salatstealer | 2f106282ae302c21a34af10eb270c2408f8e7b21fc0b83f32d1a442a39bd598b

Analysis

max time kernel
6s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 27.8MB
Sample260929-tw9rtaxbmb
SHA256 2f106282ae302c21a34af10eb270c2408f8e7b21fc0b83f32d1a442a39bd598b
MD5 b8bb3aec020afaab2a4a6d66fdace572
SHA1 d1d012e6e17ab7cdd5fd14153f5bedc670e05f9e
SHA512 84f7bab89203fb588af309852f6c3f4a98dce452f8eb37438546d91c43c82580d317273245b4001ac8d7b2ccb963e35aec5bbaa318506f3705416311869787ad
SSDEEP 786432:+SxhxTLbHeCSJtFLhlR+P8lK9X3GrKtx9DpqteBH:+uxTLc3LoGurJjBH
TLSH
T18757334A0EE9584CFEC9FAF45DD40366E8D92CA7DF219DE71294CA632CB3AC41874253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution salatstealer persistence stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 15 IoCs

resource	yara_rule
behavioral2/memory/3556-60-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-74-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-80-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-89-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-94-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-103-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-120-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-127-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-140-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/3556-154-0x0000000000560000-0x00000000011B6000-memory.dmp	family_salatstealer
behavioral2/memory/2324-158-0x0000000000C50000-0x00000000018A6000-memory.dmp	family_salatstealer
behavioral2/memory/2860-161-0x0000000000910000-0x0000000001566000-memory.dmp	family_salatstealer
behavioral2/memory/2860-178-0x0000000000910000-0x0000000001566000-memory.dmp	family_salatstealer
behavioral2/memory/2860-184-0x0000000000910000-0x0000000001566000-memory.dmp	family_salatstealer
behavioral2/memory/2860-197-0x0000000000910000-0x0000000001566000-memory.dmp	family_salatstealer

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3608	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2884	file.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4ec-11.dat	upx
behavioral2/memory/3556-13-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-60-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-74-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-80-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-89-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-94-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-103-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-120-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-127-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-140-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/3556-154-0x0000000000560000-0x00000000011B6000-memory.dmp	upx
behavioral2/memory/2324-158-0x0000000000C50000-0x00000000018A6000-memory.dmp	upx
behavioral2/memory/2860-161-0x0000000000910000-0x0000000001566000-memory.dmp	upx
behavioral2/memory/2860-178-0x0000000000910000-0x0000000001566000-memory.dmp	upx
behavioral2/memory/2860-184-0x0000000000910000-0x0000000001566000-memory.dmp	upx
behavioral2/memory/2860-197-0x0000000000910000-0x0000000001566000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1484	cmd.exe
1188	cmd.exe
5276	cmd.exe
5968	cmd.exe
1484	cmd.exe
5224	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4860	schtasks.exe
5080	schtasks.exe
796	schtasks.exe
2864	schtasks.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 2884	3400	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe"
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2884
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe"
    3⤵
    PID:3556
  - - C:\Users\Admin\AppData\Local\Google\services.exe
      C:\Users\Admin\AppData\Local\Google\services.exe
      4⤵
      PID:2860
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-task"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCacheBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-excl"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"
    3⤵
    - Modifies Windows Firewall
    PID:3608
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe"
    3⤵
    PID:2556
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-task"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:796
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCacheBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-excl"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER2 --password x --tls false --api-enable --api-port 28758 --api-rig-name WORKER2
    3⤵
    PID:5564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:1484
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER2 --password x --tls false --api-enable --api-port 28758 --api-rig-name WORKER2
    3⤵
    PID:2416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:1188
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER2 --password x --tls false --api-enable --api-port 28758 --api-rig-name WORKER2
    3⤵
    PID:5136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:5276
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER2 --password x --tls false --api-enable --api-port 28758 --api-rig-name WORKER2
    3⤵
    PID:5788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:5968
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER2 --password x --tls false --api-enable --api-port 28758 --api-rig-name WORKER2
    3⤵
    PID:4692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:1484
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER2 --password x --tls false --api-enable --api-port 28758 --api-rig-name WORKER2
    3⤵
    PID:4072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:5224

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
1⤵
PID:476

C:\Users\Admin\AppData\Local\D3DSCache\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\D3DSCache\SecurityHealthService.exe
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

AE801AAFD8AFF401AF19AE00381A5F3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AE801AAFD8AFF401AF19AE00381A5F3E
Size 309B
SHA256 a98d858a8c0f97c3c477a2f6554452c43d4617edae036fad534bc48d3da58ef5
MD5 f4f8bbe28725acc3d222585d3d0eb5c6
SHA1 265cf328930e9cf391210bee16191a53bbe5bb44
SHA512 6e74e67ee4de9e5db8580e841aa65a76cae17cf410e222857035eaeff5e5c7d36da9a23ed5fb9d13bf0b96ae4a73ae59ff27820fc050a4de0c93c7a3e91e064e
TLSH
T144E07281B3B966C41AB1E220EAA8D8AB6CF884C34B8FB0400380C33200C37C6E9906CC
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 cfd0a323b7e590549892a3c94bff15f6ca7e0d2bef0cc942ab8ec27eee292980
MD5 7cea5cb0c91efdf85ae313e99708e7ac
SHA1 0405685a0c4e95e1256ee9d1bd691732a73d50c1
SHA512 48940c3402d4f1bedfe20bed6e67492370d7763a7f72657044cae1bba5f47b72018a58499aec9b2cba4883b03f5526f9bf117bc8fa3d81e3e0775e3260ab4559
TLSH
T124C09B547775036DF0701D7F9953C6804FFED705D95283685F701158851DE424CB5D07
MD5 SHA1 SHA512 TLSH

Submit Download

AE801AAFD8AFF401AF19AE00381A5F3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AE801AAFD8AFF401AF19AE00381A5F3E
Size 192B
SHA256 17453f872402c4753102084086d8cfb7ae40d7599d07789722d99f28c4668938
MD5 6712e29f33733a44e5de5c08f1d636c1
SHA1 e3ec98d7bf44efd8559ac106d19d6b3fa4b1742c
SHA512 c808026410cc83bf8f4a8537c6000bcf5c2c4a6e0292c32f154f76d57013471fbd1a098fa7c6f82cb18581c1e31ac3064e651ad095b9e6946ba69e7f063732f2
TLSH
T16FC08C1A3A29C1ACE204833F44A21A0A8EFCA348C521434A5B71030946186025C30E4E
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 d26613217b088136d4a2fde67c5c1849e715823af906ac0077bc439867f16495
MD5 ebaf84143ca33496cace6aa931efcddb
SHA1 5ec18ecb257482af243bebf863fddcfd99a61b16
SHA512 6e2b4972000bc5c08d4e9a8bf6925cc4284a1f98b8aeb0e97e9816cb0cc5b34a2e5e5d7632feb33d0195be08c62781c21cd421235c33c80d5b73d887dd34a3eb
TLSH
T17AC09B147365476AF10D117D7DD6160457B94115F5C6C3044B74113485197504871D05
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftCacheHealth.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
Size 214KB
SHA256 d3f670b5ef213fd647b2a9bdac92e5a94afcec7a200ad01c5ce9e149317945ae
MD5 f914947da6cf8db9e5cf18020d54def2
SHA1 f92c654be5217672333581e8f075a9f33fce790f
SHA512 409adda545d8e7ae799a49cda7e487fddc4caf6f8abee73209b16dc8be9b37693f43261b9b44224147c6553dd004147550e1d99617e5568a006c7fa3cc3f768f
SSDEEP 3072:OGaOQL8wpd5U2tUwKo1kdXMj5WcocMDppRQghW0bx1oOm+qAszwZkte:rwfRUwKzdXMl92pOAPbxGAszwke
TLSH
T1B5240983A58954F4E857B13CA30BE125DB62BC720794E0DF07705712BF5BAE46E3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCacheWorker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
Size 24.1MB
SHA256 a0d90564ef9a943924f381c8952f91b98e4910012225e88d397ed941068300c9
MD5 820e2e8e4b843fdb5f4e7a5141a996a0
SHA1 24b216dc98ba21bf48d608b9ffde854324165b05
SHA512 5d8829e519e52e2546a709b52103def486332c91edf84b718e5d1bbf5895d6e70ef9c7c6f66b39ec0665dadb2d8d51a0de4138c3728f01827eb4e9b81c535037
SSDEEP 393216:g00lqca+bzCybph17BSCkRsBQ0HwYCM+k5VHwGKdidPViJGB/wmipELoHd:wlha+bzCkPD9AYCnGdQJGY
TLSH
T143473386D1066FB6C54A3A3BCB33084B56658BBCD7D606C09C98F775901EC9E0D6BACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 1KB
SHA256 6a907e535b0e07427eea3d232fe76f1bd0ddab4ccd31d407160f30ebf8d1c121
MD5 b9238ba408324cc28aab90c466197482
SHA1 507f6761513b0ad7cd69c781aac58358bfb0aded
SHA512 7aba7d8e366c4eba056b7c1a3a83dfa2db411b7b44cc9ea5562ddf243fe93feea6635e252126707d6ebb93188cd5d77628c2b8690125225a355d2ccacc3f1d56
TLSH
T19D41972AC9180FB216D0A41A6CA99F4346134E23390B7C6873C7961C9F8D33F21BDA7D
MD5 SHA1 SHA512 TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 1KB
SHA256 eb1b4166cdabb63f97b9622fb92d34936269065298c6aed3c314191398bb6131
MD5 9b36cea857ab0345138381e832e41fbf
SHA1 ae578f82279e469ea5bb0b9452600140303ebae5
SHA512 0250c927edfe5793abfb24ba74437e4419b7264e6b62b12b1f1055d0c5d5c0e7cbc8865730bf1219dc7a9bf99b1d9479766439681dd363fdcc8a754234bc8cbe
TLSH
T19F418923C9180FB216F0A4191CA99743E6134F2FA307786A7277961C5F7D33A21BDA69
MD5 SHA1 SHA512 TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 2KB
SHA256 2339c71f4e67f0b1c8b8f61bbfb71c3a20cb2aa5c419913ed8d75aa58568c77b
MD5 f2e095feea707fe8d49faea4b6ef4c02
SHA1 84b83357456d8c20748be61c8181fca71e5e36aa
SHA512 9aabe796432d0e76c47bae3d54bac891850b0138c72c55a2afce4edb5791532172c511df07388ef8675ee38f11f7b74defeaa6e72e3c038e5508e2b3e46c6a57
TLSH
T1E7417A23C9184FB216F0A41918A99343E6134F3FA306786A7277961C5F7C33A21BDA29
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_duty.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
Size 95B
SHA256 0dbf73789e87d81c30dbc828fdfbb784b9e0a596948c333416bd1fa6703beba3
MD5 9814e239877d9ef6dcc7a031264c4668
SHA1 e7dcc5dd4bcc5affe4fc9f0abf23a8e3d002c2bf
SHA512 3697aa0596024b31eaeb8f4fc90203468b2bb91bd1c89cf6709cfa14fc308b995e8e77e0cf962f49ebb17b4a7f1b2e05b5f4da156c30aabb70c56bf66b884d35
TLSH
T18DB012480C20C8780044036283EB09D315FB101703519A11D8EC470C04658658418DA7
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 139B
SHA256 346aca036a709f213d6d3aebf32310990fc02b8c0372806741f03ba8bb112095
MD5 168994e07e6110feb4045d0bd2df4ce2
SHA1 7943819838c717cf9f1aafce379a9b0f3560f6c7
SHA512 cd535abacec865d3fd77deae3cd55fe7856cfb9aa19b33ea08185fc9303f5f8257f4be94cbdaad75bba9127ee8d18b98d90f814190382482bd7a3822993f3a4b
TLSH
T180C02B3BCA0113686F013B43644B68B3CE7029AB129A2030A50987CCE90C83D1A2400C
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 135B
SHA256 9bbdcd7fd28a956ea7cdc602e9f16f293612ca7bd5956178e80058d48f9685da
MD5 3c722782dca5628bdf470edc01ce02dc
SHA1 e2e117662669f5c55f1b4d92eb104ccff36a2b5f
SHA512 534dfea2e435daecd349a00aa92f212cfff1dff8ac6c59a8f36bc0e445dbc27e9266a33dfbbc40a0b87cff355066c44ce0cdef164545db2bf83d67f1af257d39
TLSH
T16CC02B27CA0513286E013B43644B6C63CE71296B119B2030D909878CF90C82A062400C
MD5 SHA1 SHA512 TLSH

