61189fdf8c4ecbfdd956efbc7dbc6b1da182e006812f6076713e104eed69108f

Analysis

max time kernel
7s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Size 31.7MB
Sample260710-e6nj1ac14l
SHA256 61189fdf8c4ecbfdd956efbc7dbc6b1da182e006812f6076713e104eed69108f
MD5 1f9d01478d27e2c9cbef318a89790ea9
SHA1 bd1f3143b1602c8a834a7154ab3bcd7af552108b
SHA512 38f8a69b38bb0dcfd8fd31f50e92233f82c66007b6d11d3f10c1e653a44fa195a8e67e72db818661d37a7a1a09eeb07233075084345a750d19b559d5d658a7a8
SSDEEP 393216:cm+sFHI7EzNFAUYl8XRQo/gCcT5NB35jmxEsYAwDjUWsNWcx9Q7m:cm+GCl3MNWc7c
TLSH
T1DD779D1373A50192E4B7D2388AA74203E773F8535731DACF326D06152FBBAD49A7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2240	tasklist.exe
3924	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4548	powershell.exe
3812	powershell.exe
3592	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3168	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
4548	powershell.exe
4548	powershell.exe
3812	powershell.exe
3812	powershell.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	tasklist.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeIncreaseQuotaPrivilege	3812	powershell.exe
Token: SeSecurityPrivilege	3812	powershell.exe
Token: SeTakeOwnershipPrivilege	3812	powershell.exe
Token: SeLoadDriverPrivilege	3812	powershell.exe
Token: SeSystemProfilePrivilege	3812	powershell.exe
Token: SeSystemtimePrivilege	3812	powershell.exe
Token: SeProfSingleProcessPrivilege	3812	powershell.exe
Token: SeIncBasePriorityPrivilege	3812	powershell.exe
Token: SeCreatePagefilePrivilege	3812	powershell.exe
Token: SeBackupPrivilege	3812	powershell.exe
Token: SeRestorePrivilege	3812	powershell.exe
Token: SeShutdownPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeSystemEnvironmentPrivilege	3812	powershell.exe
Token: SeRemoteShutdownPrivilege	3812	powershell.exe
Token: SeUndockPrivilege	3812	powershell.exe
Token: SeManageVolumePrivilege	3812	powershell.exe
Token: 33	3812	powershell.exe
Token: 34	3812	powershell.exe
Token: 35	3812	powershell.exe
Token: 36	3812	powershell.exe
Token: SeDebugPrivilege	2240	tasklist.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeIncreaseQuotaPrivilege	3592	powershell.exe
Token: SeSecurityPrivilege	3592	powershell.exe
Token: SeTakeOwnershipPrivilege	3592	powershell.exe
Token: SeLoadDriverPrivilege	3592	powershell.exe
Token: SeSystemProfilePrivilege	3592	powershell.exe
Token: SeSystemtimePrivilege	3592	powershell.exe
Token: SeProfSingleProcessPrivilege	3592	powershell.exe
Token: SeIncBasePriorityPrivilege	3592	powershell.exe
Token: SeCreatePagefilePrivilege	3592	powershell.exe
Token: SeBackupPrivilege	3592	powershell.exe
Token: SeRestorePrivilege	3592	powershell.exe
Token: SeShutdownPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeSystemEnvironmentPrivilege	3592	powershell.exe
Token: SeRemoteShutdownPrivilege	3592	powershell.exe
Token: SeUndockPrivilege	3592	powershell.exe
Token: SeManageVolumePrivilege	3592	powershell.exe
Token: 33	3592	powershell.exe
Token: 34	3592	powershell.exe
Token: 35	3592	powershell.exe
Token: 36	3592	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3796	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	86
PID 3796 wrote to memory of 1240	3796	cmd.exe	88
PID 3948 wrote to memory of 408	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	89
PID 408 wrote to memory of 1180	408	cmd.exe	91
PID 1180 wrote to memory of 2644	1180	net.exe	92
PID 3948 wrote to memory of 4136	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	93
PID 4136 wrote to memory of 3924	4136	cmd.exe	95
PID 3948 wrote to memory of 4548	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	97
PID 4548 wrote to memory of 4816	4548	powershell.exe	99
PID 4816 wrote to memory of 2800	4816	csc.exe	100
PID 3948 wrote to memory of 596	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	101
PID 596 wrote to memory of 3812	596	cmd.exe	103
PID 3948 wrote to memory of 4972	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	104
PID 4972 wrote to memory of 1128	4972	cmd.exe	106
PID 3948 wrote to memory of 4012	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	108
PID 4012 wrote to memory of 2240	4012	cmd.exe	110
PID 3948 wrote to memory of 4620	3948	2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	111
PID 4620 wrote to memory of 3592	4620	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mcafjvfm\mcafjvfm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8008.tmp" "c:\Users\Admin\AppData\Local\Temp\mcafjvfm\CSC9E38945559B24FBC9324F8FB5E74CE9.TMP"
      4⤵
      PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
  2⤵
  PID:4068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im svchost.exe
    3⤵
    - Kills process with taskkill
    PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
TLSH
T11C51FE323275B1D8C9167F071E6819C053BF4356EAA4AF5CB69C621EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8350958b7997e4738f0fe75dccb8f79e1a58bdbfe48ee69f35ed214fb97e61c4
MD5 77d7cda0b6cab6cf544a89c72134c602
SHA1 3ba1b574f95714d2a4b99d296c21288c2b618b1a
SHA512 a91ff261af3d3089240536943b95ce70bb7c6f797751cc69fecfe865fa80fcdd0f8da65aac05cb11122589acab169c951f9959b399c6a5da34831d64bfee4898
TLSH
T1D6218727B39DC821DC99153A209DAC1172B683C7809ECF8F6FC0D224A07FAC4CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

RES8008.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8008.tmp
Size 1KB
SHA256 fa4992133231c4dad0ab328a41fe95ffb402fa6af18473538ff04eb0c7eb76b9
MD5 90a23bced7c3c8780fa72acb42ffae80
SHA1 2e827644ac214f367c71d5c7cb7a11de35126407
SHA512 978215bb4951b627bb436fee8eb624fe7fccb86a41fc5621ed7745bbd6f871dd571af9d826506f4c0abca42d9bffb12f59e924dab8153faf4797ecddd286249d
TLSH
T13021AB0493ED4B1EF0775731AAF6172FA279FDA4EFA2535B894041282C51504EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5xjp51i2.zb5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xjp51i2.zb5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mcafjvfm.dll

Path C:\Users\Admin\AppData\Local\Temp\mcafjvfm\mcafjvfm.dll
Size 3KB
SHA256 150478aa1a511c84cfc51f46c833a789e9594890e8e2159878bd6af7a27b3f8f
MD5 4b1020f508fb5bf349367187b0287610
SHA1 4c35e4708acddb89fc1603c1a62b87a0128942ee
SHA512 b6c3a1ea2f37f92d2d8eaf8d522c689ee99de42f2849640695498fc9b09ef39c247d44c03392288cf4e3e6040a344f43c886a7df3dfba3eefabf3f1ec8973595
TLSH
T1C351DB2AA7E8466BE07B4735AEF343162BB4F8508B73572E49C44228AC617546D32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9E38945559B24FBC9324F8FB5E74CE9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mcafjvfm\CSC9E38945559B24FBC9324F8FB5E74CE9.TMP
Size 652B
SHA256 3cf7a538a5ef7e8b07f1a5b7340099b96ab216c6fb34e4a43ef3d89aff25cd2d
MD5 62edb8a590faa80ce803d0063b482c99
SHA1 fe71bf30519ffdaab44b618ce025a4577d2daf10
SHA512 ea172df8b7aff6faf3f208b83c865c657e6cbba85f5bb2defbbf4c0d033f0ca63f58fe5a4b38c771f18d1c0cb18f3409a02628fbf9a635e94fad631adf1e41f3
TLSH
T1D7F05E09A3FC030EF0F34B30BEF6836395A9BC64DE7293ED1940031928749108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mcafjvfm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mcafjvfm\mcafjvfm.0.cs
Size 420B
SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
MD5 4834cd4ec7820683e18f56a41a577e70
SHA1 890b830c0419de74eb89527b845c22fd4ffa375a
SHA512 ee26baa118f1ff963ccc62f12b08f66a3288b76499e98b4dc0b1fba0c49c880d59c3b79b3eb2957960adfeeaddca13ef236fabc0c4e8590f5b6d52a469f998cc
TLSH
T1ACE0864852DBB632541B843F5A62D4DB7B13014222BBAD11F5FC43118F0B4857121D78
MD5 SHA1 SHA512 TLSH

Submit Download

mcafjvfm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mcafjvfm\mcafjvfm.cmdline
Size 369B
SHA256 7ae0d40ff827d7f0da6e1fd5fbd8f43a2c5c537e897b6be1da920bb33f6cf99f
MD5 3d8b7bfcf389e90a9bae2434562ba4fb
SHA1 6ec1a17b56baa091a6a787430b016a34c649a877
SHA512 65b016c762a0d7f88d4cf7374cec4ed532005e08c39eede03da3e7ea8333a2e964ac101e8b99172f4cd2395d926c4267c1ec15e84c0582c82e63f4d899605668
TLSH
T135E0C03E6266C27D02FE100761E9E4ACC272278B39833FC4D862480DD4670032FD2761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3812-34-0x00000218715E0000-0x000002187160A000-memory.dmp

Download

memory/3812-37-0x00000218737E0000-0x000002187392E000-memory.dmp

Download

memory/3812-35-0x00000218715E0000-0x0000021871604000-memory.dmp

Download

memory/4548-10-0x000001BD32180000-0x000001BD321F6000-memory.dmp

Download

memory/4548-23-0x000001BD31D00000-0x000001BD31D08000-memory.dmp

Download

memory/4548-9-0x000001BD320B0000-0x000001BD320F4000-memory.dmp

Download

memory/4548-8-0x000001BD31940000-0x000001BD31962000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads