489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 17.9MB
Sample261009-ypfmlss1bt
SHA256 489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2
MD5 fae31a1b99b802d086777002b8e1d513
SHA1 25fd875e077d212ed298f53a549c98f63490aa4d
SHA512 628d964194d31c1a8493da38a162879c254b092cb8c05ae5f9bdf082006321aa0ffff56ff43b84fe1b992f89f869d43fbdb733ec3ba40e052c842b0ea4971d2c
SSDEEP 393216:nQdubMlQjO30tos6q73/+q22DBv8a9pmrcGHdp8dT:nJMhqwHq22DZ81r9u
TLSH
T1C517C001B3F52798F5FB8BB8867792069972BC299B11D2DF0120915D1E32BD88D78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\ARM\\Win32Container.exe,"	Win32Container.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2796	rundll32.exe
8	2796	rundll32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
3620	Win32Container.exe
3028	Win32Container.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Environment\UserInitMprLogonScript = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Environment\UserInitMprLogonScript = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCache60c1 = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCache60c1 = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCache60c1 = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCache60c1 = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\ARM\desktop.ini	rundll32.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3272	cmd.exe
2528	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3752	timeout.exe
4488	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2812	systeminfo.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\LocalServer32\ = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\LocalServer32	Win32Container.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\CLSID	Win32Container.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}	Win32Container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\LocalServer32\ = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\LocalServer32	Win32Container.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\ARM\desktop.ini:cache_svc	rundll32.exe
File opened for modification	C:\ProgramData\ARM\desktop.ini:cache_svc	Win32Container.exe
File opened for modification	C:\ProgramData\ARM\desktop.ini:cache_svc	Win32Container.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
4704	file.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	file.exe
Token: SeIncBasePriorityPrivilege	4704	file.exe
Token: 33	4704	file.exe
Token: SeLoadDriverPrivilege	4704	file.exe
Token: SeProfSingleProcessPrivilege	4704	file.exe
Token: SeBackupPrivilege	4704	file.exe
Token: SeRestorePrivilege	4704	file.exe
Token: SeShutdownPrivilege	4704	file.exe
Token: SeTakeOwnershipPrivilege	4704	file.exe
Token: SeSecurityPrivilege	4704	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3272	4704	file.exe	89
PID 4704 wrote to memory of 2528	4704	file.exe	90
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 2528 wrote to memory of 3752	2528	cmd.exe	94
PID 3272 wrote to memory of 4488	3272	cmd.exe	95
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 4704 wrote to memory of 2796	4704	file.exe	91
PID 2796 wrote to memory of 2812	2796	rundll32.exe	96
PID 4704 wrote to memory of 1116	4704	file.exe	99
PID 4704 wrote to memory of 1116	4704	file.exe	99
PID 4704 wrote to memory of 1116	4704	file.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 600 /nobreak >nul 2>&1 & taskkill /f /pid 4704 >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 600 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 900 /nobreak >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ss_dbg.txt" "C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log" "C:\Users\Public\ss_release_debug.log"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\timeout.exe
    timeout /t 900 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3752
- C:\Windows\System32\rundll32.exe
  rundll32.exe
  2⤵
  - Badlisted process makes network request
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\systeminfo.exe
    C:\Windows\system32\systeminfo.exe
    3⤵
    - Gathers system information
    PID:2812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-first-run --disable-gpu --disable-extensions --disable-background-networking --disable-sync --no-startup-window --disable-background-mode --window-position=-32000,-32000 --window-size=1,1 --noerrdialogs --noerrdialogs --headless=new about:blank
    3⤵
    PID:2060
- C:\Windows\System32\rundll32.exe
  rundll32.exe
  2⤵
  - Drops desktop.ini file(s)
  - NTFS ADS
  PID:1116
- - C:\ProgramData\ARM\Win32Container.exe
    "C:\ProgramData\ARM\Win32Container.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Registers new Windows logon scripts automatically executed at logon.
    - Adds Run key to start application
    - Modifies registry class
    - NTFS ADS
    PID:3620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1656

C:\ProgramData\ARM\Win32Container.exe
"C:\ProgramData\ARM\Win32Container.exe"
1⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Modifies registry class
- NTFS ADS
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ARMHelper.exe

Path C:\ProgramData\ARM\ARMHelper.exe
Size 2.7MB
SHA256 323fee0ea61ed97c6cab4364972362fa68c7aedefa861f931ec89692b14c5018
MD5 ed6f0fc98a87bb0bee41d6aeb3b297c4
SHA1 e8a438c4d6a2c6a5b1cd1b87490fcaa86e467271
SHA512 9fe8c94d0cc8d42355d68d2779cf5958e22fe5234a483a80b9a385afb1ab5ec78845dea647e310a2256f1ac25a07d98a7b7132a809dd18af6477c930bf3094e3
SSDEEP 49152:UXSLHLM1xSIzOzyQepma2ulnSwNRgAGBRS1Dwf0Vy5W8JeXBC3fRcOx59dfzve:YHOIyeDsOSwNRg101scVyYlRWRZx5jzG
TLSH
T1F0D52316F68708F9D05BC17497428693A5B5B4860B327BFF139402315FAAAF21E3CB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\ss_dbg.txt
Size 421B
SHA256 f30ee79bd82b784c23a7961807d5a7777e6742154e832fee575f3fe84438f101
MD5 6e22ae7ced91039931ba1adf7f116a09
SHA1 f69201e36a59774154430043c0a8c1d736e13d5d
SHA512 2a5f08b74ee607276ae4be27e1bb50d8ceccf7eed8fddd38898f60b848d63778aa9e54f4cda3fdb332b59e9859d03292e59a93c00f195c64d33fbb68be9fa854
TLSH
T167E065874FDA46AA72CE5118E6E86A15D454C50C4E350B70E5069E6191F0AF310FE424
MD5 SHA1 SHA512 TLSH

Submit Download

ss_release_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log
Size 455B
SHA256 8a4dc2725378d91934902f1d0da59f59c731e88824137185c8bcffb8f9b6a958
MD5 64245da3eeea2d3c9f51253b09c1952f
SHA1 db54d354ed092c2de04b4ae4df3aa04d897f5d4c
SHA512 a4463b87ba232cb12692f9ef0d3f91fba7bbfed89a22ef6e7a4e9a62e8817dfc005223a6e30523b8739836e497a217b3a37bdf3bbb31e00adeed02209970f850
TLSH
T131F0E5232DFA8580DC653A7FD1BDD26AF4528583ED54C813831294360D30A2FF43217A
MD5 SHA1 SHA512 TLSH

Submit Download

ss_release_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log
Size 46B
SHA256 dce1b9b28523bc11777010830dd4d8767cd5451d07cfb4cc8255f2156c0ea761
MD5 afbce0067f3bb515e550da2f871baa6e
SHA1 4b1366eed80e78847af4c914d57bf0c6d621f0af
SHA512 daf5d8f3ffb8edcff97fd6f92da0b3f7757a5a6f346bd57bd7cd112f6ce8d1e1ffcb2ac95136706a2294bd1225c5c6c8ea8d14324195ee5076c6ee662b97d666
MD5 SHA1 SHA512

Submit Download

ss_release_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log
Size 85B
SHA256 0e551400c6996c8f4871fb71a36a10693333a1ec77d7258efd8d2ad43fedbd77
MD5 b747759a0ed9714d09aaac9a9d599541
SHA1 b2f7b2ce10d14806ac458d6e9bdd34eecb10c01a
SHA512 41cb471e1c051c0b5a21610dc2660943fdb0fb5495c2e5c097544b3210111d9650107d95aaca62951652c2d9e04e284ed1a3f7aefcf0b2a8e08b58b468641341
TLSH
T145A011028CA88000CEB3322E80ECCA2AA0800003C020C0220300002A0C20A2FB0B0222
MD5 SHA1 SHA512 TLSH

Submit Download

yami_264783

Path C:\Users\Admin\AppData\Local\Temp\yami_264783
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_305536

