Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_9e4708720b8d20c3fed32df31bc89c80_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_9e4708720b8d20c3fed32df31bc89c80_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-20_9e4708720b8d20c3fed32df31bc89c80_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
- Size 2.6MB
- Sample260820-eawwhassaw
- SHA256 21cb1fb49186ac1706368a49db008cca7b803bead376a4b3b90508af11695ff6
- MD5 9e4708720b8d20c3fed32df31bc89c80
- SHA1 25f04b3917f8f8c5363b6150198987f07e71965c
- SHA512 aebaa901f93ac1554e5b81432ae6e18a2ee73be915a0e7e2859689187d64a1ad2af6b3f71c5b34a9cb325ac3ee22935dec4263cf5aaef1cd98cae681e426fcee
- SSDEEP 49152:b9WJlXo/w3hE4txMFAKerFQr7qK0GxzEIql9dM:pwlXTE4telyl9
- TLSH T18CC5AE1AA3D901ECE0B7A4BCC5694A42E735B00AC750CBD702FC46A51FB76E89B7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
pid Process 3880 powershell.exe 5704 powershell.exe 5840 powershell.exe 3880 powershell.exe 5704 powershell.exe 5840 powershell.exe - Executes dropped EXE 2 IoCs
pid Process 4136 SysRtProc.exe 3472 SysRtProc.exe - Power Settings 1 TTPs 12 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2696 powercfg.exe 1152 powercfg.exe 1312 powercfg.exe 5700 powercfg.exe 5792 powercfg.exe 5220 powercfg.exe 1276 powercfg.exe 5448 powercfg.exe 4164 powercfg.exe 924 powercfg.exe 2468 powercfg.exe 4016 powercfg.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_bzb1c1mt.scd.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_detgkgip.nlv.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_es3pgaqk.edc.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_dgdr0sc3.j3z.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_q0y4fzyt.eg0.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_amd431yg.0iu.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_3bdm4u43.eln.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_oxuu1k12.h24.psm1 powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3880 powershell.exe 3880 powershell.exe 5704 powershell.exe 5704 powershell.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 5840 powershell.exe 5840 powershell.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe 4136 SysRtProc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3880 powershell.exe Token: SeIncreaseQuotaPrivilege 3880 powershell.exe Token: SeSecurityPrivilege 3880 powershell.exe Token: SeTakeOwnershipPrivilege 3880 powershell.exe Token: SeLoadDriverPrivilege 3880 powershell.exe Token: SeSystemProfilePrivilege 3880 powershell.exe Token: SeSystemtimePrivilege 3880 powershell.exe Token: SeProfSingleProcessPrivilege 3880 powershell.exe Token: SeIncBasePriorityPrivilege 3880 powershell.exe Token: SeCreatePagefilePrivilege 3880 powershell.exe Token: SeBackupPrivilege 3880 powershell.exe Token: SeRestorePrivilege 3880 powershell.exe Token: SeShutdownPrivilege 3880 powershell.exe Token: SeDebugPrivilege 3880 powershell.exe Token: SeSystemEnvironmentPrivilege 3880 powershell.exe Token: SeRemoteShutdownPrivilege 3880 powershell.exe Token: SeUndockPrivilege 3880 powershell.exe Token: SeManageVolumePrivilege 3880 powershell.exe Token: 33 3880 powershell.exe Token: 34 3880 powershell.exe Token: 35 3880 powershell.exe Token: 36 3880 powershell.exe Token: SeIncreaseQuotaPrivilege 3880 powershell.exe Token: SeSecurityPrivilege 3880 powershell.exe Token: SeTakeOwnershipPrivilege 3880 powershell.exe Token: SeLoadDriverPrivilege 3880 powershell.exe Token: SeSystemProfilePrivilege 3880 powershell.exe Token: SeSystemtimePrivilege 3880 powershell.exe Token: SeProfSingleProcessPrivilege 3880 powershell.exe Token: SeIncBasePriorityPrivilege 3880 powershell.exe Token: SeCreatePagefilePrivilege 3880 powershell.exe Token: SeBackupPrivilege 3880 powershell.exe Token: SeRestorePrivilege 3880 powershell.exe Token: SeShutdownPrivilege 3880 powershell.exe Token: SeDebugPrivilege 3880 powershell.exe Token: SeSystemEnvironmentPrivilege 3880 powershell.exe Token: SeRemoteShutdownPrivilege 3880 powershell.exe Token: SeUndockPrivilege 3880 powershell.exe Token: SeManageVolumePrivilege 3880 powershell.exe Token: 33 3880 powershell.exe Token: 34 3880 powershell.exe Token: 35 3880 powershell.exe Token: 36 3880 powershell.exe Token: SeShutdownPrivilege 5448 powercfg.exe Token: SeCreatePagefilePrivilege 5448 powercfg.exe Token: SeShutdownPrivilege 4164 powercfg.exe Token: SeCreatePagefilePrivilege 4164 powercfg.exe Token: SeShutdownPrivilege 924 powercfg.exe Token: SeCreatePagefilePrivilege 924 powercfg.exe Token: SeShutdownPrivilege 2468 powercfg.exe Token: SeCreatePagefilePrivilege 2468 powercfg.exe Token: SeShutdownPrivilege 2468 powercfg.exe Token: SeCreatePagefilePrivilege 2468 powercfg.exe Token: SeDebugPrivilege 5704 powershell.exe Token: SeAssignPrimaryTokenPrivilege 5704 powershell.exe Token: SeIncreaseQuotaPrivilege 5704 powershell.exe Token: SeSecurityPrivilege 5704 powershell.exe Token: SeTakeOwnershipPrivilege 5704 powershell.exe Token: SeLoadDriverPrivilege 5704 powershell.exe Token: SeSystemtimePrivilege 5704 powershell.exe Token: SeBackupPrivilege 5704 powershell.exe Token: SeRestorePrivilege 5704 powershell.exe Token: SeShutdownPrivilege 5704 powershell.exe Token: SeSystemEnvironmentPrivilege 5704 powershell.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2548 wrote to memory of 3880 2548 2026-08-20_9e4708720b8d20c3fed32df31bc89c80_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe 89 PID 3880 wrote to memory of 5448 3880 powershell.exe 92 PID 3880 wrote to memory of 4164 3880 powershell.exe 93 PID 3880 wrote to memory of 924 3880 powershell.exe 94 PID 4136 wrote to memory of 5704 4136 SysRtProc.exe 96 PID 3880 wrote to memory of 2468 3880 powershell.exe 97 PID 5704 wrote to memory of 4016 5704 powershell.exe 99 PID 5704 wrote to memory of 2696 5704 powershell.exe 100 PID 5704 wrote to memory of 5700 5704 powershell.exe 101 PID 5704 wrote to memory of 5792 5704 powershell.exe 102 PID 4136 wrote to memory of 3472 4136 SysRtProc.exe 103 PID 3472 wrote to memory of 5840 3472 SysRtProc.exe 104 PID 5840 wrote to memory of 1152 5840 powershell.exe 106 PID 5840 wrote to memory of 1312 5840 powershell.exe 107 PID 5840 wrote to memory of 5220 5840 powershell.exe 108 PID 5840 wrote to memory of 1276 5840 powershell.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9e4708720b8d20c3fed32df31bc89c80_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9e4708720b8d20c3fed32df31bc89c80_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EP Bypass -WindowStyle Hidden -C "Add-MpPreference -ExclusionPath $env:LOCALAPPDATA; Add-MpPreference -ExclusionPath $env:ProgramData"; powercfg /change standby-timeout-ac 0; powercfg /change standby-timeout-dc 0; powercfg /change hibernate-timeout-ac 0; powercfg /hibernate off2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5448
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /hibernate off3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
-
C:\ProgramData\SysRtProc\SysRtProc.exe"C:\ProgramData\SysRtProc\SysRtProc.exe" -service1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EP Bypass -WindowStyle Hidden -C "Add-MpPreference -ExclusionPath $env:LOCALAPPDATA; Add-MpPreference -ExclusionPath $env:ProgramData"; powercfg /change standby-timeout-ac 0; powercfg /change standby-timeout-dc 0; powercfg /change hibernate-timeout-ac 0; powercfg /hibernate off2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 03⤵
- Power Settings
PID:4016
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 03⤵
- Power Settings
PID:2696
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 03⤵
- Power Settings
PID:5700
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /hibernate off3⤵
- Power Settings
PID:5792
-
-
-
C:\ProgramData\SysRtProc\SysRtProc.exe"C:\ProgramData\SysRtProc\SysRtProc.exe" -agent2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EP Bypass -WindowStyle Hidden -C "Add-MpPreference -ExclusionPath $env:LOCALAPPDATA; Add-MpPreference -ExclusionPath $env:ProgramData"; powercfg /change standby-timeout-ac 0; powercfg /change standby-timeout-dc 0; powercfg /change hibernate-timeout-ac 0; powercfg /hibernate off3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 04⤵
- Power Settings
PID:1152
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 04⤵
- Power Settings
PID:1312
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 04⤵
- Power Settings
PID:5220
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /hibernate off4⤵
- Power Settings
PID:1276
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysRtProc\SysRtProc.exe
- Size 2.6MB
- SHA256 21cb1fb49186ac1706368a49db008cca7b803bead376a4b3b90508af11695ff6
- MD5 9e4708720b8d20c3fed32df31bc89c80
- SHA1 25f04b3917f8f8c5363b6150198987f07e71965c
- SHA512 aebaa901f93ac1554e5b81432ae6e18a2ee73be915a0e7e2859689187d64a1ad2af6b3f71c5b34a9cb325ac3ee22935dec4263cf5aaef1cd98cae681e426fcee
- SSDEEP 49152:b9WJlXo/w3hE4txMFAKerFQr7qK0GxzEIql9dM:pwlXTE4telyl9
- TLSH T18CC5AE1AA3D901ECE0B7A4BCC5694A42E735B00AC750CBD702FC46A51FB76E89B7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
- MD5 66f9b690d4e5313231bc173ce7b2c029
- SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
- SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
- TLSH T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_q0y4fzyt.eg0.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH