c222d0b266a2eddee4d939e50374fa7f688987d31268bb9ab14eb2e65881c5fd

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.1MB
Sample260604-vcsjvsbx6l
SHA256 c222d0b266a2eddee4d939e50374fa7f688987d31268bb9ab14eb2e65881c5fd
MD5 97629a6366f73be9e30a2a3887ff4950
SHA1 e86fcdd03696ace06cb25e6bece8e7cc66adccaf
SHA512 aa41cac84a50c25bd20e08c5a7debe041536aff57c624ae519208306e11758498eec517300dda94bd560bde005a978325d1858cc9f300bb8d3d5c8f45e998ead
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfL:fMguj8Q4VfvXqFTrYE
TLSH
T1D9878B0773E60195E9B3D1388AA74503D773B4639731CADF329D06552FABAE09A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3976	powershell.exe
4068	powershell.exe
3320	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2592	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3976	powershell.exe
3976	powershell.exe
4068	powershell.exe
4068	powershell.exe
3320	powershell.exe
3320	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3820	WMIC.exe
Token: SeSecurityPrivilege	3820	WMIC.exe
Token: SeTakeOwnershipPrivilege	3820	WMIC.exe
Token: SeLoadDriverPrivilege	3820	WMIC.exe
Token: SeSystemProfilePrivilege	3820	WMIC.exe
Token: SeSystemtimePrivilege	3820	WMIC.exe
Token: SeProfSingleProcessPrivilege	3820	WMIC.exe
Token: SeIncBasePriorityPrivilege	3820	WMIC.exe
Token: SeCreatePagefilePrivilege	3820	WMIC.exe
Token: SeBackupPrivilege	3820	WMIC.exe
Token: SeRestorePrivilege	3820	WMIC.exe
Token: SeShutdownPrivilege	3820	WMIC.exe
Token: SeDebugPrivilege	3820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3820	WMIC.exe
Token: SeRemoteShutdownPrivilege	3820	WMIC.exe
Token: SeUndockPrivilege	3820	WMIC.exe
Token: SeManageVolumePrivilege	3820	WMIC.exe
Token: 33	3820	WMIC.exe
Token: 34	3820	WMIC.exe
Token: 35	3820	WMIC.exe
Token: 36	3820	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3820	WMIC.exe
Token: SeSecurityPrivilege	3820	WMIC.exe
Token: SeTakeOwnershipPrivilege	3820	WMIC.exe
Token: SeLoadDriverPrivilege	3820	WMIC.exe
Token: SeSystemProfilePrivilege	3820	WMIC.exe
Token: SeSystemtimePrivilege	3820	WMIC.exe
Token: SeProfSingleProcessPrivilege	3820	WMIC.exe
Token: SeIncBasePriorityPrivilege	3820	WMIC.exe
Token: SeCreatePagefilePrivilege	3820	WMIC.exe
Token: SeBackupPrivilege	3820	WMIC.exe
Token: SeRestorePrivilege	3820	WMIC.exe
Token: SeShutdownPrivilege	3820	WMIC.exe
Token: SeDebugPrivilege	3820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3820	WMIC.exe
Token: SeRemoteShutdownPrivilege	3820	WMIC.exe
Token: SeUndockPrivilege	3820	WMIC.exe
Token: SeManageVolumePrivilege	3820	WMIC.exe
Token: 33	3820	WMIC.exe
Token: 34	3820	WMIC.exe
Token: 35	3820	WMIC.exe
Token: 36	3820	WMIC.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3104	3088	2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	85
PID 3104 wrote to memory of 5060	3104	2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	86
PID 5060 wrote to memory of 3820	5060	cmd.exe	88
PID 3104 wrote to memory of 2592	3104	2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 2592 wrote to memory of 3976	2592	cmd.exe	92
