154d984416941d6242bb44d6889b769095fc0530f75a0f6c8bb80df97d909aca

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 13.3MB
Sample260831-2c59aazdpe
SHA256 154d984416941d6242bb44d6889b769095fc0530f75a0f6c8bb80df97d909aca
MD5 1ef1d22a0a69c2921f6500e37dd9098e
SHA1 875e7e2fe55a9e4d9935fee142508c946c779648
SHA512 5c55b1f9450371ab75957d3da0242b970ec6a9dddf9aa1929400503eeaccd82487a7dacad38229793ecebef97f23309d6db368c1df0dc2a9fb40676e42ec9b11
SSDEEP 98304:3LV9QQzd86EnOWsDPD8VXCK6CSrNWPwLlsZAo6aqECXnfkLzQe6grJaTW7re/J:7VhC6EO8cvMwKCXnfkLzQe6grJ1G
TLSH
T13CE65B47E9A501E4C0AED535C6669663BA707C884B3463D77F50F7382F36BD0AAB9B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

detects Windows exceutables potentially bypassing UAC using fodhelper.exe 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_fodhelper

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5496	powershell.exe
3152	powershell.exe
6036	powershell.exe
1988	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4848	Updater.exe
5244	Updater.exe
4732	Updater.exe
2392	Updater.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Updater.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Updater.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Updater.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2520	tasklist.exe
3528	tasklist.exe
5924	tasklist.exe
3532	tasklist.exe
1728	tasklist.exe
5400	tasklist.exe
6112	tasklist.exe
952	tasklist.exe
3196	tasklist.exe
4668	tasklist.exe
5328	tasklist.exe
2128	tasklist.exe
1196	tasklist.exe
572	tasklist.exe
4472	tasklist.exe
5944	tasklist.exe
4352	tasklist.exe
616	tasklist.exe
5784	tasklist.exe
4548	tasklist.exe
4908	tasklist.exe
2296	tasklist.exe
5424	tasklist.exe
756	tasklist.exe
3308	tasklist.exe
4236	tasklist.exe
5248	tasklist.exe
5716	tasklist.exe
4992	tasklist.exe
1580	tasklist.exe
1888	tasklist.exe
5344	tasklist.exe
1972	tasklist.exe
2948	tasklist.exe
1988	tasklist.exe
2516	tasklist.exe
5068	tasklist.exe
5248	tasklist.exe
5328	tasklist.exe
1896	tasklist.exe
1568	tasklist.exe
2348	tasklist.exe
4328	tasklist.exe
3276	tasklist.exe
5764	tasklist.exe
2760	tasklist.exe
1196	tasklist.exe
5240	tasklist.exe
4740	tasklist.exe
3852	tasklist.exe
4656	tasklist.exe
5328	tasklist.exe
4852	tasklist.exe
5764	tasklist.exe
1932	tasklist.exe
2816	tasklist.exe
3896	tasklist.exe
3444	tasklist.exe
4840	tasklist.exe
4648	tasklist.exe
2332	tasklist.exe
1792	tasklist.exe
3264	tasklist.exe
2248	tasklist.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5288	schtasks.exe
5068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5496	powershell.exe
5496	powershell.exe
5496	powershell.exe
3152	powershell.exe
3152	powershell.exe
3152	powershell.exe
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe
1988	powershell.exe
1988	powershell.exe
1988	powershell.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe
4848	Updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5188	tasklist.exe
Token: SeDebugPrivilege	1816	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	4120	tasklist.exe
Token: SeDebugPrivilege	4248	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	2468	tasklist.exe
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	2520	tasklist.exe
Token: SeDebugPrivilege	4472	tasklist.exe
Token: SeDebugPrivilege	5328	tasklist.exe
Token: SeDebugPrivilege	1308	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	4108	tasklist.exe
Token: SeDebugPrivilege	5400	tasklist.exe
Token: SeDebugPrivilege	3276	tasklist.exe
Token: SeDebugPrivilege	5244	tasklist.exe
Token: SeDebugPrivilege	1196	tasklist.exe
Token: SeDebugPrivilege	4348	tasklist.exe
Token: SeDebugPrivilege	3184	tasklist.exe
Token: SeDebugPrivilege	4996	tasklist.exe
Token: SeDebugPrivilege	6104	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	572	tasklist.exe
Token: SeDebugPrivilege	1356	tasklist.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	1888	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	5344	tasklist.exe
Token: SeDebugPrivilege	1792	tasklist.exe
Token: SeDebugPrivilege	2816	tasklist.exe
Token: SeDebugPrivilege	4548	tasklist.exe
Token: SeDebugPrivilege	4676	tasklist.exe
Token: SeDebugPrivilege	3552	tasklist.exe
Token: SeDebugPrivilege	5944	tasklist.exe
Token: SeDebugPrivilege	6128	tasklist.exe
Token: SeDebugPrivilege	3376	tasklist.exe
Token: SeDebugPrivilege	6112	tasklist.exe
Token: SeDebugPrivilege	3556	tasklist.exe
Token: SeDebugPrivilege	4656	tasklist.exe
Token: SeDebugPrivilege	5764	tasklist.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	4504	tasklist.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	1196	tasklist.exe
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	1956	tasklist.exe
Token: SeDebugPrivilege	2852	tasklist.exe
Token: SeDebugPrivilege	3444	tasklist.exe
Token: SeDebugPrivilege	4784	tasklist.exe
Token: SeDebugPrivilege	1036	tasklist.exe
Token: SeDebugPrivilege	3892	tasklist.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	5168	tasklist.exe
Token: SeDebugPrivilege	2816	tasklist.exe
Token: SeDebugPrivilege	4844	tasklist.exe
Token: SeDebugPrivilege	3460	tasklist.exe
Token: SeDebugPrivilege	3528	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 5188	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	90
PID 1116 wrote to memory of 1816	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	92
PID 1116 wrote to memory of 1144	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	94
PID 1116 wrote to memory of 4120	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	96
PID 1116 wrote to memory of 4248	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	98
PID 1116 wrote to memory of 2080	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	100
PID 1116 wrote to memory of 5524	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	102
PID 1116 wrote to memory of 2468	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	104
PID 1116 wrote to memory of 4840	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	106
PID 1116 wrote to memory of 2520	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	108
PID 1116 wrote to memory of 4472	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	110
PID 1116 wrote to memory of 5328	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	112
PID 1116 wrote to memory of 1308	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	114
PID 1116 wrote to memory of 2532	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	116
PID 1116 wrote to memory of 4936	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	118
PID 1116 wrote to memory of 2576	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	120
PID 1116 wrote to memory of 4108	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	122
PID 1116 wrote to memory of 5400	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	124
PID 1116 wrote to memory of 3276	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	126
PID 1116 wrote to memory of 5244	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	128
PID 1116 wrote to memory of 1196	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	130
PID 1116 wrote to memory of 4348	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	132
PID 1116 wrote to memory of 3184	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	134
PID 1116 wrote to memory of 4996	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	136
PID 1116 wrote to memory of 6104	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	138
PID 1116 wrote to memory of 5112	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	140
PID 1116 wrote to memory of 572	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	320
PID 1116 wrote to memory of 1356	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	144
PID 1116 wrote to memory of 3264	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	146
PID 1116 wrote to memory of 1888	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	148
PID 1116 wrote to memory of 1244	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	150
PID 1116 wrote to memory of 5344	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	152
PID 1116 wrote to memory of 1792	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	154
PID 1116 wrote to memory of 2816	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	376
PID 1116 wrote to memory of 4548	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	158
PID 1116 wrote to memory of 4676	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	160
PID 1116 wrote to memory of 3552	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	162
PID 1116 wrote to memory of 5944	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	330
PID 1116 wrote to memory of 6128	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	428
PID 1116 wrote to memory of 3376	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	338
PID 1116 wrote to memory of 6112	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	170
PID 1116 wrote to memory of 3556	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	172
PID 1116 wrote to memory of 4656	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	174
PID 1116 wrote to memory of 5764	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	439
PID 1116 wrote to memory of 1120	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	456
PID 1116 wrote to memory of 2760	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	294
PID 1116 wrote to memory of 3024	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	182
PID 1116 wrote to memory of 4504	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	354
PID 1116 wrote to memory of 4864	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	302
PID 1116 wrote to memory of 5068	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	188
PID 1116 wrote to memory of 4848	1116	2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	192
PID 4848 wrote to memory of 1196	4848	Updater.exe	193
PID 4732 wrote to memory of 1896	4732	Updater.exe	196
PID 4848 wrote to memory of 1956	4848	Updater.exe	198
PID 5244 wrote to memory of 2852	5244	Updater.exe	375
PID 4732 wrote to memory of 3444	4732	Updater.exe	455
PID 4848 wrote to memory of 4784	4848	Updater.exe	425
PID 4732 wrote to memory of 1036	4732	Updater.exe	372
PID 4848 wrote to memory of 3892	4848	Updater.exe	467
PID 5244 wrote to memory of 1568	5244	Updater.exe	463
PID 4848 wrote to memory of 5168	4848	Updater.exe	321
PID 4732 wrote to memory of 2360	4732	Updater.exe	418
PID 4732 wrote to memory of 2816	4732	Updater.exe	376
PID 4848 wrote to memory of 4844	4848	Updater.exe	383

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Updater.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Updater.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5244
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5344
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5944
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5068
- C:\Users\Admin\AppData\Local\Discord\Updater.exe
  C:\Users\Admin\AppData\Local\Discord\Updater.exe --installed
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4848
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    PID:5148
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    PID:4696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    PID:4760
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    - Discovers running processes
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    PID:4712
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    PID:5712
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    - Discovers running processes
    PID:4352
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    PID:1392
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    - Discovers running processes
    PID:2248
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    - Discovers running processes
    PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    PID:5164
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    PID:2360
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    PID:4612
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3528
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    - Discovers running processes
    PID:616
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    - Discovers running processes
    PID:1932
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    - Discovers running processes
    PID:5328
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    PID:2760
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    PID:4672
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    - Discovers running processes
    PID:5784
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    - Discovers running processes
    PID:4648
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    PID:5868
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    PID:1980
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    PID:572
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5168
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    - Discovers running processes
    PID:5924
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    PID:3124
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    PID:5944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    PID:5148
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:4740
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    PID:4604
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:3308
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    PID:5220
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    PID:4600
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    - Discovers running processes
    PID:3532
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    PID:5164
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2852
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    - Discovers running processes
    PID:2816
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    - Discovers running processes
    PID:4328
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    - Discovers running processes
    PID:3276
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    - Discovers running processes
    PID:1728
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    PID:2140
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5288
- - C:\Users\Admin\AppData\Local\Discord\Updater.exe
    C:\Users\Admin\AppData\Local\Discord\Updater.exe --watchdog 4848 --wd-target C:\Users\Admin\AppData\Local\Discord\Updater.exe
    3⤵
    - Executes dropped EXE
    PID:2392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1988

C:\Users\Admin\AppData\Local\Discord\Updater.exe
"C:\Users\Admin\AppData\Local\Discord\Updater.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  PID:3276
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  PID:3916
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  PID:5248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  PID:4228
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  PID:5104
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:1964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:3196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2360
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  PID:6052
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  PID:1288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:3260
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:4784
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6128
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  PID:4668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Discovers running processes
  PID:3896
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:2912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:5716
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  PID:5328
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  PID:5764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  PID:2332
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:3916
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:5252
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  PID:968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  PID:4112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:2128
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  PID:4852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:3444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  PID:3852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:4276
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  PID:1568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  PID:4992
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:3892
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:1580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:3196
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:240
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:4644
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:5424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:300
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:4584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:1884
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:2584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  PID:1792
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  PID:5148
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  PID:756
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  PID:4656
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:2320
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Discovers running processes
  PID:5068
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  PID:5248

C:\Users\Admin\AppData\Local\Discord\Updater.exe
C:\Users\Admin\AppData\Local\Discord\Updater.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  PID:3712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:4840
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  PID:4272
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  PID:5104
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  PID:2348
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:1208
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Discovers running processes
  PID:952
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:3292
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  PID:4668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Discovers running processes
  PID:2948
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:5340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:4908
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  PID:300
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  PID:1984
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  PID:2296
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:4604
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:4724
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  PID:1972
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  PID:4552
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:4864
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  PID:5240
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:3228
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:2852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:1580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:5424
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  PID:672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:3936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:756
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4272
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:3340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:1684
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:4504
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:5864
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:3632
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  PID:4236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:5760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  PID:1036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  PID:2516
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  PID:2472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4844
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  PID:2592
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:2584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:5716
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:4908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Updater.exe

Path C:\Users\Admin\AppData\Local\Discord\Updater.exe
Size 13.3MB
SHA256 154d984416941d6242bb44d6889b769095fc0530f75a0f6c8bb80df97d909aca
MD5 1ef1d22a0a69c2921f6500e37dd9098e
SHA1 875e7e2fe55a9e4d9935fee142508c946c779648
SHA512 5c55b1f9450371ab75957d3da0242b970ec6a9dddf9aa1929400503eeaccd82487a7dacad38229793ecebef97f23309d6db368c1df0dc2a9fb40676e42ec9b11
SSDEEP 98304:3LV9QQzd86EnOWsDPD8VXCK6CSrNWPwLlsZAo6aqECXnfkLzQe6grJaTW7re/J:7VhC6EO8cvMwKCXnfkLzQe6grJ1G
TLSH
T13CE65B47E9A501E4C0AED535C6669663BA707C884B3463D77F50F7382F36BD0AAB9B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp_wr
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies.tmp_wr

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.tmp_wr
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data.tmp_wr

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.tmp_wr
Size 138KB
SHA256 d1e2362431d3a621a0e59352e5db0311b3aeb46de43089e61b7df0bc2d357c72
MD5 65bb6304be3925ec27f5d2094248e04a
SHA1 271e4c39a44d4a381840b5a02a6a9b2951c7f220
SHA512 6111a80e2cc61d256b3f0f961cc137b0871ff443cea5909c674a6ab4776a958321e74a61b33fd7ecb50130df0e82580dd01e6327cba493f77eb32fc7d64fb087
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Oa1+hVumSVn+a:FnbZeMrv/hGta1+sn+a
TLSH
T108D3984B3A747502EDE59A722CE0517F5E3C716D8F1591D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies.tmp_wr

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.tmp_wr
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data.tmp_wr

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.tmp_wr
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 35c5a7604e3a1a23f5422d25dbf0c5908480803d7d5b13782da36174deb41749
MD5 a78e310911d624c017a8ccd81e644cf9
SHA1 c56b85e63ba69b36dc67735aacd646eeacf41a2d
SHA512 d7e340552ef2159522fe3a4cfe06f8d85ab454cb009e602e72e168dbe1860d64f3c4b624ed2765359d2082a673410af2d08298c11e9819dec862b5acb12a90a5
TLSH
T157115733B3CC8624C89A403650CEAC1036B597DB509ECF6BBB84D144B53F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

Updater_task.xml

Path C:\Users\Admin\AppData\Local\Temp\Updater_task.xml
Size 1KB
SHA256 c073886326054400298c946fd3ef0603df6bc4f6968457fcba1e82d65606ce74
MD5 f1911ec98cd6bbb4806c8aaf8b89c67f
SHA1 dee0e954cf207672553a3a01aaff844ae8bf0c83
SHA512 b6382a1f71375a0f57681eaeea245e3097795e2f28c5a0d85bf7e83935cfad53047d0cd58fcd4006d30b4cc9293ae02fbf5b2e2a7d3c0b6fe5a4f4d68767c74a
TLSH
T1F32132905C15F52F755A973ECB9153C3273E5B694AB64038D8CC4DBC648A1CA710397B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ujxjzth0.mn4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujxjzth0.mn4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 68454d9c8cb5d44545d34d54fd081ee767d379b16a8f6dd29ad658a04e4b61e7
MD5 86140b78921f80b868455031efa25aa0
SHA1 e240e76865e100c99dec42d540266a92421fe799
SHA512 74c3208d1fefcb6b88cd192790f612b89ea315d0aaffc2d25803212996d2038c5e2e38e5bac1470d036d32f27c34ef89796a63a00837a8d22270fbb861362f8b
TLSH
T128419CC778FB8A3EA445C1EBC2530389CE60A6151D29B0E28FE4814D23D700A7E85F75
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 5KB
SHA256 d467379d5aa1793e7da8ab04ea0a18d952bf243b525b17e3f45150fe112b583f
MD5 95ac2c03484eb927e2bfb9d8ecfdf1d4
SHA1 5e9445a5e1b1c87434cd8d0d13279317bb8d3da4
SHA512 ea9c2b91e59e6f2b08a27206fcada7464f1d122e3aff212f23a54e2f180e762689895b0b2fdfbcdba37d4c7f812acad88eae9b12a0c00a0f5a15453f8aecddd1
SSDEEP 96:o8oN7U55QON7VarRON7XON7wCLpliChmyJiRh/y0V/96kKnx/IfG/+/cvTzbsLbc:SNqNyANSN3pliChmyJiRh/ye1Unx/qEt
TLSH
T1D1B164933AB3593E60B280E761B2435C9E3652249F85F1C147DC4A0D23E640A2FEAF79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 eb63c0ce6999eb4b879538f5b48aa7c75c05d897a16674954bbe2a0f41ee4330
MD5 80858c855b5fdb8d25f656d8a9d64c74
SHA1 078859ec9cd53a7600049f3e186f059ba8fc05f1
SHA512 20ee18020ecaef0ce9bd6808392b5b6feb232c94c209075c2e3f2be38ef01160f4bb51cdb3d87b851b7827aa8c9cd3fe2609b5503ab1bfdf3f4de2bc591dd5d9
TLSH
T15411ADC339FB8B2E6495C0DBC3520789CD20A6191D29B0E38BE0824D23CA40B7E81F75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5496-17-0x00000247BD7C0000-0x00000247BD7E2000-memory.dmp

Download