Path C:\Users\Admin\AppData\Local\Temp\yami_305536
Size 224KB
SHA256 ad28f9a5298ae7a8eb785b5ac488af303af360c1e55aca3833cdb57f79a1f861
MD5 aea3238ac9f81e3c6e5b18da9bc6104f
SHA1 3caffc415598827b2d03c71ae0fb9e06f4d3959c
SHA512 cea7d11aad32dca610584a55a50efdfa7fb21faa963b20b57765322d336cfb86a0768c96078311124a29e8955bd2e334b9c4bf26ba9b7330bd5d32c009e16e21
SSDEEP 96:bbSzFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqD:bbJH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T14B24EE4E5F343722CDBD913668E644A35C7CF03FCB5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_387581

Path C:\Users\Admin\AppData\Local\Temp\yami_387581
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_491762

Path C:\Users\Admin\AppData\Local\Temp\yami_491762
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_579963

Path C:\Users\Admin\AppData\Local\Temp\yami_579963
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_610279

Path C:\Users\Admin\AppData\Local\Temp\yami_610279
Size 138KB
SHA256 ec501d01373480b8717bc6e4fd75222ee5d2fc71a231664839c0be2a605b38e9
MD5 4d95c510060b3b15ae17d388ac5b7a7b
SHA1 deb2987277acd5f1e7841d874fdb9a5ed930cf5b
SHA512 fcfa82f180e4cf754afacd43d609365b5fd2b444b543085e178efb26b2577c6f88eff00a0113f05d853fceef2b1f6c84901b8054a6e6bc508f4a4c1172aadf9a
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OoxeVumqynl:FnbZeMrv/hGtoxqnl
TLSH
T1FBD3884B3A747102EDE59A721CE050BB5E3C716D8F5595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_976415

Path C:\Users\Admin\AppData\Local\Temp\yami_976415
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_977277

Path C:\Users\Admin\AppData\Local\Temp\yami_977277
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_abe_key_2060.txt

Path C:\Users\Admin\AppData\Local\Temp\yami_abe_key_2060.txt
Size 85B
SHA256 581d21f2228c3a61fa038c838015da7b1b29f5ba1a86b2f935c0d910b3a9f11e
MD5 9ea7b8562371b8cbac918e2e37f9023b
SHA1 edc2ca2f3028ee105bdf06da7bcf770076b46f30
SHA512 41b746d0f2129dc7578deb5c77649045c126ee5b23a4d6fe3dffa7e73f950292158a25f2127cdb34942808510ca7f578ad1406f0a1d08ac4fb93430b011d9d4e
TLSH
T12BA01249602104130BD0C8DD9E8B11A405D4323494004852401D0B380558A3A070C400
MD5 SHA1 SHA512 TLSH

Submit Download

yami_pipe.txt

Path C:\Users\Admin\AppData\Local\Temp\yami_pipe.txt
Size 77B
SHA256 43db12c9cda8c9179defeec9ce37a194f057c97dad63725a6b02674944d99c87
MD5 78464dd614915864c6fd68ebd69fce21
SHA1 c9993bae99d388210df2ae46d45ea5d0147a20f4
SHA512 a8144c5b48d77351a3e1d3c033f22025439bee0c6ecea18c3f23552c4bedf4bf8e3faf8123a5b44f217ea478b3a057d0866d3c09620af75f7c4b0e88d96edb84
TLSH
T159A0120074C2B9083904A01B5461C14CC4251C0425482A208D10CC88C15D4CC6344301
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1116-141-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/1116-82-0x000001E9BB9B0000-0x000001E9BB9B1000-memory.dmp

Download

memory/1116-86-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/1116-96-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2796-26-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2796-43-0x000002245F650000-0x000002245F8C7000-memory.dmp

Download

memory/2796-9-0x000002245C360000-0x000002245C361000-memory.dmp

Download

memory/2796-28-0x000002245F650000-0x000002245F8C7000-memory.dmp

Download

memory/2796-25-0x000002245DEF0000-0x000002245E166000-memory.dmp

Download

memory/2796-37-0x000002245F650000-0x000002245F8C7000-memory.dmp

Download

memory/2796-16-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2796-13-0x000002245C450000-0x000002245C451000-memory.dmp

Download

memory/2796-41-0x000002245F650000-0x000002245F8C7000-memory.dmp

Download

memory/2796-5-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2796-248-0x0000000180000000-0x00000001800B9000-memory.dmp

Download