defendnot | e270660d595e4ab738210d1b99e4f30ede1068a801600ea0758e09d2664ff509

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_a4ada3c1c1c5e6375037f3c55f97c736_cryptbot_icedid_luca-stealer_njrat_remcos_stealc.exe
Size 2.6MB
Sample261012-rhzzcaft5p
SHA256 e270660d595e4ab738210d1b99e4f30ede1068a801600ea0758e09d2664ff509
MD5 a4ada3c1c1c5e6375037f3c55f97c736
SHA1 aabc85f44c4ad88f06b354fa1851896cf04b52ea
SHA512 f6e0329745fda7dd9dbd51d8157a1b473ce9cc4207fc6aba3e08f224581377fb178239b41d2d802d91ecc070d18fc30d2bb96edce7d0acfb831d8edfd2defdf9
SSDEEP 49152:/6xcx0RYeAAQrFjEzlKoiSAWt5eCOuTRKMxzH5cbaHfb7OvL1yAY1m2q:/6IInQxjulxipO5NgMEejyD1ykD
TLSH
T1F6D501E5A39444B8E0B39178C8378A53EA33B84D4F74964F1698BE572F33391492BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution defendnot xworm hacktool persistence privilege_escalation rat trojan upx

Malware Config

Extracted

Family

xworm

us.loclx.io:49051

Attributes

Install_directory
%Userprofile%
install_file
DlpUserAgent.exe

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c4cc-20.dat	family_xworm
behavioral2/memory/3548-28-0x0000000000FA0000-0x0000000000FE4000-memory.dmp	family_xworm

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x001300000001c3a5-53.dat	family_defendnot

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c4cc-20.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3548-28-0x0000000000FA0000-0x0000000000FE4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x0006000000016b49-13.dat	UPX
behavioral2/memory/4068-23-0x0000000140000000-0x0000000140027000-memory.dmp	UPX
behavioral2/memory/4068-60-0x0000000140000000-0x0000000140027000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2960	powershell.exe
2444	powershell.exe
2272	powershell.exe
1512	powershell.exe
3228	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DlpUserAgent.lnk	MpDlpCmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DlpUserAgent.lnk	MpDlpCmd.exe

Executes dropped EXE 7 IoCs

pid	Process
4068	1.exe
3548	MpDlpCmd.exe
5716	defendnot-loader.exe
4896	defendnot-loader.exe
5608	DlpUserAgent.exe
5436	DlpUserAgent.exe
1464	DlpUserAgent.exe

Loads dropped DLL 2 IoCs

pid	Process
6088	Taskmgr.exe
3400	Taskmgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\DlpUserAgent = "C:\\Users\\Admin\\DlpUserAgent.exe"	MpDlpCmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000016b49-13.dat	upx
behavioral2/memory/4068-23-0x0000000140000000-0x0000000140027000-memory.dmp	upx
behavioral2/memory/4068-60-0x0000000140000000-0x0000000140027000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	MpDlpCmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6076	cmd.exe
5920	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MpDlpCmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MpDlpCmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2960	powershell.exe
2960	powershell.exe
2960	powershell.exe
2960	powershell.exe
3228	powershell.exe
3228	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
3548	MpDlpCmd.exe
3548	MpDlpCmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	MpDlpCmd.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeIncreaseQuotaPrivilege	3228	powershell.exe
Token: SeSecurityPrivilege	3228	powershell.exe
Token: SeTakeOwnershipPrivilege	3228	powershell.exe
Token: SeLoadDriverPrivilege	3228	powershell.exe
Token: SeSystemProfilePrivilege	3228	powershell.exe
Token: SeSystemtimePrivilege	3228	powershell.exe
Token: SeProfSingleProcessPrivilege	3228	powershell.exe
Token: SeIncBasePriorityPrivilege	3228	powershell.exe
Token: SeCreatePagefilePrivilege	3228	powershell.exe
Token: SeBackupPrivilege	3228	powershell.exe
Token: SeRestorePrivilege	3228	powershell.exe
Token: SeShutdownPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeSystemEnvironmentPrivilege	3228	powershell.exe
Token: SeRemoteShutdownPrivilege	3228	powershell.exe
Token: SeUndockPrivilege	3228	powershell.exe
Token: SeManageVolumePrivilege	3228	powershell.exe
Token: 33	3228	powershell.exe
Token: 34	3228	powershell.exe
Token: 35	3228	powershell.exe
Token: 36	3228	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeIncreaseQuotaPrivilege	2444	powershell.exe
Token: SeSecurityPrivilege	2444	powershell.exe
Token: SeTakeOwnershipPrivilege	2444	powershell.exe
Token: SeLoadDriverPrivilege	2444	powershell.exe
Token: SeSystemProfilePrivilege	2444	powershell.exe
Token: SeSystemtimePrivilege	2444	powershell.exe
Token: SeProfSingleProcessPrivilege	2444	powershell.exe
Token: SeIncBasePriorityPrivilege	2444	powershell.exe
Token: SeCreatePagefilePrivilege	2444	powershell.exe
Token: SeBackupPrivilege	2444	powershell.exe
Token: SeRestorePrivilege	2444	powershell.exe
Token: SeShutdownPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeSystemEnvironmentPrivilege	2444	powershell.exe
Token: SeRemoteShutdownPrivilege	2444	powershell.exe
Token: SeUndockPrivilege	2444	powershell.exe
Token: SeManageVolumePrivilege	2444	powershell.exe
Token: 33	2444	powershell.exe
Token: 34	2444	powershell.exe
Token: 35	2444	powershell.exe
Token: 36	2444	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	powershell.exe
Token: SeSecurityPrivilege	2272	powershell.exe
Token: SeTakeOwnershipPrivilege	2272	powershell.exe
Token: SeLoadDriverPrivilege	2272	powershell.exe
Token: SeSystemProfilePrivilege	2272	powershell.exe
Token: SeSystemtimePrivilege	2272	powershell.exe
Token: SeProfSingleProcessPrivilege	2272	powershell.exe
Token: SeIncBasePriorityPrivilege	2272	powershell.exe
Token: SeCreatePagefilePrivilege	2272	powershell.exe
Token: SeBackupPrivilege	2272	powershell.exe
Token: SeRestorePrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeSystemEnvironmentPrivilege	2272	powershell.exe
Token: SeRemoteShutdownPrivilege	2272	powershell.exe
Token: SeUndockPrivilege	2272	powershell.exe
Token: SeManageVolumePrivilege	2272	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3548	MpDlpCmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4068	4840	2026-10-11_a4ada3c1c1c5e6375037f3c55f97c736_cryptbot_icedid_luca-stealer_njrat_remcos_stealc.exe	89
PID 4840 wrote to memory of 3548	4840	2026-10-11_a4ada3c1c1c5e6375037f3c55f97c736_cryptbot_icedid_luca-stealer_njrat_remcos_stealc.exe	90
PID 4068 wrote to memory of 6076	4068	1.exe	91
PID 6076 wrote to memory of 2960	6076	cmd.exe	93
PID 2960 wrote to memory of 5716	2960	powershell.exe	94
PID 5716 wrote to memory of 6088	5716	defendnot-loader.exe	95
PID 3548 wrote to memory of 3228	3548	MpDlpCmd.exe	96
PID 4896 wrote to memory of 3400	4896	defendnot-loader.exe	101
PID 4896 wrote to memory of 5920	4896	defendnot-loader.exe	105
PID 3548 wrote to memory of 2444	3548	MpDlpCmd.exe	106
PID 3548 wrote to memory of 2272	3548	MpDlpCmd.exe	108
PID 3548 wrote to memory of 1512	3548	MpDlpCmd.exe	110
PID 3548 wrote to memory of 2436	3548	MpDlpCmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-11_a4ada3c1c1c5e6375037f3c55f97c736_cryptbot_icedid_luca-stealer_njrat_remcos_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_a4ada3c1c1c5e6375037f3c55f97c736_cryptbot_icedid_luca-stealer_njrat_remcos_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Roaming\1.exe
  "C:\Users\Admin\AppData\Roaming\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CF90.tmp\CF91.tmp\CF92.bat C:\Users\Admin\AppData\Roaming\1.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process 'defendnot-loader.exe' -ArgumentList '-n microsoft360-enable','--silent','--autorun-as-user' -NoNewWindow"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
        
        "defendnot-loader.exe" -n microsoft360-enable --silent --autorun-as-user
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5716
      - C:\Windows\SYSTEM32\Taskmgr.exe
        
        Taskmgr.exe
        6⤵
        Loads dropped DLL
        
        PID:6088
- C:\Users\Admin\AppData\Roaming\MpDlpCmd.exe
  "C:\Users\Admin\AppData\Roaming\MpDlpCmd.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MpDlpCmd.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MpDlpCmd.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\DlpUserAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DlpUserAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DlpUserAgent" /tr "C:\Users\Admin\DlpUserAgent.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2436

C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:5920

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:4724

C:\Users\Admin\DlpUserAgent.exe
C:\Users\Admin\DlpUserAgent.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Users\Admin\DlpUserAgent.exe
"C:\Users\Admin\DlpUserAgent.exe"
1⤵
- Executes dropped EXE
PID:5436

