c17b89ed1dd3009c064759bea9f30a3b8f9f2b48ca5b6b81501bfdc04b24d0fb

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.3MB
Sample260806-vxfe2abc24
SHA256 c17b89ed1dd3009c064759bea9f30a3b8f9f2b48ca5b6b81501bfdc04b24d0fb
MD5 3ad01fb6c3564f5f95b6b4a642805f90
SHA1 7b780defb50b0284c543116a1e09858c187d8a08
SHA512 bca3213c2fb9741ea69aed50bfd32fc2a2f731eb7ebdd71caae0c0a210d552480e64836094109cd419a1130bdfaac72c0671b871ba8417152cf0b9313395add9
SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfy:iMguj8Q4VfvmqFTrYi
TLSH
T116E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 7 IoCs

pid	Process
2080	chrome.exe
2176	chrome.exe
4736	GoogleService.exe
4132	MicrosoftEdgeUpdate.exe
4384	AdobeARM.exe
1640	AdobeARM.exe
748	smss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
660	cmd.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3332	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4740	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4792	powershell.exe
4928	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2688	cmd.exe
524	cmd.exe
4860	cmd.exe
4952	cmd.exe
1876	cmd.exe
3688	cmd.exe
4048	cmd.exe
4892	cmd.exe
1952	cmd.exe
1316	cmd.exe
1252	cmd.exe
4756	cmd.exe
928	cmd.exe
2608	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	GoogleService.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4828	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1528	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4792	powershell.exe
4792	powershell.exe
4928	powershell.exe
4928	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	tasklist.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	1548	WMIC.exe
Token: SeSecurityPrivilege	1548	WMIC.exe
Token: SeTakeOwnershipPrivilege	1548	WMIC.exe
Token: SeLoadDriverPrivilege	1548	WMIC.exe
Token: SeSystemProfilePrivilege	1548	WMIC.exe
Token: SeSystemtimePrivilege	1548	WMIC.exe
Token: SeProfSingleProcessPrivilege	1548	WMIC.exe
Token: SeIncBasePriorityPrivilege	1548	WMIC.exe
Token: SeCreatePagefilePrivilege	1548	WMIC.exe
Token: SeBackupPrivilege	1548	WMIC.exe
Token: SeRestorePrivilege	1548	WMIC.exe
Token: SeShutdownPrivilege	1548	WMIC.exe
Token: SeDebugPrivilege	1548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1548	WMIC.exe
Token: SeRemoteShutdownPrivilege	1548	WMIC.exe
Token: SeUndockPrivilege	1548	WMIC.exe
Token: SeManageVolumePrivilege	1548	WMIC.exe
Token: 33	1548	WMIC.exe
Token: 34	1548	WMIC.exe
Token: 35	1548	WMIC.exe
Token: 36	1548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1548	WMIC.exe
Token: SeSecurityPrivilege	1548	WMIC.exe
Token: SeTakeOwnershipPrivilege	1548	WMIC.exe
Token: SeLoadDriverPrivilege	1548	WMIC.exe
Token: SeSystemProfilePrivilege	1548	WMIC.exe
Token: SeSystemtimePrivilege	1548	WMIC.exe
Token: SeProfSingleProcessPrivilege	1548	WMIC.exe
Token: SeIncBasePriorityPrivilege	1548	WMIC.exe
Token: SeCreatePagefilePrivilege	1548	WMIC.exe
Token: SeBackupPrivilege	1548	WMIC.exe
Token: SeRestorePrivilege	1548	WMIC.exe
Token: SeShutdownPrivilege	1548	WMIC.exe
Token: SeDebugPrivilege	1548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1548	WMIC.exe
Token: SeRemoteShutdownPrivilege	1548	WMIC.exe
Token: SeUndockPrivilege	1548	WMIC.exe
Token: SeManageVolumePrivilege	1548	WMIC.exe
Token: 33	1548	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4892	4936	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	86
PID 4892 wrote to memory of 2608	4892	cmd.exe	88
PID 4936 wrote to memory of 660	4936	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 660 wrote to memory of 3308	660	cmd.exe	91
PID 4936 wrote to memory of 1952	4936	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	92
PID 1952 wrote to memory of 692	1952	cmd.exe	94
PID 4936 wrote to memory of 1316	4936	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	95
PID 1316 wrote to memory of 2464	1316	cmd.exe	97
PID 2080 wrote to memory of 2688	2080	chrome.exe	100
PID 2688 wrote to memory of 3332	2688	cmd.exe	102
PID 2688 wrote to memory of 3480	2688	cmd.exe	103
PID 4936 wrote to memory of 2176	4936	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	105
PID 2176 wrote to memory of 1252	2176	chrome.exe	106
PID 1252 wrote to memory of 4828	1252	cmd.exe	108
PID 2176 wrote to memory of 4736	2176	chrome.exe	109
PID 2176 wrote to memory of 1528	2176	chrome.exe	121
PID 2176 wrote to memory of 524	2176	chrome.exe	123
PID 2176 wrote to memory of 4860	2176	chrome.exe	125
PID 4860 wrote to memory of 4792	4860	cmd.exe	127
PID 2176 wrote to memory of 4952	2176	chrome.exe	128
PID 4952 wrote to memory of 1256	4952	cmd.exe	130
PID 2176 wrote to memory of 1876	2176	chrome.exe	131
PID 1876 wrote to memory of 4928	1876	cmd.exe	133
PID 2176 wrote to memory of 3544	2176	chrome.exe	134
PID 3544 wrote to memory of 3436	3544	csc.exe	136
PID 2176 wrote to memory of 4132	2176	chrome.exe	137
PID 2176 wrote to memory of 4756	2176	chrome.exe	139
PID 4756 wrote to memory of 1548	4756	cmd.exe	141
PID 2176 wrote to memory of 4740	2176	chrome.exe	142
PID 4740 wrote to memory of 212	4740	cmd.exe	144
PID 2176 wrote to memory of 928	2176	chrome.exe	146
PID 928 wrote to memory of 4876	928	cmd.exe	148
PID 2176 wrote to memory of 2372	2176	chrome.exe	149
PID 2372 wrote to memory of 1220	2372	csc.exe	151
PID 2176 wrote to memory of 4384	2176	chrome.exe	152
PID 2176 wrote to memory of 3688	2176	chrome.exe	154
PID 3688 wrote to memory of 1224	3688	cmd.exe	156
PID 2176 wrote to memory of 1668	2176	chrome.exe	157
PID 1668 wrote to memory of 60	1668	csc.exe	159
PID 2176 wrote to memory of 1640	2176	chrome.exe	160
PID 2176 wrote to memory of 4048	2176	chrome.exe	162
PID 4048 wrote to memory of 1964	4048	cmd.exe	164
PID 2176 wrote to memory of 1888	2176	chrome.exe	165
PID 1888 wrote to memory of 3828	1888	csc.exe	167
PID 2176 wrote to memory of 748	2176	chrome.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
212	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "AMDUSBTask" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "AMDUSBTask" /f
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "AMDUSBTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "AMDUSBTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "AMDUSBTask""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "AMDUSBTask"
    3⤵
    PID:2464
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SystemUpdate_acaiu1\GoogleService.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SystemUpdate_acaiu1\GoogleService.exe --SocksPort 9903 --DataDirectory C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SystemUpdate_acaiu1\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
    3⤵
    - Executes dropped EXE
    - System Time Discovery
    PID:4736
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Modifies registry key
    PID:1528
- - C:\Windows\system32\cmd.exe
    cmd /d /c vol C:
    3⤵
    - Executes a command shell one-liner
    PID:524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\system32\reg.exe
      reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
      4⤵
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb8bdba8c9.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1860.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8BD4FCEAF0064CB784CBB51C7D7D22EB.TMP"
      4⤵
      PID:3436
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
    C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\th8bdba8c9.jpg
    3⤵
    - Executes dropped EXE
    PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h "F:\.drvid""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\attrib.exe
      attrib +h "F:\.drvid"
      4⤵
      Views/modifies file attributes
      PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      PID:4876
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tbcc1db310.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E3C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFDB32A3AC981482C9A7F0B49D14A7CF.TMP"
      4⤵
      PID:1220
- - C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe
    C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\thcc1db310.jpg
    3⤵
    - Executes dropped EXE
    PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      PID:1224
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tba20bcbe4.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES447.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC98128F23522942698D1C1FA586611D5A.TMP"
      4⤵
      PID:60
- - C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe
    C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\tha20bcbe4.jpg
    3⤵
    - Executes dropped EXE
    PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      PID:1964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\smss.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tbc3e8bb8e.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7929.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB065802CBF41898D99B3FFC3EBE5E.TMP"
      4⤵
      PID:3828
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Users\Admin\AppData\Local\Temp\thc3e8bb8e.jpg
    3⤵
    - Executes dropped EXE
    PID:748

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 4936" 2>nul | find "4936""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 4936"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\system32\find.exe
    find "4936"
    3⤵
    PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AdobeARM.exe.log
Size 859B
SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
MD5 e204f3d12abd1691ce1f149399441188
SHA1 798042095539abfe857e456fca4e1035f67d29bf
SHA512 804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f
TLSH
T1E7116B70227AA1D889162F952C1E2BC403BF4336B650DE0C7998729EED364175F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fbd6b175b9e1ffc92c569a6467172b6f1cebd4b8cd2d3bbb5119e1b4856cfe50
MD5 c24e9d1123bd6a335730119e7399c481
SHA1 53e88f378e61191fd1b0213e0beac692297cc5c2
SHA512 3323e8e2d73cb4e986b25ccd7abfe350f5205f144999ffe01cf8e30e4eb6c6d68ac03b1f1a0c82e3d1ab292320e66c44263bcdf05e1c78b5953fa5bb5bf2a80d
TLSH
T18B71CF323375B0D4C8567F072A2819C063BF4396EA98AF0CB65C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 396693fd7971715ec8bacccc721e2a65c1c7ed14132acf0a05c4e21e2ce1eb66
MD5 168d1b2c6dfb7d51e4e6262c612d148c
SHA1 dd98306c96640cee1f216b1e016195bfa3c2c77b
SHA512 8bfe65c2ada037f69b1f85eaafcbf26d5ee7216cf293ac281c2c39c652adc150c9f00f13698fcd431ddf5466abc6a63f587706bbb1085a32edc5dd610b174b76
TLSH
T1B3218727B39DC961DCDA113A209DAC1176B6C3C7809ECF8F6BC4D224A47F6C4CB615A4
MD5 SHA1 SHA512 TLSH

Submit Download

.mid_06802c12

Path C:\Users\Admin\AppData\Local\Temp\.mid_06802c12
Size 36B
SHA256 69b2e63702a1038b34884bcb80f79e1dd4aa62df64219114c1dce2b6534fb6e3
MD5 ceaeae7f3aa2b229bf2d53b58595eaee
SHA1 82866c560032fba39a459462368103f511a38e64
SHA512 6f60f0e12d6e0e3e04d400b928273d787beb713d49832f2a5df2c5e739b68cb7b61458510c0359269b07595a63ee71142d99cff7f47c3720d207cbaa4de55396
MD5 SHA1 SHA512

Submit Download

.psvc_7927fa087ac5

Path C:\Users\Admin\AppData\Local\Temp\.psvc_7927fa087ac5
Size 275B
SHA256 cbeb07e4c356505d07c6e4b2575cb01bee78184274d55e58f36c224e77f41099
MD5 382a7b058ee0312a213f4de21078bbc5
SHA1 87d79d8a8804f1673d9357bb5e619ae4cd7d2bb5
SHA512 b6ca3b360fe7b67ace750fb0381f7932bac6ddacef10ec1c6187a7cb23cf05226965b1d86e2e868338214b48723347a4a3fde31261fb297ca595884e5683645c
TLSH
T186D02B389401DE2FFCA13E08526A6F0B34C9000730D45E1BDB404E489AD8198D02D4A3
MD5 SHA1 SHA512 TLSH

Submit Download

.winsvc_7927fa087ac5fdbd

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_7927fa087ac5fdbd
Size 4B
SHA256 206bc84a380b29acdc4257637b5d891f45ab8798d59906423c589de4552ef6b3
MD5 64a7157cf3932bf74755aa3cf586f2ec
SHA1 af35f31db4766616c1056d36b263ebf3246492da
SHA512 787c321a42309efa0e48cf3df49c095ad0f31d2f0bf43d1e81719def0295ad180baf949fa3c16598f20a964978d7893982067914a598aefddb4a72d7664fed85
MD5 SHA1 SHA512

Submit Download

.winsvc_7927fa087ac5fdbd

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_7927fa087ac5fdbd
Size 4B
SHA256 396b8e65a84afe48d62b470e74299638c2d9144bafba47b6027bf1b388010dbd
MD5 0234c510bc6d908b28c70ff313743079
SHA1 3ecc7d38bdca415a2256a20a563b7d618125ee35
SHA512 83d06c58c0dc224626376c268346c5b843412358f267805ddd216d533887433bbfe94352fd690fd1a80bfd9607ff77326c84ab9dfb3f25b44a781ca06af7af7b
MD5 SHA1 SHA512

Submit Download

AdobeARM.exe

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe
Size 5KB
SHA256 aeff464d56775bdba7d79fd59d7209c0ddef83c887e33644d05a2ddf3bff8bc5
MD5 f9de6e33537b4a03fffd3d3c091909db
SHA1 7966929986a6c18084fddf8c297b2c47aafa8ec8
SHA512 53bdad4a2a5e48b0cbc7e08f4b14c33f6d589aba78aeda864099bb2e8aad5b6736ad92ce67df0774ac554cb16f91ffefb07486c9b639459d647050e0a70a63da
SSDEEP 96:SQ85oRT9j5zdiDYZ+zqWlAYkYUj+viHKLzNt:zuoRTADC83AYkYUj+vHN
TLSH
T1EEB1B80963DC8625D4FB4F7539F3831127B4E6654A2A835E3CC4222EAE1AB600D677F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.exe
Size 5KB
SHA256 76059cdf05d3e4330b45cadd7fe6820124e2ade0807bb1c0aa5a2dfc9427d896
MD5 535ee1eb3f0edd41818c0aa0b64250c5
SHA1 a3331b32d71b0afa06aa694abeeb60b00d3dc03e
SHA512 04c07017e2a5cabae296a37b152f0779a2f0925225fa05b7dc35a63296bdfc124a41309bcb7bd96d7d1faf9bf5eaca6c3ce0c67a3460d3be854f0d0295cfe14a
SSDEEP 96:QQ85oRT9j5zdiDYZ+zqWlAYkYU2+viHKLzNt:luoRTADC83AYkYU2+vHN
TLSH
T10EB1B70963DC8629D4FB4F7539F3831123B4E6254A3A835E3CC4222EAE16B600D673F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
Size 5KB
SHA256 f9efe69191d7f1c3e073797e2bdd6e6ea8feac10c433427fb96247880d1e1b3f
MD5 1d3c42a4a29a1dcd6f01fcdd44043a11
SHA1 8f514ed944fb02826f6ab34c759980b7440ddb52
SHA512 debcea84c5b5271d4360bf4bb77c762db9d184626f8ac64f14ff83cc0f5f8116565d28e4735b1c70196168a54e6017a94a324aa133dce02ab9f719ae3aa35fc1
SSDEEP 96:Tkplw5oxT9jDa3ZPmVmt+zqWlAYkYUy+vzTVqzNt:HoxT52L83AYkYUy+vVM
TLSH
T166C1BA0557E8C536D4FA4F7478F7871133B8D2714A25DB5E2CC4222E5E26B5009673F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1860.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1860.tmp
Size 1KB
SHA256 851e8bfc019e907caa3f1df25b84757bf09f81e220883bbd2aed873ff4080829
MD5 3dbc0b507913dcc74551aa3b761df5ce
SHA1 bace205bddbf277f870c2cc4dd6bfa32c36a0117
SHA512 2c425a5f6a2dcbd795fea9d5b6e46f896f5e48e9ab9f5efc7240ea32e9e2cf035580144d1aba5e2f85f4d525a06fd15ac7ea9dcca20221c49f4719ce32f84879
TLSH
T13741440083E84B1EF172133119FB8B29B278FE55AE9A574EB084122E1E02B40CDC37B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES447.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES447.tmp
Size 1KB
SHA256 b722ba8fb380ed62c33244bb5e580382f1df2dae2e4e86e3ed76a750b1160ce3
MD5 2e9a2d12366a5476d80cc8e7e22fb1c0
SHA1 d6a50dd8033995130ce9029613f37a097f0e9fe9
SHA512 9a4bdbee68c1d7b5d4ce1e346bd6ec04563d051c05d4438a967fca48ff2578b2854c1c5253e03cbe9b42ba9ff607faa642201cacf003c15f0bee99a6d0a061a6
TLSH
T15841250483E88B1AE172473229F78729A374FD569EA9475DB484122E1E42740DDC3672
MD5 SHA1 SHA512 TLSH

Submit Download

RES7929.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7929.tmp
Size 1KB
SHA256 62e320d7c1e8c18c85de966c97274780f41db4256118b0423e639f6c3f2ec500
MD5 2ce91c482163645e26ffa903cb10ccaa
SHA1 77d6e1282c5377ca40612f72284df9ae81c5258e
SHA512 d400fc5ce75313dbd7c90d210685d654a5f5a2311a94b5d33f5da5cf228d223f2ccef0c4e837f13c7aab136f91ed88ff15373610273730027a0b79c22433ea6e
TLSH
T1DE41234083E88B1EF173473268F75719A678BE55AFAA475EB484123E1E02740DDD36B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES8E3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8E3C.tmp
Size 1KB
SHA256 68a072f320891940d03336df8068c2e6d0ca40cd005f5907033cba24a8985e74
MD5 76445a7f46710f0e1f85941fd70f9d01
SHA1 7d084ee460dd90670cafc8077c8032b9cd8bef69
SHA512 9186b5b5225a3ec8ad4b4ba7009bbc96fc292b12761076cadcfa4f1d87be837cebd5fb62a255966eaa4b96aba17b9b2ce4a5a77dadf161bdf00b6b9705ac8ebc
TLSH
T13741234483D88B1BE17247312EF78729A374FE59AFAA475EB484122E1F42740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_blmzf2rm.4yl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blmzf2rm.4yl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 5KB
SHA256 5eb85f440fbfd848c30488b1d6c304aca4e66c40cddcd4f3edcb9959c4963ced
MD5 355e9142b9e7fcc349a7a5a0189876df
SHA1 e9dca4bf6c69376879a1296eacdd2889f978281c
SHA512 3cd95975bc576bd63a1ff94a5eff2def77bc7746d36145f4926effc32f565336c8ba5d68d24888a87735c0f41c2b1eda56889b2b785bcf99fcd191800e9850f6
SSDEEP 96:AFwzw5oxT9jvQ+zqWlAYkYUUqL+v6cG6zNt:ASzCoxTNQ83AYkYUtL+vw8
TLSH
T11BB1A84A67DCC566D4EA4F7179F3831427B4E7614E2A872E3CC4222A9E26B6049623F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th8bdba8c9.jpg

Path C:\Users\Admin\AppData\Local\Temp\th8bdba8c9.jpg
Size 86KB
SHA256 7283f11411e8f91b211eb7bc7511d76349326a33647de88c0491a7557a9a34ab
MD5 8be48b531f28aa9aee7b06dc8bc8899c
SHA1 60765482642d4bc25c3f1531864c9e88906abc0b
SHA512 07355418228a84492f840cea50e1fc5bd8eea841c28ef0e4eabc5cfe1f57245f7ed934060e93451f760b89d8e731318558b174f1fc35eaa0c100d6de047a0ed2
SSDEEP 1536:UXN2hnAK+H2jKMXIBtJuW00jCTcWDtWPVrNudJ:WYhY4KMXIBLCTcWZWPVrcT
TLSH
T10A936303CD448B83A42887F9BE070EAD5F097B1CE5963AFF45664ECB3A212265D4F12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tha20bcbe4.jpg

Path C:\Users\Admin\AppData\Local\Temp\tha20bcbe4.jpg
Size 86KB
SHA256 d0b7d59d202cce426b18b9dc36a8ea158e2944591900de6d3199d9b7e3f1492b
MD5 23a36779606b2c503a62917561b66b83
SHA1 d142dc641043ff560e459f3e0a17a35a8ec066f8
SHA512 605692c5ba05bba5582157f548830c6c4ac121d3c7e8147ddd675257b7c9ea0ed8f3e697e4d25db25de913408c00d11399f3fe79d93c22dcae53f23d05493858
SSDEEP 1536:UXN2hnAK+H2jKMXIBtJuW00jCTcWDtWPVrNu3:WYhY4KMXIBLCTcWZWPVrc3
TLSH
T198937803CD048B83A47887E9BE070EAD5F097B1CE5963AFF45664ECB3A312265D4E16D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SystemUpdate_acaiu1\GoogleService.exe
Size 9.9MB
SHA256 5c204e004ec7f65ebe3a9bdc55170144a1067bf89a6712b87e0825a036e45ff8
MD5 e7a2dcb8517590998754000074ebe058
SHA1 a349c04514d14dea3ac435b05a6f33112d0a6ba8
SHA512 30b7dc2e768cac57c9b4620a0f03180c22aeda7857090d4bcfa3c113dbda87b89ca59c06310d8584a86fca8cb3cca3cd0c0b31e34c54c52ab07fc5f82c643b11
SSDEEP 98304:VDzqKjm8GE+CTH/SDnmdNB9YKdzCOmCl1dvv1wDKlE/z7j6kR++:xaKJSPwzXmo1dvaRR
TLSH
T1D9A62947F27710DDC5BAC17892177223F9A13C8C81346B6B5A8097622B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SystemUpdate_acaiu1\data\cached-microdesc-consensus.tmp
Size 3.5MB
SHA256 5cf2da4b3170daa9861ccd5529a3cdaa895fd557ae67454df9d96d06c8dfccf9
MD5 7bcf148956b868a67226471041fd1482
SHA1 c30ac29b5feeabb68cc3668889e3f8d1c497c96c
SHA512 6f7a5c9d2633ea8de287cb15ca73dbe93e543cd1774928892274447c407758e1b4430a720f6953e8d0617aba8c9f305ddf254e0d43c85f1c1a4898b466e38e09
SSDEEP 24576:3rW6nmbJuI9I3STt0qF36GbhHdgPUKduYkBGIxy6SlhV:7Cljrt0iZydX3
TLSH
T1E0F554EA97124EEAD32609DBE510FF7BF33F1725C2486B94296F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SystemUpdate_acaiu1\data\cached-microdescs.new
Size 7.4MB
SHA256 53d67ec86c050bb9942ddf0a7018b63dcdb7720b3efd8c12d9abb46bc73fb272
MD5 4b5b71ba3c4f590147f4404686bd8dce
SHA1 7b823b75176ccc576ff8294383e006a8e31e2612
SHA512 b5cf1bb2f081b7f9b4cc3ec4ae01e3e37c49e5716a36fdaf1b713fe45f4dd09c471542cd982ac4e581b913afcb1061a9017c4c76be07ad6522717ebfef9fc03f
SSDEEP 24576:t30VFsImiVfVFOVVmVlCQleFVhaqLVcbV9UZBKNVHVbAcDqZ7dFV4slYDV3lwtVq:Rr8X+raMNsAk
TLSH
T13D76AEDA899B04C14E05E7CDEC1607C3DB144B3E0A1441A1B6AAB5AB7F3329FC55EE39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.drvid

Path F:\.drvid
Size 13B
SHA256 629f5bea881546453311bbdb44a12dd9d44a13a5da7ad4511041bb42bfe7f1cd
MD5 18351e49ba8b92b39bd2c9022b1805ad
SHA1 3b5fe9096ff23ab3aa2f537f4e72b2db55adeae7
SHA512 2b6f4628343e59548c245ae5333c20aa5c878da2e3fb5d0f9e0dffdcdd42363b90a787fe4eda7e9db023ef5d332cb10859bd3710e497bf0eb1ca10e7db067430
MD5 SHA1 SHA512

Submit Download

CSC8BD4FCEAF0064CB784CBB51C7D7D22EB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8BD4FCEAF0064CB784CBB51C7D7D22EB.TMP
Size 1KB
SHA256 45c2b969883405f4b7862e96ead3c7255a4b79b554c77aac56e111c8064bae2b
MD5 c36e37603d4d80514ec132e128a35a89
SHA1 5d50170b6e3eddb394e51a88fbb989b86f58c352
SHA512 ea9ef0bc7b26697defd00017ea106d4d203775d21dee349a9d090a5591dc3a76d8753d70087cbf9248eec376c52cfd3d530dca8962cc18490d758aec2facc26f
TLSH
T1BF21CC41A3E8431EF1B347306AF5C762A16DBE669D7A83DC3488135F1F25A0084937B2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB065802CBF41898D99B3FFC3EBE5E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB065802CBF41898D99B3FFC3EBE5E.TMP
Size 1KB
SHA256 b4713f585dbd4185833afeb466a2fbaa5c9d17071f9de2a1f0dfeec01b346c01
MD5 70ebd87a449c83d0645ba22e10ab83e5
SHA1 5980251d5a46d81e6f48fe53ee04e87a28219015
SHA512 b44a0154a6c4b1f2af61046a0357b8018a5095262f0ec54e701f4bd46adcaad3e88bafe23567e49b845bd83578d0291bcff6a43351d6027ea02c9e1ead96ca66
TLSH
T13821AB85A3E8821EF2B34B7179F2C36292A8BE568D7E47EC7488175B1F25500C5936F1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFDB32A3AC981482C9A7F0B49D14A7CF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCFDB32A3AC981482C9A7F0B49D14A7CF.TMP
Size 1KB
SHA256 e16ab3c9980bc440d20325b37801350660717ca8684e314c42708713e754103e
MD5 2c9e3b045f8e4b90f86012789139cb3e
SHA1 d43ea3cbfaa9168d630a003a163591958f205abc
SHA512 7681e619e51cb288aa94ab87cd74ce0c39e9f978a5106a488eb8f2539ffcdd2ccb242607c2b43188ab54263c35ea996bfa29dc06bb0a9f4226a9c558526825dc
TLSH
T19A21AB45A3E8421EF2B347707AF2C363D2A8BE6A9D7A43EC7488175F2F155408583AB1
MD5 SHA1 SHA512 TLSH

Submit Download

tb8bdba8c9.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tb8bdba8c9.cs
Size 923B
SHA256 c6ff54dd3a703552310c280c739151a474f4b2cc4475b738209f27beda31b79c
MD5 0470fa83dca5ed81d6ffcd590762fcfa
SHA1 71122fb90564516ea5c4a534052bb9bdeb3de002
SHA512 8a828f118938422fbac1bee174c218cd83a5de2025d62edf97b7349b6c9a6f1d8b3aa44a0588179e6b34d02951d847b8f7924f945c2fe93bac44680fed9fee9b
TLSH
T1DD11147435AFC3896D631B222CDCD5850F39327032B56CEA9C5E85108A59D900B3CE34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-181-0x00000000009E0000-0x00000000009E8000-memory.dmp

Download

memory/1640-167-0x00000000008E0000-0x00000000008E8000-memory.dmp

Download

memory/4132-107-0x0000000000070000-0x0000000000078000-memory.dmp

Download

memory/4384-151-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Download

memory/4792-61-0x000001947D190000-0x000001947D1B2000-memory.dmp

Download

memory/4792-79-0x000001947E590000-0x000001947E5BA000-memory.dmp

Download

memory/4792-76-0x000001947E340000-0x000001947E35C000-memory.dmp

Download

memory/4792-77-0x000001947E360000-0x000001947E415000-memory.dmp

Download

memory/4792-78-0x000001947E330000-0x000001947E33A000-memory.dmp

Download

memory/4792-80-0x000001947E590000-0x000001947E5B4000-memory.dmp

Download