salatstealer | 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864

Analysis

max time kernel
44s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT10).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
MD5 9a77b713dc626138ec7421f560716a28
SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
TLSH
T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral12/files/0x000700000002462c-7327.dat	family_salatstealer

Executes dropped EXE 5 IoCs

pid	Process
2132	Setup-bTbvWlUQiXYpayRj.exe
2532	agent_FmcjmRKq.exe
4516	Setup-bTbvWlUQiXYpayRj.exe
1576	agent_SADqghtv.exe
4180	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2524	certutil.exe
4576	certutil.exe
2384	certutil.exe
4936	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_FmcjmRKq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_FmcjmRKq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_SADqghtv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_FmcjmRKq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_SADqghtv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	agent_FmcjmRKq.exe
2532	agent_FmcjmRKq.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4696	4384	cmd.exe	85
PID 4384 wrote to memory of 2524	4384	cmd.exe	94
PID 4384 wrote to memory of 2132	4384	cmd.exe	95
PID 4384 wrote to memory of 4576	4384	cmd.exe	96
PID 2132 wrote to memory of 2532	2132	Setup-bTbvWlUQiXYpayRj.exe	97
PID 4384 wrote to memory of 4516	4384	cmd.exe	98
PID 4516 wrote to memory of 1576	4516	Setup-bTbvWlUQiXYpayRj.exe	102
PID 4384 wrote to memory of 2384	4384	cmd.exe	104
PID 4384 wrote to memory of 4180	4384	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT10).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4696
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Roaming\GroupInitialize\agent_FmcjmRKq.exe
    C:\Users\Admin\AppData\Roaming\GroupInitialize\agent_FmcjmRKq.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2532
  - - C:\Program Files (x86)\Internet Explorer\cmd.exe
      "C:\Program Files (x86)\Internet Explorer\cmd.exe"
      4⤵
      PID:3664
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:4772
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:4876
    - - C:\Program Files\Google\Chrome\Application\cmd.exe
        
        "C:\Program Files\Google\Chrome\Application\cmd.exe" -
        5⤵
        
        PID:2364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\cmd.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\cmd.exe" -
        5⤵
        
        PID:4068
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Roaming\DismountLock\agent_SADqghtv.exe
    C:\Users\Admin\AppData\Roaming\DismountLock\agent_SADqghtv.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1576
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Users\Admin\AppData\Roaming\ResumeProtect\agent_ZTdnBXSN.exe
    C:\Users\Admin\AppData\Roaming\ResumeProtect\agent_ZTdnBXSN.exe
    3⤵
    PID:4072
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:3932
- - C:\Users\Admin\AppData\Roaming\TestUnblock\agent_mzVAIbib.exe
    C:\Users\Admin\AppData\Roaming\TestUnblock\agent_mzVAIbib.exe
    3⤵
    PID:2384
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=none --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.exe

Path C:\Program Files (x86)\Internet Explorer\cmd.exe
Size 7.9MB
SHA256 dbbeeacfd6fe902693ff4f4d6ae9ac46a426b04db14ffe11e5dc555e1f6522e4
MD5 2a92716c6be223e24c8c22cac49114df
SHA1 3ef91796aca47911a851278206c4f553c29e7046
SHA512 98a5eb398a6b6e8f2ca0c47ba4e9f3618af1484aafd11097e6261179fc4053ffa6d31bb35f45246423a4a459f18022f58579b7e3efbf1e47fdfc711d29492f02
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfs:icVUcTedI6C9e9MQR7t+cQ
TLSH
T1FC860821EADB91F5FC035C31115BB23F67351E048728EAE7DB543E43E87BAA2187A605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe

Path C:\Program Files (x86)\Internet Explorer\cmd.exe
Size 7.0MB
SHA256 1543b77db6e13f6170b5ef520658ed21a75d01ebca03ff2b6574020eb4364378
MD5 11b41b0e0f53669a469dff0ee6a7e20d
SHA1 4177686d87c35069b33175e6600411f7d5264a28
SHA512 69f357eb2789f5b24258299621da20c86e8692e41c421a7e20516959acf5a68b7616b718c91f187f18a0c0a1f7a039dc22df51fc7bd73dfeec3d809fda79a68b
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFf8:icVUcTedI6C9e9MQR7t+cw
TLSH
T1A2760620EEDB91F1EC035C31116BB33F67351E058728DAE7EB943E06E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\cmd.exe
Size 3.4MB
SHA256 2dbd66d8383af5f4e4b559332dc28f9dabd7d9d662ff3a09e2284fe6f906314e
MD5 6897085afcce7b4ee7cf2960374b1222
SHA1 ed86d3c889368976ef3e84e415d586b80e3786f5
SHA512 28475dbd57d6f6582e7e01593382444d3527ca434f66f236456c3e69a15e3fb2d35fc8374dcb5c864189e61f3fbfc60ecf4892b36985559395d472ec6303fa26
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7U:icVUcTedI6C9e9M3
TLSH
T10AF5C564EEEBD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\cmd.exe
Size 3.5MB
SHA256 399842be09d2906391511310063b13f224b08098ff9bb6318cb7b87a082eb1a5
MD5 18737ab4643f0111903f304c7a96d8e9
SHA1 c47bd408371f4dad0f4ade3f56ad7484231495f5
SHA512 ec2c09a55e0e03f9f78d4a5692a25c36d1a898b621ed5473873b080252ab1b37e62483cb9c4221e05f8e9ca74979fa9ada5352f1e7487af753741cd07b1a0254
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fl:icVUcTedI6C9e9M6
TLSH
T1DC06C564EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe

Path C:\Program Files\Google\Chrome\Application\cmd.exe
Size 3.1MB
SHA256 f4367101877f16ee9ce6530d7b0f0c34869712fa443ab0d245780e57bfebe8f1
MD5 59b519150ddcf152adb400084bddff53
SHA1 4c6d44e7284520eb5460dcac3a68532a5fe48034
SHA512 7c5c1ac26a80f17ef140f932f6803bb37254445f7a2a961b485432b298bb98aae93f0a54eae3e84b7c2e784ab2bf2d73e8d326ed021fa22b72938dbf8ed9dcce
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIyv:icVUcTedI6C9e9Mv
TLSH
T16DE5C564EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe

Path C:\Program Files\Google\Chrome\Application\cmd.exe
Size 3.1MB
SHA256 4b53298bce653f6359623c824745ce7b9e5159977b030f6b7940c28ae7290444
MD5 5c658e3f902e71bb33fdba4f2628096e
SHA1 a389924450cde190ac3340f28a877340b7ee90aa
SHA512 eb0ec1ba8c0432d2d9d741ddab67ef154e306303fa358f053125567b9f276d61d31f31d1abbaf3010dae4f7155a480f28f68220eff386fcd000decde529d76b5
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIym:icVUcTedI6C9e9Mm
TLSH
T1CFE5C564EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 5.8MB
SHA256 34b346358e06f40efba9ff1a1f4ad9c3b707e60cc12cc0e643a735ec2977d38c
MD5 0a7e8fd755439e70414e2a7f26af9039
SHA1 cf623bdc4b5425710b2ce412235a1b353f397cdc
SHA512 3e4533b05cb46479669317f84a936d4122b2d74b7ab954ad0ee678c0a7205b0baf8a0e2f52e10c87dd91508f9ddb6b99a74eae361b4d6f792d1abe94e4426119
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eNX8t:06GtcbPy/lwHVSavaeNn0
TLSH
T16E564B03EC6555E9C0AED2318A729163BB717C881B3163D32B90F6392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 400KB
SHA256 233b1c25dea8422ab15fde8689481711aff40770509f84c9c59c587de486a156
MD5 5d8b1e60a3cd62b7c7d66e59d2a2eafc
SHA1 4907af5ab9674de11e8a94e4707da1ed0d55761e
SHA512 545dd462c9ed9c657e3c5d287eba9d541f311bc85e83be0e0edb4a244a773785e7cb45f8580f230459131c680e2fff4ea20da53ebf802ffa6e5d357908122460
SSDEEP 6144:rofLVXn5Yz3HB6rblimZkFyLjo70Yx7neuq0tDNBY/lmRamnnW:rof08tihFAuFRamnW
TLSH
T19A94193906A770BC38BC3D9275220D4D5E5D3B0E157A430767C530BAA7AD5E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 13.6MB
SHA256 2e23595a542b922456153b94369d16b87a4374b4168910de38e69061c5d06d67
MD5 43e6e37748f7029a617a62ce48d73421
SHA1 debcc3542f76d515ebf45c7c7a34cd14ce52d4fb
SHA512 c1f518fd31c16ddffde327349fae26b21880f1c3c3f0ac9c147405659ef9c55c62364da2fe4660e18b51ff03f6cc9cd1dd9c7f54fbec3360795c5b046b348e75
SSDEEP 49152:VHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9Cg:w
TLSH
T17AE6CF320243FDBD3FAD2D45E0052E455D9D7A1B12A8D259FB8930BA63EE5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.1MB
SHA256 68ede11f6470c8bbd2b242b498f36f128f5df7c8bed92e74c5bd4972f4f2b0d2
MD5 b59c889cc31568a7670eacc9b61fba0f
SHA1 0e9992ecc558cec5e10962d463685fdd82c4b08b
SHA512 92ad3f585c787ffe28c1632c397ff41a90199047572cadec09e3db4b1966bc67d2d3bd0bb854b3b2b88dcba49181484d170cb258bad1c1fb6960519f8f02a52b
SSDEEP 49152:/8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRCj:9
TLSH
T15AE6BF320683BDBD3FAD3D45E0012E495D9D7A1B11A89359FB8930BA63ED5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 915a8945f4a2e66f475d0946536e72747a0f5b5b6176ee75f1fba912ce019c1a
MD5 5ab3e5641181d264795e3ed3ae3e7d2b
SHA1 41ee5e8273eff0ba17e3805bb3682521d91e47c0
SHA512 3271800190ed2ae6fe79d9c2e91179d128aef14d4e4e6f190aef26144e989ebfe66e4432dd30cf89bf13afa202e1ae58ef84613ffb3f667941bb0d2de8f08c59
SSDEEP 384:UNw4cycXd6uBQRBzroYLCP6PbWDWmP3ul00hIQekGoFTa9oD3XAcX:UNw4cVN6uBaCP6PbWDWwel0QIQUopa9g
TLSH
T1DA7286A1168730B8EBCC7E0E1C564C9CB6BA53819D22475F0348B6BC21769CF9F79653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 079fd901115cfe65816a33122fcfd68f684924a41312b87ffc749f3915f04f49
MD5 2fba7ab0666c1f1e193a563c325a16b6
SHA1 af46fd3cdfcf5216caf956e95c9f7a250a7281c3
SHA512 b82f8c418ff0e8f32dc54287bd5bdb0c956286cc660288f519bc295fb901f03fae6c977c0574291496488b8efd0ef4d0fa7706f549e4f9136032505801386ac7
SSDEEP 192:S5N8GVmlyOje/ogflJhrLlpPlihRQpY0En8Di9Qr+hxfhwmqrJeuXAly6nzlyeGV:Sh0C9Jh/8hKqv8iua2mqVetRzlyeU
TLSH
T1D672B3340BE364F831FDBDD369619D9C5C6D1B0C5972130613CD3AFA62AE89C8E2686D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 5.7MB
SHA256 15cef1ebff05defa0e0992923f0ab786ce983895935c62404fbaaf986b6ef647
MD5 f9d45c4c2981d242c3d729cba746d9dd
SHA1 fe97691f5b66410fe9283de59c12d33082795665
SHA512 b95f9d59ef7a00d4c38ef17e3d5f7c5c8ec8b6718408787c0b2170478508c92ffc12fbe160db9d341b24676451c9c4303e560a0ca3236bf56940249d8179f8e5
SSDEEP 49152:f8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPn+:m
TLSH
T141566C360693BDBC3FAC3D46E4011D495D5D770B21B9834AB78934BE63AD5B88E28D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_llfajt4k.jk4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llfajt4k.jk4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_FmcjmRKq.exe

Path C:\Users\Admin\AppData\Roaming\GroupInitialize\agent_FmcjmRKq.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ZTdnBXSN.exe

Path C:\Users\Admin\AppData\Roaming\ResumeProtect\agent_ZTdnBXSN.exe
Size 4.9MB
SHA256 0e0f546336c21da110bacb2c1892734498cb07fa8c3c9c78f23388bf691426cf
MD5 127b2b5d45df66b13faf38101ef019dc
SHA1 9d3b53b1547d313c675b32b1248e7f6c9cda2638
SHA512 2c0c59e43f19697b0050eee2117279c26b9f0e69d3c8e8daaf97202e4b1b328fdf3e06f0648ac47335a2a34b2969c124c1fe9dbe3d6994347ad6470f32a175cc
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pk:icVUcTedI6C9e9MQR7t+2
TLSH
T1ED36E624EEEBD1F5FD035C30215BB23F6A3516098738DEE7DB901E02E56B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ZTdnBXSN.exe

Path C:\Users\Admin\AppData\Roaming\ResumeProtect\agent_ZTdnBXSN.exe
Size 5.2MB
SHA256 ec5bc1c96b2a5b26ac86ee155fee3766138fb036edb482e2098b87743bd4d580
MD5 51400b3ae9c867571fb6cb508ec4b62b
SHA1 6ba6812fce0b43be11e6cc5811705eaadb083af3
SHA512 ea8517252e94c725ab9b03ce689e90c94ab83051d3c8ded4f315ac9950c844be79fff55a3e4013fa11eee5982f1da36fce45be5cb8c4fff2d713b7d077a329c8
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOH:icVUcTedI6C9e9MQR7t+cU
TLSH
T10C46E624EEEBD1F5ED035C30216BB33F6A3516098738DEE7DB901E02E55B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_mzVAIbib.exe

Path C:\Users\Admin\AppData\Roaming\TestUnblock\agent_mzVAIbib.exe
Size 4.2MB
SHA256 a658abc3ef1efdc9bab94b59a586add14d67913744a17f33f0a68a9c0603fc78
MD5 d8d17e5e189532d6f68c4fcfeb10e1a9
SHA1 1aaeede9b20597dd0f50a979e1ba6d194c11d79e
SHA512 e4d354537b8c161f2eeb2cc542a7bb90fdb21b08bddc2ccadc3199c0a243a7a741478217b31d74318e0a4c243fcf0a987b08dd70117bc06320c6bc541c597852
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXO:icVUcTedI6C9e9MQR7tW
TLSH
T12726E664EEEBC1F5FD035C30215BB23F6A3516098738DEDBDB901E02E56B6A21C76606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_mzVAIbib.exe

Path C:\Users\Admin\AppData\Roaming\TestUnblock\agent_mzVAIbib.exe
Size 4.0MB
SHA256 4099918bdfb9220a5d8bf54dc549371bf5cc227aa9f4e270f01d819171a4bb4e
MD5 968cd0196d3d86424b6b0d08cfcb0d34
SHA1 31ca9f720eb5cfac959068255f52c6a716ff9b5d
SHA512 6a9947ac07f1e5f8d60c12907b3fbda935d2a4d755132eed91388686c99f7d54267720531586cb5e4a139c1803ae659197fb6a3bd5ad3d7d7596906484b57e0d
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272Ib:icVUcTedI6C9e9MQR7tb
TLSH
T14E16D664EEEBC1F5FD035C70215BB23F6A3516098738DEDBDB901E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-14547-0x00007FFF6C3A0000-0x00007FFF6C6A2000-memory.dmp

Download

memory/4144-14548-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4144-14546-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4144-14545-0x00007FFF6C3A0000-0x00007FFF6C6A2000-memory.dmp

Download

memory/4772-14564-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/4772-14565-0x00000000058B0000-0x0000000005916000-memory.dmp

Download

memory/4772-14572-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Download

memory/4772-14563-0x0000000005120000-0x0000000005142000-memory.dmp

Download

memory/4772-14574-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/4772-14575-0x0000000006140000-0x000000000618C000-memory.dmp

Download

memory/4772-14558-0x0000000004B30000-0x0000000004B66000-memory.dmp

Download

memory/4772-14562-0x00000000051A0000-0x00000000057C8000-memory.dmp

Download

memory/4772-14580-0x0000000006670000-0x00000000066B4000-memory.dmp

Download

memory/4772-14581-0x0000000007460000-0x00000000074D6000-memory.dmp

Download

memory/4772-14582-0x0000000007B60000-0x00000000081DA000-memory.dmp

Download

memory/4772-14583-0x0000000007420000-0x000000000743A000-memory.dmp

Download

memory/4772-14584-0x0000000007670000-0x00000000076A2000-memory.dmp

Download

memory/4772-14594-0x00000000076B0000-0x00000000076CE000-memory.dmp

Download

memory/4772-14595-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/4772-14596-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/4772-14586-0x0000000070C50000-0x0000000070FA4000-memory.dmp

Download

memory/4772-14585-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

Download

memory/4772-14597-0x00000000078A0000-0x0000000007936000-memory.dmp

Download

memory/4772-14598-0x0000000007800000-0x0000000007811000-memory.dmp

Download

memory/4772-14599-0x0000000007830000-0x000000000783E000-memory.dmp

Download

memory/4772-14600-0x0000000007840000-0x0000000007854000-memory.dmp

Download

memory/4772-14601-0x0000000007940000-0x000000000795A000-memory.dmp

Download

memory/4772-14602-0x0000000007870000-0x0000000007878000-memory.dmp

Download

memory/4772-14608-0x0000000007970000-0x0000000007992000-memory.dmp

Download

memory/4772-14609-0x0000000008790000-0x0000000008D34000-memory.dmp

Download