c17b89ed1dd3009c064759bea9f30a3b8f9f2b48ca5b6b81501bfdc04b24d0fb

Analysis

max time kernel
151s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.3MB
Sample260806-vxfe2abc24
SHA256 c17b89ed1dd3009c064759bea9f30a3b8f9f2b48ca5b6b81501bfdc04b24d0fb
MD5 3ad01fb6c3564f5f95b6b4a642805f90
SHA1 7b780defb50b0284c543116a1e09858c187d8a08
SHA512 bca3213c2fb9741ea69aed50bfd32fc2a2f731eb7ebdd71caae0c0a210d552480e64836094109cd419a1130bdfaac72c0671b871ba8417152cf0b9313395add9
SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfy:iMguj8Q4VfvmqFTrYi
TLSH
T116E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 7 IoCs

pid	Process
1056	chrome.exe
4624	LenovoConfig.exe
300	chrome.exe
5872	smss.exe
1940	IntelDriverUpdate.exe
2524	smss.exe
3120	services.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4812	cmd.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5732	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5656	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.exe
2920	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1504	cmd.exe
4428	cmd.exe
5964	cmd.exe
2448	cmd.exe
4136	cmd.exe
2648	cmd.exe
5852	cmd.exe
5236	cmd.exe
1980	cmd.exe
2172	cmd.exe
1696	cmd.exe
6140	cmd.exe
5956	cmd.exe
4508	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4624	LenovoConfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3360	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5080	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
2920	powershell.exe
2920	powershell.exe
2920	powershell.exe
5500	WMIC.exe
5500	WMIC.exe
5500	WMIC.exe
5500	WMIC.exe
4840	WMIC.exe
4840	WMIC.exe
4840	WMIC.exe
4840	WMIC.exe
256	WMIC.exe
256	WMIC.exe
256	WMIC.exe
256	WMIC.exe
6076	WMIC.exe
6076	WMIC.exe
6076	WMIC.exe
6076	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe
Token: 36	4480	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeIncreaseQuotaPrivilege	5500	WMIC.exe
Token: SeSecurityPrivilege	5500	WMIC.exe
Token: SeTakeOwnershipPrivilege	5500	WMIC.exe
Token: SeLoadDriverPrivilege	5500	WMIC.exe
Token: SeSystemProfilePrivilege	5500	WMIC.exe
Token: SeSystemtimePrivilege	5500	WMIC.exe
Token: SeProfSingleProcessPrivilege	5500	WMIC.exe
Token: SeIncBasePriorityPrivilege	5500	WMIC.exe
Token: SeCreatePagefilePrivilege	5500	WMIC.exe
Token: SeBackupPrivilege	5500	WMIC.exe
Token: SeRestorePrivilege	5500	WMIC.exe
Token: SeShutdownPrivilege	5500	WMIC.exe
Token: SeDebugPrivilege	5500	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5500	WMIC.exe
Token: SeRemoteShutdownPrivilege	5500	WMIC.exe
Token: SeUndockPrivilege	5500	WMIC.exe
Token: SeManageVolumePrivilege	5500	WMIC.exe
Token: 33	5500	WMIC.exe
Token: 34	5500	WMIC.exe
Token: 35	5500	WMIC.exe
Token: 36	5500	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5500	WMIC.exe
Token: SeSecurityPrivilege	5500	WMIC.exe
Token: SeTakeOwnershipPrivilege	5500	WMIC.exe
Token: SeLoadDriverPrivilege	5500	WMIC.exe
Token: SeSystemProfilePrivilege	5500	WMIC.exe
Token: SeSystemtimePrivilege	5500	WMIC.exe
Token: SeProfSingleProcessPrivilege	5500	WMIC.exe
Token: SeIncBasePriorityPrivilege	5500	WMIC.exe
Token: SeCreatePagefilePrivilege	5500	WMIC.exe
Token: SeBackupPrivilege	5500	WMIC.exe
Token: SeRestorePrivilege	5500	WMIC.exe
Token: SeShutdownPrivilege	5500	WMIC.exe
Token: SeDebugPrivilege	5500	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5500	WMIC.exe
Token: SeRemoteShutdownPrivilege	5500	WMIC.exe
Token: SeUndockPrivilege	5500	WMIC.exe
Token: SeManageVolumePrivilege	5500	WMIC.exe
Token: 33	5500	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2448	2824	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 2448 wrote to memory of 4136	2448	cmd.exe	91
PID 2824 wrote to memory of 4812	2824	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	92
PID 4812 wrote to memory of 4288	4812	cmd.exe	94
PID 2824 wrote to memory of 2648	2824	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	95
PID 2648 wrote to memory of 372	2648	cmd.exe	97
PID 2824 wrote to memory of 5852	2824	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 5852 wrote to memory of 1500	5852	cmd.exe	100
PID 1056 wrote to memory of 6140	1056	chrome.exe	103
PID 6140 wrote to memory of 3360	6140	cmd.exe	105
PID 1056 wrote to memory of 4624	1056	chrome.exe	107
PID 2824 wrote to memory of 300	2824	2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	109
PID 300 wrote to memory of 5236	300	chrome.exe	110
PID 5236 wrote to memory of 5732	5236	cmd.exe	112
PID 5236 wrote to memory of 3944	5236	cmd.exe	113
PID 1056 wrote to memory of 5080	1056	chrome.exe	115
PID 1056 wrote to memory of 5956	1056	chrome.exe	117
PID 1056 wrote to memory of 1980	1056	chrome.exe	119
PID 1980 wrote to memory of 4480	1980	cmd.exe	121
PID 1056 wrote to memory of 2172	1056	chrome.exe	122
PID 2172 wrote to memory of 3248	2172	cmd.exe	124
PID 1056 wrote to memory of 1696	1056	chrome.exe	125
PID 1696 wrote to memory of 2920	1696	cmd.exe	127
PID 1056 wrote to memory of 4664	1056	chrome.exe	128
PID 4664 wrote to memory of 3100	4664	csc.exe	130
PID 1056 wrote to memory of 5872	1056	chrome.exe	131
PID 1056 wrote to memory of 4508	1056	chrome.exe	133
PID 4508 wrote to memory of 5500	4508	cmd.exe	135
PID 1056 wrote to memory of 5656	1056	chrome.exe	136
PID 5656 wrote to memory of 3484	5656	cmd.exe	138
PID 1056 wrote to memory of 1504	1056	chrome.exe	139
PID 1504 wrote to memory of 4840	1504	cmd.exe	141
PID 1056 wrote to memory of 1116	1056	chrome.exe	142
PID 1116 wrote to memory of 252	1116	csc.exe	144
PID 1056 wrote to memory of 1940	1056	chrome.exe	145
PID 1056 wrote to memory of 4428	1056	chrome.exe	147
PID 4428 wrote to memory of 256	4428	cmd.exe	149
PID 1056 wrote to memory of 1540	1056	chrome.exe	150
PID 1540 wrote to memory of 4796	1540	csc.exe	152
PID 1056 wrote to memory of 2524	1056	chrome.exe	153
PID 1056 wrote to memory of 5964	1056	chrome.exe	155
PID 5964 wrote to memory of 6076	5964	cmd.exe	157
PID 1056 wrote to memory of 2600	1056	chrome.exe	158
PID 2600 wrote to memory of 5268	2600	csc.exe	160
PID 1056 wrote to memory of 3120	1056	chrome.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3484	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3ad01fb6c3564f5f95b6b4a642805f90_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "BroadcomGraphicsTask" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "BroadcomGraphicsTask" /f
    3⤵
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "BroadcomGraphicsTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BroadcomGraphicsTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "BroadcomGraphicsTask""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "BroadcomGraphicsTask"
    3⤵
    PID:1500
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 1056" 2>nul | find "1056""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 1056"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5732
  - - C:\Windows\system32\find.exe
      find "1056"
      4⤵
      PID:3944

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\AMDUpdate_xbjjdm\LenovoConfig.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\AMDUpdate_xbjjdm\LenovoConfig.exe --SocksPort 9223 --DataDirectory C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\AMDUpdate_xbjjdm\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
  2⤵
  - Executes dropped EXE
  - System Time Discovery
  PID:4624
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5080
- C:\Windows\system32\cmd.exe
  cmd /d /c vol C:
  2⤵
  - Executes a command shell one-liner
  PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\reg.exe
    reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\smss.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb4b7b0be9.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC600C27E5AF4149C09937570A2F1C94.TMP"
    3⤵
    PID:3100
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Users\Admin\AppData\Local\Temp\th4b7b0be9.jpg
  2⤵
  - Executes dropped EXE
  PID:5872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "F:\.drvid""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\system32\attrib.exe
    attrib +h "F:\.drvid"
    3⤵
    - Views/modifies file attributes
    PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb74c044ed.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES805D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBA9A2EF21F5D4DC6947CF3B01CA5F3E8.TMP"
    3⤵
    PID:252
- C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe C:\Users\Admin\AppData\Local\Temp\th74c044ed.jpg
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\smss.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb309a2d9c.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF56D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC126FC972744446A39AB4B3187F64BE9C.TMP"
    3⤵
    PID:4796
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Users\Admin\AppData\Local\Temp\th309a2d9c.jpg
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get DeviceID,DriveType /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\services.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb817adb2a.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6ADC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5E62BB6029614A6B8C282514315FE82D.TMP"
    3⤵
    PID:5268
- C:\Users\Admin\AppData\Local\Temp\services.exe
  C:\Users\Admin\AppData\Local\Temp\services.exe C:\Users\Admin\AppData\Local\Temp\th817adb2a.jpg
  2⤵
  - Executes dropped EXE
  PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

.mid_787dd580

Path C:\Users\Admin\AppData\Local\Temp\.mid_787dd580
Size 36B
SHA256 0405567498b41389e903f481ab82fb7f41f08d9025bb05b9fca89d9499b2e6c2
MD5 f174ac26b74c01e708d37d5f564bca10
SHA1 593c0ad1853fc28b5b6e7e83a35565830362ce38
SHA512 0d594aa5ff3891f43ae90a1651f2e26193ae36115f6fa049d1c16e54be3ad68c7e2a818c958689ccf203921dc1be8bb1d1c345492f28d4d1e5efbcdf0bc1d0ce
MD5 SHA1 SHA512

Submit Download

.psvc_2b3016839405

Path C:\Users\Admin\AppData\Local\Temp\.psvc_2b3016839405
Size 285B
SHA256 c1ba37bdad45f371824d65343ac8fd7d5fecef82f784a44baa1404de730a1b32
MD5 c67a4d7403c4e5bd91c1085a929d9dfd
SHA1 0164ae4015e1ab3f17f43ecf027d927350b61b3a
SHA512 a30217054217990abdc18a62c437a7654db7d70b99a2fccff006775644c908a376814199fbc9a1f5276a69cc0be216b6c5e8ea60936e64a640a8a87a4eb2b1ad
TLSH
T1CAD02B28D401EE3FFC912E08976A6F0B31C9000731D49E1F9A008E8CCADC174E42D4A3
MD5 SHA1 SHA512 TLSH

Submit Download

.winsvc_2b3016839405ccfb

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_2b3016839405ccfb
Size 4B
SHA256 e8c5e943ad4fd9d115c2baacd110acddee7f66ec24aa177efa6780f5641ce277
MD5 4ca82782c5372a547c104929f03fe7a9
SHA1 99d746fce4f09b8397f84131b830a865ab4308e1
SHA512 4e426137006b31ffeeb27deb9fa21431a8f16177df760304714cb551da7aba7da96189e5d746026ee312f199eef5991fec657dbf1c03049050187b6964b9c854
MD5 SHA1 SHA512

Submit Download

IntelDriverUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\IntelDriverUpdate.exe
Size 5KB
SHA256 1e4718cb6291bfa90bdd219857e9c0c80d03eb5c9eed491db38971685cf8294d
MD5 17b63f7dac9dbae31de29d3f1ced3a5e
SHA1 38c57cdaccb67a64a4ee6afe89789e905a84f05f
SHA512 ccfe916a824339a4de2e8b070f3af514b74c238542959d667962da6db8e0835340089cb89e44985cba922163232018283525ba5f46c0baca476996cb9f0ddbc3
SSDEEP 96:Dy5oZT9jiQH8J+zqWlAYkYU3+v/gfBzNt:DkoZTMJ83AYkYU3+vQD
TLSH
T14DC1A90A67E9C276D4DA4F7479F3871123B8E2614A6B935E3CC4211E9F26B6009673E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6ADC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6ADC.tmp
Size 1KB
SHA256 5d19922fa19d4ab0cf9fe7c23e46165c65c6b8281faad51db9ed4859aeba55e4
MD5 2d116f68d2dd4e9c7ff8c6edd2738857
SHA1 5810267711e50cc1243814de0cc3cd2724466a98
SHA512 f6a2f9a314863c0f53f3139aaec62380445383f2e7ca30f3aceea79084acd9686e730d72180ff0e584fb2ea209fb490b350e8245aaa0e20b05caa5d2c617d061
TLSH
T18441534083DC8B1AF1724B3129FB5716A778BD669FAA435DB084123F5E06784DDD32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RES805D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES805D.tmp
Size 1KB
SHA256 b3f468494fa6b37576392aee1b6a622df4290e9c5e437fe0fa574e391e5f8867
MD5 9ae1a8154c02635d17f4b675488a95fe
SHA1 c6e26db70c9ebd413cc7449c8110b09ff238edc4
SHA512 d189244a2369d6446374eb67537737f097a0cbb93770f89412c6b92f04b21d4a41405d287407b7237e7e4365a8d5a95be264ba29e466035934e88aadf5d3a000
TLSH
T1FB413341D3D8471AF172473028FB5726A278FE65AEAA879E7484122F5E12740DDD32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RESB7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB7B.tmp
Size 1KB
SHA256 dcff83ee13011a22f5eb5615112c23bedc7adc64db5e36391b2259c824fdde77
MD5 156795db096400fdc0559ee3282c9742
SHA1 2b12fd8179ab6b2999210fc8d41af27bc7849884
SHA512 4406ccfca2a6d5cd51f97a8c5d2612f74ad7805e42becaa91ade33fe7a2fee325ede0d0cdcb76421b8953b309d80b9ad7170872b2100a4889cfed06e567b6ae5
TLSH
T10841454183D88B1EF172473129F79719A778BE669EAF476EB084122F1E02740CDD32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RESF56D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF56D.tmp
Size 1KB
SHA256 109d3c69a2afbcca656daee476de4a3cfa4afe57212472d67786bd7b9a53669f
MD5 9ae360529019070e8bcfec4c6a125fab
SHA1 d9f5ec9842ad4f821915515ddde3bf5fbcae134e
SHA512 741b32ee12a470960c0ebdd2696e6ecefea34d7a0ecc6c9701c4e45c675e15c39959fd555d1c9cc16f76722bb872d08524eadafa98329bb52076930b8e49c7eb
TLSH
T1EC41314083D8461BF1724B3229FB5715A778BE659E9E479D7084122F1E02740DDD32B1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1dragveb.x4e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1dragveb.x4e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

services.exe

Path C:\Users\Admin\AppData\Local\Temp\services.exe
Size 5KB
SHA256 b29232f228a44cbf65a9afdb748fe4c209566d42f31b7d0cddc2a0a4b357abe0
MD5 f8ed780a9bea65d7224a8fa67f8500d3
SHA1 884113a9b017b6a10c34332b202c847cc29525d9
SHA512 d66f17d1a0009ab593733f8ca0796b614025c3bd30002aad30d85e9370a35ac6f5dae70a432f3d6fb86174952f951a21b1a853797c33dc0d668b679899840eee
SSDEEP 96:AFQ85oRT9j5zdiDY9+zqWlAYkYU3H+viQKCzNt:ACuoRTADe83AYkYU3+vAk
TLSH
T1CAB1964967D88629D4FB4F7039F3821127B4E6614E2A975E3CC4222EAE1AB600D763F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 5KB
SHA256 b1c80fdaec2b9b7a3f353e688794b7fd84876ecb227dce89c01c484faa1f6774
MD5 d3215aed503346543f00f1278483ae75
SHA1 2ffbcfcf128a942081796b7b4938af2c9dfb90cd
SHA512 f7eafec3198f5fa138c7f9b30e5cafeae77951051321f4c595beb3e778ce57ce054a92362ff691e57ccd86b6949bc147f6b7fc8317d6345a36146e048e6531ad
SSDEEP 96:T/wzw5oxT9jvQ+zqWlAYkYUK+v6cG6zNt:8zCoxTNQ83AYkYUK+vw8
TLSH
T1D6B1B80A67DCC566D4EA4F7179F3871417B4E7614E2A872E3CC4222A9E26B6049623F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 5KB
SHA256 15681c9d1ff1a8aa68e82f5abf9b7c9896b3494e2f4d7148257162eb3f2c4300
MD5 7417b973923a541bd671e1417ccaa217
SHA1 81bf465e25e9b4abe03bfc73b3c864d2cef16c84
SHA512 36e9fe8a3ba1a08ff396601b115d0d76a59958d83925b43a2754d14b572645805c562f2f95424edc1cc5e2bb68c49179e4e0bbf227f4520d3b56765e730d48a3
SSDEEP 96:Swzw5oxT9jvQ+zqWlAYkYUlo+v6cG6zNt:zzCoxTNQ83AYkYUC+vw8
TLSH
T1ADB1B90A67DCC566D4EB4F7179F3831417B4E7614E2A872E3CC4222A9E26F6049623F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th309a2d9c.jpg

Path C:\Users\Admin\AppData\Local\Temp\th309a2d9c.jpg
Size 96KB
SHA256 dad574c705eb0d7ea6059892144a9453a403031057797a22698f186430da9978
MD5 13b2940c3d385cd2c6172b4bb7c61bbe
SHA1 9c9e01665c6e958630bbcc1a95cde0602e70d7cb
SHA512 6724ba54459d20cc59182a7f532eb9ab48c8be5252bab6dad54a9f246f5830cdfd25869c4d2720cb3af50fb82c34c80378b158da76e8a90d83823c6e845a0f1c
SSDEEP 1536:UAi/YvaRyh/zRopnRkceojz19fS72SVnPlb1QwPtkkIPhBE4qtvPOHJypKDMh6:u3GLupnRhv19fYv1QetkrQ4evgJyIAh6
TLSH
T10CA346039C589B839419D3E8BF074DAD2F566B1DE8867AFF11624EDB3F502220C9E15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th4b7b0be9.jpg

Path C:\Users\Admin\AppData\Local\Temp\th4b7b0be9.jpg
Size 96KB
SHA256 aed3b9e034461413a9581fd44191c8ff89fd0637dd55602a839b35668bab3fbb
MD5 509aa5f3c26b64b68d57ffee59f86e14
SHA1 964dff4937b3d588c38ee84cc450df60da23ed76
SHA512 64bae5e03ed413feed084bfee0311444025c77758d8e8d376a1e323c00cd1f16df020315d90a27868e6dc5999fe28adf958a05e9a8651cc20f15e2a67d4c589e
SSDEEP 1536:UAi/YvaRyh/zRopnRkceojz19fS72SVnPlb1QwPtkkIPhBE4qtvPOHJypKDk:u3GLupnRhv19fYv1QetkrQ4evgJyIQ
TLSH
T161A334039C589B839419D3E8BF074DAD2F5A6B1DE8857AFF11624EDB3F502220C9E15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LenovoConfig.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\AMDUpdate_xbjjdm\LenovoConfig.exe
Size 9.9MB
SHA256 5c204e004ec7f65ebe3a9bdc55170144a1067bf89a6712b87e0825a036e45ff8
MD5 e7a2dcb8517590998754000074ebe058
SHA1 a349c04514d14dea3ac435b05a6f33112d0a6ba8
SHA512 30b7dc2e768cac57c9b4620a0f03180c22aeda7857090d4bcfa3c113dbda87b89ca59c06310d8584a86fca8cb3cca3cd0c0b31e34c54c52ab07fc5f82c643b11
SSDEEP 98304:VDzqKjm8GE+CTH/SDnmdNB9YKdzCOmCl1dvv1wDKlE/z7j6kR++:xaKJSPwzXmo1dvaRR
TLSH
T1D9A62947F27710DDC5BAC17892177223F9A13C8C81346B6B5A8097622B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\AMDUpdate_xbjjdm\data\cached-microdesc-consensus
Size 3.5MB
SHA256 e88dd10e932038c7bb63d9a9faba8137245ecd56483ab3c09feecc92360436cb
MD5 f5a74f17ab5f556621f7a6dcdb58103a
SHA1 41c4347508c38095c29fb82a81f802cab6786c4a
SHA512 b5d799ae7565176015e2a142eab22bbef63e441f86b3c98bc0eb6b66c43453742886b40f0bcde4cfcb6eecf5027ac1d9334383456f112fa3845162b069f8617e
SSDEEP 24576:aFHC8pb6IdB/JixkT6uYVEBOz2RtUGGtoZwf4Zh42pxk:ehOMqkTnoIGGg
TLSH
T188F554EA97124EEAD32609DBE510FF7BF33F1725C2486B94296F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\AMDUpdate_xbjjdm\data\cached-microdescs.new
Size 15.0MB
SHA256 110ab86f5abd66e5d33d1aab683a2e71a90a48ea9aae2571af81bd8a5c8e0962
MD5 3ab85f82be4b90f978e25010d85c56af
SHA1 5cf6f1edf79c63b2b59f4497321310b9b802be7d
SHA512 a86fe46f8d5ebdc78adf249897c40974d4f3411eb28d236d8b295a561c631e02199077855e1ce9cf862711d9cf199d72f675dd3f9848f961664fd78ecaf72cda
SSDEEP 24576:93bV1EBaV73Q08C4n0VJwVAKV4vIxUVFVZ3VpVB46nHTV5VG6N2hGsVrVE4akhB1:eWCaGf6bc0nmp
TLSH
T15EF6AEDA899B00C14E05E7CDEC2607C3DF144B3E0A5441A176AAB5AB7F3329EC65EE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.drvid

Path F:\.drvid
Size 13B
SHA256 3af9ffcfa1c00350c786d9104bd2a3db84b949329e651bda17aa78b88a0cddc1
MD5 befabab24bb42f9c0a11728b0efd2506
SHA1 a8bf706b740adfbc9c0c9fc68216213c35549026
SHA512 107d5f7c775653c5a90feb9b5237b3f008424481303f88e514b1583f969fb61238dff975367d3306121f104f560e942cef0c2a2d3ec4a1ecc371bfcb320dc65a
MD5 SHA1 SHA512

Submit Download

CSC5E62BB6029614A6B8C282514315FE82D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC5E62BB6029614A6B8C282514315FE82D.TMP
Size 1KB
SHA256 1367fb29f1eed5f5360fc57d0f73955ab54997791757fde595e53df3df43dac7
MD5 780929fe2feb53fb270143ab0691854b
SHA1 be3e8b5c1d5a2897e95e7d00420b738c3bc311b4
SHA512 7c30065be290afb2351786dd8900fd128dd822592d8c73959f0eb1ee633fef3e140f7ed5b54b16c747d7410b3486bc798136224b5ad923bad4fdf491e97ee272
TLSH
T17521AB85A3E8461EF2B34B7079F2836391A8BE668D7E43EC7488175F2F25940C5936B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC600C27E5AF4149C09937570A2F1C94.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC600C27E5AF4149C09937570A2F1C94.TMP
Size 1KB
SHA256 b4713f585dbd4185833afeb466a2fbaa5c9d17071f9de2a1f0dfeec01b346c01
MD5 70ebd87a449c83d0645ba22e10ab83e5
SHA1 5980251d5a46d81e6f48fe53ee04e87a28219015
SHA512 b44a0154a6c4b1f2af61046a0357b8018a5095262f0ec54e701f4bd46adcaad3e88bafe23567e49b845bd83578d0291bcff6a43351d6027ea02c9e1ead96ca66
TLSH
T13821AB85A3E8821EF2B34B7179F2C36292A8BE568D7E47EC7488175B1F25500C5936F1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBA9A2EF21F5D4DC6947CF3B01CA5F3E8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCBA9A2EF21F5D4DC6947CF3B01CA5F3E8.TMP
Size 1KB
SHA256 7d9a43fa66ace9d5ead09484f0c94c66eabebf74c98d849ddaa61a680ef69ecf
MD5 94b65e640238b08ffbba02d41effd53a
SHA1 26027a912d14a818935beaaa689e13f77384e46e
SHA512 d5bdb6b7c3ea583d4f17b313fe9565a46c0cf075e1c692fd1c4d82a8b2864b37bd9e50f5f488e0378ab80e15c0c3c0f428021f3a18b4e0d207496ce76525820c
TLSH
T1DC21CC85A3E8421AF2F3473079F5D363916CBE669DBA83DC3488135F1F25A408493AB1
MD5 SHA1 SHA512 TLSH

Submit Download

tb4b7b0be9.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tb4b7b0be9.cs
Size 923B
SHA256 c6ff54dd3a703552310c280c739151a474f4b2cc4475b738209f27beda31b79c
MD5 0470fa83dca5ed81d6ffcd590762fcfa
SHA1 71122fb90564516ea5c4a534052bb9bdeb3de002
SHA512 8a828f118938422fbac1bee174c218cd83a5de2025d62edf97b7349b6c9a6f1d8b3aa44a0588179e6b34d02951d847b8f7924f945c2fe93bac44680fed9fee9b
TLSH
T1DD11147435AFC3896D631B222CDCD5850F39327032B56CEA9C5E85108A59D900B3CE34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1940-104-0x0000000000680000-0x0000000000688000-memory.dmp

Download

memory/2524-118-0x0000000000120000-0x0000000000128000-memory.dmp

Download

memory/3120-132-0x0000000000C90000-0x0000000000C98000-memory.dmp

Download

memory/4480-61-0x000001C4B6200000-0x000001C4B6224000-memory.dmp

Download

memory/4480-60-0x000001C4B6200000-0x000001C4B622A000-memory.dmp

Download

memory/4480-59-0x000001C4B61C0000-0x000001C4B61CA000-memory.dmp

Download

memory/4480-58-0x000001C4B6100000-0x000001C4B61B2000-memory.dmp

Download

memory/4480-57-0x000001C4B60E0000-0x000001C4B60FE000-memory.dmp

Download

memory/4480-54-0x000001C4B6080000-0x000001C4B60A2000-memory.dmp

Download

memory/5872-78-0x0000000000310000-0x0000000000318000-memory.dmp

Download