salatstealer | 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80

Analysis

max time kernel
45s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT2).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
MD5 802a10c9f71f69ebe61eeae7693ba0e5
SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
TLSH
T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral18/files/0x000700000002466d-7673.dat	family_salatstealer

Executes dropped EXE 7 IoCs

pid	Process
3336	Setup-bTbvWlUQiXYpayRj.exe
3788	Setup-bTbvWlUQiXYpayRj.exe
1652	agent_qQxwOwiB.exe
5164	agent_ddigpaOf.exe
3084	Setup-bTbvWlUQiXYpayRj.exe
4400	agent_OyOSWQSn.exe
2128	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4616	certutil.exe
2204	certutil.exe
4716	certutil.exe
5912	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2120	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_qQxwOwiB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_qQxwOwiB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_ddigpaOf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_OyOSWQSn.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_qQxwOwiB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_ddigpaOf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_OyOSWQSn.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	agent_qQxwOwiB.exe
1652	agent_qQxwOwiB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	6040	winws.exe
Token: SeBackupPrivilege	6040	winws.exe
Token: SeDebugPrivilege	6040	winws.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3468	2120	cmd.exe	85
PID 2120 wrote to memory of 4716	2120	cmd.exe	92
PID 2120 wrote to memory of 3336	2120	cmd.exe	95
PID 2120 wrote to memory of 5912	2120	cmd.exe	97
PID 2120 wrote to memory of 3788	2120	cmd.exe	98
PID 3336 wrote to memory of 1652	3336	Setup-bTbvWlUQiXYpayRj.exe	99
PID 3788 wrote to memory of 5164	3788	Setup-bTbvWlUQiXYpayRj.exe	103
PID 2120 wrote to memory of 4616	2120	cmd.exe	104
PID 2120 wrote to memory of 3084	2120	cmd.exe	105
PID 3084 wrote to memory of 4400	3084	Setup-bTbvWlUQiXYpayRj.exe	107
PID 2120 wrote to memory of 2204	2120	cmd.exe	108
PID 2120 wrote to memory of 2128	2120	cmd.exe	109
PID 2120 wrote to memory of 6040	2120	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT2).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3468
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Users\Admin\AppData\Roaming\RevokeRepair\agent_qQxwOwiB.exe
    C:\Users\Admin\AppData\Roaming\RevokeRepair\agent_qQxwOwiB.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1652
  - - C:\Program Files (x86)\MSBuild\dllhost.exe
      "C:\Program Files (x86)\MSBuild\dllhost.exe"
      4⤵
      PID:1304
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:1752
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:5656
    - - C:\Program Files\Google\Chrome\Application\dllhost.exe
        
        "C:\Program Files\Google\Chrome\Application\dllhost.exe" -
        5⤵
        
        PID:5804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -
        5⤵
        
        PID:616
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5912
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Users\Admin\AppData\Roaming\Sun\agent_ddigpaOf.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_ddigpaOf.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5164
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_OyOSWQSn.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_OyOSWQSn.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4400
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:2128
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_LzPzbpNy.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_LzPzbpNy.exe
    3⤵
    PID:2428
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\Program Files (x86)\MSBuild\dllhost.exe
Size 5.3MB
SHA256 f2428dd7f3ea3ee899893b45395ddb19b336a56c60bbce4543f19e1df28cd163
MD5 adfcab1926ac7d343819ee979abf8e21
SHA1 9e7b102d23309d5a9a5355559093e88528b5e44d
SHA512 4dc37184b11e2e6a2a6783f30b1f3b76a5dd769edd22f1491184790448d1e66a20960417bf68acc8698a446ee396aa81c7012978cb74506987af774517f15ec0
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOO:icVUcTedI6C9e9MQR7t+cB
TLSH
T17246E624EEEBD1F5ED035C30216BB33F6B3516098738DEE7DB901E02E55B6A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllhost.exe

Path C:\Program Files (x86)\MSBuild\dllhost.exe
Size 6.0MB
SHA256 a7049affa93f2ef2b9eb73e08af7731ed0ba11c8e00ae93fe01c0efa92cca50e
MD5 0f45f713c0b7d4ae71e715d365b55375
SHA1 66bbc6671d1073519fab8348fecdf94c824a7cd7
SHA512 53e3cb52399d82a5de3dd8ead8a2f0a72ed0fd1163f5500c21bb20a2a62666f2f6794cb519e7fec65821a401834c8d17ef8f1ec9b7ea6d8935cd25c8d991cfc9
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFf0:icVUcTedI6C9e9MQR7t+cI
TLSH
T19656C420EEDB91F5ED035C30215BB33F6B351A098738DAE7DB903E06E57B6A21876605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllhost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe
Size 2.8MB
SHA256 1a35fac6ed9be7da6d8c6116d6da4178ebe225b408b353023922811e93a58910
MD5 73005ad98c1f2c71375e16354ebeeb20
SHA1 8c4fa01dda6bbbeea17d3e39f782a7b9d7957113
SHA512 2640396189f5a6f0b53a29d90cdceadd8f1158560683ad454126d4aa0b898e5f6ed57a223cc8fef557c9cf6f3815917f5922aa595f582cba1f9c3c5ae2b49be2
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJX:icVUcTedI6C9e9s
TLSH
T1A3D5C664EEDFC1F5ED435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllhost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe
Size 2.2MB
SHA256 f9d242ef39efb6fc4d6e429bdcfc2f1529e1ccf460cef9473865b6404e1cd126
MD5 db7b4eab55cec5ec310ae607391ef9b9
SHA1 86589227869a6d99a85a07dba17b6c9c916432da
SHA512 9addb58cb5a111c8d61e750197e568ed9e3978bc92d28bc186c52cfbaaa3e2f7614936feb11579af489fc83c66291eb461373c502cdaf53ace2230471dbfb545
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeK:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gx
TLSH
T1D9B5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllhost.exe

