Suspicious ^86% windows Download

Cindy.Cindy

AI agent credential access

JavaScript hides a PowerShell fetch-execute cradleJavaScript spawns a PowerShell fetch-execute cradle

SHA-2568e01972e14a0f78b09d04d2a9eeb76ccc9a20d9d177d7e5c18ccd0d4f803c219

URLhttps://github.com/makecindy/cindy/releases/download/v0.1.38/cindy-0.1.38-win32-x64-global.exe

MaleculeK₄(Am₈Li₄₆LuTe₄)O₁₃(C₆Er₁₀Al₂As₉Ca₃CoDy₂I₂La₂PPrS₃Xe₃)H₁₁(Cm₁₃₀Cr₂₃Db₆₁Ds₄F₅₆Hf₁₃Mg₄Os₆₅Po₉₀Ti₃U₂₁)Md₁₁(Bi₁₄Bk₅InLiPa₂₆Pt₄Si₆V)Th

Evidence

NSIS self-extracting installer 0x237c–0x244c

⋯3 more rows
0x23ac2d00008b45d8a9f0ffffff7572817ddc-...E......ur.}.
0x23bcefbeadde7569817de8496e7374756081....ui.}.Instu`.
0x23cc7de4736f66747557817de04e756c6c75}.softuW.}.Nullu
0x23dc4e0945088b45088b0df881420083e002N.E..E.....B....
⋯7 more rows

French function-word token "nous" 0x11de301–0x11de3c1

⋯3 more rows
0x11de33110d4faec8555b6b2e2c4e5e97554f7d7.....U......uT..
0x11de3416e6f5573da805746519c760588df45d1noUs..WFQ.v...E.
0x11de35159d31ca9263ca199362d456b62fdfafeY...&<..6-Ekb...
⋯7 more rows

French function-word token "vous" 0x4346d50–0x4346e10

⋯3 more rows
0x4346d80261ec5d9639d4ec4a73b6ef9418e61dd&...c.N..;n.A.a.
0x4346d90564f5553b82ef0f36238e849455a74baVOUS....b8.IEZt.
0x4346da0592724532ea3f9684fe3df3aed9b4e3fY'$S...hO..:..N?
⋯7 more rows