f0c
SHA512 b3373300f506d1285a80f71ed375bbe0c1d95c7b80f9cb8f77f72e323bdd32007182126279222ffe5bfc44e0208b5e9d5aa98e4fd1cf7d8cabff6d2ab6d0691c
TLSH
T1AA21873C1ED52237A2B7D6BAC6E946C7FE22741339112D4E10C7078A0953F53BC8064E
MD5 SHA1 SHA512 TLSH

Submit Download

Version.ini

Path \??\c:\ATM\DRVSP__\EXE_BRM\Version.ini
Size 54B
SHA256 601c7ff0ee32537165ed7e78f7d732a91ab53c1291596bfff1a85f0cec86966a
MD5 a3d46d71439f10a20a9e5a8d75be5664
SHA1 17bca9667a145d7e10a57bf8f9b3ab2106680843
SHA512 c06a085f1bb8857d395270fc42705230eec444bd7ae6932e3cdb6dc9c0e8d6acbde25fb18464b5730ce29dfe10ae19327f1aca0ecc75265ce85e92a4296eaf63
TLSH
T1E8900210601C492901445A12FA6C8093B2C41000615011483A42C7410E0245821E0024
MD5 SHA1 SHA512 TLSH

Submit Download

YH08_M~1.EXE

Path \??\c:\ATM\DRVSP__\EXE_BRM\YH08_M~1.EXE
Size 783KB
SHA256 76c6f7f50e6b2ca1a36de785c33a378522a99253f644ac11135bc84aa957ef8a
MD5 710afd65ed946e04e5f9ab7c1a286552
SHA1 2eb99341a91416b0d1cca2a71e9a9243381c62cd
SHA512 fb2d5162e83a72c6de45d1c96ae657333561c06755d973f301f44992ec6362093dd8530f114a0f255b95854261aaa8fd517ab9deeefd44e854640f5720204d6d
SSDEEP 12288:P5QgZNHgsNWibMbgsxHfo+Q+AW5NF2EP/EPVMg:BQAudHfo+Q+AW5NFHg
TLSH
T1D6053B1231D09076C2720EF06AA96264E57EBD631621C55F1BB95F1F8DF33806A34BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YH6040~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_BRM\YH6040~1.DLL
Size 1.8MB
SHA256 90e7befec71bec32ad819a66fd00dec2b6173083c1fe7418aba130e4249d8200
MD5 9c5fb43ad0f13fcfea564a003dd3c3bb
SHA1 a22ab5cc1aac8ce8dafd72574c04891020f6756a
SHA512 46ebcd40dc29a2ee8c2d00094584d99e0ad22f0e154e85c7c734f54fc7d7a3136307b6308d7d5d1edf9a8a20d9428f2da36d1c2eed467fad37492503fd454eeb
SSDEEP 49152:5ZFTmMsW5qfxzWNLLcJ20V4istaWw3YTKGkrBPS0:53mMDEfdWFcJ20V6at3YTKT
TLSH
T173858D2279C5C0BAC52F0732990D732E73ADE1705E3842C76E956E793D70983A6287B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YH6040~1.INI

Path \??\c:\ATM\DRVSP__\EXE_BRM\YH6040~1.INI
Size 19B
SHA256 3c5182263f8c45325e002d865db302ccd5d21ed3b45dfe71a3417a62e6c898fe
MD5 51c8e3b9d842ca12d16f7b64012f8e5f
SHA1 918c99f72109035b1dd532b18807a09cc7c7d6a8
SHA512 d722fcd83bd9969476b98d9e1c7601f634398d9f57a290d56057a649d4eaf38d819ea1e9be39040b1d958c2a32671ed529da625188f2c30f74e67654265f5f81
MD5 SHA1 SHA512

Submit Download

YHBILL~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_BRM\YHBILL~1.DLL
Size 295KB
SHA256 63e0c62f47296d211f0cb08b15692589e32c8a263d37effeba7ee9f832fb768c
MD5 6eb9f7d1305074bb4dbbbeeed2868b75
SHA1 5bb2840885f9821cd8acb94d0560d2218d3a7dfa
SHA512 9a373c3462fe6a12c545f98f5fff29253ca978b8cba77b65e3b6437ed198aa834e53e3de1cfcb89fe1654de9fe65e8215f2071f33a67fca8faaa2dc867275cee
SSDEEP 6144:LBwnkfV/53F9JKe2lSlcVEdlfOrIFm0Dcg2PwQ3oaOwR8RvbG7lUBD:2kt/53F9+VEdcrIrDcg2TYaOwRRqBD
TLSH
T1FA549D11FA508079E4AA02B592BD2E5F097C7B300B24D8C3E7C4555DBD71AC3AE3A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YhBillSn.ini

Path \??\c:\ATM\DRVSP__\EXE_BRM\YhBillSn.ini
Size 79B
SHA256 b26c4560914c968ce3e60dbbe7acdcc6208b7485c70e620acea3970853dd121f
MD5 551e8895006a7fd8280425d34f344cc5
SHA1 84f518e48c7a3e8a49bba22cd4b9033fe5041780
SHA512 14cf757a3e690485a46b42796aac91ff5b2902dcb02cc23792223ed004ee554824521d1a52e1d727afeb05fc0c5a908c60889cfca8e4d2cf87fafbee47488ee6
TLSH
T186A022000E02282A3302F3803A80AC00C0CC3303300B8C03238A30002030003CE88080
MD5 SHA1 SHA512 TLSH

Submit Download

D_USB1~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_CAB\D_USB1~1.DLL
Size 213KB
SHA256 b20567ac7780bd1222ab7f29f3eb86e6038d53a847d2c90e6f240440f897735c
MD5 9cc4fd95a5eb64d3003ea6fc815fd141
SHA1 d840c4088e7c201dbc3a1f3f9781bbabce2a631f
SHA512 6de771b5ec1c9f1a54a0a956eab597bdfe01fcc280beeae8e7a7c592140935dc309226699fe092642f4a8179723299af25d028f3d186893ecb7d0595d4e1670d
SSDEEP 3072:QMYA1fCIm2IgczFo7pSTE2odSq2yK1aktXDvc/F6FR+nUtDuds5SvTB6d2:qxsce7pSTEXNmzvcN46pFv42
TLSH
T1F6245A123680C076C36B21754857DB7537AABC708BA4D78B7F94BE7A5F342C19E3860A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YH6040~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_CAB\YH6040~1.DLL
Size 248KB
SHA256 e5b10a820285708b77994f9fea46ccc712cf37d0249265d0666392c6a867b091
MD5 46e93c34d1b7bd3c10625ca7a5026095
SHA1 e4d0f31e411ed615eee26c66770f7d4fe7f3ea93
SHA512 e863571d87a07bf1a30819b22d7bd363de71c30e3ba27098a3a0a41f3e9d08fca85d0b9973c572e6696971ee0d426b2db78e797b266c22ae058cc4bc5013b56c
SSDEEP 6144:PQczDAkY+FFIvBdjN5u1zTOg6hRGbi++8:pzDwcGN5sMR6+
TLSH
T1F8447C117680C872C3AE21750457DB7567AABC30AB65C7877F90BFBD6E311C29A3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ATD.dat

Path \??\c:\ATM\DRVSP__\EXE_CDU2\ATD.dat
Size 5.1MB
SHA256 c18508608bb68ec5413fd836e3cdc39a245eb65e542c4ee87dc398ead67b5d8e
MD5 f3e39eca1853be865b26152bfa471cd9
SHA1 f52604439463aedc0380e834ecdc2d23ab322e0e
SHA512 8200406c1c9fb14147236270d3daa1c20b73237f43e1df334a050dd1c44303f920dbba4121e63056ed34c4f617a1a8c88400c194c00b735d686ca3ea741c8788
SSDEEP 49152:hBedEwaN0wzRvFDTNvja2z0UcMAurVOFMs/OtIOxumVidRimTUnORVIJ4d54kSTi:CaNAhvMn+dbUOrKT/WotO
TLSH
T1D0368DB993C2978864A3F1B5FE042FB17087CF29B6031612253AB7E34C2997495AF51F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CASHNU~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CASHNU~1.DLL
Size 511KB
SHA256 b45d78b81fda8a3d9b00874bb2abbfdb2c51841540140a34b7d48b74311b7312
MD5 04af15393cb49dd8c00f17266e1d1078
SHA1 f559df802de9f7b23ab8b55b987f474879a87dac
SHA512 acc6c7d5535123f2cebbde924a99fd7b6fd7ddad1f60704f8a9bb0e8ffe6661161237b7280bc5fc1e33e61ec3cf8aed8c1c06c76054f0a1adf0e920d6083dc26
SSDEEP 12288:Vm1J8ecofn9L75MCJXueYCI43KOiGsvOHyudjGp/53F9Hq8nQXhzUYSYimUwET3S:/iU/53F9H7QR4pfgETk1RMgF
TLSH
T106B48D11EB20D024F4FE02B546BD5BA9693C3B70177894C793C128EA5E786E2EE71B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CDUConf.ini

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CDUConf.ini
Size 99B
SHA256 d8465a9e77ae5cb5ee84356ac46b8bcfedd2ae43e05bd073cfc4c4b53363b511
MD5 893276846d4514a8203c630a8a297684
SHA1 27999511e6c8a9d958759c599c6bd267b79cc75c
SHA512 91e27edf9d2ecd416185e5738cad736e812a3affcdc44d980ac5852094a4141daec16e92add96d857869b45f815044e80d0d062a42be9ad8f90870aa3005b11a
TLSH
T1C6B01211429A222861B4936D0C74C2C5D0C020A084410075131CCC1FED1F4971BFDA60
MD5 SHA1 SHA512 TLSH

Submit Download

0CMD_D~1.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\0CMD_D~1.TXT
Size 1KB
SHA256 2e3e8014d25824d3d4576a5537f3149b387d82aa98ec45c3f7e9b92fe7a218da
MD5 4551d0e5585e8307287838d83452b3b5
SHA1 1e2ba6f4b44dab63cbccd2684bbec0025df57120
SHA512 ebc02339f045e31dc8a43a873dfde3d8701b85fc6bbd146f197bc40fa106a29b2135b7f014fb78965b8c08288e20871be16ff225187174c5ee71b79965e82548
TLSH
T10C210B6B064E1D82F053D08E2C6930C6C56F9B03B5D795E522FD3F2BD9C5CAB6A17808
MD5 SHA1 SHA512 TLSH

Submit Download

2CMD_N~1.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\2CMD_N~1.TXT
Size 1KB
SHA256 0f222c1387815f278f43093810492b70877baddd4775cd6bd57e247c85ea2623
MD5 918e02b2a3cd750406959cf7c2bc5967
SHA1 e5b80b69f6fcbfed080d4f4e890bc8893ac3bab8
SHA512 e2574b5f9551b5373b80d8678f9ca55f4376760743734b9912da73208eb02dfada3604e90086f68da3540646b175b8cb4571f34a1fbf80865a051329e3e5dea3
TLSH
T10521FA6B064E1D82F053D08E2C6930C6C56F5B03B5D781E522FD3F2BE9D5DAB6A17808
MD5 SHA1 SHA512 TLSH

Submit Download

2CMD_N~2.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\2CMD_N~2.TXT
Size 1KB
SHA256 ad29554c877ab05e98420aa8748031e90c63c58a0a98a8e879430bf99f443645
MD5 d8ff32b8ff8c901ae42984644817d02e
SHA1 da5c91b87926cb934838e5117cfcd48a897e064d
SHA512 91c584abaa86fe1b3749d0389509bf4c97b39c80f5312ab8404d6182905cba3985f977a8872c30ade24360e53d4be64594f0f2ac72fdca1fd04b96af5e458092
TLSH
T190212A67064E1C81F053D08E2C6930C2C56F5B03B5D781D522FD7F2BE9D5C9B6A17808
MD5 SHA1 SHA512 TLSH