Path C:\Program Files\Google\Chrome\Application\dllhost.exe
Size 2.1MB
SHA256 6c567606a8ec558af400dca6bd614c023cf1f77c54c273bd60b89161b20c21a7
MD5 e2b080823c40d742d4417f231eb489a2
SHA1 88c591abaaaca14dee7b305df820c230f15cd743
SHA512 619dd8d7ac1b10ac76e064ab1eea86f99091b5aefaf6cd649727884104cbf5320ea2482a66b814163c1c2e20cdc29b30b5049771dcf26cd42351e48e61db44fc
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVe+:TjycqCUjvnTGmp2TedLKtJ8CRV9+
TLSH
T14DA5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllhost.exe

Path C:\Program Files\Google\Chrome\Application\dllhost.exe
Size 2.4MB
SHA256 1aefdb1b3a1ce09598484ecc3e88a081e5079d51922c63c3b224521990e0576b
MD5 ae2a42919c3a772897443002ffadc85c
SHA1 0474ca09d68c666562dee375887e17b85b0eaec3
SHA512 6f4cfe1a3c9c28f03881195688b4b4fd574e19059619a9def3b9dc5f712f020f110bb14e36f77d15d34b0bbeb9e3b5e12fe25acbc40a3a4a6f7438a8915ba9dc
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRH:icVUcTedI6C9e9H
TLSH
T18BC5B564EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 9.9MB
SHA256 d6f8c85370cf1cda476711e86692c1ae87d9bb3a5197c6b5c4925b254071ce39
MD5 3958543603df84f4c0c8057cef646e61
SHA1 7f2df52962e23ca494c99f9bb44544b1681b8b39
SHA512 804779b2572c7bfacd573a5879ea89a3be906467d8807dcdd55fce6de96be6e76414454d1216fc5d82650ee1a48757b481fbf9685ddf1d8344fcf508cb6ca5a2
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgQ:0bsPPSavMjysmCV3IhGjkJPnvgQ
TLSH
T174A6BE03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.7MB
SHA256 e2b50c0c51c17db9454fdd6e60067ce9236901d7d0ffe5a4c2ed513864561b89
MD5 331abead58707cc7e86e1d597676affa
SHA1 9b20928ad210bd688fae6fc0c221946e910db76b
SHA512 952141639cc8337e03ba4c6ab75fa6aefb17682de703e30cc8a25f5503fd40707475aabc05212f34656e3c82c8166d4fb8b85f5e0534d1d73c1359d97c34eae7
SSDEEP 49152:qUSsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfvK:X
TLSH
T150F6BF320693BCBD3FBC3D45A0012E495D9D7A0B11A99359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 6566e1bac1ffd260a116bbb9f736248b1112c5bbdee49e40db170c0cc8bae5f4
MD5 7f2a36e94b29674d7e87e642117b6be3
SHA1 717ee24f3b6c21323c09b52a30abe4ac1a479de7
SHA512 a15ffecab631e4d5ece0611cf2a0197080f7000df6c38d98b127cae34815991376da6a97e231bbf75156921fe82b1a5843f720b1c3d1d1898056a427d58d36dc
SSDEEP 192:ieg5RrJC9BXryIQCtzKK6csKPkKdFb91d3qu97GuY6ctokmRIQ9wi2pX5tsyO2W9:iVHrJodQCtzKt9UNVJoOYs/Ot8
TLSH
T173723B350BE720BD39ECFC9135105E5C8EAD4F4E8812125D0BC875F5B52C9988E25DBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 ed2daff5ae3d9116c9405dfea990b24d2fb504036b420be28c409ff2a3ca0922
MD5 0c6ef493fc22c0cddd5e73d14ab2fc7a
SHA1 9b64505ecc9df700fc08cd1b18c6bc6397861848
SHA512 a409673a1eec88199a50cd45d0e4d5d530e5cc6e930235a8c79883f71aa29d8472930553cf898a86277828f7a21b521840f463983978713ea1afff51503733b2
SSDEEP 384:OyZ5+4lEzRe/onaxv6B5sM8Bq1gl+StzhEgbb3b38tp:rkz4/onaB2Wps6b8j
TLSH
T1AC7229754BE7307C35BC7C4235209E2C4D6E6B4F1176024AABCC34FB63AD1D88E26A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 9.7MB
SHA256 3961ce0e7af6fd0c362b7099eecbfc97b4e9e9d3d64e129f6e28d7da11d9071d
MD5 4fa632f79405f72507172897cac19f6a
SHA1 208658669186c2e98215c1070d73113d47e53b19
SHA512 67a0db5c724dd28b80fe76236e1e68d46bccac7ea7e5d7197b2859178529330d47948521d601a2c49d7a718f8870a12a3364b682e208878ce714e0e721890e02
SSDEEP 49152:6USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfvm:j
TLSH
T1D6A68D320693BCFD3FAD3D85A0012D495D5D7A0B12A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hjdmgsaq.uri.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hjdmgsaq.uri.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_LzPzbpNy.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_LzPzbpNy.exe
Size 5.7MB
SHA256 d5321474f1a0d516b681f207a79b3c0b4fb72058f4da0876b4c52aa80f200594
MD5 58e9c8781eb2742aa1ddcdea24eb38af
SHA1 24a81555c5958622d29e536b70aecb74e07bc0a6
SHA512 75b52a092df24e54ae0c05f543d8b53e56d2947bda2542cc4b82811416a0081912023326df02b8db007c65f1a8c727dbdc7c8cbec0b92923c3d72492210e3169
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBM:icVUcTedI6C9e9MQR7t+cc
TLSH
T10156E720EEDBD1F5ED035C31215BB33F6B351A098738DAE7DB902E02E56B6A21C76605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_LzPzbpNy.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_LzPzbpNy.exe
Size 6.2MB
SHA256 a46633bc3f4406fe7b7b9eed35daa23e44186c0a11227fcf7b6c53e1d4437ec8
MD5 685127f77ef894de751cec8396acbbd8
SHA1 71fa9167eb485a1a8f36a476e891a28e8092835f
SHA512 d8f1c150ac3bc9f117c93cbf6675a808120e26f3c89cd0cc22eff9e4a06837352b01e449c8b68a917e6679358013a55f370818f86d16ff66306ccf95df7fd4d2
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfY:icVUcTedI6C9e9MQR7t+cs
TLSH
T14066D520EEDB91F1ED035C31215BB33F6B351A058738DAE7EB903E06E57B6A21876605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_qQxwOwiB.exe

Path C:\Users\Admin\AppData\Roaming\RevokeRepair\agent_qQxwOwiB.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-15253-0x0000000007100000-0x00000000071A3000-memory.dmp

Download

memory/1752-15241-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

Download

memory/1752-15215-0x00000000021E0000-0x0000000002216000-memory.dmp

Download

memory/1752-15223-0x0000000005420000-0x0000000005486000-memory.dmp

Download

memory/1752-15230-0x0000000005510000-0x0000000005864000-memory.dmp

Download

memory/1752-15267-0x0000000008160000-0x0000000008704000-memory.dmp

Download

memory/1752-15222-0x0000000004CE0000-0x0000000004D46000-memory.dmp

Download

memory/1752-15221-0x0000000004C40000-0x0000000004C62000-memory.dmp

Download

memory/1752-15232-0x0000000005B10000-0x0000000005B2E000-memory.dmp

Download

memory/1752-15233-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

Download

memory/1752-15266-0x00000000073A0000-0x00000000073C2000-memory.dmp

Download

memory/1752-15259-0x0000000007370000-0x000000000738A000-memory.dmp

Download

memory/1752-15238-0x0000000006B10000-0x0000000006B54000-memory.dmp

Download

memory/1752-15239-0x0000000006E30000-0x0000000006EA6000-memory.dmp

Download

memory/1752-15240-0x0000000007530000-0x0000000007BAA000-memory.dmp

Download

memory/1752-15220-0x0000000004DF0000-0x0000000005418000-memory.dmp

Download

memory/1752-15244-0x00000000714B0000-0x0000000071804000-memory.dmp

Download

memory/1752-15243-0x0000000070CA0000-0x0000000070CEC000-memory.dmp

Download

memory/1752-15260-0x00000000072A0000-0x00000000072A8000-memory.dmp

Download

memory/1752-15252-0x00000000070E0000-0x00000000070FE000-memory.dmp

Download

memory/1752-15254-0x0000000007200000-0x000000000720A000-memory.dmp

Download

memory/1752-15242-0x00000000070A0000-0x00000000070D2000-memory.dmp

Download

memory/1752-15255-0x00000000072D0000-0x0000000007366000-memory.dmp

Download

memory/1752-15256-0x0000000007230000-0x0000000007241000-memory.dmp

Download

memory/1752-15257-0x0000000007260000-0x000000000726E000-memory.dmp

Download

memory/1752-15258-0x0000000007270000-0x0000000007284000-memory.dmp

Download

memory/6040-15199-0x00007FFE5C780000-0x00007FFE5CA82000-memory.dmp

Download

memory/6040-15201-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/6040-15203-0x00007FFE5C780000-0x00007FFE5CA82000-memory.dmp

Download

memory/6040-15200-0x0000000100400000-0x000000010043C000-memory.dmp

Download