Submit Download

taskmgr_hook.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\taskmgr_hook.dll
Size 14KB
SHA256 d574f669ef6feb7058b85c9b8bf317c9d75104d0f47acdd992bdb3dbccff8c40
MD5 d5b6f254aea2f8bf5da7b8635b1ea55d
SHA1 c5ad55a8ce7b5d215b070e684ed7c9d0bce8a680
SHA512 f2588410af722d436be8729056c5f6326cd827ba91eb1792e27d77dafe21e4ca16d278078901585a29ea0f9ce45d326c7bb7c1788a6112497e13896a2ded6269
SSDEEP 192:mTvbwZ92ZNJGwRhCIhv9Kx+ROOYzlDEm2GVV4lq:cvb/XJ5qIrQ+UExSV4l
TLSH
T1A662EB0D33A249A9D55FD4BC41FB8F39AAB1F8009C82836F4134E9360DA1A66B775F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe
Size 27.7MB
SHA256 6f9943a261b9059196b357e6cdaf0926e88bd39436da6916616c6d1eeaa87ef6
MD5 22af7f90492ed7566960e78ffd63736f
SHA1 f2da7894c5f53a85ac087caade4110bb54bbcd74
SHA512 64b7fbec220ad39df304bd701cb28b864885670037d758f6d21c893988f5a29025cfcb588998d3a7858e529bc51b1afe31291c1ae09979e71278ad41fd10e1b9
SSDEEP 786432:0jaj/MPSA8riouCq5s4nL/nv9FyrCQ/SkIsBPL7CkBg1:njkSZGsvjSkIsBz+kBg1
TLSH
T16557335B8AE891A8ED45C038C21774A6DEB7B8E88B01D5CF27988257BE1F7D45D3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddd.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe
Size 3.4MB
SHA256 02b400d2226373c37c264192bb4aeb603a73eabefedcf921920c634c128d9e2f
MD5 6a72a2e02673fb083e82a0561f73a207
SHA1 9b86093964e31e2b2535ff49285d067bf0887bab
SHA512 57a461b3217d6d565eb96f472bb9b09cd958742ece7dd3cdcf36da816191675edcd9fb8ef44440e4c5152df71e9568e03e1a84b5a286733d619e7ab068ecb16e
SSDEEP 98304:pve6/ABXeLMHdofDr1B15bosduh/nYfx:pG7r9ofDhB15bosQ/nYf
TLSH
T12CF533ABCE2E602BE6D01278410B799D7AFBDFDCC61722F1B66C40687DE76AC1054708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2324-158-0x0000000000C50000-0x00000000018A6000-memory.dmp

Download

memory/2416-91-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-95-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-102-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-93-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-81-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-92-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-87-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-88-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2416-90-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/2860-161-0x0000000000910000-0x0000000001566000-memory.dmp

Download

memory/2860-197-0x0000000000910000-0x0000000001566000-memory.dmp

Download

memory/2860-178-0x0000000000910000-0x0000000001566000-memory.dmp

Download

memory/2860-184-0x0000000000910000-0x0000000001566000-memory.dmp

Download

memory/3556-127-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-94-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-140-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-74-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-60-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-13-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-154-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-80-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-103-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-120-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/3556-89-0x0000000000560000-0x00000000011B6000-memory.dmp

Download

memory/4072-194-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-195-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-192-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-199-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-193-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-198-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-196-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4072-191-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-176-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-175-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-174-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-173-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-172-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-177-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/4692-179-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-108-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-110-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-109-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-117-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-118-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-119-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-121-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5136-122-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-55-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-73-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-59-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-58-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-57-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-56-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-47-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5564-54-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-137-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-145-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-141-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-139-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-136-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-138-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-134-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

memory/5788-135-0x00007FF63E990000-0x00007FF641683000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads