10499a4f9a7aa4ed908d684862650883c3c588b7d2496f6d88056083a2beb30f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 10.3MB
Sample260825-s792aavema
SHA256 10499a4f9a7aa4ed908d684862650883c3c588b7d2496f6d88056083a2beb30f
MD5 344fe2d2d0557e99e0b2a53d52b94525
SHA1 7c6b0b822124f1eb41534ea1128a193976d75f76
SHA512 7782121e588b49cc51c6e49bf67bf61d5bf5bcd1402037b66bec8e0a0a0ec93f2a734a05469334efbaf8aa3b891d487e1c9d7a98eeaf970115f6c260171d3320
SSDEEP 98304:lykOISc5KRHFfz4zoGLSuD0Yn7oCtyRFESlloqOyF8lI:lemcRHqZgsVQ2SlloqO
TLSH
T18BB64B47E8A541E4C0EED575C6669663BA713C984F3063D32F60FB242F76BD06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-5.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-5.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c506-5.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4684	powershell.exe
5820	powershell.exe
2236	powershell.exe
3304	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2712	RobIoxPlayrBeta.exe
1416	RobIoxPlayrBeta.exe
5580	RobIoxPlayrBeta.exe
5976	RobIoxPlayrBeta.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RobIoxPlayrBeta.exe
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RobIoxPlayrBeta.exe
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RobIoxPlayrBeta.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3380	tasklist.exe
1144	tasklist.exe
1700	tasklist.exe
1328	tasklist.exe
3312	tasklist.exe
3804	tasklist.exe
3428	tasklist.exe
4364	tasklist.exe
4512	tasklist.exe
2828	tasklist.exe
6124	tasklist.exe
3416	tasklist.exe
1820	tasklist.exe
5572	tasklist.exe
2524	tasklist.exe
3220	tasklist.exe
5876	tasklist.exe
4772	tasklist.exe
2112	tasklist.exe
2236	tasklist.exe
4984	tasklist.exe
4556	tasklist.exe
1716	tasklist.exe
3596	tasklist.exe
2848	tasklist.exe
1428	tasklist.exe
5476	tasklist.exe
5668	tasklist.exe
3040	tasklist.exe
2000	tasklist.exe
2952	tasklist.exe
1476	tasklist.exe
5936	tasklist.exe
5712	tasklist.exe
5092	tasklist.exe
5896	tasklist.exe
5212	tasklist.exe
3344	tasklist.exe
4256	tasklist.exe
252	tasklist.exe
908	tasklist.exe
4892	tasklist.exe
3624	tasklist.exe
5616	tasklist.exe
3872	tasklist.exe
2236	tasklist.exe
4868	tasklist.exe
4212	tasklist.exe
3452	tasklist.exe
1820	tasklist.exe
4860	tasklist.exe
3208	tasklist.exe
5520	tasklist.exe
3040	tasklist.exe
5184	tasklist.exe
4624	tasklist.exe
4088	tasklist.exe
1068	tasklist.exe
4480	tasklist.exe
1868	tasklist.exe
2924	tasklist.exe
2532	tasklist.exe
5944	tasklist.exe
4300	tasklist.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1212	schtasks.exe
5036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
5820	powershell.exe
5820	powershell.exe
5820	powershell.exe
2236	powershell.exe
2236	powershell.exe
2236	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
2712	RobIoxPlayrBeta.exe
2712	RobIoxPlayrBeta.exe
2712	RobIoxPlayrBeta.exe
2712	RobIoxPlayrBeta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	5936	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	3596	tasklist.exe
Token: SeDebugPrivilege	3568	tasklist.exe
Token: SeDebugPrivilege	2876	tasklist.exe
Token: SeDebugPrivilege	2828	tasklist.exe
Token: SeDebugPrivilege	5568	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	3616	tasklist.exe
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeDebugPrivilege	4876	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	1820	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	5868	tasklist.exe
Token: SeDebugPrivilege	5784	tasklist.exe
Token: SeDebugPrivilege	4860	tasklist.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	1472	tasklist.exe
Token: SeDebugPrivilege	716	tasklist.exe
Token: SeDebugPrivilege	6124	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	1752	tasklist.exe
Token: SeDebugPrivilege	5876	tasklist.exe
Token: SeDebugPrivilege	4772	tasklist.exe
Token: SeDebugPrivilege	5700	tasklist.exe
Token: SeDebugPrivilege	5092	tasklist.exe
Token: SeDebugPrivilege	616	tasklist.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	3760	tasklist.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	2112	tasklist.exe
Token: SeDebugPrivilege	3208	tasklist.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	2992	tasklist.exe
Token: SeDebugPrivilege	5764	tasklist.exe
Token: SeDebugPrivilege	2236	tasklist.exe
Token: SeDebugPrivilege	5240	tasklist.exe
Token: SeDebugPrivilege	5520	tasklist.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	5404	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	5772	tasklist.exe
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	1660	tasklist.exe
Token: SeDebugPrivilege	3396	tasklist.exe
Token: SeDebugPrivilege	1704	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	1328	tasklist.exe
Token: SeDebugPrivilege	2952	tasklist.exe
Token: SeDebugPrivilege	3872	tasklist.exe
Token: SeDebugPrivilege	5476	tasklist.exe
Token: SeDebugPrivilege	5976	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	2304	tasklist.exe
Token: SeDebugPrivilege	4200	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2212	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	89
PID 3796 wrote to memory of 5936	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	92
PID 3796 wrote to memory of 2812	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	94
PID 3796 wrote to memory of 3596	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	96
PID 3796 wrote to memory of 3568	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	98
PID 3796 wrote to memory of 2876	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	100
PID 3796 wrote to memory of 2828	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	102
PID 3796 wrote to memory of 5568	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	104
PID 3796 wrote to memory of 1144	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	106
PID 3796 wrote to memory of 3616	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	108
PID 3796 wrote to memory of 4624	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	110
PID 3796 wrote to memory of 4876	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	112
PID 3796 wrote to memory of 2196	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	114
PID 3796 wrote to memory of 1820	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	116
PID 3796 wrote to memory of 1700	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	118
PID 3796 wrote to memory of 4640	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	120
PID 3796 wrote to memory of 5868	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	122
PID 3796 wrote to memory of 5784	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	124
PID 3796 wrote to memory of 4860	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	126
PID 3796 wrote to memory of 1416	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	128
PID 3796 wrote to memory of 4728	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	130
PID 3796 wrote to memory of 1472	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	132
PID 3796 wrote to memory of 716	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	134
PID 3796 wrote to memory of 6124	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	136
PID 3796 wrote to memory of 4172	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	138
PID 3796 wrote to memory of 2280	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	140
PID 3796 wrote to memory of 4840	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	207
PID 3796 wrote to memory of 1752	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	144
PID 3796 wrote to memory of 5876	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	275
PID 3796 wrote to memory of 4772	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	148
PID 3796 wrote to memory of 5700	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	150
PID 3796 wrote to memory of 5092	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	278
PID 3796 wrote to memory of 616	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	223
PID 3796 wrote to memory of 4480	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	342
PID 3796 wrote to memory of 3760	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	158
PID 3796 wrote to memory of 1860	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	160
PID 3796 wrote to memory of 2112	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	162
PID 3796 wrote to memory of 3208	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	164
PID 3796 wrote to memory of 2848	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	166
PID 3796 wrote to memory of 2992	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	168
PID 3796 wrote to memory of 5764	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	170
PID 3796 wrote to memory of 2236	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	407
PID 3796 wrote to memory of 5240	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	174
PID 3796 wrote to memory of 5520	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	241
PID 3796 wrote to memory of 1120	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	409
PID 3796 wrote to memory of 5404	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	180
PID 3796 wrote to memory of 1672	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	368
PID 3796 wrote to memory of 1700	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	184
PID 3796 wrote to memory of 5772	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	186
PID 3796 wrote to memory of 1212	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	188
PID 3796 wrote to memory of 2712	3796	2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	192
PID 2712 wrote to memory of 1660	2712	RobIoxPlayrBeta.exe	194
PID 1416 wrote to memory of 2752	1416	RobIoxPlayrBeta.exe	259
PID 1416 wrote to memory of 1704	1416	RobIoxPlayrBeta.exe	198
PID 2712 wrote to memory of 3396	2712	RobIoxPlayrBeta.exe	199
PID 2712 wrote to memory of 4420	2712	RobIoxPlayrBeta.exe	202
PID 1416 wrote to memory of 5964	1416	RobIoxPlayrBeta.exe	204
PID 2712 wrote to memory of 1328	2712	RobIoxPlayrBeta.exe	327
PID 1416 wrote to memory of 2952	1416	RobIoxPlayrBeta.exe	427
PID 2712 wrote to memory of 3872	2712	RobIoxPlayrBeta.exe	274
PID 1416 wrote to memory of 5476	1416	RobIoxPlayrBeta.exe	212
PID 5580 wrote to memory of 5712	5580	RobIoxPlayrBeta.exe	214
PID 2712 wrote to memory of 5976	2712	RobIoxPlayrBeta.exe	398
PID 1416 wrote to memory of 2032	1416	RobIoxPlayrBeta.exe	217

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RobIoxPlayrBeta.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RobIoxPlayrBeta.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5784
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:716
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6124
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5876
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5240
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\RobIoxPlayrBeta_task.xml /TN RobIoxPlayrBeta /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1212
- C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
  C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe --installed
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2712
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4840
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    PID:1892
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    PID:5188
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    - Discovers running processes
    PID:2236
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    PID:5520
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    PID:2252
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    PID:4396
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    PID:5020
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    PID:2376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2752
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    PID:6124
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    PID:696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    - Discovers running processes
    PID:4984
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    PID:3872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5876
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    - Discovers running processes
    PID:5092
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    PID:5236
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    PID:3596
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    - Discovers running processes
    PID:3040
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:5944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    PID:3084
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    PID:2884
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    - Discovers running processes
    PID:1068
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    - Discovers running processes
    PID:1820
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    PID:4640
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    PID:2248
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    PID:5468
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    - Discovers running processes
    PID:4300
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    - Discovers running processes
    PID:4868
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    PID:5824
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    PID:1688
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:4480
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    PID:2812
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    PID:2740
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:5896
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    PID:5136
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    PID:3624
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    PID:1672
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    PID:5280
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    PID:5572
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    PID:4576
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    - Discovers running processes
    PID:3428
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4300
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    - Discovers running processes
    PID:4364
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2364
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    PID:4612
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\RobIoxPlayrBeta_task.xml /TN RobIoxPlayrBeta /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036
- - C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
    C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe --watchdog 2712 --wd-target C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
    3⤵
    - Executes dropped EXE
    PID:5976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3304

C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
"C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  PID:5712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  PID:5856
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  PID:5488
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Discovers running processes
  PID:4512
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  PID:1528
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  PID:1120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:5212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:3344
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  PID:6140
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  PID:1696
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  PID:5572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  PID:4892
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Discovers running processes
  PID:4256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Discovers running processes
  PID:2952
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  PID:2524
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  PID:4464
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Discovers running processes
  PID:5184
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:252
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  PID:1476
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  PID:5156
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  PID:2536
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:5376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:1428
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  PID:5564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3596
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:4556
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:2908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5188
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  PID:3236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:4156
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:2508
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:5252
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:2932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  PID:3088
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  PID:3624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:3084
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:2924
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Discovers running processes
  PID:1716
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:1076
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:1868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:5400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:5796
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:4320
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  PID:3220
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  PID:3380
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  PID:2008
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  PID:3424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3500
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  PID:5616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  PID:3452
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:6008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5488
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:1860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2532

C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:1448
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  PID:1228
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  PID:5040
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  PID:5160
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:4676
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:1708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:5280
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  PID:3312
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  PID:1596
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:716
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  PID:1624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  PID:4616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  PID:3500
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  PID:3416
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Discovers running processes
  PID:1428
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Discovers running processes
  PID:2532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Discovers running processes
  PID:4088
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  PID:3772
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:3004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  PID:5336
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:1708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:5948
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:2760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:4736
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1328
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  PID:2364
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  PID:5668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  PID:3944
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:5632
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:3596
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Discovers running processes
  PID:3040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1228
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:4412
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:6048
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:3340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  PID:3804
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  PID:4212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  PID:2248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Discovers running processes
  PID:1868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  PID:2000
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:440
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:1168
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Web Data.tmp_wr

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.tmp_wr
Size 138KB
SHA256 d35e81b0e64c47eb79acf4a652e1cf5cc561f8250beb7389b7d21585ec5aa0f3
MD5 035a48946147d68c26be52624bc852ea
SHA1 c508e6a1a0fd23e402e91b87c2f3ef02bcb14f80
SHA512 94078a8825e27a4ff437c2a657e3169b6fd67b80d2513d4c22555da4f2da10fa79b32393165f81a912ac87ba5df31ad96422767f057420d1d936138666ebcfd7
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OBpX6Qq6VumGOwwkWf:zeuvBnhJsueMEGvIW1DcP2OPXVumGnw
TLSH
T1EDD3774B3A743002EDE5DE765CE0507B5E3CB16D8F5695D428B620588EF2853A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data.tmp_wr

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.tmp_wr
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RobIoxPlayrBeta.exe

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-145f189a6a974303\RobIoxPlayrBeta.exe
Size 10.3MB
SHA256 10499a4f9a7aa4ed908d684862650883c3c588b7d2496f6d88056083a2beb30f
MD5 344fe2d2d0557e99e0b2a53d52b94525
SHA1 7c6b0b822124f1eb41534ea1128a193976d75f76
SHA512 7782121e588b49cc51c6e49bf67bf61d5bf5bcd1402037b66bec8e0a0a0ec93f2a734a05469334efbaf8aa3b891d487e1c9d7a98eeaf970115f6c260171d3320
SSDEEP 98304:lykOISc5KRHFfz4zoGLSuD0Yn7oCtyRFESlloqOyF8lI:lemcRHqZgsVQ2SlloqO
TLSH
T18BB64B47E8A541E4C0EED575C6669663BA713C984F3063D32F60FB242F76BD06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobIoxPlayrBeta_task.xml

Path C:\Users\Admin\AppData\Local\Temp\RobIoxPlayrBeta_task.xml
Size 1KB
SHA256 f8d1f55c8ebadc1435e47cf9e68dfcafb013859886fefb661e925174610ea22e
MD5 49e79f1b053bba0740386568f1c7a930
SHA1 ae6d3eeb5c033b3964956a0eeda2c7f426a20e02
SHA512 1ef8bab10cb90159f010848b7baac223eda237e74c8c238647edfbb7d3e9c2edde6babcf397c7f166e9808b906e3c4d9dfe4b26aa8e7844c3063abd0b12437fd
TLSH
T1E62120909D10F62F715A973A8B9113C2333A5B790AA64038D9C84DBC748A1CA710397B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3atpjnoz.maq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3atpjnoz.maq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 3c5bf96d3ffb6c158cfa800403cf252788a430ca1d90fad5c13bb81f686722b7
MD5 237b756033cb0f03677314740a3260f6
SHA1 0e51d6cc0d891ba85713b7b3df7d826310d1ebfd
SHA512 ddafe8191d2d9b1aeb0104a4baa57fc2d4414ad44d780827779f174b2bb04bb4cb5b3e7dfd4382f14a8ef462da215c976380baaed2c69811bc663ab231b0f1b0
TLSH
T127310FC028FD06BC8406C2DAA0D11594EE7D941F0F5654F2F634E05D329B42D7BE3AB9
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 247cec3164b22fde93b74dc3d68277532787af4775c5943f85c86daeeb82477b
MD5 84116db9533d731933bc8f2c7ff3afc3
SHA1 8aa6e7a4d2285630dbb657483f53d863299fcc6d
SHA512 2b39f92f46c72f7cf6693ba324f35994991e6067c53783479c026912f6319746b22db023a1cecb47708fce4796de49522b6aa3aa0b70ca7467734b6ac1ad8d9c
TLSH
T18B4101C068FC0ABC8005C2DAA5D15294EF7DA01A1E5664F2F674E05D32A742D77E3EF9
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 3KB
SHA256 a9918141386f011c4dcb8f467ba6fed9e5658883a4ccf3ce0174198b337cdd11
MD5 7b57a301f386fe310971da9bd26db34b
SHA1 c3e75dd21faa662c77f367dc4866fba4e3457c52
SHA512 72974e804b0d658075abf8d5e65097a6963dd5c467ab2383e2420260ca72a685429c80d63a2557ee84a00b96305998c9723df3a81f7d6fcb7c5eaf58b651f12a
TLSH
T12F61FBC174BD193C416681DAB7D006A0EA7F9839CE8211F2A67C644D21B643E77F6FB8
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 754B
SHA256 cdba5d20f0cf1d18ce1ef39e2a3508004f015d1d2dbad0b632426b065ccab12f
MD5 d73cb56aa534b408a3539f9020dffd71
SHA1 4652728fdcebaadd8a7c51d2553d5e159aa46efc
SHA512 e854c08beae6c4d55806eaa0df12d1d60d1fffbf03204a5f16c37415d1f949877c3d81554833f21d554db395971c06693b542a963db24488a0c9fdbe914c422e
TLSH
T1E5019CC018FD4A3CC116C2DA94D150A8EE79941F1E0255F1F334E41D329781DBB939B5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4684-17-0x00000235854C0000-0x00000235854E2000-memory.dmp

Download