92548cc81fb889424b98c52025ea9d685cb163f05963f00d917d8dd1dda74dce

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Size 12.2MB
Sample260808-dat68s1ycx
SHA256 92548cc81fb889424b98c52025ea9d685cb163f05963f00d917d8dd1dda74dce
MD5 bd44a6ddba3a99c792d5c7de5479d8eb
SHA1 b5ff49a93634aa5822e619b8aee856da66148e78
SHA512 e61498c2b6f5768ae16c34457a67b3431565dda3e3ce74b034a0689f0028e9efac860c8ab3cbe39a560e89999fb3fb056ee95d825ca16a75f2b83db4ff2e1402
SSDEEP 196608:rztrQjXc/sRV3QqZcRRvNDvmIxTH+vLjjXN9y:reXksL3Ry7vND+KTkvz
TLSH
T1BCD67C03EC6519E9C1AED230CAA292637B727C440B3667E71B50F6386F76BD0AD79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	heartbeat-agent.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2580	icacls.exe
4480	icacls.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
1976	heartbeat-agent.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4884	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1540	sc.exe
4952	sc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4208	taskkill.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
5844	powershell.exe
5844	powershell.exe
1976	heartbeat-agent.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
1520	powershell.exe
1520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeTcbPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeShutdownPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: 33	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeSecurityPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeAssignPrimaryTokenPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeImpersonatePrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeLoadDriverPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeSystemtimePrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeSystemProfilePrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeProfSingleProcessPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeIncBasePriorityPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeCreatePagefilePrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeBackupPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeRestorePrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeTakeOwnershipPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeManageVolumePrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeChangeNotifyPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeUndockPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeCreateGlobalPrivilege	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: 34	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: 35	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	1976	heartbeat-agent.exe
Token: SeTcbPrivilege	1976	heartbeat-agent.exe
Token: SeShutdownPrivilege	1976	heartbeat-agent.exe
Token: 33	1976	heartbeat-agent.exe
Token: SeSecurityPrivilege	1976	heartbeat-agent.exe
Token: SeAssignPrimaryTokenPrivilege	1976	heartbeat-agent.exe
Token: SeImpersonatePrivilege	1976	heartbeat-agent.exe
Token: SeLoadDriverPrivilege	1976	heartbeat-agent.exe
Token: SeSystemtimePrivilege	1976	heartbeat-agent.exe
Token: SeSystemProfilePrivilege	1976	heartbeat-agent.exe
Token: SeProfSingleProcessPrivilege	1976	heartbeat-agent.exe
Token: SeIncBasePriorityPrivilege	1976	heartbeat-agent.exe
Token: SeCreatePagefilePrivilege	1976	heartbeat-agent.exe
Token: SeBackupPrivilege	1976	heartbeat-agent.exe
Token: SeRestorePrivilege	1976	heartbeat-agent.exe
Token: SeTakeOwnershipPrivilege	1976	heartbeat-agent.exe
Token: SeManageVolumePrivilege	1976	heartbeat-agent.exe
Token: SeChangeNotifyPrivilege	1976	heartbeat-agent.exe
Token: SeUndockPrivilege	1976	heartbeat-agent.exe
Token: SeCreateGlobalPrivilege	1976	heartbeat-agent.exe
Token: 34	1976	heartbeat-agent.exe
Token: 35	1976	heartbeat-agent.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	5844	powershell.exe
Token: SeSecurityPrivilege	5844	powershell.exe
Token: SeTakeOwnershipPrivilege	5844	powershell.exe
Token: SeLoadDriverPrivilege	5844	powershell.exe
Token: SeSystemProfilePrivilege	5844	powershell.exe
Token: SeSystemtimePrivilege	5844	powershell.exe
Token: SeProfSingleProcessPrivilege	5844	powershell.exe
Token: SeIncBasePriorityPrivilege	5844	powershell.exe
Token: SeCreatePagefilePrivilege	5844	powershell.exe
Token: SeBackupPrivilege	5844	powershell.exe
Token: SeRestorePrivilege	5844	powershell.exe
Token: SeShutdownPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeSystemEnvironmentPrivilege	5844	powershell.exe
Token: SeRemoteShutdownPrivilege	5844	powershell.exe
Token: SeUndockPrivilege	5844	powershell.exe
Token: SeManageVolumePrivilege	5844	powershell.exe
Token: 33	5844	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2580	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	90
PID 4556 wrote to memory of 4088	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	91
PID 4556 wrote to memory of 1540	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	94
PID 4556 wrote to memory of 5844	4556	2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe	95
PID 1976 wrote to memory of 4480	1976	heartbeat-agent.exe	97
PID 1976 wrote to memory of 4884	1976	heartbeat-agent.exe	99
PID 1976 wrote to memory of 4208	1976	heartbeat-agent.exe	101
PID 1976 wrote to memory of 4952	1976	heartbeat-agent.exe	102
PID 1976 wrote to memory of 1520	1976	heartbeat-agent.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bd44a6ddba3a99c792d5c7de5479d8eb_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\HeartbeatAgent /grant *S-1-5-32-545:(OI)(CI)M /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2580
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn HeartbeatAgent /f
  2⤵
  PID:4088
- C:\Windows\system32\sc.exe
  sc query HeartbeatAgent
  2⤵
  - Launches sc.exe
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAYwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtAAoAJABiAGkAbwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAKACQAYgBiACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBhAHMAZQBCAG8AYQByAGQACgAkAGYAaQBlAGwAZABzACAAPQAgAEAAKAAKACAAIAAkAGMAcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGMAcwAuAE0AbwBkAGUAbAAsAAoAIAAgACQAYgBpAG8AcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGIAaQBvAHMALgBWAGUAcgBzAGkAbwBuACwAIAAkAGIAaQBvAHMALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAsAAoAIAAgACQAYgBiAC4ATQBhAG4AdQBmAGEAYwB0AHUAcgBlAHIALAAgACQAYgBiAC4AUAByAG8AZAB1AGMAdAAKACkAIAAtAGoAbwBpAG4AIAAnAHwAJwAKACQAcwB2AGMAIAA9ACAAKABHAGUAdAAtAFMAZQByAHYAaQBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeACgAdgBtAHQAbwBvAGwAcwB8AFYAQgBvAHgAUwBlAHIAdgBpAGMAZQB8AFYAQgBvAHgARwB1AGUAcwB0AHwAdgBtAGgAZwBmAHMAfAB2AG0AbQBlAG0AYwB0AGwAfABjAGUAeABlAGMAcwB2AGMAKQAkACcAIAB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAE4AYQBtAGUAKQAgAC0AagBvAGkAbgAgACcALAAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAoACIARgBJAEUATABEAFMAOgAiACAAKwAgACQAZgBpAGUAbABkAHMAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAiAFMAVgBDADoAIgAgACsAIAAkAHMAdgBjACkACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5844

C:\ProgramData\HeartbeatAgent\heartbeat-agent.exe
C:\ProgramData\HeartbeatAgent\heartbeat-agent.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\HeartbeatAgent /grant *S-1-5-32-545:(OI)(CI)M /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"ProcessId=4556\" -ErrorAction SilentlyContinue).CommandLine"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\system32\taskkill.exe
  taskkill /F /T /PID 4556
  2⤵
  - Kills process with taskkill
  PID:4208
- C:\Windows\system32\sc.exe
  sc query HeartbeatAgent
  2⤵
  - Launches sc.exe
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAYwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtAAoAJABiAGkAbwBzACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAKACQAYgBiACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBhAHMAZQBCAG8AYQByAGQACgAkAGYAaQBlAGwAZABzACAAPQAgAEAAKAAKACAAIAAkAGMAcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGMAcwAuAE0AbwBkAGUAbAAsAAoAIAAgACQAYgBpAG8AcwAuAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIAAkAGIAaQBvAHMALgBWAGUAcgBzAGkAbwBuACwAIAAkAGIAaQBvAHMALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAsAAoAIAAgACQAYgBiAC4ATQBhAG4AdQBmAGEAYwB0AHUAcgBlAHIALAAgACQAYgBiAC4AUAByAG8AZAB1AGMAdAAKACkAIAAtAGoAbwBpAG4AIAAnAHwAJwAKACQAcwB2AGMAIAA9ACAAKABHAGUAdAAtAFMAZQByAHYAaQBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeACgAdgBtAHQAbwBvAGwAcwB8AFYAQgBvAHgAUwBlAHIAdgBpAGMAZQB8AFYAQgBvAHgARwB1AGUAcwB0AHwAdgBtAGgAZwBmAHMAfAB2AG0AbQBlAG0AYwB0AGwAfABjAGUAeABlAGMAcwB2AGMAKQAkACcAIAB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAE4AYQBtAGUAKQAgAC0AagBvAGkAbgAgACcALAAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAoACIARgBJAEUATABEAFMAOgAiACAAKwAgACQAZgBpAGUAbABkAHMAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAiAFMAVgBDADoAIgAgACsAIAAkAHMAdgBjACkACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

heartbeat-agent.exe

Path C:\ProgramData\HeartbeatAgent\heartbeat-agent.exe
Size 12.2MB
SHA256 92548cc81fb889424b98c52025ea9d685cb163f05963f00d917d8dd1dda74dce
MD5 bd44a6ddba3a99c792d5c7de5479d8eb
SHA1 b5ff49a93634aa5822e619b8aee856da66148e78
SHA512 e61498c2b6f5768ae16c34457a67b3431565dda3e3ce74b034a0689f0028e9efac860c8ab3cbe39a560e89999fb3fb056ee95d825ca16a75f2b83db4ff2e1402
SSDEEP 196608:rztrQjXc/sRV3QqZcRRvNDvmIxTH+vLjjXN9y:reXksL3Ry7vND+KTkvz
TLSH
T1BCD67C03EC6519E9C1AED230CAA292637B727C440B3667E71B50F6386F76BD0AD79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heartbeat-agent.pid

Path C:\ProgramData\SysCache\heartbeat-agent.pid
Size 4B
SHA256 b23826ecdcfe9d69cb981de384a372ecff0f2a5a514a7077f9e133e90a9eafa4
MD5 6f518c31f6baa365f55c38d11cc349d1
SHA1 81ad899a7cdefd3795356650d2490bc311a26faf
SHA512 40c7e1e3e6f5aa31d7340ed193daed328ec3299679a9e36ef792f3b00eff19bc0dc28e94f7199901b198a6b67160dbab96f731cd16edafc1192c93576e5d7e3a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3cf5e168f250641bd87988519ec127ad619d48298af999b8a457966afcae99c3
MD5 952efea4f057e749a84a3f6695a6175a
SHA1 78c1372faabde220a48deab009c803a20d6e925a
SHA512 862ffcf76f6b2bb93cd264b63bc7c0a16a5117c470a13f16d158d5ddfa63af8eef9ace3f37181475fc3e1a75defd3b898617ad6f37af904f165f7cbad8bd3732
TLSH
T176318837F3DC8224CC99413A10DDAC1036BAC7DB40DEDF9B6B80E155B52F698CE61150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aaeq2edf.nkd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aaeq2edf.nkd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

heartbeat-agent.log

Path C:\Users\Admin\AppData\Local\Temp\heartbeat-agent.log
Size 899B
SHA256 dc124d60ff325888694e6822c8258b9fa54d2abda2a5e66af7ea19bfc0829b32
MD5 d5c2bfb6e8cf422f5ff866b580270b62
SHA1 e0cf4c0d0b87c12a4d0a3a80c64e131a74b9e542
SHA512 f2d4cccbb735ef5818fdb018c7e18e6d7a814b05770d37541f02140a4069f15e9f60ef9168fc0a50cdd7162ceb7ddfbbe55e01c0d241e8fa156ff30d5f709c4d
TLSH
T126119C27161602F87E2949D7C8030BD0BEE6BA0CF68D525671D94C9FCAE340C1126CA9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4556-1-0x0000019EFB720000-0x0000019EFB723000-memory.dmp

Download

memory/5844-9-0x000001DACD400000-0x000001DACD422000-memory.dmp

Download

memory/5844-17-0x000001DAE55E0000-0x000001DAE55FE000-memory.dmp

Download

memory/5844-19-0x000001DAE5810000-0x000001DAE58C2000-memory.dmp

Download

memory/5844-22-0x000001DACD480000-0x000001DACD48A000-memory.dmp

Download

memory/5844-23-0x000001DAE5B50000-0x000001DAE5B7A000-memory.dmp

Download

memory/5844-24-0x000001DAE5B50000-0x000001DAE5B74000-memory.dmp

Download