salatstealer | c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc

Analysis

max time kernel
42s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
MD5 cadb63e600829d6d26aaac973d55d89d
SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
TLSH
T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 2 IoCs

resource	yara_rule
behavioral10/files/0x000f00000002465c-5800.dat	family_salatstealer
behavioral10/files/0x000700000002466e-15018.dat	family_salatstealer

Executes dropped EXE 7 IoCs

pid	Process
4684	Setup-bTbvWlUQiXYpayRj.exe
3756	agent_NFllWbPN.exe
3764	Setup-bTbvWlUQiXYpayRj.exe
3528	agent_jEitqLgL.exe
1412	Setup-bTbvWlUQiXYpayRj.exe
1620	agent_UjakfuGE.exe
3464	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5800	certutil.exe
2748	certutil.exe
6120	certutil.exe
3924	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4016	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_NFllWbPN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_jEitqLgL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_UjakfuGE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_NFllWbPN.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_NFllWbPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_jEitqLgL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_UjakfuGE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	agent_NFllWbPN.exe
3756	agent_NFllWbPN.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3084	winws.exe
Token: SeBackupPrivilege	3084	winws.exe
Token: SeDebugPrivilege	3084	winws.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3760	4016	cmd.exe	86
PID 4016 wrote to memory of 3924	4016	cmd.exe	93
PID 4016 wrote to memory of 4684	4016	cmd.exe	94
PID 4684 wrote to memory of 3756	4684	Setup-bTbvWlUQiXYpayRj.exe	98
PID 4016 wrote to memory of 5800	4016	cmd.exe	100
PID 4016 wrote to memory of 3764	4016	cmd.exe	101
PID 3764 wrote to memory of 3528	3764	Setup-bTbvWlUQiXYpayRj.exe	102
PID 4016 wrote to memory of 2748	4016	cmd.exe	105
PID 4016 wrote to memory of 1412	4016	cmd.exe	106
PID 1412 wrote to memory of 1620	1412	Setup-bTbvWlUQiXYpayRj.exe	108
PID 4016 wrote to memory of 6120	4016	cmd.exe	109
PID 4016 wrote to memory of 3464	4016	cmd.exe	110
PID 4016 wrote to memory of 3084	4016	cmd.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3760
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Roaming\Microsoft\agent_NFllWbPN.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\agent_NFllWbPN.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3756
  - - C:\Program Files (x86)\Microsoft\svchost.exe
      "C:\Program Files (x86)\Microsoft\svchost.exe"
      4⤵
      PID:5588
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:6076
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:2716
    - - C:\Program Files\Google\Chrome\Application\svchost.exe
        
        "C:\Program Files\Google\Chrome\Application\svchost.exe" -
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe" -
        5⤵
        
        PID:3384
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Users\Admin\AppData\Roaming\UseUnpublish\agent_jEitqLgL.exe
    C:\Users\Admin\AppData\Roaming\UseUnpublish\agent_jEitqLgL.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3528
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Users\Admin\AppData\Roaming\JoinUnpublish\agent_UjakfuGE.exe
    C:\Users\Admin\AppData\Roaming\JoinUnpublish\agent_UjakfuGE.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1620
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:6120
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:3464
- - C:\Users\Admin\AppData\Roaming\EnterSelect\agent_wQfBeSph.exe
    C:\Users\Admin\AppData\Roaming\EnterSelect\agent_wQfBeSph.exe
    3⤵
    PID:5868
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe
Size 3.5MB
SHA256 f6b23c97a2c1bfa65177bb0b54dc5b4c9c9ae22fc4c7b8da21529fb5e21dc86e
MD5 15fa4439df408b854e92134c9f04379d
SHA1 0a4f8e7231fa1923ac737940e5a32a828cdaed6d
SHA512 6152ae7b3f2baec35eb1ff192d4fd219122db1187403c338e67c3607fba54d6225c2a0f3be8da73fd5e4074d480f7fadf794fc4fa223837f9c171b47ee5bd581
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd79:icVUcTedI6C9e9MW
TLSH
T17DF5C564EEEBC1F5ED035C30115BB23F6A3526098738DEEBDB941E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe
Size 3.5MB
SHA256 399842be09d2906391511310063b13f224b08098ff9bb6318cb7b87a082eb1a5
MD5 18737ab4643f0111903f304c7a96d8e9
SHA1 c47bd408371f4dad0f4ade3f56ad7484231495f5
SHA512 ec2c09a55e0e03f9f78d4a5692a25c36d1a898b621ed5473873b080252ab1b37e62483cb9c4221e05f8e9ca74979fa9ada5352f1e7487af753741cd07b1a0254
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fl:icVUcTedI6C9e9M6
TLSH
T1DC06C564EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Program Files (x86)\Microsoft\svchost.exe
Size 11.3MB
SHA256 7b57ba46457f71d2c22136fadce7c34600465abc6b47b723d8e4c10ea1d317fc
MD5 5c2a02cc6fd1a70180de1c419818aaa0
SHA1 f7170b0d78774ae20adb56301f0b8e5d552d3769
SHA512 cca69364dcb08ccab779d1b6246e2a83dc8e6e19f4bbf86f158d17018046d8207600d291c8fffd9e24b74ecbbdd855e3987bf7fd9f5acca264149542e227a8dd
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfb:icVUcTedI6C9e9MQR7t+chQa4NG20Cc
TLSH
T121C65A10FEDB95F2E9035831416BB27F27315D048B28DB9BEB547A2AF87B6A11C76304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Program Files\Google\Chrome\Application\svchost.exe
Size 2.9MB
SHA256 e63dc940aea0d298b938aeba925bf3429bb78fdef0ed951658cb1fa6cc48542d
MD5 1dc6e332430633439b5d88242f77036b
SHA1 bc0e940b3ae994f8defb3e5cc803931ebf1a21c1
SHA512 fc9783b10cef53730c56304b0e6380759e139797fcdfd37feda9e90440a1b8ca0c694758d8582c8d71d98c226025d4e8e63d434e4adbdc0d29c886382f607b9c
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIw:icVUcTedI6C9e9a
TLSH
T15AE5C664EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Program Files\Google\Chrome\Application\svchost.exe
Size 2.9MB
SHA256 84d68631c75f02e4c807bb784525c582dd6b4e4ec7b6d7565f38eefdf7771177
MD5 42cce76273c1db5f1047e3a71c242c43
SHA1 5d1d4b761d768029a2cdeecead8dc00b0dba988a
SHA512 dde3654dd58b6aa81df7ab233013fdbf5a00c6715bade11223e3866f1448b5a43e75da71e931e79380f90a70803bd53971df9b64bd16ce5babd22b037b4a37b0
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIs:icVUcTedI6C9e9e
TLSH
T14EE5C664EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.3MB
SHA256 2b94e4efa57e5c3e604c908ddadf221e6bc2570f251e365286c1456bee620c0a
MD5 43518380c38461d1da7f4b1f3d244cc1
SHA1 bb99008de3e9b38d9eab1fb1161db99e57536209
SHA512 e3b5b78aa90d6fd8469b4ae31a6793c8c1c47d8c7250bcb51fc0fc7d3509e23e44c0294fb79e1a5b8b1b6dec57569a783b36477ecca9acf765d88ff80643f80c
SSDEEP 49152:60V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvY:x
TLSH
T1B6E6BE320683BDBD3FAD3D45E0012E495D9D7A0B11A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 9432cc8f66df479c053150eb2e94cc59cf1767e973376905f7776667821cdbb8
MD5 ad753b81487fbd621eddf7fff62d0de1
SHA1 df0b8f8317728878f7e049d26f141cdf45ca015b
SHA512 ae0010898babfb48cb0e142b44b6f0449bca0071d77b18d292d365055a49aa9885325c0e2005c3823296faa43c8990150f013c27dba8134f93c2547026ed5831
SSDEEP 384:3qbClnFe1ER00R3zLmVGe0Cpl6tcpb7IBWNQJ7/ErR9Gd:abClFe1ER00pmd6KpbQWNQJgt4d
TLSH
T18972F87ACBB72C3A39EC78CD5C808D859D6E0D070AB590D8E78581F2A39C2A445FE771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 b529a62eeff5ab7070e45415dd9a8ceac637aa56869e7b7fa08acce932657bd6
MD5 59374973a633d053e7512206d2de82bb
SHA1 90c8a5993df99980c266e6faaefae675a76d488a
SHA512 ca384b85221adb64e42ddb3f4ca9d03a88abadd04fd7fe9736e9335333d8bdacd809242181ec6c2c9be209ed3e9345ea4774e99ea32f3cc3fdd9d2f0ff73fd52
SSDEEP 384:GoaH0rJ5I+idkvum8ed95itDlf55K0G4wjOb:GdoJyNedMlf55Ujy
TLSH
T1A1723AB14A9B20FC31EC3D4074121F6D8E6D1F8B657303454B8971BAA37D9E88F19E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.3MB
SHA256 c0424bf83ade4f26a9ff2525ba41d0b3f5e2372915dbbd38ff322b45cf1076b7
MD5 563505f25b73f9e522da98a34791d7d3
SHA1 5e63e02c8fd9f34ae12afcee4cdc4d9a80f0e49e
SHA512 48102e3bf2d01b95b3487a4db3e149d6c69537c46d092f3a78301e30cc85221da8be2cde13799744a24f45b44aa6cb428bd1d5b1f142fe5ddc412d254bd2aec3
SSDEEP 49152:Y0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvY:X
TLSH
T17DE6BE320683BDBD3FAD3D45E0012E495D9D7A0B11A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i1o4xze2.o2f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1o4xze2.o2f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_wQfBeSph.exe

