salatstealer | 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1

Analysis

max time kernel
40s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT5).bat
Size 2KB
Sample261030-afyvtstyfw
SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
TLSH
T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 5 IoCs

resource	yara_rule
behavioral24/files/0x0007000000024486-6967.dat	family_salatstealer
behavioral24/files/0x0008000000024491-11090.dat	family_salatstealer
behavioral24/files/0x0008000000024491-11091.dat	family_salatstealer
behavioral24/files/0x0008000000024493-11287.dat	family_salatstealer
behavioral24/files/0x0008000000024493-11286.dat	family_salatstealer

Executes dropped EXE 5 IoCs

pid	Process
3092	Setup-bTbvWlUQiXYpayRj.exe
3020	agent_lwELhbSr.exe
3932	Setup-bTbvWlUQiXYpayRj.exe
4948	agent_aMgADSQL.exe
4264	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3024	certutil.exe
2696	certutil.exe
1604	certutil.exe
680	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2780	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_lwELhbSr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_lwELhbSr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_aMgADSQL.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_lwELhbSr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_aMgADSQL.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	agent_lwELhbSr.exe
3020	agent_lwELhbSr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2268	2780	cmd.exe	88
PID 2780 wrote to memory of 1604	2780	cmd.exe	94
PID 2780 wrote to memory of 3092	2780	cmd.exe	95
PID 3092 wrote to memory of 3020	3092	Setup-bTbvWlUQiXYpayRj.exe	98
PID 2780 wrote to memory of 680	2780	cmd.exe	99
PID 2780 wrote to memory of 3932	2780	cmd.exe	100
PID 3932 wrote to memory of 4948	3932	Setup-bTbvWlUQiXYpayRj.exe	102
PID 2780 wrote to memory of 3024	2780	cmd.exe	103
PID 2780 wrote to memory of 4264	2780	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT5).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2268
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Roaming\UseLock\agent_lwELhbSr.exe
    C:\Users\Admin\AppData\Roaming\UseLock\agent_lwELhbSr.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
  - - C:\Users\Admin\AppData\Local\Google\spoolsv.exe
      C:\Users\Admin\AppData\Local\Google\spoolsv.exe
      4⤵
      PID:1684
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:4040
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:5056
    - - C:\Program Files\Google\Chrome\Application\spoolsv.exe
        
        "C:\Program Files\Google\Chrome\Application\spoolsv.exe" -
        5⤵
        
        PID:1776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -
        5⤵
        
        PID:4456
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:680
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Users\Admin\AppData\Roaming\DisconnectMerge\agent_aMgADSQL.exe
    C:\Users\Admin\AppData\Roaming\DisconnectMerge\agent_aMgADSQL.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4948
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:4264
- - C:\Users\Admin\AppData\Roaming\CheckpointJoin\agent_gxHhOWeO.exe
    C:\Users\Admin\AppData\Roaming\CheckpointJoin\agent_gxHhOWeO.exe
    3⤵
    PID:3300
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2496
- - C:\Users\Admin\AppData\Roaming\ReadAdd\agent_aGJUYzFM.exe
    C:\Users\Admin\AppData\Roaming\ReadAdd\agent_aGJUYzFM.exe
    3⤵
    PID:4440
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-l3=ipv4 --filter-tcp=80,443,2053,2083,2087,2096,8443 --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=14 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe
Size 2.9MB
SHA256 e63dc940aea0d298b938aeba925bf3429bb78fdef0ed951658cb1fa6cc48542d
MD5 1dc6e332430633439b5d88242f77036b
SHA1 bc0e940b3ae994f8defb3e5cc803931ebf1a21c1
SHA512 fc9783b10cef53730c56304b0e6380759e139797fcdfd37feda9e90440a1b8ca0c694758d8582c8d71d98c226025d4e8e63d434e4adbdc0d29c886382f607b9c
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIw:icVUcTedI6C9e9a
TLSH
T15AE5C664EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe
Size 2.7MB
SHA256 bb909019be2f4e637b3b27d366cf489b9ad2624fb02d9304d587ab2ed31f0ecf
MD5 b839e751e3cb1cd29c8d6ab01b8ee53f
SHA1 e4504379867e1892ee6bb3443d14bf82862400ac
SHA512 baabf0a896f65544f144958692dca8152dbeaf0b7cc1eb3ec4d86d06035bca3a15f1aa7fab73c3db97a3fdb85910e08ed5fe5a0f2cdb214f965410133369807d
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJ9:icVUcTedI6C9e9+
TLSH
T179D5C660EEEFC1F5ED435C30115BB23F6A3526098738DEEBDB941E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Program Files\Google\Chrome\Application\spoolsv.exe
Size 3.4MB
SHA256 6860e46874874a7c53360b491c65651f9ff5abdd1fac27a824f47b54b56e99cd
MD5 5f512a70c98ee1d1cd10adc31d0e9478
SHA1 8b6694ae01602a7e30f1dcb889753bf5164579a1
SHA512 aacb0553a1275bd80dcb6255a71f0ddf1d3e88d6c42f88f70c79819794a08bcfa482b6941d1f528e4748f0531b92169ae997c7314a8098769f2400b03afa7665
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7K:icVUcTedI6C9e9MN
TLSH
T113F5C564EEEFD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Program Files\Google\Chrome\Application\spoolsv.exe
Size 2.9MB
SHA256 2e74bdfa8d1cd2f65ac8098966b32d5f1bd101fed8f6f07c947a0beff269ae79
MD5 ab27a7ecd81fa6212a5674df5f749e42
SHA1 d3bb9ef7eb779c01f5730e79648465d254106844
SHA512 49c23e2e0b7832a8adbbce1a6736babef9b2db9aa9de732e714bd5e05397dda72dfb874e8d49689eebb02a1f35a0991c1cce9d49e702a703a926c71a1d15490d
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIO:icVUcTedI6C9e9Y
TLSH
T136E5C664EEDFC1F5ED435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Users\Admin\AppData\Local\Google\spoolsv.exe
Size 11.8MB
SHA256 9c324ad392ecb1e659f93a26a8f55a89fa70c0ca12a5867fcdaaf778e87bea8c
MD5 0a043ea5ff87f0923b26368631f679a1
SHA1 5caf3de44e93d8c5b13725da5ea4193702275c3c
SHA512 7f7bea7c3bf73cd9e2c38f39d983cc4f3c3174cfb9638d21abfc4f9135533510e462fb4fe7d7cba71693b246dc679c3870c3bae23551b6f41dc4a5685f491a7f
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEEA:Ac9ZeuQt+IJnAEA
TLSH
T150C65B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Users\Admin\AppData\Local\Google\spoolsv.exe
Size 11.3MB
SHA256 7b57ba46457f71d2c22136fadce7c34600465abc6b47b723d8e4c10ea1d317fc
MD5 5c2a02cc6fd1a70180de1c419818aaa0
SHA1 f7170b0d78774ae20adb56301f0b8e5d552d3769
SHA512 cca69364dcb08ccab779d1b6246e2a83dc8e6e19f4bbf86f158d17018046d8207600d291c8fffd9e24b74ecbbdd855e3987bf7fd9f5acca264149542e227a8dd
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfb:icVUcTedI6C9e9MQR7t+chQa4NG20Cc
TLSH
T121C65A10FEDB95F2E9035831416BB27F27315D048B28DB9BEB547A2AF87B6A11C76304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 6.7MB
SHA256 599f5010e9bacd2535eaa1a80be7c76e0e511a89ddfccb990232a4345194af01
MD5 482faa7b4f3e3b49b7df464253055b64
SHA1 c88c11908212de0e244547cf69e790471c945572
SHA512 768f4c895159f73cedd35f2a22fe9b95e019dd1bfac6c39db2f5bfa076788a8ee6810b445e06b6eeab945ce3d05db2b0a30ab8793fb92f074393ad653d85a659
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eNX8c:06GtcbPy/lwHVSavaeNn6dJJo
TLSH
T18F666C03EC5555E9C0AED2718A729263BB717C884B3163D32B90F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 1.2MB
SHA256 36893e07c61f42a15b7c2f6527dcb203b70c23c4763a2a70e88e4e12a627d765
MD5 085becabb2704972dd69f75130dd9f08
SHA1 1e5cadc1e9bc1a48d990faec500c0459765dbe7d
SHA512 ef245c1cad6bfcac2ae5c3b1711e62e540256e49386393024104ad8bb714b8c028067fde5aa8ebfd6650abeb19588ffc1cb5e2ed3e4581114d998180076c7ce2
SSDEEP 12288:6UrrR/Rp4r1d7+nV8ht+LUZxjRof08tihFAuFRamnQz:6O9JKreV8eoJewHAt9
TLSH
T1054518354AE770BC39FC7D8674220E4D6D5D2B0E157A030667C531BA63AD4E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.3MB
SHA256 2b94e4efa57e5c3e604c908ddadf221e6bc2570f251e365286c1456bee620c0a
MD5 43518380c38461d1da7f4b1f3d244cc1
SHA1 bb99008de3e9b38d9eab1fb1161db99e57536209
SHA512 e3b5b78aa90d6fd8469b4ae31a6793c8c1c47d8c7250bcb51fc0fc7d3509e23e44c0294fb79e1a5b8b1b6dec57569a783b36477ecca9acf765d88ff80643f80c
SSDEEP 49152:60V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvY:x
TLSH
T1B6E6BE320683BDBD3FAD3D45E0012E495D9D7A0B11A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 13.1MB
SHA256 ad54bb34124f73c19dff09be77bfa73c7cea42589f5ba4875a04d0a99b5de9f0
MD5 fb2ea0153d804c8b66af1462dad5258d
SHA1 37e32d597bab1c673aed2cb15ff7dff3121f4c70
SHA512 382316671b8cb37753d5686b1d9eeea53125d24ff31e0599616bc0f532aa66ae4958b23ac021027a1d170e40d20e34703d4115ed679bfd9d358a146966d05548
SSDEEP 49152:avxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgu:A
TLSH
T1DBD6CF320243FDFD2F6D2D45E0052E455D9D7A1B12A8D299FB8930BA63EE5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 ba2a125d716fbd0c412870c31474a76f2b8566767c9b5712090eb90942ea3bed
MD5 f8b569faa626c9cbf22c1f43ffca8515
SHA1 b7f95793c609e7baa981a09fd6a9a08206d810eb
SHA512 c4b8d1decb974485593e61d3cd14f83ab7ae7d9b9a186e8d1aa71b6e78bda4451927b3abd780113dffa8b5af80e383116666fd6221e1b44131407fa785fcc7e7
SSDEEP 384:M6jG/2rA9mFGM1SuccLwbJjjTFvt1qjmM/LFAvkeiy5:9KVI8i5LwbZgmM/Likw
TLSH
T1A772A53A07EBB9BD387CAE5271020D492E4E351E257E9703B685317D676C8E48F28A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 be114fc0740cb06dd6dfbd13a9611a79ce17fe5dce1edae627eafa8b93f1b91e
MD5 d7640bfcb0907baf10d997190bf2a339
SHA1 5a97f55c99890d658324d44587735508e85bc3fa
SHA512 cf9c20a33b8023d4a76d1de8028c1ba257d940cfe17bbbba84ab5fac9c4f3d48169c5b012b076e50c9c7aa8966c6a10fce647aedf1846346a8f6f4a53f287c1d
SSDEEP 192:794lKX+ddCA4+ID0g4ph0wbCHmtTDLBF5ZJ/hZSJUiG9HTZ+GWuJNzjGH:7mpN/9mHwvB3ZJwGlZ+GbNOH
TLSH
T1227294711606FDEE67ED4D5480E83B922DB838AB11149150FD8BB2A373D9344FE6CAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 6.9MB
SHA256 45e50cb74fd0c7bf38342c0f9aa19671711ebe28843722d2196c8e515a0362b7
MD5 18ee87e9a45908eec1b0695ad1f0f42d
SHA1 9126df1b8a4ee1361ba60e65018e32f725295aa7
SHA512 d29ffe909a569d257146d1bbbf311c817f36046b1f340c9daec8d2c3727a3e519eecc7737428c3aa27cdb14889a7171a624e9447d3158e9a8b5d5dcf8460094f
SSDEEP 49152:jZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSycLXypwutu0okH4MmQup5kl:c
TLSH
T13F76F1721647FDDE5F6A0E44D0053A015DAC7DAB4258E2A8FEC9729371EA600EE3DCB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2mw0ybyd.qjn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2mw0ybyd.qjn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gxHhOWeO.exe

Path C:\Users\Admin\AppData\Roaming\CheckpointJoin\agent_gxHhOWeO.exe
Size 9.5MB
SHA256 bbb15afd0fe0b0645177a7987ab0d9f5b12e697109c75d96abbb1e4d81d48062
MD5 363f1383fb42af8e521fc7a86ae8d98e
SHA1 b0a3da5fa0a6187f4e6481ba48434d06dff89384
SHA512 bd3fcefdcee152eee673f69b84b18d38f0b4de5498d6f9e608da014790a2357e6c10533d8258b84da0fed4f7bb2946bef1c4ab7a3aaca9b5e4a54bf6cc0c0009
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfG:icVUcTedI6C9e9MQR7t+chQa4X
TLSH
T158A63921EADB91F1ED035C31116BB23F67315D048728DBEBEB543A16F87B6A21C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_gxHhOWeO.exe

Path C:\Users\Admin\AppData\Roaming\CheckpointJoin\agent_gxHhOWeO.exe
Size 11.1MB
SHA256 8be07afd43f8789ea1892e98fc0b528b948015d6918a3f831f64990bd857645c
MD5 a7a8f4094345be16b728c892527d4bab
SHA1 4aee3b7fc23a75cf6a7bc27d2c555451f0b5fd1e
SHA512 4cd22670ee21fe8f1046e0f37969fa9b4d5ccc83cfd59c517d7ffeaa21723a96938fec83cb7b291b2f3144273ebc3dfe651fa3867b5f99c3271ae4d0a8c4b285
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfF:icVUcTedI6C9e9MQR7t+chQa4NG20Z
TLSH
T150C65A10FEDB95F2E9035831416BB27F27305D048B28DB9BEB547A2AF87B6911C7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_aGJUYzFM.exe

Path C:\Users\Admin\AppData\Roaming\ReadAdd\agent_aGJUYzFM.exe
Size 4.6MB
SHA256 fa1541393bf1a2c1bc6cd6392aa2b31daac4fe4c8795fc3ae274a50ecf8168b9
MD5 82de1aa531d2444f85626a81b0d9b8e4
SHA1 a369d62741941ebd7be45da6c18fb0d2e3b82f31
SHA512 76966e6779c19b5c3179572b5c4110dcadf5f853fa34d9bfcce60e6dac1006765364e25922c227ccf8d7ecf7b7afac999b7621de1a31e5a9b19a4a639afdee09
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhVm:icVUcTedI6C9e9MQR7tm
TLSH
T17436E664EEEBD1F5FD035C30215BB23F6A3516098738DEEBDB901E02E15B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_aGJUYzFM.exe

Path C:\Users\Admin\AppData\Roaming\ReadAdd\agent_aGJUYzFM.exe
Size 4.8MB
SHA256 bd72cd20842137451c42fb1885149fa84de78d82514e58f521517a298a033f5c
MD5 c4c811eaa0e0cdacc89f373a0a65b3f8
SHA1 e0b63a87b52d0e4c3e85c8e4bfc97c51969cc4a7
SHA512 bc986d8a52452e0c508380079d74114f02e3c5f1f67d39ae5fa296e4ed5f37bef423defd1d63f7eef71791c4aab29d0613b0c29b7e7438c253e7588ceee82771
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+u:icVUcTedI6C9e9MQR7t+u
TLSH
T17936E664EEEBD1F5FD035C30215BB23F6A3516098738DEE7DB901E02E56B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_lwELhbSr.exe

Path C:\Users\Admin\AppData\Roaming\UseLock\agent_lwELhbSr.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4040-12990-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/4040-13008-0x0000000007D00000-0x000000000837A000-memory.dmp

Download

memory/4040-12985-0x00000000054A0000-0x0000000005AC8000-memory.dmp

Download

memory/4040-13035-0x0000000008930000-0x0000000008ED4000-memory.dmp

Download

memory/4040-12999-0x0000000005CB0000-0x0000000006004000-memory.dmp

Download

memory/4040-13034-0x0000000007B50000-0x0000000007B72000-memory.dmp

Download

memory/4040-12991-0x0000000005C30000-0x0000000005C96000-memory.dmp

Download

memory/4040-12989-0x0000000005330000-0x0000000005352000-memory.dmp

Download

memory/4040-13000-0x00000000062E0000-0x00000000062FE000-memory.dmp

Download

memory/4040-13001-0x0000000006310000-0x000000000635C000-memory.dmp

Download

memory/4040-13027-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Download

memory/4040-13028-0x0000000007A50000-0x0000000007A58000-memory.dmp

Download

memory/4040-13006-0x0000000006710000-0x0000000006754000-memory.dmp

Download

memory/4040-13007-0x0000000007600000-0x0000000007676000-memory.dmp

Download

memory/4040-13009-0x0000000007680000-0x000000000769A000-memory.dmp

Download

memory/4040-12983-0x0000000004CF0000-0x0000000004D26000-memory.dmp

Download

memory/4040-13012-0x00000000705A0000-0x00000000708F4000-memory.dmp

Download

memory/4040-13021-0x00000000078B0000-0x0000000007953000-memory.dmp

Download

memory/4040-13022-0x00000000079B0000-0x00000000079BA000-memory.dmp

Download

memory/4040-13020-0x0000000007890000-0x00000000078AE000-memory.dmp

Download

memory/4040-13011-0x000000006FD90000-0x000000006FDDC000-memory.dmp

Download

memory/4040-13023-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/4040-13010-0x0000000007850000-0x0000000007882000-memory.dmp

Download

memory/4040-13024-0x00000000079E0000-0x00000000079F1000-memory.dmp

Download

memory/4040-13025-0x0000000007A10000-0x0000000007A1E000-memory.dmp

Download

memory/4040-13026-0x0000000007A20000-0x0000000007A34000-memory.dmp

Download

memory/4608-12974-0x00007FFAFF960000-0x00007FFAFFC62000-memory.dmp

Download

memory/4608-12977-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4608-12978-0x00007FFAFF960000-0x00007FFAFFC62000-memory.dmp

Download

memory/4608-12975-0x0000000100400000-0x000000010043C000-memory.dmp

Download