Submit Download

3CMD_R~1.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\3CMD_R~1.TXT
Size 1KB
SHA256 368c22e3b9c256fa7a67d828bd665c7ce461c5979b3aa8c92b49b3fa7d0de865
MD5 856e1aa21e7ca7a9373dc207d98b1431
SHA1 acae64c374251ad1b6dbca375570650995395844
SHA512 249af6e42e1520432e1834ed5e188b8ff89266f6838322a9c4d19433bc2cdae7cf0f719128a2d725af94929636ef13aac7ea1e8ce5ada621f2985591942489d1
TLSH
T1B121E667060E1D82F063D08E2C6930C6C56F5B03B5D791E522FD3F2BD9C5CAB6A57808
MD5 SHA1 SHA512 TLSH

Submit Download

6CMD_J~1.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\6CMD_J~1.TXT
Size 1KB
SHA256 157228995e272d71c8c4d55235407430f722f46bd2ebd5dbe3d56f386097f43a
MD5 a6fba8b013c0c4195091dda80e29d839
SHA1 da13fb9c0c868018706a7413ab74f9cc67233653
SHA512 5e4dc3072404463dbe6392e689ce22fce44b0370c9ea14b752e50dfd88650bae76b0232262643eb8ce853b6bb22836f0352f0bbd4082025cbc79539842e4c17d
TLSH
T15221FAA7064D1D82F063D08E2C6970C6C56F5B03B5D785E522FD3F2BD9C5C9B6A17808
MD5 SHA1 SHA512 TLSH

Submit Download

7CMD_N~1.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\7CMD_N~1.TXT
Size 1KB
SHA256 335bf11b37ed4fe738e5b8dc6a2a69bf6febcae054da5749be3f89a5ffaa9715
MD5 5ab227811f368a8a498135382a6bd0de
SHA1 af8e3d54fbe13bd09b38278e13c93a5d7045f529
SHA512 0c444fa09b425ca7291a7aeabcf6b651744a545ffec04c1c957f4c2510000997549e4f14f309741388dad972ca2c4fe75ec00ee5fba5964811287b703ab085ec
TLSH
T11621FA67064D1D82F053D08E2C6930C6C56F5B03B5D795E522FD3F2BE9D5CAB6A17808
MD5 SHA1 SHA512 TLSH

Submit Download

8CMD_J~1.TXT

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMDMGR~1\8CMD_J~1.TXT
Size 1KB
SHA256 9829d0ec330ad45c3b341ce260c010548fb9b575f62ce72e4b61174e05dceed6
MD5 5bf09f20172e959dbe626626297ee569
SHA1 ad9fd714426c4d5be404d9ced02740fcf9f31e26
SHA512 7fd3a06036f47c2d1fdf1b899c5eed4da4b19bed3b4d84a9a7cd3f5970a3b4d9b42085d2de0ce1ec5ccb3e88498c3b086653c6ec4b274b9f6efdbd7768b41b79
TLSH
T1A021FAA7064D1D82F063D08E2C6970C6C56F5B03B5D785E522FD3F2BE9D5C9B6A17808
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_DE~1.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_DE~1.VBS
Size 94B
SHA256 e8d318a3f50300c9277d717a2f340b952f8a2f5855f7029ec901c2a476db4551
MD5 46405541833ec8a17a4aa619997e9dc0
SHA1 08d347079be557b703ab596c3140a1b27276515c
SHA512 6b1dac9a70f70d636ac879db31f3d131162ed17758bca02ea291c31bf61ca1cfa0bb07d769ffde837b12d129b1ccb0ff5a8bbd8f62a0e94e8dc536a2c9158603
TLSH
T137B012087C45C82BEB2052878830426247C960417220D51992E9DCD041543C1293654E
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_JB~1.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_JB~1.VBS
Size 94B
SHA256 aae7d159a03628480526c6fc313dea9a0ed9726758b10ea528c24aab4a37f87e
MD5 530b10d437bf4a8abb01453f05ed47fb
SHA1 77cc2051ff128ed06cbd18b895246a39380297f8
SHA512 7b134986a712ea4831574d6a0ce0a66eb75a2862b1842d5bc7702c4c9b472bf6e1463dbe4b2901d9341eb910bd3d68b942de8074703e5ab9b1b4a929ac49dd65
TLSH
T179B012085D85C03EEB5092468D70824157C010517132D51452E8DCC441643C0293255E
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_JB~2.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_JB~2.VBS
Size 101B
SHA256 0bb4bb362e7c7506576490b25d398854aa5b0940efe516cc66914edd7af27c4a
MD5 e23125eb41d0e7b05d8ade46496e7480
SHA1 b30b35e562e2d9b818136237fe4fe298f67f76bb
SHA512 7cb55403e98602344fc6907ae7fa8fdcb74b9c4d561c645f573629cce617f81037f6a2489a05f0cc9c5947a44f05b80cef0ca660f4cbbcc116ab73be5f9e75fb
TLSH
T12CB012085DC9C02AEF605357883042526EC054516534D82A52E4CCD441047C01D3385F
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_NO~1.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_NO~1.VBS
Size 98B
SHA256 6a3bb46cde33bb8cd409590ae4b55debff38d6123f96d359e1546fe7f16e82c3
MD5 9291b680c2e06905b4b3586b07a04320
SHA1 ad158613942984da9d1b70215ade5713ab3795e0
SHA512 6c3b22bde0dd8f40e693920418193f2ca3324f02d29c3bbb6ee6dd9b14aa2b87a9eef1ac89bfa94ea749d19e920561b6a86b77dff450bc04656b263adafb1a77
TLSH
T103B0120C5D49C63BEB515646883082514AD014016132D41866E4CCC442043C0292280F
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_NO~2.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_NO~2.VBS
Size 92B
SHA256 908c0810c0947b4963cec8b59188c53b3266a03d8505e436954f7737f1176dd7
MD5 54011256d7646bc78310f4dbe26bc8be
SHA1 1657d4380dd8f0b10f8610c3e3fe5083e32eb5a7
SHA512 3d78698d2a3daa1eb314c24c41405096131b6eadde5bbed0a638faa2a266677fd1900e939d2d2071d9927df24a4fe75636fd85b92491857f5d9ebf4a4307759f
TLSH
T1E5B0120C5C49C03AEB105246883082514AC11401A122E41456E4CCC441043C0292240E
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_NO~3.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_NO~3.VBS
Size 95B
SHA256 5d1d0243dbe9c5ce24e2629b8e8aa30d0daf50a143303a295045d0b695b2be63
MD5 632465301fa42a0c161811f239b0b1e3
SHA1 d2f933bb2cf7d8ce4a2818b1d6b638b195ebfa01
SHA512 b3ba12841858aa81ac2e3d8e3b6c7ccfaf8ce131dd8184d3352777c452e08d4341d555572f9586f97853d91a702b3fbd9d23fc7fa7a16f7d5c7a36ed0973c3f6
TLSH
T16BB012085C49C52AEB119247897046414AD81C056122E51896E4ECC041043C0292244F
MD5 SHA1 SHA512 TLSH

Submit Download

CMD_RE~1.VBS

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CMD_RE~1.VBS
Size 103B
SHA256 bab76b14c2093ad50956f569fda1e267379bd5008505a96c50c958e942bb940c
MD5 ccb01e12b34e6fca41d2329913b1a22c
SHA1 a2c654602ccedd35e834a10754269bf9416cbd17
SHA512 e3ea1031738b9245e218cb57b485624097b2409d4ddf72a5bb28c57c68de3ba1374ab250e3f6544dab138f06f6eca4b8c9a5d4fc93f6da6784d94276b506f1b8
TLSH
T18CB0120C6E8AC47FFF10E24F883442514AC710016235D51896E8CCC452483C0193244E
MD5 SHA1 SHA512 TLSH

Submit Download

CmdMgr.exe

Path \??\c:\ATM\DRVSP__\EXE_CDU2\CmdMgr\CmdMgr.exe
Size 280KB
SHA256 40717408acde4e45b2bf49329fc472b464c9daee808edc72c36bf67db74dcae2
MD5 5a682f8fa9aa8f1e509d2129e1bdb8a8
SHA1 afcfa861c048f0bed087ff56ce8fc29ff1b6ecbb
SHA512 e0b958749c2aca1afa8fc38f907b83ed254d8ff23b83e47b28a694eb3adf44fde008e6a78679ad0c96c5f8b5e62c08c441d4af134d0d0e92805d7887892a4c82
SSDEEP 6144:0V8FlbUeEpMDZzvGnmxekY7P0VC/q3fZF4nJ5Log6WEC:+8LJEiXoLDr/OF4noPC
TLSH
T192543D00B760D034F6F706B64AF58798AD3C7A705B38D4CB53D42A9EAA646E1ED31B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NETDRI~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_CDU2\NETDRI~1.DLL
Size 281KB
SHA256 df5d87ad7b4583225fe651ffeeaef70b5ae73bf300ae59f0a6391a48ef8dba83
MD5 b9487d18a8a95a9073415c9b97685ff3
SHA1 a73eb56a6850a1959974825d24009f1377e50154
SHA512 967feb789c10825decab055cb6ea802364b160ce7cd78a88abb3cde3c747065687f3d3ca90a6c056ed8fee116d890cfdcaadfcc0f373f4e5b02d6482a0eca798
SSDEEP 6144:iCQIreH9lIM9xedCro0QeYZmjhscMcdD34:iBdK0jro0p6mjhsmdj4
TLSH
T153545B01B660D034F4FF02B956759AA8E93C797117BCC4CBA7D02D9E1A286E2ED31727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OKIREC~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_CDU2\OKIREC~1.DLL
Size 129KB
SHA256 76ae99e7afde82d26d1660a8eb90258729db64ab806074a02eff4d58ccd3087c
MD5 c6f316f5f903e6cd097b60323876328e
SHA1 d393cdb962fbfc4b2bf0ccd0d94fd9df15288037
SHA512 00098e83753d9183aeacd4f867676b94f254207d82e9a5ed9bcfa2f3d56e8586e6f05a58ef6c9fcf197e7272e813c6d20068227b3bc193200c8c543ccd7a541c
SSDEEP 3072:NPEB2kfIOLuVdiQApX17rKB+xrfUhaSg:NPlkiQN17riq9r
TLSH
T12FD35A0236D0C075D0BE023949699B124B7EBDB5DFB598C7BB980B4E59742C0AF36B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YH6040~1.DLL

Path \??\c:\ATM\DRVSP__\EXE_CDU2\YH6040~1.DLL
Size 204KB
SHA256 30298569c4938577e7e56ef6bd05fd8378e126689750f04978dc244d77af9d46
MD5 bf73158fcd2db0a47919812fb1ca3caf
SHA1 0e42cd30a5ad30e447e7aa036f37c684877dcb6b
SHA512 5c0b7049250d9ce3ef48eec282d6f17d8cf5251d14b1319ab107e00aecec86a61a5e9e3b84efba9521e6a0ad791ea8b554e5f351be51621895c635e3fd7757e1
SSDEEP 3072:WQ7y3plFhH6sqIRp4zdaOFGB+8YEftLHHT6gvt/pt:WQ7y3fFhZRmhaOcZtbzlvrt
TLSH
T1E8147C407580C075D5BF023A457AAB2116BEBD314FA5DACBBBC88D4E5A702D0AB39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path \??\c:\ATM\INSTALLER\en\install.bat
Size 5KB
SHA256 753f072780f08f01864354c33f8cd2d7de9e994f3fd8b22da2ca45df7b586be6
MD5 ca6c83df96a61f051688c03605f02884
SHA1 83c2f994f7c4253223356c129891087cefb73175
SHA512 12f931d217ccd2bc30ca260785db3c8dff4db771c1f806d510d19f53c9dc24cc137762f619ac66591e85fa1cecafa15e726c127487d4ebeb01983ea1296e8cce
SSDEEP 96:1DD0/Hc5c1Yd+EE7KmH03Y+6IqxEDeIY+6vp/Qdhd7O/WOBr4j0N0iXGFbu0oqjW:1DD0/PM+E9mH03Y+6IqxEBY+6vp/Qdhq
TLSH
T16AC1CD89F08946FC19009768AA3F248FFDD5490743217ED8EBF35035265A3816BD7A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modules.bat

Path \??\c:\ATM\INSTALLER\en\modules.bat
Size 756B
SHA256 b72c37c1683211a26860773aaffc1646d9143d8cc1fd775d7e688d18e12a5e42
MD5 6dc3bfe5617f37896f31b7c696a6f3dc
SHA1 cf3ecf79479a47e7429cda9d34af9d7d95618522
SHA512 f5ecdacedc3d2fadd935a630af75ae6a3ac7ea5bb4c075d7dc4390520dfe9680c74ac53f4f0a084931b28c7695f0789b63cac28514c4df8dba447d78fc2742c8
TLSH
T1E2018482A08641FA2A06A765967B10CBF5DB944B82B06DC0DBFF449E141FB90F9874DF
MD5 SHA1 SHA512 TLSH

Submit Download

is_install_brm.bat

Path \??\c:\ATM\INSTALLER\pub\isinstall\is_install_brm.bat
Size 633B
SHA256 7a3037a6c2d2dad9ee56c286c50b5daa5a96c838f1554255faa26e914f527e00
MD5 41001ed22a7cbb182b57e0286927f66a
SHA1 a87b2c982dd0ee85848a6d65d4a1c0c08c5bc5ec
SHA512 4419d902c8738ec5a98b2ff3bd8c1f2bda24ea989b664200844eee587557cf920c2006da5cd3e2271e5252d4c62e5827d4015c2a733f25b9aa474ea63e2572e5
TLSH
T147F0DB1B10A7043585182ED4D215558BFDD927931235FAC5F6CE00F4BBBE3645AF12ED
MD5 SHA1 SHA512 TLSH

Submit Download

is_install_cab.bat

Path \??\c:\ATM\INSTALLER\pub\isinstall\is_install_cab.bat
Size 632B
SHA256 89dc41a214f0e09ee69a0d3678ab8f2b1132b77805e5428dff525b319386ebed
MD5 124352764c45599fd4ff65ea8070ca63
SHA1 30e1223b34e7ba49bb8901427545790bbec582d4
SHA512 53e0cc5daf06a26b8d11ab07fc8d280d43db7d6f14befe6e867d771b695f558000b1fd1495096998163f215791008be884ee6e08d7866d51c1b11df89e3424fd
TLSH
T16FF0D61B10B7003585182AD4D616558BEEED2B931235FAC5F2CE04F4BB6E2A45AF12EE
MD5 SHA1 SHA512 TLSH

Submit Download

is_install_cdu.bat

Path \??\c:\ATM\INSTALLER\pub\isinstall\is_install_cdu.bat
Size 632B
SHA256 482133c10000a56b7a9019db1add5ca8e31402c5de8bc6347956bcc1d5126a99
MD5 61775f55312438474269c216a24f88d4
SHA1 c0d94facf71aaa23d467abab8ff50ccefdc78d32
SHA512 ce1a2cade0f1d32492c60480841342abfe7511f8dbaef383e1e1304350c92d5552342a642b062ce9cfdf0460367a12b99984b464cd744e33d87c30557d6d6b2c
TLSH
T1D1F0D61B10A7003585282AD4D215518BFEDD2B931235FAC5F2CE04F8BB6E2A45AF12EE
MD5 SHA1 SHA512 TLSH

Submit Download

is_install_cdu2.bat

Path \??\c:\ATM\INSTALLER\pub\isinstall\is_install_cdu2.bat
Size 634B
SHA256 bc9e3d2fe590660cf8ac03b230cd612d6e91b5b26a2eb5e4b138fb827a81d14e
MD5 27fdf22b0f84d576f7c8814ebcb8a9bf
SHA1 2f9a5740fc97fb1f5d21f28f7718a163de17b86b
SHA512 64b1dce8c3504dc7d91abec12aeb6d31ee2950fa88ef5232849fd7c9ae11fe3f12736c8bf7ed663ae7fab646f24283f9b0d71f27aaf306573b88d72c996fc45f
TLSH
T18AF0D61B10B7003585182AD4D615518BFEDD2B931235FAC5F2CE00F8BB6E2B45AF12EE
MD5 SHA1 SHA512 TLSH

Submit Download

kill.bat

Path \??\c:\ATM\INSTALLER\pub\kill.bat
Size 3KB
SHA256 908c9362df71f12ccf45e9ea38b52323846bab31913eb5da38163b6511cfaa9f
MD5 4688516cbf6854843c5dce14b98fa7c2
SHA1 4219284efc768d4136f6a22d0d33751027ca34e9
SHA512 52828d7fab50f3474b683e42fccb3d2f6353011fa3a6ff28ad5db91959759ab77b652624e62482aebc1c2427dcf87ccc7b44b54566821ab554dce69cd6e213b3
TLSH
T15981B62A6413003DC88822E1D26461E7EE5ADE7B2778B7C4F184D8F9634A45C4BE5FF9
MD5 SHA1 SHA512 TLSH

Submit Download

myping.txt

Path \??\c:\ATM\myping.txt
Size 41B
SHA256 736d00cbfe5d788e5db84000b2aa46a71f5ca252010ddb918f33d17c1ad1e2bc
MD5 489a8fda1ae2f01e262160d625068d30
SHA1 b187eef0fe4e611294f5a854db329f60d681d095
SHA512 0b1e857eeb11d95c86b76521b73eabd3f479544435d248fe4380332dbaa4a0232bc1a22012e159a3a0f07e073e3b95c5affedc19802d35fbaf65ce1ed3d69741
MD5 SHA1 SHA512

Submit Download

Addpath.bat

Path \??\c:\atm\installer\pub\Addpath.bat
Size 610B
SHA256 d2ffe13cc4fdb535870b8fc18a00b77b2359785b8bd48a0f8a3d216d8dc7fb6f
MD5 618eb2b54e564d23f82d639b7b1d28d5
SHA1 b4b20aa03f9a56f15d97afa1c92674119bae20bc
SHA512 c077f614eac63d45e05cfef80edc7bdb36f875549b1e3aed4c782458ae55587c3fe94dcf447ea37c20942d9754f7c2f16d7402b1e4a45232a01897b6306eb8ea
TLSH
T1F7F07D26328B88191C38A620C3B0C0075D76D1E9129B9A1C709425D3EE3F0401858BCE
MD5 SHA1 SHA512 TLSH

Submit Download

tasklist.txt

Path \??\c:\tasklist.txt
Size 7KB
SHA256 3282ade2d7b91a740687190122c02466669fee9c18d6e953cd8b12b13ae6465f
MD5 09c278f3cf89c876b80257e18f57582f
SHA1 ae36047069612c87612d11a9600db997d773c82f
SHA512 32b546c0f523a760fa7eda13218029473bfb6f740b6c66a6138f66505a218c9a007670524fbdcef3031a0a50e0854f06c9781ef040bd22ea4e721e67e3aa8054
SSDEEP 192:CAL5kx19OSHWzQejzD7w3ygbUSgiu7g6ruwyN10QoxB3SgramYYbHEr4LxNfJ7rF:CAL5kx19OSHWzQejzD7w3ygbUSgiu7g2
TLSH
T13BE1ED85889F85EC911DE3983E130002EB4E5501317AADD93ADE18EC77E5B1CE7EBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads