55034f8533437e710d8f7b866f982de83a6c85e1350ccab7800111714e8fbd42

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.9MB
Sample260905-cm66wsbd88
SHA256 55034f8533437e710d8f7b866f982de83a6c85e1350ccab7800111714e8fbd42
MD5 9caa21e87562682bf61c47070d6f8b68
SHA1 ed442037434e2376102adee829c049f92688c337
SHA512 5aa990c9ec3ef42c41ddf7d3952dae69996920295af092b0220ea261e94b77e81fefda7a5cb77cfb3de7a753186da372293c2610f54c1a52c82a4dff0ac1954d
SSDEEP 49152:PB+jhMrE0b0jKTm00v4HGXTHEGwkuBCgD3rboqPHyYPmiBb/Gkj/9tNrba1yrjEh:PB2eQiEp0kXITDyYjLsk5E
TLSH
T153763907EC6515E9C1AD96318AB69353BB71BC490B3223D32B60F2786E77BD0AD79340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5712	powershell.exe
1324	powershell.exe
2552	powershell.exe
2056	powershell.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3196	server-remote.exe
3808	server-remote.exe
5672	server-remote.exe
1708	server-remote.exe
4328	edgeconnect.exe
4868	edgeconnect.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4256	tasklist.exe
4108	tasklist.exe

GoLang User-Agent 4 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	14	Go-http-client/1.1
HTTP User-Agent header	16	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	13	Go-http-client/1.1

Kills process with WMI 3 IoCs

defense_evasion

pid	Process
3004	wmic.exe
1056	wmic.exe
3420	wmic.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1256	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2156	schtasks.exe
1892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1324	powershell.exe
1324	powershell.exe
2552	powershell.exe
2552	powershell.exe
2552	powershell.exe
3004	wmic.exe
3004	wmic.exe
3004	wmic.exe
3004	wmic.exe
2056	powershell.exe
2056	powershell.exe
1056	wmic.exe
1056	wmic.exe
1056	wmic.exe
1056	wmic.exe
5712	powershell.exe
5712	powershell.exe
3420	wmic.exe
3420	wmic.exe
3420	wmic.exe
3420	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	tasklist.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	4108	tasklist.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3004	wmic.exe
Token: SeSecurityPrivilege	3004	wmic.exe
Token: SeTakeOwnershipPrivilege	3004	wmic.exe
Token: SeLoadDriverPrivilege	3004	wmic.exe
Token: SeSystemProfilePrivilege	3004	wmic.exe
Token: SeSystemtimePrivilege	3004	wmic.exe
Token: SeProfSingleProcessPrivilege	3004	wmic.exe
Token: SeIncBasePriorityPrivilege	3004	wmic.exe
Token: SeCreatePagefilePrivilege	3004	wmic.exe
Token: SeBackupPrivilege	3004	wmic.exe
Token: SeRestorePrivilege	3004	wmic.exe
Token: SeShutdownPrivilege	3004	wmic.exe
Token: SeDebugPrivilege	3004	wmic.exe
Token: SeSystemEnvironmentPrivilege	3004	wmic.exe
Token: SeRemoteShutdownPrivilege	3004	wmic.exe
Token: SeUndockPrivilege	3004	wmic.exe
Token: SeManageVolumePrivilege	3004	wmic.exe
Token: 33	3004	wmic.exe
Token: 34	3004	wmic.exe
Token: 35	3004	wmic.exe
Token: 36	3004	wmic.exe
Token: SeIncreaseQuotaPrivilege	3004	wmic.exe
Token: SeSecurityPrivilege	3004	wmic.exe
Token: SeTakeOwnershipPrivilege	3004	wmic.exe
Token: SeLoadDriverPrivilege	3004	wmic.exe
Token: SeSystemProfilePrivilege	3004	wmic.exe
Token: SeSystemtimePrivilege	3004	wmic.exe
Token: SeProfSingleProcessPrivilege	3004	wmic.exe
Token: SeIncBasePriorityPrivilege	3004	wmic.exe
Token: SeCreatePagefilePrivilege	3004	wmic.exe
Token: SeBackupPrivilege	3004	wmic.exe
Token: SeRestorePrivilege	3004	wmic.exe
Token: SeShutdownPrivilege	3004	wmic.exe
Token: SeDebugPrivilege	3004	wmic.exe
Token: SeSystemEnvironmentPrivilege	3004	wmic.exe
Token: SeRemoteShutdownPrivilege	3004	wmic.exe
Token: SeUndockPrivilege	3004	wmic.exe
Token: SeManageVolumePrivilege	3004	wmic.exe
Token: 33	3004	wmic.exe
Token: 34	3004	wmic.exe
Token: 35	3004	wmic.exe
Token: 36	3004	wmic.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 4256	5832	2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 5832 wrote to memory of 1324	5832	2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 5832 wrote to memory of 2704	5832	2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 5832 wrote to memory of 2156	5832	2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 5832 wrote to memory of 3196	5832	2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 5832 wrote to memory of 4108	5832	2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 3196 wrote to memory of 2552	3196	server-remote.exe	101
PID 3196 wrote to memory of 4304	3196	server-remote.exe	105
PID 3196 wrote to memory of 1892	3196	server-remote.exe	107
PID 3196 wrote to memory of 5672	3196	server-remote.exe	110
PID 5672 wrote to memory of 1708	5672	server-remote.exe	111
PID 1708 wrote to memory of 1256	1708	server-remote.exe	112
PID 1708 wrote to memory of 3004	1708	server-remote.exe	114
PID 1708 wrote to memory of 2056	1708	server-remote.exe	116
PID 1708 wrote to memory of 4328	1708	server-remote.exe	118
PID 4328 wrote to memory of 1056	4328	edgeconnect.exe	119
PID 4328 wrote to memory of 1668	4328	edgeconnect.exe	121
PID 4328 wrote to memory of 5712	4328	edgeconnect.exe	123
PID 4328 wrote to memory of 3420	4328	edgeconnect.exe	125
PID 4328 wrote to memory of 4868	4328	edgeconnect.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq server-remote.exe" /FI "PID ne 5832" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "ProxyNetwork Watchdog" /F
  2⤵
  PID:2704
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN "ProxyNetwork Watchdog" /TR "\"C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe\" -watchdog" /SC MINUTE /MO 5 /RL LIMITED
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2156
- C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
  C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "ProxyNetwork Watchdog" /F
    3⤵
    PID:4304
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "ProxyNetwork Watchdog" /TR "\"C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe\" -watchdog" /SC MINUTE /MO 5 /RL LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1892
- - C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
    C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
      C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /FI "IMAGENAME eq server-remote.exe" /FI "PID ne 1708"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where "Name='edgeconnect.exe' and ProcessId<>1708 and not CommandLine like '%-watchdog%'" call terminate
        5⤵
        Kills process with WMI
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\edgeconnect.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Creates a file in the Startup directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\ProxyNetwork\edgeconnect.exe
        
        C:\Users\Admin\AppData\Local\ProxyNetwork\edgeconnect.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where "Name='edgeconnect.exe' and ProcessId<>4328 and not CommandLine like '%-watchdog%'" call terminate
        6⤵
        Kills process with WMI
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "ProxyNetwork Watchdog" /F
        6⤵
        
        PID:1668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "$sc = (New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5712
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic process where "Name='edgeconnect.exe' and CommandLine like '%-watchdog%'" call terminate
        6⤵
        Kills process with WMI
        Suspicious behavior: EnumeratesProcesses
        
        PID:3420
      - C:\Users\Admin\AppData\Local\ProxyNetwork\edgeconnect.exe
        
        C:\Users\Admin\AppData\Local\ProxyNetwork\edgeconnect.exe -watchdog
        6⤵
        Executes dropped EXE
        
        PID:4868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq server-remote.exe" /FI "PID ne 5832" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4108

C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
"C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe"
1⤵
- Executes dropped EXE
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

.provider_key

Path C:\Users\Admin\AppData\Local\ProxyNetwork\.provider_key
Size 32B
SHA256 cdccee34eadafcda95eeb8406f5be1f0effae8666caee1f3294f196428e8451a
MD5 5ec2ee5238fe512a38a815aae3e5fb05
SHA1 3d87ae3105ceedfe7e124c30657c6b4a7607ed0c
SHA512 0ce0ec5f237cd09b97b885e162f3c4e91760e4e1a3de88bcf699b6e38764dec2ecc628eccb4361d371d11a25da7b42b4c018753c9678b2fe62cf6823ced6f333
MD5 SHA1 SHA512

Submit Download

client-install.json

Path C:\Users\Admin\AppData\Local\ProxyNetwork\client-install.json
Size 25B
SHA256 004dcab13761655436f9b00315d77ae8865b072562ac4c4240e7e7446d09a829
MD5 cb5a0cb771f989fa6cddd6beb4df3ebd
SHA1 d315ed4a7b7212b0699b8c417a1ba05a9eedf787
SHA512 059d2246af2b01e9406b3d956dd4850a1ca13ae2847475e268fd86eaa6e6601ca8ad439af684d987fe4a015fbccaead84bc58e9ab69230a1d0f98d10910e6fbc
MD5 SHA1 SHA512

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
Size 241B
SHA256 bffd7229ce464663d22b98217ae4f5aff6def781561acbb48fa0c4c3eb134da2
MD5 4e7e2c79bcbf0fdfa9d1978c2e34a2c1
SHA1 6516a4bc6c7bee83783db31e091f567947b7773d
SHA512 5f0a95111b22dab0083a000652c0e7c602f93f7d60a6c64b13720706a8a791ed41075500dcf607d6f938a76fb3a26c816ab87961c21fda338f1fee7c4994d9b2
TLSH
T1ACD0A719985142752E0AC06FC22323C642C27D556B3D37DD7799440F216941EAFE7A42
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
Size 698B
SHA256 1753052623adb63f62481a57f3c289f761875f03ed4e645e2eec43fbe902d5d3
MD5 5ad49c75a41e7903fd94ad38ee3e79b9
SHA1 210432a7b643476ab9042e4da3bd961a2b4b1a8e
SHA512 5ca6baeb19f5f15720553075d82a2ec545c73ae1624d4306c9d20e09a5af9a0acb5f05ece57402c2fe31c603a8df3dc56dab3769e8a68dac90d555859db73c39
TLSH
T1F301700DA01181BA3D1A84BFD533574741C67D44773D33D9BB8D400E51B645EBBAAD85
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
Size 760B
SHA256 73d2c4c1584608d825ae46de2a2edbb67843bd2002aea9603e7935940d6049e7
MD5 26a9566a57d701cd953c9f6b15ab3057
SHA1 afc1e9c356c6c4782a959903f7ab0c0aa2aac60d
SHA512 d62bf30dc9ee800192079238db87c9b8b3625ea5130598a81268ad2db985470bed4e0c1b2005de3f269fb0069443a28f8ba7ca24b15213cf3de0e32a71d85e41
TLSH
T19201494D902181BA2D1A80BFD132665341C67D04A73D33D9BB8E400E51B641EBBAAD85
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
Size 1KB
SHA256 4b472c969391284d4c21609dc8bb9ff37c649f4a165e29bdba1a0caa11e165d6
MD5 1c258ee85cf58dc8038e440325a76d19
SHA1 0ef322bc700ebe7a0682510507c750c49a38ba1d
SHA512 ee742c4f2c471aefa0156b9120fa941f5c248cba31a7d90019ed718b72ee9797dd66e60237cae8a762bf4fbea9ca357685503db0beeb05070f1507c54af06186
TLSH
T1D811894D902180BA3D0990BFC13266D352C67E04B73E23DDB7CF400E10B68AEBB97986
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
Size 1KB
SHA256 0f110a8aa85d0e1005d8288a74eb57a63a916e59389f8b222656ee0dd7737c5d
MD5 e7e4451c2d64965b2b4589a3a154c82f
SHA1 ac35e91bb4a091798d3bbc16cff137ef490d949c
SHA512 948aa94aa3037dfe149fc365779a1274c933935f654393fdf02244142cce83ac9b336fc5a0ad7c6bb8fc9c93a41410a62e332a02760b4a07d53e2560377688f6
TLSH
T13F216B4D8062C07A2D0980BFC13266C352D67E04B73E33DDB7CE400E51B646EBB969C6
MD5 SHA1 SHA512 TLSH

Submit Download

server-remote.exe

Path C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
Size 6.9MB
SHA256 55034f8533437e710d8f7b866f982de83a6c85e1350ccab7800111714e8fbd42
MD5 9caa21e87562682bf61c47070d6f8b68
SHA1 ed442037434e2376102adee829c049f92688c337
SHA512 5aa990c9ec3ef42c41ddf7d3952dae69996920295af092b0220ea261e94b77e81fefda7a5cb77cfb3de7a753186da372293c2610f54c1a52c82a4dff0ac1954d
SSDEEP 49152:PB+jhMrE0b0jKTm00v4HGXTHEGwkuBCgD3rboqPHyYPmiBb/Gkj/9tNrba1yrjEh:PB2eQiEp0kXITDyYjLsk5E
TLSH
T153763907EC6515E9C1AD96318AB69353BB71BC490B3223D32B60F2786E77BD0AD79340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server-remote.exe.new

Path C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe.new
Size 7.0MB
SHA256 e404c30d9c901c60e9654c73a4bd7ea7c99ab34589ea66183e1c3ec6755505cd
MD5 61dc6b43f84893ddf68f91142a558d05
SHA1 e8826d0b2309f72b46a40b6fb222b3e453673296
SHA512 a6a443b5162bedeb36ca26b7314faaaacad910e5e656f8ec8086919a13dce2bdc33d8397a8924fa8043b879bf261a6bc51d159b897ee75291ee1853ea01d2e47
SSDEEP 49152:UWQV28j4qJXMAI6Pct/EdpbFqKq2xK504NPKGrbfuBuAvH+mNQhcjQe9Z5WKQK1n:UWCn0yv3KZbaheotWOrEIb
TLSH
T13A764947EC6918E9C1ADA23089B296537B71BC490B3223C72B50F6386F77BD0AD79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-pending.json

Path C:\Users\Admin\AppData\Local\ProxyNetwork\update-pending.json
Size 96B
SHA256 f4644a87aa0a31cc22ea0f51b2833fa921f2709c16fa14e5237c07e6aae4b341
MD5 285dc6b3a17d5a57b8d761a01f8540b0
SHA1 5115c700d6e7a3986ce6a94cbba7f4b87a52a860
SHA512 3937090ee648689ed4b8bd702292779b34dfcd3f698ccb3287a41508419847daf08925b36625b17d8c6ecf3d794747a4d09956d126e791384cba8a79e6069a36
TLSH
T181B012128C8C90953C000554025D50D02378062D1F90DF9D07C5050045A20526835014
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2erw5a0i.5ly.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2erw5a0i.5ly.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Proxy Network.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk
Size 1KB
SHA256 8b1892bab5dec8e10b3d26da4aa69156e637173f7d614cd5b7eca2950e901b75
MD5 1a68a24aa5cd9801cbaf20c1aa146d06
SHA1 d29c8ccc14f357b2d849124fd7a4a967296c4c7c
SHA512 3663509f20a4cb3867f5e2e26765dbee5ff7c1f765c3d8aa9eef5d99c7562ff16e5b691851a63a31f3e9d317773f47126efa6f70b5a2c946289b144e29e3455b
TLSH
T15921230247D21B02F3B9C33146FBA27C86B77842FB919F4D4040524C0D7DA525685FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Proxy Network.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk
Size 1KB
SHA256 2016b43b125d98e5ae8c74c7d9727f75c58b56c17c9942eaf67452979df7ccdd
MD5 eaa821056c48765e011fad33c2266182
SHA1 b88ba01a0fc2db7e2c49fe81e0f110de72442339
SHA512 0f73e6977418e80208be3dda4cc5c612ae0c7e8c2afc962ccd3cf9d6ed23fb012805914bd0506029713c0e0405895685a8842d6a5703acd608211f9b01ea2f9e
TLSH
T189210D0206E20B06E3B9837556FBA568C6777C46F7A18F4D4080A24D1D6CB426A49FAF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1324-16-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-7-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-8-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-6-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-1-0x00007FFF8C95F000-0x00007FFF8C960000-memory.dmp

Download

memory/1324-9-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-5-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-12-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-11-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/1324-4-0x00000183F7FA0000-0x00000183F7FC2000-memory.dmp

Download

memory/1324-10-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/5672-34-0x00007FF6BD7C0000-0x00007FF6BFF0B000-memory.dmp

Download