92548cc81fb889424b98c52025ea9d685cb163f05963f00d917d8dd1dda74dce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Size 12.2MB
Sample260808-dat68s1ycx
SHA256 92548cc81fb889424b98c52025ea9d685cb163f05963f00d917d8dd1dda74dce
MD5 bd44a6ddba3a99c792d5c7de5479d8eb
SHA1 b5ff49a93634aa5822e619b8aee856da66148e78
SHA512 e61498c2b6f5768ae16c34457a67b3431565dda3e3ce74b034a0689f0028e9efac860c8ab3cbe39a560e89999fb3fb056ee95d825ca16a75f2b83db4ff2e1402
SSDEEP 196608:rztrQjXc/sRV3QqZcRRvNDvmIxTH+vLjjXN9y:reXksL3Ry7vND+KTkvz
TLSH
T1BCD67C03EC6519E9C1AED230CAA292637B727C440B3667E71B50F6386F76BD0AD79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4952	heartbeat-agent.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1164	icacls.exe
4480	icacls.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
4952	heartbeat-agent.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1056	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4324	sc.exe
4548	sc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4488	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
1004	powershell.exe
1004	powershell.exe
4952	heartbeat-agent.exe
1056	powershell.exe
1056	powershell.exe
5000	powershell.exe
5000	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeTcbPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeShutdownPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: 33	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeSecurityPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeAssignPrimaryTokenPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeImpersonatePrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeLoadDriverPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeSystemtimePrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeSystemProfilePrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeProfSingleProcessPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeIncBasePriorityPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeCreatePagefilePrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeBackupPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeRestorePrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeTakeOwnershipPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeManageVolumePrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeChangeNotifyPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeUndockPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeCreateGlobalPrivilege	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: 34	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: 35	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeIncreaseQuotaPrivilege	1004	powershell.exe
Token: SeSecurityPrivilege	1004	powershell.exe
Token: SeTakeOwnershipPrivilege	1004	powershell.exe
Token: SeLoadDriverPrivilege	1004	powershell.exe
Token: SeSystemProfilePrivilege	1004	powershell.exe
Token: SeSystemtimePrivilege	1004	powershell.exe
Token: SeProfSingleProcessPrivilege	1004	powershell.exe
Token: SeIncBasePriorityPrivilege	1004	powershell.exe
Token: SeCreatePagefilePrivilege	1004	powershell.exe
Token: SeBackupPrivilege	1004	powershell.exe
Token: SeRestorePrivilege	1004	powershell.exe
Token: SeShutdownPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeSystemEnvironmentPrivilege	1004	powershell.exe
Token: SeRemoteShutdownPrivilege	1004	powershell.exe
Token: SeUndockPrivilege	1004	powershell.exe
Token: SeManageVolumePrivilege	1004	powershell.exe
Token: 33	1004	powershell.exe
Token: 34	1004	powershell.exe
Token: 35	1004	powershell.exe
Token: 36	1004	powershell.exe
Token: SeDebugPrivilege	4952	heartbeat-agent.exe
Token: SeTcbPrivilege	4952	heartbeat-agent.exe
Token: SeShutdownPrivilege	4952	heartbeat-agent.exe
Token: 33	4952	heartbeat-agent.exe
Token: SeSecurityPrivilege	4952	heartbeat-agent.exe
Token: SeAssignPrimaryTokenPrivilege	4952	heartbeat-agent.exe
Token: SeImpersonatePrivilege	4952	heartbeat-agent.exe
Token: SeLoadDriverPrivilege	4952	heartbeat-agent.exe
Token: SeSystemtimePrivilege	4952	heartbeat-agent.exe
Token: SeSystemProfilePrivilege	4952	heartbeat-agent.exe
Token: SeProfSingleProcessPrivilege	4952	heartbeat-agent.exe
Token: SeIncBasePriorityPrivilege	4952	heartbeat-agent.exe
Token: SeCreatePagefilePrivilege	4952	heartbeat-agent.exe
Token: SeBackupPrivilege	4952	heartbeat-agent.exe
Token: SeRestorePrivilege	4952	heartbeat-agent.exe
Token: SeTakeOwnershipPrivilege	4952	heartbeat-agent.exe
Token: SeManageVolumePrivilege	4952	heartbeat-agent.exe
Token: SeChangeNotifyPrivilege	4952	heartbeat-agent.exe
Token: SeUndockPrivilege	4952	heartbeat-agent.exe
Token: SeCreateGlobalPrivilege	4952	heartbeat-agent.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1164	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	87
PID 4112 wrote to memory of 4820	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	88
PID 4112 wrote to memory of 4324	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	90
PID 4112 wrote to memory of 1004	4112	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	91
PID 4952 wrote to memory of 4480	4952	heartbeat-agent.exe	95
PID 4952 wrote to memory of 1056	4952	heartbeat-agent.exe	97
PID 4952 wrote to memory of 4488	4952	heartbeat-agent.exe	99
PID 4952 wrote to memory of 4548	4952	heartbeat-agent.exe	100
PID 4952 wrote to memory of 5000	4952	heartbeat-agent.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\HeartbeatAgent /grant *S-1-5-32-545:(OI)(CI)M /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1164
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn HeartbeatAgent /f
  2⤵
  PID:4820
- C:\Windows\system32\sc.exe
  sc query HeartbeatAgent
  2⤵
  - Launches sc.exe
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAYwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtAAoAJABiAGkAbwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAKACQAYgBiACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBhAHMAZQBCAG8AYQByAGQACgAkAGYAaQBlAGwAZABzACAAPQAgAEAAKAAKACAAIAAkAGMAcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGMAcwAuAE0AbwBkAGUAbAAsAAoAIAAgACQAYgBpAG8AcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGIAaQBvAHMALgBWAGUAcgBzAGkAbwBuACwAIAAkAGIAaQBvAHMALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAsAAoAIAAgACQAYgBiAC4ATQBhAG4AdQBmAGEAYwB0AHUAcgBlAHIALAAgACQAYgBiAC4AUAByAG8AZAB1AGMAdAAKACkAIAAtAGoAbwBpAG4AIAAnAHwAJwAKACQAcwB2AGMAIAA9ACAAKABHAGUAdAAtAFMAZQByAHYAaQBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeACgAdgBtAHQAbwBvAGwAcwB8AFYAQgBvAHgAUwBlAHIAdgBpAGMAZQB8AFYAQgBvAHgARwB1AGUAcwB0AHwAdgBtAGgAZwBmAHMAfAB2AG0AbQBlAG0AYwB0AGwAfABjAGUAeABlAGMAcwB2AGMAKQAkACcAIAB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAE4AYQBtAGUAKQAgAC0AagBvAGkAbgAgACcALAAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAoACIARgBJAEUATABEAFMAOgAiACAAKwAgACQAZgBpAGUAbABkAHMAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAiAFMAVgBDADoAIgAgACsAIAAkAHMAdgBjACkACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1004

C:\ProgramData\HeartbeatAgent\heartbeat-agent.exe
C:\ProgramData\HeartbeatAgent\heartbeat-agent.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\HeartbeatAgent /grant *S-1-5-32-545:(OI)(CI)M /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"ProcessId=4112\" -ErrorAction SilentlyContinue).CommandLine"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Windows\system32\taskkill.exe
  taskkill /F /T /PID 4112
  2⤵
  - Kills process with taskkill
  PID:4488
- C:\Windows\system32\sc.exe
  sc query HeartbeatAgent
  2⤵
  - Launches sc.exe
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAYwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtAAoAJABiAGkAbwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAKACQAYgBiACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBhAHMAZQBCAG8AYQByAGQACgAkAGYAaQBlAGwAZABzACAAPQAgAEAAKAAKACAAIAAkAGMAcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGMAcwAuAE0AbwBkAGUAbAAsAAoAIAAgACQAYgBpAG8AcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGIAaQBvAHMALgBWAGUAcgBzAGkAbwBuACwAIAAkAGIAaQBvAHMALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAsAAoAIAAgACQAYgBiAC4ATQBhAG4AdQBmAGEAYwB0AHUAcgBlAHIALAAgACQAYgBiAC4AUAByAG8AZAB1AGMAdAAKACkAIAAtAGoAbwBpAG4AIAAnAHwAJwAKACQAcwB2AGMAIAA9ACAAKABHAGUAdAAtAFMAZQByAHYAaQBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeACgAdgBtAHQAbwBvAGwAcwB8AFYAQgBvAHgAUwBlAHIAdgBpAGMAZQB8AFYAQgBvAHgARwB1AGUAcwB0AHwAdgBtAGgAZwBmAHMAfAB2AG0AbQBlAG0AYwB0AGwAfABjAGUAeABlAGMAcwB2AGMAKQAkACcAIAB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAE4AYQBtAGUAKQAgAC0AagBvAGkAbgAgACcALAAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAoACIARgBJAEUATABEAFMAOgAiACAAKwAgACQAZgBpAGUAbABkAHMAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAiAFMAVgBDADoAIgAgACsAIAAkAHMAdgBjACkACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

heartbeat-agent.exe

Path C:\ProgramData\HeartbeatAgent\heartbeat-agent.exe
Size 12.2MB
SHA256 92548cc81fb889424b98c52025ea9d685cb163f05963f00d917d8dd1dda74dce
MD5 bd44a6ddba3a99c792d5c7de5479d8eb
SHA1 b5ff49a93634aa5822e619b8aee856da66148e78
SHA512 e61498c2b6f5768ae16c34457a67b3431565dda3e3ce74b034a0689f0028e9efac860c8ab3cbe39a560e89999fb3fb056ee95d825ca16a75f2b83db4ff2e1402
SSDEEP 196608:rztrQjXc/sRV3QqZcRRvNDvmIxTH+vLjjXN9y:reXksL3Ry7vND+KTkvz
TLSH
T1BCD67C03EC6519E9C1AED230CAA292637B727C440B3667E71B50F6386F76BD0AD79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heartbeat-agent.pid

Path C:\ProgramData\SysCache\heartbeat-agent.pid
Size 4B
SHA256 059f5e543bd484b00e235edc5083558c59d45706bd99c14422bda8868c6c6f90
MD5 fdeea652a89ec3e970d22a86698ac8c4
SHA1 5de64d5b6c8483c5583206f9b15e620115ad7691
SHA512 6bfb467f942a23900be9ae78f00d03a80d9ba4e13765fc62789f32ab413742e7752c308ec1a68d3fe6cad8efb19d7655c136f13ff7fbd89a73e929272ca64638
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 8d8ddf65c2b43712e4c74aad1583d73d1ef11b5362997861a9769946c7bc1412
MD5 7221e0d532a5abb24634e95594af9f0a
SHA1 ee6679e7db629d82ccaacb932a6c0c54d56c43e4
SHA512 3b816376233697135ae3b548033ee0ed65889bcf40a08f2dfebd50999a42f9c78f1e05f2a9156e42007b9df5c237355ffcba2a76fe4b1ead65058c831b5be3e8
TLSH
T1AE81EF313275E1D4C8567F07292819D063BF4396EA94AF4CB29C621EE92751B9B122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7c512b1d8a5cfbf253c68079e3ef2d87d00e6084264e6cb1b57c24f884dece59
MD5 f10ea8da32273b440df7648552a1075b
SHA1 92dc3df8467bd3e29d60ca9b077bc99409c59d7b
SHA512 7e9b584cff0c781165c524dcff16ee5eeb49ce83b7b484c4ca6b886b1c4b8e947fcb0638793e21075980e6b80b99541d40119165902d723c47ce710948479a26
TLSH
T14E217827B39C8921CCD9113A20AC9C1176B683DB809ECF9F6FC0D625A57FAD9CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5648fb5e2cdbd5294fa238e46c38650c94b3d8b53c8e7a772f588a98e96621aa
MD5 b58559288dd8dcb1f5bfaf42f614244f
SHA1 8c5c3f16c70153834fbf9fceefab8246221c4b37
SHA512 56a7fa593cb7649a64e78a4f6a2643e187d1caaf772b6cdcfbcdcef656da885eef34c6a73d10dc77ac6756b917a59003fdc2ae769e49c77414fd59dd93029d5f
TLSH
T1EF216527B39DD961CC85253A209CAC1172B683C7809ECF8F2EC0D224A57FAC8CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_to3gq1t5.huf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_to3gq1t5.huf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

heartbeat-agent.log

Path C:\Users\Admin\AppData\Local\Temp\heartbeat-agent.log
Size 814B
SHA256 9bb535c2fa0430a43e13f6cbd0319259e73d09fe857e11013fe6d2a62f69ed7b
MD5 f537a5f99e5409ed51d5340de9d9c851
SHA1 542b3166f0f5034fbb4208b222ea877f653f1b93
SHA512 cedb24715254a424c4576aae876cc7ddaa2dbb5dcc6a8f15fe01232d9e674f0b4047cc64af4a78399ae90074d4b247c171dc6db2756ff63f655cba38d140cbc4
TLSH
T1F401BD27162602F8BE364697DD070AD0FEE6FA0CF58D5196B0DD0E6FC6A340C2136CA9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-18-0x0000020E7C2F0000-0x0000020E7C314000-memory.dmp

Download

memory/1004-17-0x0000020E7C2F0000-0x0000020E7C31A000-memory.dmp

Download

memory/1004-14-0x0000020E7C190000-0x0000020E7C1B2000-memory.dmp

Download

memory/1004-8-0x0000020E63AE0000-0x0000020E63AF0000-memory.dmp

Download

memory/1004-7-0x0000020E63AE0000-0x0000020E63AF0000-memory.dmp

Download

memory/4112-1-0x000001656CD50000-0x000001656CD53000-memory.dmp

Download