f84cc46dae3aa0a38fad2f125b36ae17ff72bcb2a3f3f906acd0f06e026820ec

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 6.8MB
Sample260730-sms72avsav
SHA256 f84cc46dae3aa0a38fad2f125b36ae17ff72bcb2a3f3f906acd0f06e026820ec
MD5 93994701d836b623ebf16b310425d8a1
SHA1 ce12e520293f3586e9e77749c44e2b3698315177
SHA512 3623c2bca6dd094b778e4fd406bda44e78a24f88b0db02012059613ec7050f0aa45cc866cceaf62c4b699bbc54c938b964cd1e0e7867293005026d8ecc1159c0
SSDEEP 196608:gBvBUAECosTVvvqSPKMOOyQe9zusr+Rv:gBJUArosTVvCkKMOOyQe9zusid
TLSH
T1A5769D69B6BC00A5D8AAC1BCC2975227D772B46553B057CF1A648AFD0F23BE01A7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe
3372	powershell.exe
1992	powershell.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\u837503\Parameters\ServiceDll = "C:\\Windows\\System32\\u837503.dll"	svctrl64.exe

Executes dropped EXE 2 IoCs

pid	Process
1128	svctrl64.exe
4864	svctrl64.exe

Loads dropped DLL 1 IoCs

pid	Process
1656	svchost.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
56	ipinfo.io
57	ipinfo.io

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\System32\u837503.dll	svctrl64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	\??\c:\windows\system32\wsvcz\u405277	svchost.exe
File opened for modification	\??\c:\windows\system32\wsvcz\u581574	svchost.exe
File created	\??\c:\windows\system32\wsvcz\u405277	svchost.exe
File created	C:\Windows\System32\svctrl64.exe	2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	\??\c:\windows\system32\wsvcz\u400767	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	\??\c:\windows\system32\wsvcz\u581574	svchost.exe
File created	C:\Windows\System32\wsvcz\wlogz.dat	2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	\??\c:\windows\system32\wsvcz\wlogz.dat	svchost.exe
File created	\??\c:\windows\system32\wsvcz\u400767	svchost.exe
File created	\??\c:\windows\system32\wsvcz\u752276.exe	svchost.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4236	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4092	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	svchost.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1900	powershell.exe
1900	powershell.exe
3372	powershell.exe
3372	powershell.exe
1992	powershell.exe
1992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1128	5052	2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	85
PID 5052 wrote to memory of 4236	5052	2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	86
PID 4236 wrote to memory of 4092	4236	cmd.exe	88
PID 1656 wrote to memory of 1900	1656	svchost.exe	101
PID 1656 wrote to memory of 3372	1656	svchost.exe	103
PID 1656 wrote to memory of 1992	1656	svchost.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\System32\svctrl64.exe
  "C:\Windows\System32\svctrl64.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 5 /nobreak && del /q "C:\Users\Admin\AppData\Local\Temp\2026-07-30_93994701d836b623ebf16b310425d8a1_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4092

C:\Windows\System32\svctrl64.exe
C:\Windows\System32\svctrl64.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k DcomLaunch
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'c:\windows\system32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'G:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'H:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svctrl64.exe

