fdc6aef1520e74e9576c7911ebbd26bad3252d1443661dd567490e9ec0b0de7d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
Size 2.6MB
Sample261110-zn449aba95
SHA256 fdc6aef1520e74e9576c7911ebbd26bad3252d1443661dd567490e9ec0b0de7d
MD5 4766560ec0c625cbbd5b581dfc1861d9
SHA1 3d3654a6fb939d7cf91eb5da33ce902b540c757f
SHA512 12b71f632baf35f8fda56988ebbc4c55dd01662fa869481dc436a2fb6f9c5205da0e5bc6475383b1d93f275ea6927d85631e40425ec401136d93868746221d81
SSDEEP 49152:ybLVD2jn3CQLrXA8BkfiBxbTChxKCnFnQXBbrtgb/iQvu0UHOL:yp2j3LdkSx6hxvWbrtUTrUHOL
TLSH
T149C5F111B301E472E5A780B14BE4BF7B743F64241B369DDBB7C84A392EB05C29B70696
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3372	@AEC73E.tmp.exe
2832	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
2024	WdExt.exe
3480	launch.exe
4384	wtmps.exe
4400	mscaps.exe
6072	launch.exe

Loads dropped DLL 2 IoCs

pid	Process
3372	@AEC73E.tmp.exe
2024	WdExt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\""	launch.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3404	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
2832	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe
File opened for modification	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5704	cmd.exe
1340	cmd.exe
1320	cmd.exe
3908	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	@AEC73E.tmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	@AEC73E.tmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WdExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WdExt.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WdExt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@AEC73E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtmps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3372	@AEC73E.tmp.exe
3372	@AEC73E.tmp.exe
2024	WdExt.exe
2024	WdExt.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
3480	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe
6072	launch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2408	3404	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe	88
PID 3404 wrote to memory of 2408	3404	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe	88
PID 3404 wrote to memory of 2408	3404	2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe	88
PID 2408 wrote to memory of 3372	2408	explorer.exe	90
PID 2408 wrote to memory of 2832	2408	explorer.exe	91
PID 3372 wrote to memory of 3908	3372	@AEC73E.tmp.exe	92
PID 3372 wrote to memory of 5704	3372	@AEC73E.tmp.exe	94
PID 3908 wrote to memory of 2024	3908	cmd.exe	96
PID 2024 wrote to memory of 1320	2024	WdExt.exe	97
PID 1320 wrote to memory of 3480	1320	cmd.exe	99
PID 3480 wrote to memory of 1340	3480	launch.exe	100
PID 1340 wrote to memory of 4384	1340	cmd.exe	102
PID 4384 wrote to memory of 4400	4384	wtmps.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe"
1⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\@AEC73E.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\@AEC73E.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 2024
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\wtmps.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\mscaps.exe
        
        "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
        10⤵
        Executes dropped EXE
        
        PID:4400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe"
    3⤵
    - Executes dropped EXE
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:2832

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_4766560ec0c625cbbd5b581dfc1861d9_amadey_coinminer_darkgate_darpapox_elex_luca-stealer_njr.exe
Size 896KB
SHA256 c9cec9bfedaae2141beab4879d8b6e053fa7112ee621c6a5f26c468f8b7d4fa7
MD5 2766720bbab9f264461897e9c912c574
SHA1 bc7a2ea8cf36be584e238e0a7e024ef095e94f3f
SHA512 14d3ca3ae2098674c0df80cbda8fb424ce30bf1c2654858eadf68ed3fe988a6c5066db92771b8a70ef8e1195d2d56adf28f3aa4f4e628297969e6766a314cb02
SSDEEP 24576:v6YyLVD0D73HH3kClEQq0K0b4aA8Bkfiz:ybLVD2jn3CQLrXA8Bkfiz
TLSH
T158159E61F702F173D4A104B15E78FBBB642CA9290B6469EFB3D84E2D6C701C12E35B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@AEC73E.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\@AEC73E.tmp.exe
Size 1.7MB
SHA256 1fdba5ba54c2396e77e05f4a586e6cc3f09417f5637bcb5a80ac6e8e9fc1b99f
MD5 26d6c9ee74f2d3d7dba46d3192fb2597
SHA1 e20a5eca772d732c2a93722db2af6d64f85f91d2
SHA512 b215f99ee2b48911cbfb0de356084925881957ce6512a7a09192df6f4c7682df4d7dc01797cabf9732a5dab8015736d7a04ed98442f0071f79ccab89339ce82a
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNc:mbTChxKCnFnQXBbrtgb/iQvu0UHOz
TLSH
T15F85FF152790CD61F36FC07283E56E79B5B329213733D886AE4855312BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D73C.tmp

Path C:\Users\Admin\AppData\Local\Temp\D73C.tmp
Size 406B
SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
TLSH
T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
MD5 SHA1 SHA512 TLSH

Submit Download

SeC9E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\SeC9E0.tmp
Size 768B
SHA256 28434e080f38a0f12603bbe23a71f370e7a625b457ac91e3f7b31392a7267db7
MD5 c3e5cf1f68b0cdbef3a6efe7166771ba
SHA1 d8bb9d877a51d0ff8af1f473e842e60fbdd7b267
SHA512 0b942c2b63c2de5bdc9f2e128aef486475be82f061997ee75712873d0d1c5710c45648155c86b63783c01e2734d6e7a12012c780cb405c8ed59494c0ba444a5e
TLSH
T10701206B40A13655CA7302E5CDBDB4A31D38F222998B051B505A3E6884BE1CAC597B89
MD5 SHA1 SHA512 TLSH

Submit Download

tmpCB55.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCB55.tmp
Size 1.0MB
SHA256 11a1383b8c058ef364839159441ff346e7828bf674acf5c58b8ff270b87481c3
MD5 09fb5503125289ff47fb22e116657214
SHA1 dfe2f43fecda79824a668d94449917e6fab9ecb8
SHA512 8cf9b68c8cbba8f7280fe3a50f645406d28fe9c38d7b4588351ed0390dd051333292fb58ad73f83b659ee0b3cf39559236ac3e6d71cf9edf697c7bd558e44863
SSDEEP 768:B9fOXcKDY7D7J8GnwTemmrGmv0fl88OrWrqcH5w1/TYoqnANjYwBPnEq4C3zTMDD:7D7NOFmFvE88OrX44/2ANjPndTMDcVda
TLSH
T1192536189DD2CE1A4F4B8390EDAE97F6F977CB12499EA70277880F1AB7D25E2D00450D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpCB85.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCB85.tmp
Size 229KB
SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
MD5 6f90e1169d19dfde14d6f753f06c862b
SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpCB95.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCB95.tmp
Size 120KB
SHA256 250650040534767cd1a87864246caeace0a9fc53870b0269331e952d00a6190c
MD5 a1b1063f57137fd40f2a52206465fd7c
SHA1 f39e46b41998cf31ae637cb8e821867f1f42aa63
SHA512 2febbbf1ecd0d7f1f2338586ef3515bb70557c07f9744c24e346021587ebd9a90c9c975281ce9b6801041371f7c7e311595d1b38406fc59ccab9279f1ee2fba6
SSDEEP 768:5ssvw0vPL7D2350wDeCEkb7FUurnR2ntGCC0GTxxbZNkO0fRA3k2sZ3P11TWD:Pz7CB5EWF5wntGdT/70NP11TWD
TLSH
T1D0C384089CC28A5F4F4AC390A8EE97B6FD779F12498EE74337885F1AA7D25E2D41110D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpCBC5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCBC5.tmp
Size 126KB
SHA256 2f3e760bbc21add68378076c3bc7cfc91be5749fb77ea75ba8f81afdd5322672
MD5 8be246f888e928684973e118322c4847
SHA1 3cba529d4dbabf4f6c30c76cef8451b51e617b65
SHA512 9453497676cafc61f34206b6e0186d3fef1d0b7bdb46bcc8bc061d710fa01ef47d14f3650005b9061c0f6963bddf33ecde110d54ab6229b2fc0cc136dbd676f5
SSDEEP 1536:hJVvQes8Ajfg4SHcECVi/mwVMo9fOTANLqsFyfiCuvWhyXD:h3Qj8Ajn/VzK9fmfiCunz
TLSH
T11AC361089DC2CA5B4F4A8395A8EE97B6FD779F13499EB74373885F0AB6D25F2C401009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpCBD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCBD6.tmp
Size 89KB
SHA256 0fd071cfe62bcb2bcb4bdf362f6ccbaf9da8762445a9c19cf53b5a2888e808dd
MD5 b63c4552bcf6835739ca0ac1bd41af5e
SHA1 7b07c9dd5359c461bfb9c2a4937a893dd1e68ec1
SHA512 03becf7bcdb04282565a260b2d8cd4d64b8b1fd8a14b7e266be4c755a7ff2551105ad4582c4da06356187ac093ca13575e217f3eed789aaec9f9edc62f84a079
SSDEEP 1536:h5QmUNtCKcKcyR2zh5Te2D6grD5Z3MIOKs:hItC42zhlGgrXCKs
TLSH
T13D93CB14DDC28A1BCF5A83B5A8EA8376FD779B03099EA743378C5F1AA6C25F2D10114D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpCBE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCBE6.tmp
Size 99KB
SHA256 e035f365e13bd6048b562764cc1b0d337087926f965371492efd5da979ab0afd
MD5 26a4e917597e27057db5bcb2b702a3ab
SHA1 734f6116f43230b387de60a2735bd2687490d1e9
SHA512 8cca1a3c51582ac50148a2b9f4051bacab797a1acafb5659016cdbe1771a98cb0add91387e89f1681a21cf639dbcf4aed7324aa80a87b60b6e3c1b1cbad78d86
SSDEEP 1536:AfVMTLl0+j+R3S6CVaTqifclr7MB3tY0ZHp8Fkb:Fl67CVgBbNl
TLSH
T120A32A089DD2CA5B4F4A83D1A8EA87B6BD779F02099EE743778C5F1EA6D25F2C005049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpCBF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCBF8.tmp
Size 276KB
SHA256 a188a969de50b46195088581c04db89ecb3ae129a1d48f92a6f0278b69e12a27
MD5 727d249fde8c7eaf5c6edb7e1a66a132
SHA1 1edf420c80c5ee1997e4a2c1f42a7be1b259799c
SHA512 e9837bd462fcdb18ad54acf0982c3fe5e8f1acc6f90f92e632c58ee3df8063cc861655e14477713a4b8febb9f5f79bf069ae2bb788be401af3b2b15692ab621b
SSDEEP 1536:VFHDdToM+32yzefXoTvMeQVWBytFz1zHUXLh+mBCw:Xaz/zePJWMtFzFECw
TLSH
T11D54D2199CD3C617CF5B83B0A8EA87B6FD379B12099EE35377884F0EA6D20F29414149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtmps.exe

Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
Size 276KB
SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
MD5 75c1467042b38332d1ea0298f29fb592
SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
TLSH
T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
Size 172KB
SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
MD5 daac1781c9d22f5743ade0cb41feaebf
SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
TLSH
T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WdExt.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
Size 1.7MB
SHA256 2aae7a5e8c6b274ea3b07c6c84e4a50ec2829b0c59e8e0b13771383ced61fe52
MD5 a4f970a9fd56f0d5d676e91d8626f6a3
SHA1 2566824693bdec980648201d5bd2f993a14d324e
SHA512 ca40933bd8a045618363506d61ba7ef3d24076d683d74842bd389d52f0dfbfb865cb84e7570762baea3fc9171cecfd518eb7f93d80e622e74efe644cf49658e9
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UN2:mbTChxKCnFnQXBbrtgb/iQvu0UHOr
TLSH
T16A85FF152790CDA1F36FC07283E56E79B5B329213733D886AE4855312BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin0.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
Size 129B
SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
MD5 d1073c9b34d1bbd570928734aacff6a5
SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
TLSH
T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
MD5 SHA1 SHA512 TLSH

Submit Download

Admin0.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
Size 102B
SHA256 9cddd4b2ac719f01052deef3aa558fbfbcd21d5728215651345c3d2b9ba250d9
MD5 1d68f046cd6a9197038fb2445d2bea05
SHA1 d8dca54cfa0b2ad404bce32d5d94634bcfc9b2d7
SHA512 2720d071fd02b2cf0d9f1de8dd19117fd128f213dd7f66fa8adb00d7873a5de58d2f2618100d28eec85db707d9e34d20258f9a1f76acf75fe668e66722e1cc4c
TLSH
T182B0121143CACF0D144060DB177591CCC0740C983F847714EF01C84C314080DFDD6A02
MD5 SHA1 SHA512 TLSH

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 196B
SHA256 216a92b042a30b08f4e1cac4a3767c627d4e066da1a8f15627e3bde6aa4cfc97
MD5 dbb1c67e56b865c722500677c1e5bc96
SHA1 4c934f7ce8ad77ae2ddc50f64d0153613e4ed4b6
SHA512 fdb281c7e9cb384e20ef1eb0ca9deeb0b696f54d505ddcbdc55180d886af0511825f354992970cbe4a1238d6e0276cfbcb1ed655a861868f9b01ca857b4e8b97
TLSH
T1A9D0120642C6C79E7444605B0B75559EE1B94BE93F9937178712C55C218150DBD97A01
MD5 SHA1 SHA512 TLSH

Submit Download

Admin2.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
Size 126B
SHA256 2f3574056412b007dd74ecf08aadc3957d397c603a42f8992f05fb25e68a1f06
MD5 97472601d206ebeb7bd1d2e1c7b60471
SHA1 e773d45473a852783b858c65be4094947268a70d
SHA512 54ada696cc3b96c34bfc42a894210b1574d4419f69079fac3cec4b63f1eb9ff94799e7d2c6382c3b04e8b05c4d21fd3ad5be726ca17b5a8263b462f82c888781
TLSH
T168B09B1353C9C74E745760970779555D507849C23E94B605D611859C3151C0CFD5A545
MD5 SHA1 SHA512 TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 382KB
SHA256 7dfe977fdcc574247832556c09da5bce081fdb9d0a74fca7a81af2a88fa8c9ef
MD5 aa24d7333340597bf283b6a468a16130
SHA1 33bd6817a0fe28ec110c322599f527a8daf595db
SHA512 a88f856e925e0c81b5c807561d49152f9ec3231d45afdb971a0892c3fb89510100335736687ff7034691386b506285c7eebb7b3ea6a73525cfe34120186757ca
SSDEEP 768:30P3MZlNjcf4FsDuGW6DuD5Kzb2LSA0RFzhzzG5IKDkNBGN0NrNaNJajNHNFNDNH:3g42DuGWo2JwzhzzMD8mhotRrj
TLSH
T14384AA08DD92CE5A5F5BC390B9AED7B6F8369F52199EE74773880F1FA2C24E38510109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 382KB
SHA256 85a88d5d17da04e314c1e4c2cd97cab852d303505c4f859a95bd266ba1cf5601
MD5 f18c54533c93fefa857e8e374a06b67e
SHA1 50f460c4a2c22923105129906d6735e7e8669ae1
SHA512 6dcdb4111bca801e2ab4e6ccbb4f42ec2273ee83117932f4a920901afe94c9f180e5e5bc411ebe270d045a979600b96d750f3dec89b2328f9ad39767bad4825a
SSDEEP 3072:EDuGWZSlzzq8Yoo2exV9SFJaUdacDWOZSyehplLXEGFo1g8dgeQOSgPZJiG4dIY2:ED1coZXbdacDWZyehpRHy9H4dIBXR
TLSH
T197844A489C82CA568F5793A0B9AED776B8279F160ADDF78373884F5FF2C14E39120149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 382KB
SHA256 68e76928e819b42b024a6b288ca57ec2f91d6db5e355eb8fc806dbc87815d612
MD5 b1c329d590dcb1d472206ddd0e3ad075
SHA1 3618a8caa453cb47aa424a4f00491a2187d8d0be
SHA512 2761ae0bcd9f4e71c2ed07dfb9a2664345fe2e0a4d211e0e93b3cd95f2b66357af930925820957738fd4d113b041d9fc455976ecca3af772630c8e42c256e939
SSDEEP 6144:ED1coZXbdacDWZyehpRHy9H4dIBXCN2x/DMVP1t7:EDhZLdN9eNXdIlCNu4
TLSH
T17E8467049CD28916CF679370B8BED776B826AF160F9DEBC772880F5EA2D15E2C530149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscaps.exe

Path C:\Windows\SysWOW64\mscaps.exe
Size 200KB
SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
MD5 78d3c8705f8baf7d34e6a6737d1cfa18
SHA1 9f09e248a29311dbeefae9d85937b13da042a010
SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
TLSH
T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-16-0x0000000010000000-0x0000000010015000-memory.dmp

Download