Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 16:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
- Size 95.0MB
- Sample260804-thp59athkf
- SHA256 e26e3191735b4def623a6e720a232abf195b71f0644e6be5ebb0a1eaa6285cad
- MD5 40ad7664a00d63db4247ce564a8b9e26
- SHA1 9cbc974cce85f4c5c6d7c9dee28c36a5b943ef40
- SHA512 f42b5995fd1fb9f32218f00807b79521b6fc4632ae983e5b09a63669dd5c69150f1d46e4063755bc2a4f1b6bea614ba72fb37943b2c2a0c359795cd8f3286723
- SSDEEP 393216:13pr0gjHmFbXCDG/E+3xYeVQNCdejDj2JbIqkuQsFoHpeiKARQlt2zMpzZmPXmtR:1SAFTJrgY+trrPulBQqRJ27
- TLSH T116286B4267EA0585F9F7DA358AF64617C673BC466B3086CF214C0B2A1F736E08D76B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to get system information.
pid Process 3604 powershell.exe 5128 powershell.exe 2872 powershell.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5432 tasklist.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1400 cmd.exe 4100 cmd.exe 5872 cmd.exe 3544 cmd.exe 5904 cmd.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2872 powershell.exe 2872 powershell.exe 3604 powershell.exe 3604 powershell.exe 5128 powershell.exe 5128 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2872 powershell.exe Token: SeIncreaseQuotaPrivilege 2872 powershell.exe Token: SeSecurityPrivilege 2872 powershell.exe Token: SeTakeOwnershipPrivilege 2872 powershell.exe Token: SeLoadDriverPrivilege 2872 powershell.exe Token: SeSystemProfilePrivilege 2872 powershell.exe Token: SeSystemtimePrivilege 2872 powershell.exe Token: SeProfSingleProcessPrivilege 2872 powershell.exe Token: SeIncBasePriorityPrivilege 2872 powershell.exe Token: SeCreatePagefilePrivilege 2872 powershell.exe Token: SeBackupPrivilege 2872 powershell.exe Token: SeRestorePrivilege 2872 powershell.exe Token: SeShutdownPrivilege 2872 powershell.exe Token: SeDebugPrivilege 2872 powershell.exe Token: SeSystemEnvironmentPrivilege 2872 powershell.exe Token: SeRemoteShutdownPrivilege 2872 powershell.exe Token: SeUndockPrivilege 2872 powershell.exe Token: SeManageVolumePrivilege 2872 powershell.exe Token: 33 2872 powershell.exe Token: 34 2872 powershell.exe Token: 35 2872 powershell.exe Token: 36 2872 powershell.exe Token: SeDebugPrivilege 3604 powershell.exe Token: SeIncreaseQuotaPrivilege 3604 powershell.exe Token: SeSecurityPrivilege 3604 powershell.exe Token: SeTakeOwnershipPrivilege 3604 powershell.exe Token: SeLoadDriverPrivilege 3604 powershell.exe Token: SeSystemProfilePrivilege 3604 powershell.exe Token: SeSystemtimePrivilege 3604 powershell.exe Token: SeProfSingleProcessPrivilege 3604 powershell.exe Token: SeIncBasePriorityPrivilege 3604 powershell.exe Token: SeCreatePagefilePrivilege 3604 powershell.exe Token: SeBackupPrivilege 3604 powershell.exe Token: SeRestorePrivilege 3604 powershell.exe Token: SeShutdownPrivilege 3604 powershell.exe Token: SeDebugPrivilege 3604 powershell.exe Token: SeSystemEnvironmentPrivilege 3604 powershell.exe Token: SeRemoteShutdownPrivilege 3604 powershell.exe Token: SeUndockPrivilege 3604 powershell.exe Token: SeManageVolumePrivilege 3604 powershell.exe Token: 33 3604 powershell.exe Token: 34 3604 powershell.exe Token: 35 3604 powershell.exe Token: 36 3604 powershell.exe Token: SeDebugPrivilege 5128 powershell.exe Token: SeIncreaseQuotaPrivilege 5128 powershell.exe Token: SeSecurityPrivilege 5128 powershell.exe Token: SeTakeOwnershipPrivilege 5128 powershell.exe Token: SeLoadDriverPrivilege 5128 powershell.exe Token: SeSystemProfilePrivilege 5128 powershell.exe Token: SeSystemtimePrivilege 5128 powershell.exe Token: SeProfSingleProcessPrivilege 5128 powershell.exe Token: SeIncBasePriorityPrivilege 5128 powershell.exe Token: SeCreatePagefilePrivilege 5128 powershell.exe Token: SeBackupPrivilege 5128 powershell.exe Token: SeRestorePrivilege 5128 powershell.exe Token: SeShutdownPrivilege 5128 powershell.exe Token: SeDebugPrivilege 5128 powershell.exe Token: SeSystemEnvironmentPrivilege 5128 powershell.exe Token: SeRemoteShutdownPrivilege 5128 powershell.exe Token: SeUndockPrivilege 5128 powershell.exe Token: SeManageVolumePrivilege 5128 powershell.exe Token: 33 5128 powershell.exe Token: 34 5128 powershell.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5104 wrote to memory of 5872 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 89 PID 5872 wrote to memory of 2676 5872 cmd.exe 91 PID 5104 wrote to memory of 3544 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 94 PID 3544 wrote to memory of 2872 3544 cmd.exe 96 PID 5104 wrote to memory of 5904 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 97 PID 5904 wrote to memory of 3604 5904 cmd.exe 99 PID 5104 wrote to memory of 1400 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 100 PID 1400 wrote to memory of 5128 1400 cmd.exe 102 PID 5104 wrote to memory of 4100 5104 2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 103 PID 4100 wrote to memory of 5432 4100 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "getmac"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\system32\getmac.exegetmac3⤵PID:2676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5432
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 eb33ee8b512a069e5e29224afda7761c8c118c9adb8238bcd0d67442d4ab1b4a
- MD5 9e290076bc17e72acac9badcf8d49680
- SHA1 81be079aa5888f43910705f413af30bec6fb170a
- SHA512 d7dc5f5c670de9ab8776b328713309ae335166f883d57c4e5cdde455e1f6f6c8a2643ce2767058c3a6ef74290c7b369ac1d14cdd7e17b47e8ca940fb902c714c
- TLSH T136219837B3DC8214CC99003A10DDAC1036B6C7DB40DECF9B6B85E259A82F298CF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 88f91118da5200d18f5b4cfd350ceae57b49f0f18702dd2f90adb4fc25e4b664
- MD5 e0cc33c16c1d38cde3fc61615dea153d
- SHA1 a439a2c55e57e431717e006e2b4c5d66fe208aa7
- SHA512 66be0f5077fbaef41fc2e79ffd14728b1ff00cb04e2c0f4e7bcd3830f723c0d0fdb340db3f445029339a486d1b275e38c2dacc3f48ea87beba3a2b5f3cc58fe1
- TLSH T1D1217633B3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_5104\api-ms-win-core-_primn.node
- Size 134KB
- SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
- MD5 5dc8861862329b3b4122314922be3ed9
- SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
- SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
- SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
- TLSH T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_5104\api-ms-win-core-ffi_na.node
- Size 588KB
- SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
- MD5 d1f6e50334a50a3f1f8e35e02d788ad9
- SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
- SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
- SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
- TLSH T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_5104\api-ms-win-core-koffi_.node
- Size 2.3MB
- SHA256 a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490
- MD5 ebe3666be392b02383d411e846317b76
- SHA1 69a87af1f3e7175ef6f681f419d0d18f35038195
- SHA512 b473fd70c1b874a8b400283110de077dde62cd3bc5dc7a50334f1b62b3c1d5e07e8a3aee63db14b12aa5f7c3ff495cf21411ff61c6433462698eec743c9a1ff4
- SSDEEP 24576:QIURRJEkuyU3d7pJP2JJ4Gvop6geUTnefOE:QIURJETyUN7ph2JKwFJ
- TLSH T125B5DE064758C8E9D83EB072B4176776E56A221B083D62DF04F48D61082ABFD5DAFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_5104\api-ms-win-core-ref_na.node
- Size 579KB
- SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
- MD5 153a5d422243f7f95721f6c2c5de8c9d
- SHA1 b0f73501859500acd1eccbff3d790abb610511ef
- SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
- SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
- TLSH T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_5104\api-ms-win-core-sqlite.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxudplpo.jk2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH