ea0c166042f1b3d0541071b1fc2449f2f01b3f81cb183746a1f1fc0b443b40be

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 61.2MB
Sample260716-l2vabady41
SHA256 ea0c166042f1b3d0541071b1fc2449f2f01b3f81cb183746a1f1fc0b443b40be
MD5 ecf66bc4429453084400a627ddf19bc7
SHA1 2d33a57c2f6edc53cbb1b7c068e0c505df047c30
SHA512 a79eca2b44b72e42d47fe4ac132e26b739736a441771dd23a8ed20cd6d7ed36a58c8af2b621cfb01ad335dc0f4a2ac2a566e414ab8edfbfd4c9719124dc9f2db
SSDEEP 393216:YsqGxqsktO5GG02US1P+/U7q7K0mAb5ZUjcDUND3usyBvaRRMV+o33irYVI31BLT:Y4lmOIUMFCrYVKAGmjvM
TLSH
T166E7494666EA0881FDF7EA348AF65513C633BC166F3185CF610C1B2A1F776E08976722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
4256	powershell.exe
4288	powershell.exe
5816	powershell.exe
4352	powershell.exe
3104	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1300	tasklist.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
292	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3104	powershell.exe
3104	powershell.exe
4288	powershell.exe
4288	powershell.exe
5816	powershell.exe
5816	powershell.exe
4352	powershell.exe
4352	powershell.exe
4256	powershell.exe
4256	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	5816	powershell.exe
Token: SeDebugPrivilege	292	taskkill.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeIncreaseQuotaPrivilege	4256	powershell.exe
Token: SeSecurityPrivilege	4256	powershell.exe
Token: SeTakeOwnershipPrivilege	4256	powershell.exe
Token: SeLoadDriverPrivilege	4256	powershell.exe
Token: SeSystemProfilePrivilege	4256	powershell.exe
Token: SeSystemtimePrivilege	4256	powershell.exe
Token: SeProfSingleProcessPrivilege	4256	powershell.exe
Token: SeIncBasePriorityPrivilege	4256	powershell.exe
Token: SeCreatePagefilePrivilege	4256	powershell.exe
Token: SeBackupPrivilege	4256	powershell.exe
Token: SeRestorePrivilege	4256	powershell.exe
Token: SeShutdownPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeSystemEnvironmentPrivilege	4256	powershell.exe
Token: SeRemoteShutdownPrivilege	4256	powershell.exe
Token: SeUndockPrivilege	4256	powershell.exe
Token: SeManageVolumePrivilege	4256	powershell.exe
Token: 33	4256	powershell.exe
Token: 34	4256	powershell.exe
Token: 35	4256	powershell.exe
Token: 36	4256	powershell.exe
Token: SeIncreaseQuotaPrivilege	4256	powershell.exe
Token: SeSecurityPrivilege	4256	powershell.exe
Token: SeTakeOwnershipPrivilege	4256	powershell.exe
Token: SeLoadDriverPrivilege	4256	powershell.exe
Token: SeSystemProfilePrivilege	4256	powershell.exe
Token: SeSystemtimePrivilege	4256	powershell.exe
Token: SeProfSingleProcessPrivilege	4256	powershell.exe
Token: SeIncBasePriorityPrivilege	4256	powershell.exe
Token: SeCreatePagefilePrivilege	4256	powershell.exe
Token: SeBackupPrivilege	4256	powershell.exe
Token: SeRestorePrivilege	4256	powershell.exe
Token: SeShutdownPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeSystemEnvironmentPrivilege	4256	powershell.exe
Token: SeRemoteShutdownPrivilege	4256	powershell.exe
Token: SeUndockPrivilege	4256	powershell.exe
Token: SeManageVolumePrivilege	4256	powershell.exe
Token: 33	4256	powershell.exe
Token: 34	4256	powershell.exe
Token: 35	4256	powershell.exe
Token: 36	4256	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3740	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	87
PID 3740 wrote to memory of 1300	3740	cmd.exe	89
PID 828 wrote to memory of 3520	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	91
PID 3520 wrote to memory of 3104	3520	cmd.exe	93
PID 828 wrote to memory of 5428	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	94
PID 5428 wrote to memory of 4288	5428	cmd.exe	96
PID 828 wrote to memory of 1240	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	97
PID 1240 wrote to memory of 5816	1240	cmd.exe	99
PID 828 wrote to memory of 5588	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	100
PID 5588 wrote to memory of 4468	5588	cmd.exe	102
PID 4468 wrote to memory of 3572	4468	net.exe	103
PID 828 wrote to memory of 5392	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	104
PID 5392 wrote to memory of 292	5392	cmd.exe	106
PID 828 wrote to memory of 3472	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	107
PID 3472 wrote to memory of 4352	3472	cmd.exe	109
PID 828 wrote to memory of 4204	828	2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	110
PID 4204 wrote to memory of 4256	4204	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_ecf66bc4429453084400a627ddf19bc7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-WmiObject Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-WmiObject Win32_VideoController).Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_VideoController).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; $ver=if($r.PSObject.Properties['DisplayVersion'] -and $r.DisplayVersion){$r.DisplayVersion}else{if($r.PSObject.Properties['ReleaseId'] -and $r.ReleaseId){$r.ReleaseId}else{'N/A'}}; $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName; if(-not $av){$av='Not available'}; $ubr=if($r.PSObject.Properties['UBR'] -and $r.UBR){$r.UBR}else{'0'}; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $ver, $r.CurrentBuild, $ubr, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; $ver=if($r.PSObject.Properties['DisplayVersion'] -and $r.DisplayVersion){$r.DisplayVersion}else{if($r.PSObject.Properties['ReleaseId'] -and $r.ReleaseId){$r.ReleaseId}else{'N/A'}}; $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName; if(-not $av){$av='Not available'}; $ubr=if($r.PSObject.Properties['UBR'] -and $r.UBR){$r.UBR}else{'0'}; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $ver, $r.CurrentBuild, $ubr, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
MD5 0773347dabec51061ea4a74589125e12
SHA1 05aa0df69fe48f55680b77c79ae91b5912ca48d4
SHA512 43e24bd488c61f8b8de22a5643a668863f07b523674e94c74f6ce644b8510c58e54ee8b9d45c5f99d0523501d316b9dc8d6d44360d99e1b0b0ad88182bad6669
TLSH
T12A21AB33B3CC8724CC8A403A10CEAC1032B6C7DB409ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c890f79a740919ad6da3e891842a6e6ba658bec2e6760bbb74f6ac129935e830
MD5 161072b40e6f01b70d0318163cf3eee4
SHA1 82ffecd877f29a6ccb17928c42439b13f1f74257
SHA512 f02eca49fae41bd7a9638dcd3703b8036500cc78ad3bed22a5833e68051eee66c7f22e55cad8e425e80bb1b64c79f974e1e95ba02ce3e131c8e671f5a9503848
TLSH
T1F9215733B3CC8625CC89413650DEAC1036B687DB419EDF6BBB84D545B43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u3hrmy22.ib1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3hrmy22.ib1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3104-1-0x000001C49FBC0000-0x000001C49FBE2000-memory.dmp

Download

memory/4256-23-0x000001E2688A0000-0x000001E2688BE000-memory.dmp

Download

memory/4256-24-0x000001E268AE0000-0x000001E268B92000-memory.dmp

Download

memory/4256-25-0x000001E2688C0000-0x000001E2688CA000-memory.dmp

Download

memory/4256-26-0x000001E268D20000-0x000001E268D4A000-memory.dmp

Download

memory/4256-27-0x000001E268D20000-0x000001E268D44000-memory.dmp

Download