PID 3104 wrote to memory of 2132	3104	2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 2132 wrote to memory of 4068	2132	cmd.exe	95
PID 3104 wrote to memory of 2500	3104	2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 2500 wrote to memory of 3320	2500	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-04_97629a6366f73be9e30a2a3887ff4950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\Administrator\Desktop\ss\GEMİNİ\sa.js --stealth
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -Command "Start-Process powershell -ArgumentList "-Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Rivals'" -Verb RunAs""
    3⤵
    - Access Token Manipulation: Create Process with Token
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -Command "Start-Process powershell -ArgumentList "-Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Rivals'" -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -Command "[Reflection.Assembly]::LoadWithPartialName('System.Security'); [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]](-split ('01 0x00 0x00 0x00 0xd0 0x8c 0x9d 0xdf 0x01 0x15 0xd1 0x11 0x8c 0x7a 0x00 0xc0 0x4f 0xc2 0x97 0xeb 0x01 0x00 0x00 0x00 0x85 0x1f 0x26 0x5b 0x55 0x4a 0x47 0x48 0xa5 0xcd 0x1a 0x88 0x0e 0x73 0x33 0xee 0x10 0x00 0x00 0x00 0x1c 0x00 0x00 0x00 0x47 0x00 0x6f 0x00 0x6f 0x00 0x67 0x00 0x6c 0x00 0x65 0x00 0x20 0x00 0x43 0x00 0x68 0x00 0x72 0x00 0x6f 0x00 0x6d 0x00 0x65 0x00 0x00 0x00 0x10 0x66 0x00 0x00 0x00 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x8a 0x3c 0xb4 0xbd 0xd7 0x1d 0x99 0xdb 0xcf 0x43 0x64 0x2c 0xf0 0x76 0xfb 0x4d 0x72 0x22 0xc9 0x41 0x82 0x63 0x7d 0xb9 0x98 0x14 0xfa 0x8f 0xab 0x5d 0xbc 0x81 0x00 0x00 0x00 0x00 0x0e 0x80 0x00 0x00 0x00 0x02 0x00 0x00 0x20 0x00 0x00 0x00 0xc0 0x6f 0x94 0x53 0x3c 0x49 0x67 0x41 0x48 0x07 0x7b 0x00 0x9c 0xe7 0x76 0xf2 0x07 0xee 0xf0 0x81 0x52 0x40 0x50 0xa5 0x25 0x37 0x25 0x68 0x19 0x55 0x47 0x38 0x30 0x00 0x00 0x00 0x57 0xe4 0x3f 0x7e 0x4b 0x0c 0x93 0xe1 0x93 0x46 0x62 0x36 0xfa 0x90 0xd7 0x08 0x21 0xe9 0xb1 0x79 0x97 0xe3 0xba 0x9f 0x74 0x23 0x6b 0x52 0x0e 0x5c 0x54 0x50 0xab 0xd5 0xf4 0x62 0x41 0x16 0xd2 0x11 0xe7 0x38 0x1e 0x88 0xd9 0xf5 0x9e 0xf5 0x40 0x00 0x00 0x00 0x37 0x13 0x18 0x9b 0xb7 0x26 0x2f 0xb6 0x26 0x21 0x78 0x75 0x38 0x1a 0x39 0x83 0xa6 0xcf 0x62 0xb6 0x6a 0xe0 0xbb 0x03 0x45 0x0a 0x42 0xa8 0x36 0x68 0xff 0xde 0x83 0xa4 0x5e 0xc5 0xc9 0x6e 0x0f 0x31 0xfa 0x15 0x8a 0xa3 0x2f 0xd6 0xbb 0x90 0x1a 0x9d 0x56 0x01 0x4b 0x09 0xa4 0x09 0x2e 0xa8 0x5f 0x0b 0x33 0x37 0x10 0x2e'.replace(' ', ' 0x'))), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) | ForEach-Object { "$_" }""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -Command "[Reflection.Assembly]::LoadWithPartialName('System.Security'); [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]](-split ('01 0x00 0x00 0x00 0xd0 0x8c 0x9d 0xdf 0x01 0x15 0xd1 0x11 0x8c 0x7a 0x00 0xc0 0x4f 0xc2 0x97 0xeb 0x01 0x00 0x00 0x00 0x85 0x1f 0x26 0x5b 0x55 0x4a 0x47 0x48 0xa5 0xcd 0x1a 0x88 0x0e 0x73 0x33 0xee 0x10 0x00 0x00 0x00 0x1c 0x00 0x00 0x00 0x47 0x00 0x6f 0x00 0x6f 0x00 0x67 0x00 0x6c 0x00 0x65 0x00 0x20 0x00 0x43 0x00 0x68 0x00 0x72 0x00 0x6f 0x00 0x6d 0x00 0x65 0x00 0x00 0x00 0x10 0x66 0x00 0x00 0x00 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x8a 0x3c 0xb4 0xbd 0xd7 0x1d 0x99 0xdb 0xcf 0x43 0x64 0x2c 0xf0 0x76 0xfb 0x4d 0x72 0x22 0xc9 0x41 0x82 0x63 0x7d 0xb9 0x98 0x14 0xfa 0x8f 0xab 0x5d 0xbc 0x81 0x00 0x00 0x00 0x00 0x0e 0x80 0x00 0x00 0x00 0x02 0x00 0x00 0x20 0x00 0x00 0x00 0xc0 0x6f 0x94 0x53 0x3c 0x49 0x67 0x41 0x48 0x07 0x7b 0x00 0x9c 0xe7 0x76 0xf2 0x07 0xee 0xf0 0x81 0x52 0x40 0x50 0xa5 0x25 0x37 0x25 0x68 0x19 0x55 0x47 0x38 0x30 0x00 0x00 0x00 0x57 0xe4 0x3f 0x7e 0x4b 0x0c 0x93 0xe1 0x93 0x46 0x62 0x36 0xfa 0x90 0xd7 0x08 0x21 0xe9 0xb1 0x79 0x97 0xe3 0xba 0x9f 0x74 0x23 0x6b 0x52 0x0e 0x5c 0x54 0x50 0xab 0xd5 0xf4 0x62 0x41 0x16 0xd2 0x11 0xe7 0x38 0x1e 0x88 0xd9 0xf5 0x9e 0xf5 0x40 0x00 0x00 0x00 0x37 0x13 0x18 0x9b 0xb7 0x26 0x2f 0xb6 0x26 0x21 0x78 0x75 0x38 0x1a 0x39 0x83 0xa6 0xcf 0x62 0xb6 0x6a 0xe0 0xbb 0x03 0x45 0x0a 0x42 0xa8 0x36 0x68 0xff 0xde 0x83 0xa4 0x5e 0xc5 0xc9 0x6e 0x0f 0x31 0xfa 0x15 0x8a 0xa3 0x2f 0xd6 0xbb 0x90 0x1a 0x9d 0x56 0x01 0x4b 0x09 0xa4 0x09 0x2e 0xa8 0x5f 0x0b 0x33 0x37 0x10 0x2e'.replace(' ', ' 0x'))), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) | ForEach-Object { "$_" }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -Command "[Reflection.Assembly]::LoadWithPartialName('System.Security'); [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]](-split ('01 0x00 0x00 0x00 0xd0 0x8c 0x9d 0xdf 0x01 0x15 0xd1 0x11 0x8c 0x7a 0x00 0xc0 0x4f 0xc2 0x97 0xeb 0x01 0x00 0x00 0x00 0x85 0x1f 0x26 0x5b 0x55 0x4a 0x47 0x48 0xa5 0xcd 0x1a 0x88 0x0e 0x73 0x33 0xee 0x10 0x00 0x00 0x00 0x1e 0x00 0x00 0x00 0x4d 0x00 0x69 0x00 0x63 0x00 0x72 0x00 0x6f 0x00 0x73 0x00 0x6f 0x00 0x66 0x00 0x74 0x00 0x20 0x00 0x45 0x00 0x64 0x00 0x67 0x00 0x65 0x00 0x00 0x00 0x10 0x66 0x00 0x00 0x00 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0xda 0xf4 0x5a 0x54 0x98 0x56 0x1a 0x62 0x63 0x28 0x26 0x59 0x29 0x14 0x70 0x9b 0x1c 0xe7 0x5f 0x2d 0x97 0xcf 0x63 0xb3 0xc7 0x75 0x90 0x78 0x0e 0xd1 0x44 0x4a 0x00 0x00 0x00 0x00 0x0e 0x80 0x00 0x00 0x00 0x02 0x00 0x00 0x20 0x00 0x00 0x00 0xf0 0xd3 0xc8 0xde 0x7a 0xc5 0x4f 0x81 0x69 0x08 0x3b 0x4e 0x6f 0x7b 0x5c 0x48 0x72 0xb6 0xd5 0x5b 0x96 0xa0 0xd3 0x49 0x5a 0x40 0xc6 0x9c 0x9f 0xde 0xaf 0x89 0x30 0x00 0x00 0x00 0xc4 0xfd 0xe7 0x3e 0x2e 0xe6 0xbf 0x4e 0x1c 0x77 0x03 0xe9 0x53 0x96 0x82 0x28 0x5e 0xfb 0xa8 0x95 0x8a 0xbc 0x51 0x51 0x36 0x1f 0x1d 0xbe 0xf8 0xff 0xf3 0xb6 0x81 0x1c 0x4c 0x2f 0xc6 0x2e 0x4c 0x1e 0xdf 0xd2 0x5c 0x47 0x23 0x7c 0x28 0x8f 0x40 0x00 0x00 0x00 0x88 0x82 0x78 0xef 0x83 0xff 0x1b 0x63 0x80 0x7d 0x8d 0x1d 0x31 0x8c 0xd5 0x35 0xcf 0x01 0xf7 0x15 0x82 0xef 0x32 0x76 0xac 0x62 0x7b 0xf7 0x3f 0x03 0x6a 0xcb 0x2a 0x07 0x97 0xee 0x86 0xf3 0x6e 0x4d 0xb8 0x15 0xc2 0xf6 0x90 0x78 0xe4 0x51 0x57 0x32 0x8e 0xe2 0x4e 0x69 0x08 0x5c 0xe1 0x11 0x0f 0x86 0x97 0x3e 0x9f 0x98'.replace(' ', ' 0x'))), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) | ForEach-Object { "$_" }""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -Command "[Reflection.Assembly]::LoadWithPartialName('System.Security'); [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]](-split ('01 0x00 0x00 0x00 0xd0 0x8c 0x9d 0xdf 0x01 0x15 0xd1 0x11 0x8c 0x7a 0x00 0xc0 0x4f 0xc2 0x97 0xeb 0x01 0x00 0x00 0x00 0x85 0x1f 0x26 0x5b 0x55 0x4a 0x47 0x48 0xa5 0xcd 0x1a 0x88 0x0e 0x73 0x33 0xee 0x10 0x00 0x00 0x00 0x1e 0x00 0x00 0x00 0x4d 0x00 0x69 0x00 0x63 0x00 0x72 0x00 0x6f 0x00 0x73 0x00 0x6f 0x00 0x66 0x00 0x74 0x00 0x20 0x00 0x45 0x00 0x64 0x00 0x67 0x00 0x65 0x00 0x00 0x00 0x10 0x66 0x00 0x00 0x00 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0xda 0xf4 0x5a 0x54 0x98 0x56 0x1a 0x62 0x63 0x28 0x26 0x59 0x29 0x14 0x70 0x9b 0x1c 0xe7 0x5f 0x2d 0x97 0xcf 0x63 0xb3 0xc7 0x75 0x90 0x78 0x0e 0xd1 0x44 0x4a 0x00 0x00 0x00 0x00 0x0e 0x80 0x00 0x00 0x00 0x02 0x00 0x00 0x20 0x00 0x00 0x00 0xf0 0xd3 0xc8 0xde 0x7a 0xc5 0x4f 0x81 0x69 0x08 0x3b 0x4e 0x6f 0x7b 0x5c 0x48 0x72 0xb6 0xd5 0x5b 0x96 0xa0 0xd3 0x49 0x5a 0x40 0xc6 0x9c 0x9f 0xde 0xaf 0x89 0x30 0x00 0x00 0x00 0xc4 0xfd 0xe7 0x3e 0x2e 0xe6 0xbf 0x4e 0x1c 0x77 0x03 0xe9 0x53 0x96 0x82 0x28 0x5e 0xfb 0xa8 0x95 0x8a 0xbc 0x51 0x51 0x36 0x1f 0x1d 0xbe 0xf8 0xff 0xf3 0xb6 0x81 0x1c 0x4c 0x2f 0xc6 0x2e 0x4c 0x1e 0xdf 0xd2 0x5c 0x47 0x23 0x7c 0x28 0x8f 0x40 0x00 0x00 0x00 0x88 0x82 0x78 0xef 0x83 0xff 0x1b 0x63 0x80 0x7d 0x8d 0x1d 0x31 0x8c 0xd5 0x35 0xcf 0x01 0xf7 0x15 0x82 0xef 0x32 0x76 0xac 0x62 0x7b 0xf7 0x3f 0x03 0x6a 0xcb 0x2a 0x07 0x97 0xee 0x86 0xf3 0x6e 0x4d 0xb8 0x15 0xc2 0xf6 0x90 0x78 0xe4 0x51 0x57 0x32 0x8e 0xe2 0x4e 0x69 0x08 0x5c 0xe1 0x11 0x0f 0x86 0x97 0x3e 0x9f 0x98'.replace(' ', ' 0x'))), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) | ForEach-Object { "$_" }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 026d1569cc7d92522224cb7202b04adbf0978279191ab5814949d1ff9d618a6e
MD5 5b84d29fd77754bcac2b74bd815e2d83
SHA1 f8f5ec2d7ed3dbfd3028d7182306e9817b4493e0
SHA512 e12efddd4b134b72853b9a3007e5d43f28f749e191d0a38fda5522eb6ebc2770d5e68e80cf7b9c3d51a54e3b0f1277760208a2c3addab8014f0174b0ed06194f
TLSH
T1B0117A33B79CC134C8D9157A1088AD11B1B5C3CB049EDE8F7B84C109E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 e3b61a692ce5138712731f07a05f87c5553ac286615c73971294878075e7c9f8
MD5 bb5d5a34a3f321816aee66a30343ee7c
SHA1 53513e081cff479c03c0fc72b6127148d9a5db64
SHA512 74778b96e5e5b7c62f9410a2b975eacccad27f48068b50baa62e217c16ffcaba81940f370a080102223a8c01488a0d86db4f1047eb1501b7afdf5767d4121f8d
TLSH
T15B115533B78CC174C89901391499AA0172BAC3CB009FCE8B7A84C105E97F48ADB501E0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kwo4jge0.2qf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kwo4jge0.2qf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3976-8-0x000002CF2E300000-0x000002CF2E322000-memory.dmp

Download

memory/4068-20-0x000001DF4FDE0000-0x000001DF4FE30000-memory.dmp

Download