94fdb85080488ea5e18e202b44259a229b0198facfa5cefc8902de0184cae817

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cmder.exe
Size 161KB
Sample261110-pk8cdstshx
SHA256 94fdb85080488ea5e18e202b44259a229b0198facfa5cefc8902de0184cae817
MD5 7241c7e99a056a3a01bc5610e749a435
SHA1 18464d67788b02a34e27ba8c3f797e1abb196090
SHA512 966548644e9c3abe5b4cbd09e743f41d13f3df2e29d1d4f50714aaa6c81248d718a9b254df91302c768b99102cb60f252103ad899df0b73078e77f5da296ebc5
SSDEEP 3072:u9qqL4GgHvqCeloCosN+KKl3Crqae4pv3CT1yYJFUO:u9qqLLgSCelovsN+PBgq6CT84b
TLSH
T157F31AD3BCD2C532F6B7487075648E31892DFC704B909997E7440AEB4A285E0FB6B762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	4596	cmd.exe
16	4596	cmd.exe
17	4596	cmd.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Wine	ConEmuC64.exe
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Wine	ConEmu64.exe
Key opened	\REGISTRY\MACHINE\Software\Wine	ConEmu64.exe
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Wine	ConEmuC64.exe

Loads dropped DLL 1 IoCs

pid	Process
4596	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 24 IoCs

description	pid	Process	procid_target
PID 3376 set thread context of 4596	3376	ConEmuC64.exe	94
PID 4596 set thread context of 2408	4596	cmd.exe	95
PID 4596 set thread context of 5344	4596	cmd.exe	96
PID 4596 set thread context of 3000	4596	cmd.exe	97
PID 4596 set thread context of 4768	4596	cmd.exe	98
PID 4768 set thread context of 5772	4768	cmd.exe	99
PID 4596 set thread context of 3336	4596	cmd.exe	100
PID 4596 set thread context of 6056	4596	cmd.exe	101
PID 4596 set thread context of 4888	4596	cmd.exe	102
PID 4596 set thread context of 3804	4596	cmd.exe	103
PID 4596 set thread context of 1276	4596	cmd.exe	104
PID 4596 set thread context of 876	4596	cmd.exe	105
PID 4596 set thread context of 3572	4596	cmd.exe	106
PID 4596 set thread context of 2696	4596	cmd.exe	107
PID 4596 set thread context of 5976	4596	cmd.exe	108
PID 4596 set thread context of 2184	4596	cmd.exe	109
PID 4596 set thread context of 1756	4596	cmd.exe	110
PID 4596 set thread context of 5284	4596	cmd.exe	111
PID 4596 set thread context of 2100	4596	cmd.exe	112
PID 4596 set thread context of 3772	4596	cmd.exe	113
PID 4596 set thread context of 1132	4596	cmd.exe	114
PID 4596 set thread context of 5632	4596	cmd.exe	115
PID 4596 set thread context of 5216	4596	cmd.exe	116
PID 4596 set thread context of 3504	4596	cmd.exe	117

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
4596	cmd.exe
4768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmder.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3376	ConEmuC64.exe
3376	ConEmuC64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
4596	cmd.exe
4596	cmd.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5880	ConEmu64.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe
5880	ConEmu64.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5880	ConEmu64.exe
5880	ConEmu64.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5880	4904	Cmder.exe	89
PID 5880 wrote to memory of 1340	5880	ConEmu64.exe	90
PID 5880 wrote to memory of 3376	5880	ConEmu64.exe	91
PID 3376 wrote to memory of 4596	3376	ConEmuC64.exe	94
PID 3376 wrote to memory of 4596	3376	ConEmuC64.exe	94
PID 4596 wrote to memory of 2408	4596	cmd.exe	95
PID 4596 wrote to memory of 2408	4596	cmd.exe	95
PID 4596 wrote to memory of 5344	4596	cmd.exe	96
PID 4596 wrote to memory of 5344	4596	cmd.exe	96
PID 4596 wrote to memory of 3000	4596	cmd.exe	97
PID 4596 wrote to memory of 3000	4596	cmd.exe	97
PID 3000 wrote to memory of 4596	3000	clink_x64.exe	94
PID 4596 wrote to memory of 4768	4596	cmd.exe	98
PID 4596 wrote to memory of 4768	4596	cmd.exe	98
PID 4768 wrote to memory of 5772	4768	cmd.exe	99
PID 4768 wrote to memory of 5772	4768	cmd.exe	99
PID 4596 wrote to memory of 3336	4596	cmd.exe	100
PID 4596 wrote to memory of 3336	4596	cmd.exe	100
PID 4596 wrote to memory of 6056	4596	cmd.exe	101
PID 4596 wrote to memory of 6056	4596	cmd.exe	101
PID 4596 wrote to memory of 4888	4596	cmd.exe	102
PID 4596 wrote to memory of 4888	4596	cmd.exe	102
PID 4596 wrote to memory of 3804	4596	cmd.exe	103
PID 4596 wrote to memory of 3804	4596	cmd.exe	103
PID 4596 wrote to memory of 1276	4596	cmd.exe	104
PID 4596 wrote to memory of 1276	4596	cmd.exe	104
PID 4596 wrote to memory of 876	4596	cmd.exe	105
PID 4596 wrote to memory of 876	4596	cmd.exe	105
PID 4596 wrote to memory of 3572	4596	cmd.exe	106
PID 4596 wrote to memory of 3572	4596	cmd.exe	106
PID 4596 wrote to memory of 2696	4596	cmd.exe	107
PID 4596 wrote to memory of 2696	4596	cmd.exe	107
PID 4596 wrote to memory of 5976	4596	cmd.exe	108
PID 4596 wrote to memory of 5976	4596	cmd.exe	108
PID 4596 wrote to memory of 2184	4596	cmd.exe	109
PID 4596 wrote to memory of 2184	4596	cmd.exe	109
PID 4596 wrote to memory of 1756	4596	cmd.exe	110
PID 4596 wrote to memory of 1756	4596	cmd.exe	110
PID 4596 wrote to memory of 5284	4596	cmd.exe	111
PID 4596 wrote to memory of 5284	4596	cmd.exe	111
PID 4596 wrote to memory of 2100	4596	cmd.exe	112
PID 4596 wrote to memory of 2100	4596	cmd.exe	112
PID 4596 wrote to memory of 3772	4596	cmd.exe	113
PID 4596 wrote to memory of 3772	4596	cmd.exe	113
PID 4596 wrote to memory of 1132	4596	cmd.exe	114
PID 4596 wrote to memory of 1132	4596	cmd.exe	114
PID 4596 wrote to memory of 5632	4596	cmd.exe	115
PID 4596 wrote to memory of 5632	4596	cmd.exe	115
PID 4596 wrote to memory of 5216	4596	cmd.exe	116
PID 4596 wrote to memory of 5216	4596	cmd.exe	116
PID 4596 wrote to memory of 3504	4596	cmd.exe	117
PID 4596 wrote to memory of 3504	4596	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\Cmder.exe
"C:\Users\Admin\AppData\Local\Temp\Cmder.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu64.exe
  /Icon "C:\Users\Admin\AppData\Local\Temp\icons\cmder.ico" /title "Cmder"
  2⤵
  - Identifies Wine through registry keys
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\ConEmuC64.exe
    "C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\ConEmuC64.exe" -download -async "Y" https://conemu.github.io/version.ini "ConEmuVersion.ini"
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\ConEmuC64.exe
    "C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\ConEmuC64.exe" /CINMODE=600020 /AID=3652 /GID=5880 /GHWND=000B004A /BW=238 /BH=60 /BZ=1000 "/FN=Lucida Console" /FW=3 /FH=5 /TA=10100007 /HIDE /ROOT cmd /k ""%ConEmuDir%\..\init.bat" "
    3⤵
    - Identifies Wine through registry keys
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /k ""C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\..\init.bat" "
      4⤵
      Badlisted process makes network request
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Executes a command shell one-liner
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "
        5⤵
        
        PID:2408
    - - C:\Windows\System32\find.exe
        
        C:\Windows\System32\find /i " "
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\vendor\clink\clink_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vendor\clink\clink_x64.exe" inject --quiet --profile "C:\Users\Admin\AppData\Local\Temp\config" --scripts "C:\Users\Admin\AppData\Local\Temp\vendor"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where git.exe 2>nul
        5⤵
        Suspicious use of SetThreadContext
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4768
      - C:\Windows\system32\where.exe
        
        where git.exe
        6⤵
        
        PID:5772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" dir "C:\Users\Admin\AppData\Local\Temp\vendor\bin" 2>NUL"
        5⤵
        
        PID:3336
    - - C:\Windows\system32\findstr.exe
        
        findstr -i -e "\.COM \.EXE \.BAT \.CMD \.VBS \.VBE \.JS \.JSE \.WSF \.WSH \.MSC"
        5⤵
        
        PID:6056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\Scripts;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;""
        5⤵
        
        PID:4888
    - - C:\Windows\System32\findstr.exe
        
        C:\Windows\System32\findstr /I /R /C:";C:\\Users\\Admin\\AppData\\Local\\Temp\\vendor\\bin;"
        5⤵
        
        PID:3804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\Scripts;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;""
        5⤵
        
        PID:1276
    - - C:\Windows\System32\findstr.exe
        
        C:\Windows\System32\findstr /I /R /C:"\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vendor\\bin;"
        5⤵
        
        PID:876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" dir "C:\Users\Admin\AppData\Local\Temp\bin" 2>NUL"
        5⤵
        
        PID:3572
    - - C:\Windows\system32\findstr.exe
        
        findstr -i -e "\.COM \.EXE \.BAT \.CMD \.VBS \.VBE \.JS \.JSE \.WSF \.WSH \.MSC"
        5⤵
        
        PID:2696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" dir "C:\Users\Admin\AppData\Local\Temp" 2>NUL"
        5⤵
        
        PID:5976
    - - C:\Windows\system32\findstr.exe
        
        findstr -i -e "\.COM \.EXE \.BAT \.CMD \.VBS \.VBE \.JS \.JSE \.WSF \.WSH \.MSC"
        5⤵
        
        PID:2184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\vendor\bin;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\Scripts;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;""
        5⤵
        
        PID:1756
    - - C:\Windows\System32\findstr.exe
        
        C:\Windows\System32\findstr /I /R /C:";C:\\Users\\Admin\\AppData\\Local\\Temp;"
        5⤵
        
        PID:5284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\vendor\bin;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu\Scripts;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5;C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;""
        5⤵
        
        PID:2100
    - - C:\Windows\System32\findstr.exe
        
        C:\Windows\System32\findstr /I /R /C:";C:\\Users\\Admin\\AppData\\Local\\Temp\"$"
        5⤵
        
        PID:3772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir /b *.bat *.cmd 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:1132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\config\user_aliases.cmd" "
        5⤵
        
        PID:5632
    - - C:\Windows\System32\findstr.exe
        
        C:\Windows\System32\findstr /b /l /i "history=cat "
        5⤵
        
        PID:5216
    - - C:\Windows\system32\doskey.exe
        
        C:\Windows\system32\doskey /listsize=1000 /macrofile="C:\Users\Admin\AppData\Local\Temp\config\user_aliases.cmd"
        5⤵
        
        PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ConEmuVersion.ini

Path C:\Users\Admin\AppData\Local\Temp\ConEmu\ConEmuVersion.ini
Size 1KB
SHA256 de41addf130438c83f192c72f9186d1294c3c4d6a8f1325383c81c66c0e453c1
MD5 e3d6772db6792620187e04d6601aef3f
SHA1 d31acb9060cb87b45d6738600b99aac55120e960
SHA512 9f85df9e9ac782d714816a547e4949489050e352911a19147db10895b14bfadcb1e46633fd0caea81e23f35fab3df842d50b08080d56732933f6be48a9a0d8ea
TLSH
T1A441CDABF737E4796B575C034FBE0818B3A303D922C4DE9B8570580CE02A41572AAA37
MD5 SHA1 SHA512 TLSH

Submit Download

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.5.ee6b4f_a7423391\clink_dll_x64.dll
Size 2.7MB
SHA256 3759a664b82afa0a16cfb898bae6d5916af3d2b34279b0679e1523d4a6efef9a
MD5 4921e981e06f93af8d1fb631ee391c61
SHA1 b8a60e6b2e788ce68b663c652194344f2079df73
SHA512 bc78e77f0538a1fc8ceffbd2edc854ddbeabb35e7e4a6c64763e856f9a1893e1b4e87ddbc101c759bf966cd90f3592190a32cfe88e3a592f944c7009e2709462
SSDEEP 49152:upAtg6bkrNPi5E4lnKLvQ//+7QhvfIhJrmRYxuoZRc1fY7JwO6FrvuZzyAELmsMS:YLxZxuoHcPfLmmBbXaY
TLSH
T1AAD58D47F6A902B6D06B8034C9671A53E7B5F4A9071493EB13D4D2692F13BF12ABF780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.5.ee6b4f_a7423391\clink_dll_x64.dll.origin
Size 64B
SHA256 e8001eb8f2f6c2be949a52eaefb1264308d0bb3e149bfac458b148a45f142a45
MD5 a94e04d47e07730865eedf66659d87f5
SHA1 66820f14dc4572210e4ccbe1345c780949ee3653
SHA512 1fbd18fb9d4af978ddf5978d0628c2839c0fadf4875d4097af1df1fd0d37808df9725a46a8c6bbb44f2c416a6cd59f147b9fa551c120405ab8b33fcb64b7f9e6
TLSH
T125A0026152C7BE1A08057877CB72D74CC5710A5B2F473F3BCAE184C862534CAF596202
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\Temp\config\clink.log
Size 1KB
SHA256 1d0583847f7e41e214468d4d38e0567506590d221fd4e05ab5a5f5d40bed45fc
MD5 91db4ce5b5a91447bfb0b0e7b2546b1b
SHA1 90a8252463413cebdf5416f67ecff44512c658f1
SHA512 d6b84b89b02570f5d2b10192208e324256f60e6750b46247bb84fc90c318ee28312b6f2dfd2670da26e8ddf8e9c15f5edefc8d99d94b5872283cad0a8dc14c8e
TLSH
T14E31D0408CC99314A7E6D296A4BBF309EB66F1179F80D063FD18C4DD168E1A513CF11A
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\Temp\config\clink.log
Size 2KB
SHA256 06d495b2e4976c8661fdb63a6ddcf71eed821092ea6b554808ad837f85ac851d
MD5 79aba5bc91ecbb5211a22fa981aababc
SHA1 35efc189211003c065e75f2944dc5fde0f67588b
SHA512 4d151e227dfd0eb27d8e3acb19d583e12af927bf417e977e003421360275cc98eca0fb49d4ca21f8b06ebf6e37ed286a67cbac66e587f73a6343169b69eda161
TLSH
T1444180409CC95251A3E7D251A4BBB30DE76AF2079E80E063FC18D5EE674F1A6528F11A
MD5 SHA1 SHA512 TLSH

Submit Download

clink_settings

Path C:\Users\Admin\AppData\Local\Temp\config\clink_settings
Size 897B
SHA256 327ccf39492030c9b0c4ff818eb045a08409fd881d2e0366e2014fb69fa046b3
MD5 4976f4d9bde2c6fa1e0ffa8180d78855
SHA1 37a55795fd2cafc233b99514483f575cb2f84d2d
SHA512 691f8eed21376acdf5812b682b0e4cb4fe2dc56a9339b9049813b61ad6bf8af948bd8f6bf1d33fa88fc633a521d5558b999535faf7bd924eff25e764f3c7acd4
TLSH
T14711D00BE41E54A00FB680ED590873553618C29AC3D21E7AB2DC3458242195DE2C711C
MD5 SHA1 SHA512 TLSH

Submit Download

user_aliases.cmd

Path C:\Users\Admin\AppData\Local\Temp\config\user_aliases.cmd
Size 682B
SHA256 84c70d992264fabf4bd36c3d75a6190033d91780fcc668bd530e7878747d8f27
MD5 9e1c05a494881da22e0afb6915ec4cf3
SHA1 c09fd53fa2ec5d684f1a361eef2cb68f80b4e258
SHA512 4bd1f9e27d3764a27d788bc2e0314347e963d23c6dd7b12369c77d2c444524ed932d82b6b557b378d17cb465775d38f53db0f091a931ac677286f2072d42d729
TLSH
T19C011B72C8B9C2AA59DDBA2AB2809864F438300ADB3BEB4A31E08715C44B210C3B3C54
MD5 SHA1 SHA512 TLSH

Submit Download

ConEmu.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor\conemu-maximus5\ConEmu.xml
Size 54KB
SHA256 4774440f93074db289ad6cbe4d6083b26ba401216c40a359005b774e7e904143
MD5 30c518f1600687bbcb6a3198c95a610b
SHA1 ca3c8ce2ea57604236777b451c19ff9b6ea49221
SHA512 1b4de198a18aee4c8bc736cfc5b8d7244bb3dd4966594480b741f4e27774190cce65fc20eb3700d8f327d3efb91781bc664058b68f214c2699ae900e8f8a08e7
SSDEEP 768:avwQLKzydkK8m7nCBS7xkqczlMlVWfM6KTXWzeVDPhmTgpRoj:LikKO
TLSH
T18A431F20784DAD24C74249991C703D919D6BFB2B0BD929C811CDB637BC679E0B27B7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4596-40-0x00000250892C0000-0x00000250892C1000-memory.dmp

Download

memory/4596-24-0x00000250892C0000-0x00000250892C1000-memory.dmp

Download

memory/4596-23-0x0000025089240000-0x0000025089241000-memory.dmp

Download

memory/4596-16-0x0000025089240000-0x0000025089241000-memory.dmp

Download

memory/4596-77-0x0000025089250000-0x00000250892AD000-memory.dmp

Download