Path C:\Users\Admin\AppData\Roaming\EnterSelect\agent_wQfBeSph.exe
Size 5.2MB
SHA256 ec5bc1c96b2a5b26ac86ee155fee3766138fb036edb482e2098b87743bd4d580
MD5 51400b3ae9c867571fb6cb508ec4b62b
SHA1 6ba6812fce0b43be11e6cc5811705eaadb083af3
SHA512 ea8517252e94c725ab9b03ce689e90c94ab83051d3c8ded4f315ac9950c844be79fff55a3e4013fa11eee5982f1da36fce45be5cb8c4fff2d713b7d077a329c8
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOH:icVUcTedI6C9e9MQR7t+cU
TLSH
T10C46E624EEEBD1F5ED035C30216BB33F6A3516098738DEE7DB901E02E55B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_NFllWbPN.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\agent_NFllWbPN.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3084-15008-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3084-15011-0x00007FFADBAC0000-0x00007FFADBDC2000-memory.dmp

Download

memory/3084-15010-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3084-15007-0x00007FFADBAC0000-0x00007FFADBDC2000-memory.dmp

Download

memory/6076-15030-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/6076-15061-0x0000000007AB0000-0x0000000007B53000-memory.dmp

Download

memory/6076-15039-0x0000000005EF0000-0x0000000006244000-memory.dmp

Download

memory/6076-15029-0x00000000054F0000-0x0000000005512000-memory.dmp

Download

memory/6076-15040-0x00000000064F0000-0x000000000650E000-memory.dmp

Download

memory/6076-15041-0x0000000006590000-0x00000000065DC000-memory.dmp

Download

memory/6076-15028-0x0000000005680000-0x0000000005CA8000-memory.dmp

Download

memory/6076-15023-0x0000000004EE0000-0x0000000004F16000-memory.dmp

Download

memory/6076-15046-0x0000000007650000-0x0000000007694000-memory.dmp

Download

memory/6076-15047-0x00000000077E0000-0x0000000007856000-memory.dmp

Download

memory/6076-15049-0x0000000007880000-0x000000000789A000-memory.dmp

Download

memory/6076-15048-0x0000000007EE0000-0x000000000855A000-memory.dmp

Download

memory/6076-15060-0x0000000007A90000-0x0000000007AAE000-memory.dmp

Download

memory/6076-15031-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/6076-15062-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

Download

memory/6076-15052-0x0000000070770000-0x0000000070AC4000-memory.dmp

Download

memory/6076-15063-0x0000000007C80000-0x0000000007D16000-memory.dmp

Download

memory/6076-15064-0x0000000007BE0000-0x0000000007BF1000-memory.dmp

Download

memory/6076-15051-0x0000000070600000-0x000000007064C000-memory.dmp

Download

memory/6076-15050-0x0000000007A50000-0x0000000007A82000-memory.dmp

Download

memory/6076-15065-0x0000000007C10000-0x0000000007C1E000-memory.dmp

Download

memory/6076-15067-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Download

memory/6076-15068-0x0000000007C50000-0x0000000007C58000-memory.dmp

Download

memory/6076-15066-0x0000000007C20000-0x0000000007C34000-memory.dmp

Download

memory/6076-15074-0x0000000007D20000-0x0000000007D42000-memory.dmp

Download

memory/6076-15075-0x0000000008B10000-0x00000000090B4000-memory.dmp

Download