C:\Users\Admin\DlpUserAgent.exe
"C:\Users\Admin\DlpUserAgent.exe"
1⤵
- Executes dropped EXE
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1fbbe4ab8c3a66b2eff094e291b076d86bc9e5775e5be4d4912700bdd9233edb
MD5 d968c0738897dd59339ee1bc9fd4aac5
SHA1 185cbdf04e56b4ead390b45fc1a6e03e7844a63d
SHA512 f69b5fc03b54b86df7c3e50502f3c12a310f966efb573f5d0afe29a1c5b5d6839ddda9be635ce0b2978a48dab18b238ddfab9ee9d281273b553b8dc706f7b0d5
TLSH
T18F216833B3DD8624C89A413A10CDAC1036BAC7DB41DECFAB7B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b9742837d237cde952d60beb5e9fa577cae80b6d431ef9f62d2fd08e15342180
MD5 520b5a98375dae2fa33242f5edeefda3
SHA1 6e2f1eb269246aff712a5c4ee4147db3e45be0ea
SHA512 675c15d9e3be043457248b202c50990e1e0bf73d6281db191f51e91bdb9fa861b29fb98f3554729f4747edb18d7f84894a3f059f6acd077e456f3d71eaabb862
TLSH
T11C219833B3CC8614C89A003A10CDAC0036B6CBCB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9e2e11b45a68ab3614fb2b5ae84f9bec9e5638950f0446e20d5c2f7c7880c2dd
MD5 bc9eda99a7d6ac9c8bb79a0a10a7a246
SHA1 e019eaaca01667502f8a07359970870bfc2f98fb
SHA512 233d94436ab566d2570ab7eca454491646569c0c361f28d4f322df7a6e774f15b4fa5227f01a7be4fc5db6acbfb25bbe5e6501081176588be99c96c671e4fb19
TLSH
T1C4215937B3DC8625DC9A413A10CEAC1036B6C7DB419ECEAB7B84D544A42F699DE60560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ae7a554d6193cdb2739224bda995f35d4b0ad205ac609bfeeb64f6b6a5b5784e
MD5 2484be47e92c5bb00dd6568925c3041c
SHA1 0335af3e344941b98c88b7fbbfd70612d4ec7cc9
SHA512 bfd08bbaafa00ce02122d315b1c2ee61ec61e2aef035cc0942bc3010abb77bd233b5c7edf5122ff5be8d9e28246ef0032ea7af7183c522e1dced6eca88af72eb
TLSH
T11E219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

CF92.bat

Path C:\Users\Admin\AppData\Local\Temp\CF90.tmp\CF91.tmp\CF92.bat
Size 189B
SHA256 e87588321343d49f9472ee53ca7567bc08cb52c7e81852f5f492fcdc29834c67
MD5 cffd3e45e94ae939eb396bf36d4edf81
SHA1 b2d21c46580e6a4144f962d464ee27fed9ed6158
SHA512 2f352aca98bbaee2e70fba3b03eaa2aa595d561e101910e726b5fd9f869e7c9ff49022bf881fc1cc4a55287d35f6ffb792bc1b09138d246306262c517f5343f4
TLSH
T126C022352858B46BEB54C223209A570AFAAA1143000B041715AAA42D7B800CBC3C8C10
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xztbj2os.uqk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xztbj2os.uqk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1.exe

Path C:\Users\Admin\AppData\Roaming\1.exe
Size 53KB
SHA256 47dd63e3adb77fd4561b34595bd71506d06e6aba7b5f177f6668a5a6b45c262e
MD5 5103b76c999d61060eb88210ae96bc30
SHA1 cd84f11e766dfbdee2c685e7001739978e26b887
SHA512 0c05875c5d82b636714e4639c89f7d5430e7ed6825953d3dcd73e9c8241739ff74ce4d91601d1e8857743cb049ff2b64f2a501494052e66b67d54d008b0b96bf
SSDEEP 1536:k4dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTNrw:k4dzVTaer344JzthRZijQ1J
TLSH
T1C933F1B7967DE8BCC42311B26BCD0444F66F2A2B9BC5172F0990AAFFC8A62D45700756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpDlpCmd.exe

Path C:\Users\Admin\AppData\Roaming\MpDlpCmd.exe
Size 251KB
SHA256 b60fa7733181b9b955f19e88e1db8e7acf90c62fd51091b57893a64efd62699a
MD5 dcad1039921e593d86e14a988d5bf1f2
SHA1 373c5bde6294c6a142e84f3c3628fe86ab0c61b1
SHA512 cc211042b86e12a0cc8b472fb761b45de96ed877ddb77adb481a524649ef2ce48c88997410a4a31ec4ecee861a8aeb1a2aa45a4bbafe6beeb022ed3a3b2ea4ef
SSDEEP 6144:pbbLJk2iTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVG:pbJu
TLSH
T16B448681DF89148BDC399F31E270F7694B3BEAD0B89A9F6D206D3D2D7C5494098027B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctx.bin

Path C:\Users\Admin\AppData\Roaming\ctx.bin
Size 131B
SHA256 8ddf2555e4d12e11f10ed348995573cd42bb3895af248d176f0c8c4db8491219
MD5 ba3a032a0b6390c669a45ebb7dedab71
SHA1 47919c12679794f3424993a789242ed788f4d79b
SHA512 2a425de435783afe0ff32fd7ca05b7bdb323d5a9fa17b4b02b7c683304003a485c9342bce765f30181185d55754bcba8e918c88ae047e09f7370080d3c30f0c8
MD5 SHA1 SHA512

Submit Download

ctx.bin

Path C:\Users\Admin\AppData\Roaming\ctx.bin
Size 131B
SHA256 5d7f018ddd2e052e2816d42ab6e1f204fd5103954102d574c6128b32fc8d56ef
MD5 555d91c31e323915b09acd85b167d656
SHA1 fbf73cc606eb4d9d89a443e9c8906fb3878bacd0
SHA512 15f5759ab5cf22f1f24316b63ee1b17987f34a7aa2217537d595bac7cc2cd619a122f53637c4d4aa10c5fb84a0a6c19475e85037f15e3d7bdbd2e7fd1d697134
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
Size 581KB
SHA256 4776620d4a617ce96d83a3a2ae0999a9dc6ee79bd9dcefe296cd877a62aa2224
MD5 734d301654affee77396b554ccb04e0e
SHA1 7a4129e6a9180d4eb326e0c3a1f138539816cbc6
SHA512 48762065698d08366bc7413f65cc9f9577dc6099ecd8441bc48fb9a16e65d03fa6815b1000839fd4a34a5d11cebbc5a3a0505dc2d085e3e5ca424b6189490184
SSDEEP 12288:wDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBk:wDddddddddoChjhw7CYh0lhSMXlns
TLSH
T18BC49D26B7E940F9D1ABC27889530A16EB737C4643616ACF03E44A675F236E05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Users\Admin\AppData\Roaming\defendnot.dll
Size 427KB
SHA256 45e942ba59f3876b263a03ed7e5d5b1b250e84a0a4b4093b3c13b5fca4e12b21
MD5 edcfd344d44db165aaadaa1c75499daf
SHA1 09b25238b9df51d2d390599a12f49384f815fb73
SHA512 b295f371a3f0f907d8273b83bca32e6512b08dc10215ba2ad7f8e02c1b56c7d6f579a8affb693837fec711f9ef6a0f9ab1088f8760a58a21b7a430ef0fbbbb33
SSDEEP 6144:yuax4l7odwsjYGT5Zeu14MPQEPa6/ph0lhSMXlBXBWniG77mHBR:yppTzn1bZa6/ph0lhSMXliV3
TLSH
T15094AE16B7A580B9E16B8278C8570A05EB337C414791EBCF03A4DAB66F637D15B3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2960-49-0x00000197BCB10000-0x00000197BCB18000-memory.dmp

Download

memory/2960-46-0x00000197BCFF0000-0x00000197BD00E000-memory.dmp

Download

memory/2960-50-0x00000197BD010000-0x00000197BD016000-memory.dmp

Download

memory/2960-51-0x00000197BD3C0000-0x00000197BD3CA000-memory.dmp

Download

memory/2960-48-0x00000197BD3E0000-0x00000197BD3FC000-memory.dmp

Download

memory/2960-47-0x00000197BCB00000-0x00000197BCB0A000-memory.dmp

Download

memory/2960-44-0x00000197BCE30000-0x00000197BCEE2000-memory.dmp

Download

memory/2960-30-0x00000197A4A00000-0x00000197A4A22000-memory.dmp

Download

memory/2960-43-0x00000197BCAD0000-0x00000197BCAEE000-memory.dmp

Download

memory/2960-45-0x00000197BCAF0000-0x00000197BCAFA000-memory.dmp

Download

memory/3228-74-0x00000207B0F80000-0x00000207B1032000-memory.dmp

Download

memory/3548-28-0x0000000000FA0000-0x0000000000FE4000-memory.dmp

Download

memory/4068-60-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/4068-23-0x0000000140000000-0x0000000140027000-memory.dmp

Download