f75632ad1e35b48cea8b892476bf61d458862a22a3271aa99c26896239355bec

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.8MB
Sample260730-hs3zbade28
SHA256 f75632ad1e35b48cea8b892476bf61d458862a22a3271aa99c26896239355bec
MD5 31c0777a4ebca412e8994552f0faf126
SHA1 b99ec5173713663406f93d000416fa45dbf3cca1
SHA512 27fc34fbf35ca91f730603f5777348fa7b6ced1d400e5b232ff9b16d4fad93afecc04183004a1e248f498ee129c68f19861455a141f86dd10c8827931ba13296
SSDEEP 196608:CDeN2LsRBB/f6r1uZbe612gBMsvDSSIUuWrYke:CyN2LsRBB/fU1Ge612gBMsvDSwuWc7
TLSH
T154A68C59E37900E8D4A6C9BCC743A157D371784903B0ABDF1B90AAA11F23AE55E3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2452	cmd.exe
6064	cmd.exe
1304	cmd.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
5	api.ipify.org
27	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4568	powershell.exe
2396	powershell.exe
4428	powershell.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1192	cmd.exe
3552	cmd.exe
3904	cmd.exe
5128	cmd.exe
5036	cmd.exe
5100	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3928	schtasks.exe
2128	schtasks.exe
3880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
2396	powershell.exe
3948	powershell.exe
3948	powershell.exe
2396	powershell.exe
4428	powershell.exe
4428	powershell.exe
4568	powershell.exe
4568	powershell.exe
4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeRestorePrivilege	5744	7z.exe
Token: 35	5744	7z.exe
Token: SeSecurityPrivilege	5744	7z.exe
Token: SeSecurityPrivilege	5744	7z.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 5036	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	86
PID 5036 wrote to memory of 2128	5036	cmd.exe	88
PID 4464 wrote to memory of 5100	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	89
PID 5100 wrote to memory of 4408	5100	cmd.exe	91
PID 4464 wrote to memory of 2452	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	98
PID 2452 wrote to memory of 4876	2452	cmd.exe	100
PID 4464 wrote to memory of 1192	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	101
PID 1192 wrote to memory of 3880	1192	cmd.exe	103
PID 4464 wrote to memory of 3552	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	104
PID 3552 wrote to memory of 3592	3552	cmd.exe	106
PID 4464 wrote to memory of 6064	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	112
PID 6064 wrote to memory of 5392	6064	cmd.exe	114
PID 4464 wrote to memory of 3904	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	115
PID 3904 wrote to memory of 3928	3904	cmd.exe	117
PID 4464 wrote to memory of 5128	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	118
PID 5128 wrote to memory of 4672	5128	cmd.exe	120
PID 4464 wrote to memory of 1304	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	130
PID 1304 wrote to memory of 1544	1304	cmd.exe	132
PID 4464 wrote to memory of 5744	4464	2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_31c0777a4ebca412e8994552f0faf126_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "VoidTempDecrypt" /tr "powershell.exe -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1"" /ru SYSTEM /sc once /st 00:00 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "VoidTempDecrypt" /tr "powershell.exe -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1"" /ru SYSTEM /sc once /st 00:00 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /run /tn "VoidTempDecrypt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "VoidTempDecrypt"
    3⤵
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "VoidTempDecrypt" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "VoidTempDecrypt" /f
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "VoidTempDecrypt" /tr "powershell.exe -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1"" /ru SYSTEM /sc once /st 00:00 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "VoidTempDecrypt" /tr "powershell.exe -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1"" /ru SYSTEM /sc once /st 00:00 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /run /tn "VoidTempDecrypt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "VoidTempDecrypt"
    3⤵
    PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "VoidTempDecrypt" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "VoidTempDecrypt" /f
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "VoidTempDecrypt" /tr "powershell.exe -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1"" /ru SYSTEM /sc once /st 00:00 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "VoidTempDecrypt" /tr "powershell.exe -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1"" /ru SYSTEM /sc once /st 00:00 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /run /tn "VoidTempDecrypt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "VoidTempDecrypt"
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "VoidTempDecrypt" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "VoidTempDecrypt" /f
    3⤵
    PID:1544
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\VoidG-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\\void_dec.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5heown5d.52r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5heown5d.52r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VoidG-Admin.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\VoidG-Admin.7z
Size 3.3MB
SHA256 17672a367bec8132a1ee5d1168027703a8ff8592250c6c88fb7839f69b4c9caf
MD5 b9cd16c781e12f49d12dce20463ee82c
SHA1 050176f51fb4547af1cb757bfcfc1eb96c72a090
SHA512 6b078ef28ea82e58c077e9c841cd237ac4412d47d357b13fa49b7453544c6d90bd3b40de348f60f759fbdaebde48b862a58ce2e50ac99179f897aa58b7f0c35d
SSDEEP 49152:JNERHT0MIeSbPCVzaFRilbVtbkPJ+Y7fAI24wmjTPsKZ/ZUjmA7m+anuomh9akNm:JN8zePGOFR8axnfAMweTPPdUanZQS7z
TLSH
T1D7F53335CEE3FEF9552D5BA241A1059B24028A4FCF76FC8B1C6101BA8C84DAE0755FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Browser\Edge\Cookies.txt
Size 46B
SHA256 03268110152a71fcd4381f83056c18feecb75ddcdfa7e6bd7a10e89e31ee82f5
MD5 98e2d6e63d7f3f1709b09f345f125932
SHA1 83ebec55666174bd19ac1b1e090da18028f84f20
SHA512 80dcf55bc32ab6657d5aa2244b09cac00a5cad4e507ecb891bb2dfa534ea272be4f6943f91b28cc92cca05dbb8bd4ec13730878dcab8ab7194140767e53baf3d
MD5 SHA1 SHA512

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Browser\Firefox\Bookmarks.txt
Size 367B
SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
MD5 1e5809dc37fdb89a5f31aefd8d07e742
SHA1 7d7e459b5709f8480d7b4100ce232c2ce1e5d1ca
SHA512 e76ec273e7a47a9ef0bd69e36c44a601bc49a51005a2263c1f1d2c115c7702045e55a8d70518b750ae8fc4ad5aae23dcb116a5f322cd7f6922f52434e985128e
TLSH
T1F1E0D8A3627241EB4F018B1870297A16644B8708DFF959DEE046247244A93A440E6B4C
MD5 SHA1 SHA512 TLSH

Submit Download

BackupTrace.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\BackupTrace.xlsx
Size 11KB
SHA256 b80598e3c13b5e118a0a61d5c21024c5448e3a4ed88e803ddb8f6df3d9542a8f
MD5 810241f35fe04ad730b9270a58463e83
SHA1 6b928221ff20024b91bcb9620d633416967a4529
SHA512 9af4a87b10e9e3d2159e16a6ee02033ce280b54be1fcdac3063194720f4b6a955938201fdced99181690afad29388db4f2b1d7fccb408f4bf192e57a79d5ccf0
SSDEEP 192:wc8mVJGjmpOxaJb3UfqMf/5BaFUlbVvevUqzQXpS0OzyMezW+CY2ao6:wc3TEmAAB3Mb4UlM9z6pW2MezW+f2ao6
TLSH
T15B329E55E071802DC3B74CB9906B2AF8BAAD50964B8479993974F94D6F8037B128F0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisableUnprotect.docx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\DisableUnprotect.docx
Size 19KB
SHA256 19055f0dffc9091ee80ba1ec09facb183ac94168c42030a8e17b1b7661443dca
MD5 73d4c9a6ffe6ccbb7242e5db5463c6ca
SHA1 87b187c79af1c83b8da505808f7a1a2fd366b15f
SHA512 e632b0659f5044bc5f3ab24a10214443be88c40914ecae0080ea4b1da13e040ff68f154769e2bf846ad8f1a59857892b567336aebba48614c43c21a16161d009
SSDEEP 384:aOVVJDBHgA8jVVeUnyQ4o/bXPdNxt/ZtNNh2RIFHmkUmo:R7HgBBVhnKoTXxllN4Itm9n
TLSH
T1FB92BFB8E802AE21EB23957DD05D23F5F1085313768AE19321463BCF96BBF514357A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectDisable.docx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\DisconnectDisable.docx
Size 13KB
SHA256 97a4568cd8a89de7c643c04c5d353d39cf51a94568bd0b099e828ab5b48e13ab
MD5 7de0e0487826197cd0cd99bee25f1b87
SHA1 3771c3bbc7832eb7aea152e048ab4cfc592afe29
SHA512 35ac4bbc60e5ceb2ada696c27f08b803ebdfccbb45ccaa2e780849ce7501c2fc2cd34803d01b10a9cee1dc6c268f39bd0bb1464ecd36a4ed320aeba05fc1d924
SSDEEP 192:CtyG2ZxXa97AACCNxtpgoZ22NNdp1beTWNGFHBEp+lT2v0k:a0ZVkZdNxt/ZtNNPfIFHm+J2v0k
TLSH
T14952AE39CA9298A2FE03847CF09E03F6F14C9341750AD0E731AB9A5F4756F474727A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallSwitch.docx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\InstallSwitch.docx
Size 234KB
SHA256 77bda127603aeed687c6247c607f326c39dfb77db16ffe74ba7d2cc5addb4bf6
MD5 8ec80c9efd32fb4726d867a3e05c2e27
SHA1 2410b702c72f7b1b428c3558bf4e392bbc84f22c
SHA512 d0dd5f51ddd3d4af0f17a59155dedc0ae191eeae521c580d328c24809fdb102541ec227e64d2ae0d7267046d08084f7a18c5f0cae0f4a31b18f92dd92c9553b3
SSDEEP 6144:Qt+O11YwK7ZOFers/m1xPz3puATvuS79lO/TN640KO8N:QhcVmers/uxPzwnEq/To40Kr
TLSH
T1D134236B07AD9B062D186EC58F2F48C563EDAB03D3B389CD8C595D8B0D6ECDA41A75C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitMount.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\LimitMount.rtf
Size 655KB
SHA256 68d7e5473d7e7ab4ea47c8ba5ec7ff2e921e5562ca7e5eacc6bec259ab60bf24
MD5 8ec410cbd093a128fc4760c77e5f5959
SHA1 f82b85178778cf3292cbdea4cda46b0e7524135c
SHA512 5c620fc4c2b67fae18dc51918f2e27a11b0fd57a0aa39be8771e752ebcf2d242cca71e1f26b4e9b92bda2c5d7eba505a060be1c18e9a051a4b41ab7f20734ccd
SSDEEP 12288:1tLAFcPZIejjvlqDP1CVkB9EZK0zYlsFa7FtxmLpYzxiORlwc6ZXrByFV2SVedP:3IKZIedqDP1CVcCZF5Fa74piielL6ZFp
TLSH
T1FBE423A5CB1655FFA33C627287DDB7A32808C01ACB437D277AA6429BC5705BC6910F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectClose.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\ProtectClose.txt
Size 345KB
SHA256 af11d82788c86069109c1fa6cdcaa46d51ad10ac5f3c0587a5253e957137f522
MD5 6823836e9e4f29782543ac58fbc9fcbb
SHA1 f6f85155d0d978949d085737c85245299dbc83c4
SHA512 f9f8ab9870b5da41b316894c3275626d5699c64de71921bfe525e97783106dcbe1771d7fb7aad49e1f8e8981b3f05cbbfbdacb3613ce7a2c9b10d2b41b639a89
SSDEEP 6144:b2UWwctbIPY3SvtfZM6UjUaX9Vb030ZteIf75BNV0dxAGJrwwoEKODje0F3/:yUWwctbIPgS1fZraNVZZzBNaAIMY1+0V
TLSH
T1B7742374A2DFEEF595BECAD1B3016A2D5822CEC3C828F8C76F1546B094C0F1956D91B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishEnable.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\PublishEnable.txt
Size 804KB
SHA256 1c4592c59778298517a33fade611c91882b7d7a3ebf193332fb8f8dda7fdf443
MD5 6ec417fc0f165211c0e0f55543c93d91
SHA1 38a79912fb7e163c61fd659ce7d817662ad0a812
SHA512 2937999a2bb3982b281734768323857347fa9d731a7f0e2d9c95ab1b7974ac55178fd0297573e2e8760479ea553586e0d2ae0ae9b447c51af43fac15c3fe44a2
SSDEEP 12288:gAK+lYpXVUNjTPzcKIhpMJWE8M51mjhrUJvz8V+1cCBQ2SEbhHg3jWnHHRj8:gb+eCjTPAKwMECAZUe4mP0KCRj8
TLSH
T14A0533AD9CF288AC4471446A04F1145BA85280DE5BBFF383548630E9FEC98BB559FB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveSubmit.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\ReceiveSubmit.xlsx
Size 12KB
SHA256 77ca7194a66c8300aa3e45108cdad6069b453ba072f501ca11140a0908b5ab1b
MD5 dd2881c8a1c0d976f72cfefa30fa029d
SHA1 f77bc1f021d9be1c2fddf36b7d62d604c01eef5c
SHA512 68551b988beb6245568b29eed3668625520bf006c35578c03d84b01f6b401230b1f4fe39ec778167f1825aeac1bb86bb7b46cf46c5e86b3b545e4d3546d8b4f7
SSDEEP 192:wc8mVzFeDb3UvnB3v5aFUlbVvevUqzQXpS0vBb9PXePsoDJxhaTwaopOG:wc3W3cRSUlM9z6pt9doDdaEaopOG
TLSH
T1D242809AE0517265CB3B843BC25E00F2568DB0C75D8727E72C61F76BA7801E7158B24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterBackup.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\RegisterBackup.xlsx
Size 12KB
SHA256 3c22dbd45ea1a2aadaa991f36710c8b84161705c3cec99dfccf996c86d127523
MD5 47790f9350b5e599bb943fa854252f7a
SHA1 c348e6c69e33a1ebdd74958b2f11a154005f08d6
SHA512 3129812c48d8c4e45ce2367693e04d258a0902c053223278f1b058ea0f83e228accd0e416ead090cebef01e4b494f1d72e1d33091e8c52dd6e0414739b61d8b9
SSDEEP 192:wc8mVst6ph+b3U6w092qLMqrms5aCaFUlbVvevUqzQXpS0+2i6wsCGtmXTaIaod:wc36sphq3dwQmsUTUlM9z6pVd8jaIaod
TLSH
T1F0429D99F9600065D233C4BEA8BF09F4B54F6086D743A98F6421F6543382277259E3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveUse.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\RemoveUse.xlsx
Size 11KB
SHA256 a07b8b4e09aa4b97530dcc5565a74a2a7be8d6951298447e36dc4abbdc436f2f
MD5 a1a45aba38ca928c3dd7b399a1330a1b
SHA1 7e88e488edf82323d82c81bf90af49315dbbad1e
SHA512 71cc3f2fe2d31fcfc17844a9790583e2ec48d1ba785089285b1e909f850eafd3ce348868c02a16f72c8a892aa7ac72374e9b0a96a6857b54547f9d41db797cd7
SSDEEP 192:wc8mVpMPSVSfb3UNh7LEwkpaFUlbVvevUqzQXpS0OFBqCpE7CUQ/qEdaoU5:wc3bYSSz38ewbUlM9z6p2bpCCUQ/qMaH
TLSH
T1D5328D5AF5B0A1BEC22FC9BDC18B40F73D5C30959A4279497910F95E218239B238F2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetGrant.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\SetGrant.rtf
Size 226KB
SHA256 22fbc9c4a4b5c2cb40da2c967d68e6a37f49ef8d72700488990254b471c45bed
MD5 3acc0553d8db76024f28fc6873fd29c9
SHA1 79dc34092a5453209286e50ba0d93596026365ee
SHA512 7571b47effac2686ba023588632f7a4b45033f8eb2e659d3d1002e147803a713abfdb82f688907ed95e1e3d39a178ab93a54d9b1b71f27aca1790fe8c366ef5a
SSDEEP 6144:wJLtle3EEKKMlPsZE9ChqbIwszTcfXqzIjf9Ns44fGg0:wbECl4E9VIyXq8jjsBfs
TLSH
T116341214DC07BAC9BE4AE01A6766E48F63C35E5DC9DD4FB3D1B162E3227BA28CE05144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartUnpublish.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\StartUnpublish.xlsx
Size 12KB
SHA256 c871cc685f72798619d5edd07009cd90076805e45790ab66795eda7daa298b43
MD5 488b93c06ce93b6b8ae5e927c59086a9
SHA1 d9d22a3e943937eccc4eec7c3f90272ecda208d8
SHA512 18e8078d76f5353fb277813d402f898f8320e0d0678b92cd244a2955f9c50f873c9a4433f9ec13eb56bcec29ffa24bc93bc05687e8eba02ef75daf70428639b9
SSDEEP 384:wc3jYRC3cX2gW5UlM9z6pexw+zZlpNKdwaoJ:wfwgW5xWpefJ
TLSH
T17B52AF24F0724A54CA76CD7EC0B905EAB98D60809FC2245E5144F8AE1ED175B23FF2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartWait.xlsx

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\StartWait.xlsx
Size 11KB
SHA256 32d44cedf1cf89bc3c9b033ffd46d54b610e0a8473819a5b25d18942a7166764
MD5 831486277929cb66488ca5848f4297d0
SHA1 5d7dcade249de9dcb48bbc3aa6745eb2fcaf01ba
SHA512 041749c3346b6d6b675130985c00629a005ea921cf643b424f5f70471c61d9d395e3b150ea3fa4537e49f187c9bd93b96449f0132d0639fb72ba30d72cdfd7bc
SSDEEP 192:wc8mVRzpb3Uj38Jvp4ZwvW//aFUlbVvevUqzQXpS0iDCkGIA9E6VzmTmao+:wc3T1303CBV00UlM9z6pwPs9Eqy6ao+
TLSH
T1CF327B1AD576997DD663887ED49E04F2B50E60854AC274CF6920F24E2B423D703BB3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendReceive.rtf

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Common Files\Documents\SuspendReceive.rtf
Size 685KB
SHA256 109b6fde12af9d88ae56f619fffcd540fc966a8db65294c787eff48993e7e2ac
MD5 110e9ada476a0b0ddc0afb44fcfa7893
SHA1 62db25ff25ec8ba817c2f8e6cd3c08848da722ed
SHA512 b5c13716316b56e06f8f7c2eb5b15f1207b7c7153a20076b1511b7adb3d3855dadba18f27ec10037053be7e27f92ebe335d263fd04b327e089a0d3d5ab914935
SSDEEP 12288:/AD3B3uNyshcn+Qorqph3rGwX2FQqxb6F360Go3bemvUFl3lFu9Hg2BN:/IuN/hSh6wGvxeDRUT3lE9Hr/
TLSH
T106E423724DF2E0B7BD497FA488742B998863A70EDD30BA970C11513EA848DF58750EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Credentials\Edge\cookies.txt
Size 48B
SHA256 1a3b7780ecb9da83dd34690f42fb15049b780584ace80f1b26996278c55ba3dd
MD5 3fec78c5f79d0ffb29a66ad394ec3f4e
SHA1 99ca84bc57dc00f0ee025994fd2753dd76e95a7a
SHA512 607b36b2a191579e2036dc72f00fdb078c6fbd375db0d7d16a6f36bfd3da2327e44bc41eede58825a7d525aac87944aeb772598c942e619a2a9818109a0461d7
MD5 SHA1 SHA512

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Directories\Desktop.txt
Size 1KB
SHA256 a952e610a7d95f26a2f5f64160ecf6ce6542848b559a327a0128b2a245bbd051
MD5 1b5c2e8666501aeaa0753d037d47ea1c
SHA1 ddef2070bbb4c98b04b8cdf213a472d400e48949
SHA512 9e268b7dc60bc091c56f93b43e4a3516b4e6556fe30a2ec8369f3c1106adc3b959abac4d47bdc5273ced5a9f7873ecc34b5690647ac1ab3918c59fd6c844dc8b
TLSH
T136219B8E99B9ED2F9A95765E6B20FC8701DA08CE4E64F6B33BCEA8D506126085026403
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Directories\Documents.txt
Size 1KB
SHA256 ab16c3d8bf4852e6a3a57d5992abdcbbce1157f97c0a33771f51ff18614d9b83
MD5 04a01942e2a09e683ea7b414cc49cf81
SHA1 0727c3ef4d35f34f73e4620ae589c99b37ac264e
SHA512 95852e8440e4f12ad7308c7310a84751bcc3ae1f4d69ec7092538ba06b91f226df7b001f0de41aa9158702924521a6d2edc192261da27fdd36950333f10130a5
TLSH
T142317A8D587DEE2F4A9ADBA50321781306E908C98FB4E09737DEEAC56401A35901990B
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Directories\Downloads.txt
Size 1KB
SHA256 ee6afc51cb4b37cbcbbb3f96c3a1256b3922edc2bcfadc3921e9deb7a1339b49
MD5 068c940d13b481cfa4fd1fb42375bf2c
SHA1 7baf3ac5fc8cc7c57a8842da77ef31d0fda9512a
SHA512 3dc4a541e756f552f781f5f888d888f25e04d7382efb18785a86d9005618710f0c0622ad5b7cc40efdf15fdb704103e785f29046426efb145b00579433c6c73b
TLSH
T1CC2142EA5530EF1FAA143DFD1B607E1396C618CA3C8AE5717BCBCD60564174640B1C87
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Directories\Music.txt
Size 1KB
SHA256 e7da36ed80f6321f7e919f71e808ed3e4c35922a1cc9247ce806af858f897929
MD5 5204520acc04c17d9797e82d1787bdc2
SHA1 3899d193c6b453ba92537c9eb8acad5c025a7042
SHA512 8197467f5d5bf6cb451112c1318300fe0830b0f9be5d2bf2955b00bf1dba79b04e5fa8a5d8d55e6f2566eb4d9fb310e22dfd1df397de1a449945ca767d0b1659
TLSH
T15C111F1E9130CA1F4E593AE82B68798308D51DDA4D22E433F3DBC8BB020AE0E14E9803
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Directories\Pictures.txt
Size 628B
SHA256 76dbe1f44b3d98e6db629d7f70208af0c7f7ae079e5c36b27a5efd4e3bed8afd
MD5 78f65cfdcf4905b7f4f64f459ea732f9
SHA1 63177e7fb4f7d3a587b24ec92e6e5b197514e7e3
SHA512 86f05a89621ae42404cff0afc93d36cf8669092cac9d8c079db961729c5db560709700737b0451afdb6ecf893af95598a9d170539768886a490255876d67cc77
TLSH
T10DF07D4A34ACCC0359DF2DA92B64718797C13DE75E00F76A36CF48920902B4598B2C83
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

Display 1.png

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\Display 1.png
Size 5.9MB
SHA256 0983c916b355f265f4d058242f57926173a927ef7fb7e0d9aa2e90b125659608
MD5 0929c784dead7c2a7a7f22294565f76a
SHA1 9a3439b2c7183401ba4c228fd4fcbe652ec4e7ff
SHA512 61026eb19075ecaa1cdd80b7b35f8c5c233e0abf5aff6eff94a860cf582923c7001a4db9073a2b699c128900c1b03743092b40921ac33d0a7343890c6ee26e6a
SSDEEP 12288:ppQf2QRaInjjN1vEyzWWehYgj9ZpeSmai98:ppQuQ0I2hYgJ6Smai98
TLSH
T124560323F5EA7A54EA3A397582F4071DA310ECD8BB48078F852978F0F1A23456D776B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\System\MAC Addresses.txt
Size 34B
SHA256 9c940aafa78912273776c6515886fd629db8f0cef567265015cda07603faa3c0
MD5 9db8a44ff34a3e168b3b1e8e5afea1b8
SHA1 dd576fd153b58f0bfa607c59321715f3463d25cc
SHA512 2e6b4ac66c640681921073cc7142596368939980b161a0a0ab2eb99b5148dc2c1333d708f0f0b4e59eb0f8b7e34f7b83f100b4d217d03c0626e04ca433c503c3
MD5 SHA1 SHA512

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\System\System Info.txt
Size 679B
SHA256 e0b442c867ac2f73f6759ae0237e4b56f7019321955ed830bdb71080c69dbbff
MD5 381b323d835819efa384f0ef93ba15b4
SHA1 e076c07ff5f47dcde92107f7173a9c046ded6370
SHA512 47663ef87f1d9b2fc700b6689fe570bf2b54c5dd94b1879217321e5a028d095b297b67603c73e3f3412a4b96622eb87948bf28f164fc919f27fd543dec227800
TLSH
T1840110E0625C0002C3AB23F51307174731F65AC73597A82D62EE81CC2ED31C5D749041
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__snwabvhg\organized\System\Task List.txt
Size 2KB
SHA256 b84e230a2c3f0077227fed0ce13ccdce5c692ec2c65ced5d54df7e12fc9d7fc7
MD5 bc452ebf86a89dbe6c0893c2d119b085
SHA1 e012d6be56a659731cebf6df6be3f56330fe9c2c
SHA512 3f83d196d74c3cb6392a05f520729580b4415b0048e97ac79dd96c144f07b1747eebd73fc2e51838db50515077305a373f38c1c130032df4a96d3bab809479e3
TLSH
T17B41C80B948FD2CED6C566EF3E215A5F4BAB040C000F5DDA725205EC29B0C1DDA4B72E
MD5 SHA1 SHA512 TLSH

Submit Download

void_dec.ps1

Path C:\Users\Admin\AppData\Local\Temp\void_dec.ps1
Size 1KB
SHA256 2942ce08b4397ac0af7bf3de3d4b2337448ccc408078f615d9d17ff5ade61c3b
MD5 c64386add18ce9461594771e3da9a233
SHA1 e0ae0fe35e6a4d9915065d337b14b7f8f3a41357
SHA512 7867dbbc248bc0af941a5c37385d2ce3805e0f94d21230233ed80633fce3b970c03eefbf9a3020345422d71b24b233daca10b2bf0a0449a717d255878536fe23
TLSH
T12C21F118668BDA444866A537EF22F8CE4913065817DEB907F3A5D1B06C89A15B278B50
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
MD5 6c47b3f4e68eebd47e9332eebfd2dd4e
SHA1 67f0b143336d7db7b281ed3de5e877fa87261834
SHA512 0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
TLSH
T1F8112223F38C8920DC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 ca7b1de34ae6c8e4a3cc042bb6538d1431d8587524a5724ccc05e2c052c17fca
MD5 7250df9f5db159faf15ffc4b7906f9fd
SHA1 254c80fd73377c8daf0b9554b6abb307d5174f91
SHA512 6b9a50434e157e0ac448904dfd04fd323a482c391fcea229012dc4cac91b94c50a8cf00a196e3bb21d4ac194de946919bbeacfda20ea5257d731cbd2d751c50b
TLSH
T175112223F38C8960CC86163950ADAC5172B686DB85EEDF9F7BC0C210E5BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2396-5-0x0000020CFFE30000-0x0000020CFFE52000-memory.dmp

Download

memory/2396-4-0x0000020CE5740000-0x0000020CE5750000-memory.dmp

Download

memory/2396-25-0x0000020C80010000-0x0000020C8022C000-memory.dmp

Download

memory/3948-26-0x000002E61E1E0000-0x000002E61E3FC000-memory.dmp

Download

memory/3948-20-0x000002E61E550000-0x000002E61E594000-memory.dmp

Download

memory/3948-21-0x000002E61E970000-0x000002E61E9E6000-memory.dmp

Download

memory/4428-43-0x000001F240DB0000-0x000001F240FCC000-memory.dmp

Download

memory/4568-64-0x000001BC1CB70000-0x000001BC1CD8C000-memory.dmp

Download