Path C:\Windows\System32\svctrl64.exe
Size 6.6MB
SHA256 7aa7fd96c8a7097f86e9d068c5b47ff86354d91b50b32ee57e93df1e5ed279c4
MD5 52060418d303e0677b6af6b9b4116b3f
SHA1 522140ce3d2348029e04c77f3da45a5596745664
SHA512 381e8f89f6605c060fae1ea75d86efbbe96d425a1fc9cbfd09e65f5d03aabda2f7c68fca8b18204977f5d81b83704c8cd36a5a28ae8468b9ddcfd0c627fe4b2c
SSDEEP 196608:CBvBUAECosTVvvqSPKMOOyQe9zusr+Rv:CBJUArosTVvCkKMOOyQe9zusid
TLSH
T1CC669D69B6BC00A5D8AAC1BCC2975227D772B46553B057CF1A648AFD0F23BE01A7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_33byghtc.ljf.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_33byghtc.ljf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 93ea56ad38069dbc3d1ae192afd3f3dc8704e9298752f73729b95cf3298dcaca
MD5 7b1fe6890101f73a0c9796d8d585b168
SHA1 56eb99ee341b880cf7a80ebc705371aea87b3743
SHA512 fe73cccfadc916f613fbcc7a80ec82ae1228ea2aa28bba4515851e82463e76942ff3a3d6bcc78ea666a841d89220fb49b8fa52279985e88fe0aec6728f21aefa
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkqntznEfqeYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkqntznEfqtZq6FIzoI
TLSH
T18791EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0cd16eee7f172785bd5fb815e32d8e5b537101b36ef50ba31b2e6b26010a3832
MD5 7a97b836d9bfa22edb1d40ba78b1003c
SHA1 357d300e0ceb255c4fdc8c4b078325cc89e7bb63
SHA512 c31c68249cab6031a9e68af3be7aa46a5f7a1b37476f6ffb7edaef77bc5559f3be4509d2fb24c1f68b05bc130eba1f2aedfd273237ac5c34850ee9881607f065
TLSH
T1BB217B27F3DC8A21CC96123A509D9C1176B683D7819EDF9F6BC4D614A0BF5D8CB31190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 185a0eeec546deb88e14db636726e3f348531e5f4c9fb5aff281072ee681d557
MD5 2718a11462a0574d8a31eec0aa4ac1c6
SHA1 2a139c61fe6e39714e17dd55a3c51086bd00f79b
SHA512 3503dc15484d1c4355051bc95eaf1a9e3df6702e4d9f82bf7d6234dea52e8dd6c1fe2901513bd6474b48784a6bba757f045e6c547f958f168842a91b377e9291
TLSH
T1A3218627B39C8A21CC86163A009D9C10767683C7819ECF9F6BC4D624A0BF988CA21290
MD5 SHA1 SHA512 TLSH

Submit Download

u837503.dll

Path \??\c:\windows\system32\u837503.dll
Size 6.3MB
SHA256 306584094b93262bf1b762c4618dc2eaaa1424270885cc3dbbac3449a9f1341d
MD5 72c27fb0f345879da43775712cc1b5db
SHA1 56a357e2993291b08c45eb11c974f953fae43b56
SHA512 bb2b2b357b616e8f22db12adea916848ec0364aa70601c5bf65aed7cacda970db7a546a3ace379f461d324118e0eef58050786578e7bc980c9ecc94d5ab379e5
SSDEEP 98304:xvrNUAECosTVvvqSPKMOOyQe9zuoMyr++YeGmQ:xvBUAECosTVvvqSPKMOOyQe9zusr+Rv
TLSH
T174668CA9B6BC00A5D8AAC1BCC2975227D772B46553B057CF1A648AFD0F23BE0167F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlogz.dat

Path \??\c:\windows\system32\wsvcz\wlogz.dat
Size 32B
SHA256 a0780724f34cc880d1883f584247848ef33998f8cf042e5e4b06d20a5e2596ea
MD5 0aad5b73f7f58d472b888b23baeb292b
SHA1 17031d54dc8607f267ea61239bf975000cf91f9a
SHA512 16ab70903567f7a548b8be975602c8c4973e44f9ead69e52981371b648f53d4e81f51a4759abf023e393172b8db7c14a30d7d957d34f9dbe944d8f01114bf10c
MD5 SHA1 SHA512

Submit Download

memory/1900-28-0x00000159FF820000-0x00000159FF83C000-memory.dmp

Download

memory/1900-27-0x00000159FF7B0000-0x00000159FF7BA000-memory.dmp

Download

memory/1900-29-0x00000159FF7C0000-0x00000159FF7CA000-memory.dmp

Download

memory/1900-30-0x00000159FF840000-0x00000159FF85A000-memory.dmp

Download

memory/1900-31-0x0000015999BC0000-0x0000015999BC8000-memory.dmp

Download

memory/1900-32-0x0000015999DF0000-0x0000015999DF6000-memory.dmp

Download

memory/1900-33-0x00000159FF800000-0x00000159FF80A000-memory.dmp

Download

memory/1900-26-0x0000015999BF0000-0x0000015999CA5000-memory.dmp

Download

memory/1900-25-0x0000015999BD0000-0x0000015999BEC000-memory.dmp

Download

memory/1900-17-0x00000159FF7D0000-0x00000159FF7F2000-memory.dmp

Download

memory/1900-9-0x00000159983B0000-0x00000159983C0000-memory.dmp

Download