4bbccea6ff853e7b308c762882df82d6b4079cee0908f7664898f6f8820f16af

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe
Size 29.0MB
Sample261023-jb653scd84
SHA256 4bbccea6ff853e7b308c762882df82d6b4079cee0908f7664898f6f8820f16af
MD5 c952dfb6d5cb62eed97a1a6d78e7b57f
SHA1 80a6370728b655cefa929917f3fdf5404e129085
SHA512 d9f45d289f3c14a6bd061429495dfd421396b1e9e3fed260bea7d43c3e55cdfed016d698a19d922488c00b66c923d12c9ef11caea28a1544eeb5f4a5472a6738
SSDEEP 393216:GRLIbf77xkn1PYRYXG9ntWoSdjXlj42g5:8LkfqoYXRoSdjXi2
TLSH
T14B67BF05FBC940B1D5E785389E67D36BD636B8214B30CECBA190691D6E73BC14A39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	handle64.exe
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	handle64.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	handle64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	handle64.exe

Executes dropped EXE 5 IoCs

pid	Process
4240	CisWarrantyTool.exe
1148	handle.exe
1872	handle64.exe
3420	handle.exe
5732	handle64.exe

Loads dropped DLL 1 IoCs

pid	Process
4240	CisWarrantyTool.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CisWarrantyTool	CisWarrantyTool.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	CisWarrantyTool.exe
File opened (read-only)	\??\V:	CisWarrantyTool.exe
File opened (read-only)	\??\X:	CisWarrantyTool.exe
File opened (read-only)	\??\V:	handle64.exe
File opened (read-only)	\??\P:	handle64.exe
File opened (read-only)	\??\T:	handle64.exe
File opened (read-only)	\??\A:	CisWarrantyTool.exe
File opened (read-only)	\??\U:	handle64.exe
File opened (read-only)	\??\G:	CisWarrantyTool.exe
File opened (read-only)	\??\H:	CisWarrantyTool.exe
File opened (read-only)	\??\L:	CisWarrantyTool.exe
File opened (read-only)	\??\Z:	handle64.exe
File opened (read-only)	\??\S:	handle64.exe
File opened (read-only)	\??\Z:	CisWarrantyTool.exe
File opened (read-only)	\??\V:	handle64.exe
File opened (read-only)	\??\W:	handle64.exe
File opened (read-only)	\??\Q:	CisWarrantyTool.exe
File opened (read-only)	\??\R:	CisWarrantyTool.exe
File opened (read-only)	\??\Y:	CisWarrantyTool.exe
File opened (read-only)	\??\S:	handle64.exe
File opened (read-only)	\??\X:	handle64.exe
File opened (read-only)	\??\N:	CisWarrantyTool.exe
File opened (read-only)	\??\B:	handle64.exe
File opened (read-only)	\??\J:	handle64.exe
File opened (read-only)	\??\J:	handle64.exe
File opened (read-only)	\??\T:	handle64.exe
File opened (read-only)	\??\R:	handle64.exe
File opened (read-only)	\??\B:	CisWarrantyTool.exe
File opened (read-only)	\??\G:	handle64.exe
File opened (read-only)	\??\D:	handle64.exe
File opened (read-only)	\??\G:	handle64.exe
File opened (read-only)	\??\O:	handle64.exe
File opened (read-only)	\??\H:	handle64.exe
File opened (read-only)	\??\R:	handle64.exe
File opened (read-only)	\??\H:	handle64.exe
File opened (read-only)	\??\S:	CisWarrantyTool.exe
File opened (read-only)	\??\A:	handle64.exe
File opened (read-only)	\??\K:	handle64.exe
File opened (read-only)	\??\L:	handle64.exe
File opened (read-only)	\??\M:	handle64.exe
File opened (read-only)	\??\O:	handle64.exe
File opened (read-only)	\??\K:	handle64.exe
File opened (read-only)	\??\L:	handle64.exe
File opened (read-only)	\??\D:	CisWarrantyTool.exe
File opened (read-only)	\??\I:	handle64.exe
File opened (read-only)	\??\M:	handle64.exe
File opened (read-only)	\??\B:	handle64.exe
File opened (read-only)	\??\M:	CisWarrantyTool.exe
File opened (read-only)	\??\P:	CisWarrantyTool.exe
File opened (read-only)	\??\U:	CisWarrantyTool.exe
File opened (read-only)	\??\P:	handle64.exe
File opened (read-only)	\??\Q:	handle64.exe
File opened (read-only)	\??\N:	handle64.exe
File opened (read-only)	\??\Q:	handle64.exe
File opened (read-only)	\??\I:	CisWarrantyTool.exe
File opened (read-only)	\??\T:	CisWarrantyTool.exe
File opened (read-only)	\??\I:	handle64.exe
File opened (read-only)	\??\W:	handle64.exe
File opened (read-only)	\??\J:	CisWarrantyTool.exe
File opened (read-only)	\??\N:	handle64.exe
File opened (read-only)	\??\U:	handle64.exe
File opened (read-only)	\??\Y:	handle64.exe
File opened (read-only)	\??\A:	handle64.exe
File opened (read-only)	\??\X:	handle64.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3796	tasklist.exe
5136	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5748	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CisWarrantyTool.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CisWarrantyTool.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	handle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	handle.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1732	netstat.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4240	CisWarrantyTool.exe
4240	CisWarrantyTool.exe
2284	powershell.exe
2284	powershell.exe
1828	powershell.exe
1828	powershell.exe
5748	powershell.exe
5748	powershell.exe
5748	powershell.exe
1872	handle64.exe
1872	handle64.exe
1872	handle64.exe
1872	handle64.exe
1872	handle64.exe
1872	handle64.exe
1872	handle64.exe
1872	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
5732	handle64.exe
1708	powershell.exe
1708	powershell.exe
1708	powershell.exe
572	powershell.exe
572	powershell.exe
572	powershell.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1872	handle64.exe
5732	handle64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTcbPrivilege	4240	CisWarrantyTool.exe
Token: SeDebugPrivilege	1732	netstat.exe
Token: SeSecurityPrivilege	4176	wevtutil.exe
Token: SeBackupPrivilege	4176	wevtutil.exe
Token: SeSecurityPrivilege	5200	wevtutil.exe
Token: SeBackupPrivilege	5200	wevtutil.exe
Token: SeSecurityPrivilege	1604	wevtutil.exe
Token: SeBackupPrivilege	1604	wevtutil.exe
Token: SeSecurityPrivilege	4152	wevtutil.exe
Token: SeBackupPrivilege	4152	wevtutil.exe
Token: SeSecurityPrivilege	3212	wevtutil.exe
Token: SeBackupPrivilege	3212	wevtutil.exe
Token: SeSecurityPrivilege	3436	wevtutil.exe
Token: SeBackupPrivilege	3436	wevtutil.exe
Token: SeSecurityPrivilege	1588	wevtutil.exe
Token: SeBackupPrivilege	1588	wevtutil.exe
Token: SeSecurityPrivilege	3016	wevtutil.exe
Token: SeBackupPrivilege	3016	wevtutil.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeIncreaseQuotaPrivilege	2284	powershell.exe
Token: SeSecurityPrivilege	2284	powershell.exe
Token: SeTakeOwnershipPrivilege	2284	powershell.exe
Token: SeLoadDriverPrivilege	2284	powershell.exe
Token: SeSystemProfilePrivilege	2284	powershell.exe
Token: SeSystemtimePrivilege	2284	powershell.exe
Token: SeProfSingleProcessPrivilege	2284	powershell.exe
Token: SeIncBasePriorityPrivilege	2284	powershell.exe
Token: SeCreatePagefilePrivilege	2284	powershell.exe
Token: SeBackupPrivilege	2284	powershell.exe
Token: SeRestorePrivilege	2284	powershell.exe
Token: SeShutdownPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeSystemEnvironmentPrivilege	2284	powershell.exe
Token: SeRemoteShutdownPrivilege	2284	powershell.exe
Token: SeUndockPrivilege	2284	powershell.exe
Token: SeManageVolumePrivilege	2284	powershell.exe
Token: 33	2284	powershell.exe
Token: 34	2284	powershell.exe
Token: 35	2284	powershell.exe
Token: 36	2284	powershell.exe
Token: SeIncreaseQuotaPrivilege	2284	powershell.exe
Token: SeSecurityPrivilege	2284	powershell.exe
Token: SeTakeOwnershipPrivilege	2284	powershell.exe
Token: SeLoadDriverPrivilege	2284	powershell.exe
Token: SeSystemProfilePrivilege	2284	powershell.exe
Token: SeSystemtimePrivilege	2284	powershell.exe
Token: SeProfSingleProcessPrivilege	2284	powershell.exe
Token: SeIncBasePriorityPrivilege	2284	powershell.exe
Token: SeCreatePagefilePrivilege	2284	powershell.exe
Token: SeBackupPrivilege	2284	powershell.exe
Token: SeRestorePrivilege	2284	powershell.exe
Token: SeShutdownPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeSystemEnvironmentPrivilege	2284	powershell.exe
Token: SeRemoteShutdownPrivilege	2284	powershell.exe
Token: SeUndockPrivilege	2284	powershell.exe
Token: SeManageVolumePrivilege	2284	powershell.exe
Token: 33	2284	powershell.exe
Token: 34	2284	powershell.exe
Token: 35	2284	powershell.exe
Token: 36	2284	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	5748	powershell.exe
Token: SeDebugPrivilege	1872	handle64.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 4240	2324	2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe	90
PID 4240 wrote to memory of 4936	4240	CisWarrantyTool.exe	91
PID 4240 wrote to memory of 3832	4240	CisWarrantyTool.exe	92
PID 4240 wrote to memory of 2948	4240	CisWarrantyTool.exe	94
PID 4240 wrote to memory of 1732	4240	CisWarrantyTool.exe	95
PID 4240 wrote to memory of 3356	4240	CisWarrantyTool.exe	96
PID 4240 wrote to memory of 4176	4240	CisWarrantyTool.exe	98
PID 4240 wrote to memory of 5200	4240	CisWarrantyTool.exe	99
PID 4240 wrote to memory of 1604	4240	CisWarrantyTool.exe	101
PID 4240 wrote to memory of 4152	4240	CisWarrantyTool.exe	102
PID 4240 wrote to memory of 3212	4240	CisWarrantyTool.exe	103
PID 4240 wrote to memory of 3436	4240	CisWarrantyTool.exe	104
PID 4240 wrote to memory of 1588	4240	CisWarrantyTool.exe	105
PID 4240 wrote to memory of 3016	4240	CisWarrantyTool.exe	106
PID 4240 wrote to memory of 2656	4240	CisWarrantyTool.exe	107
PID 4240 wrote to memory of 2284	4240	CisWarrantyTool.exe	108
PID 4240 wrote to memory of 1828	4240	CisWarrantyTool.exe	109
PID 1828 wrote to memory of 5748	1828	powershell.exe	110
PID 5748 wrote to memory of 1328	5748	powershell.exe	113
PID 4240 wrote to memory of 1148	4240	CisWarrantyTool.exe	114
PID 1148 wrote to memory of 1872	1148	handle.exe	115
PID 4240 wrote to memory of 3420	4240	CisWarrantyTool.exe	117
PID 3420 wrote to memory of 5732	3420	handle.exe	118
PID 4240 wrote to memory of 3796	4240	CisWarrantyTool.exe	119
PID 4240 wrote to memory of 5136	4240	CisWarrantyTool.exe	120
PID 4240 wrote to memory of 1708	4240	CisWarrantyTool.exe	121
PID 4240 wrote to memory of 572	4240	CisWarrantyTool.exe	122
PID 4240 wrote to memory of 248	4240	CisWarrantyTool.exe	123
PID 4240 wrote to memory of 5028	4240	CisWarrantyTool.exe	124
PID 4240 wrote to memory of 1528	4240	CisWarrantyTool.exe	125
PID 4240 wrote to memory of 2720	4240	CisWarrantyTool.exe	126
PID 4240 wrote to memory of 2676	4240	CisWarrantyTool.exe	127
PID 4240 wrote to memory of 976	4240	CisWarrantyTool.exe	128
PID 4240 wrote to memory of 1592	4240	CisWarrantyTool.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\cwte592cb3\CisWarrantyTool.exe
  C:\Users\Admin\AppData\Local\Temp\cwte592cb3\CisWarrantyTool.exe --out "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59.zip"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKLM\SYSTEM\CurrentControlSet\Services\CmdAgent" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\Configs\Config_1.reg.tmp" /y
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKLM\SOFTWARE\COMODO" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\Configs\Config_2.reg.tmp" /y
    3⤵
    PID:3832
- - C:\Windows\SYSTEM32\cmd.exe
    cmd
    3⤵
    PID:2948
- - C:\Windows\SYSTEM32\netstat.exe
    netstat.exe -a -n -o
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\SYSTEM32\msinfo32.exe
    msinfo32.exe /nfo "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\MsInfo32\msinfo32.nfo"
    3⤵
    - Enumerates system info in registry
    PID:3356
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "Application" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\Application.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "Security" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\Security.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "Setup" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\Setup.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "System" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\System.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "COMODO Client - Security CEF" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\COMODO Client - Security CEF.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "COMODO Internet Security CEF" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\COMODO Internet Security CEF.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "COMODO Client - Security Trace" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\COMODO Client - Security Trace.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil.exe epl "COMODO Internet Security Trace" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsEvents\COMODO Internet Security Trace.evtx"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /query /FO CSV /V
    3⤵
    PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "$FormatEnumerationLimit=-1; Get-HotFix"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "$FormatEnumerationLimit=-1; Get-WindowsUpdateLog"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5748
    - - C:\Windows\system32\tracerpt.exe
        
        "C:\Windows\system32\tracerpt.exe" C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.001020.321.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.001125.299.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.001125.299.2.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.001125.299.3.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.003159.884.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.003413.476.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.003624.457.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.003835.511.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.004050.449.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260912.004249.688.1.etl -of XML -o C:\Users\Admin\AppData\Local\Temp\WindowsUpdateLog\wuetl.XML.tmp.f7b740e8-42ca-4169-8423-6899c464edfc.00000 -y
        5⤵
        
        PID:1328
- - C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe
    "C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe" -accepteula -a -u
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\handle64.exe
      "C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe" -accepteula -a -u
      4⤵
      Drops file in Drivers directory
      Sets service image path in registry
      Executes dropped EXE
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- - C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe
    "C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe" -accepteula -s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\handle64.exe
      "C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe" -accepteula -s
      4⤵
      Drops file in Drivers directory
      Sets service image path in registry
      Executes dropped EXE
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      PID:5732
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe /svc
    3⤵
    - Discovers running processes
    PID:3796
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe /v
    3⤵
    - Discovers running processes
    PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "$FormatEnumerationLimit=-1; [Environment]::GetEnvironmentVariables('Machine') | Out-String -Width 4096"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "$FormatEnumerationLimit=-1; [Environment]::GetEnvironmentVariables('User') | Out-String -Width 4096"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "$FormatEnumerationLimit=-1; [Environment]::GetEnvironmentVariables() | Out-String -Width 4096"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:248
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsInstallerHives\HKU_.DEFAULT_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
    3⤵
    PID:5028
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsInstallerHives\HKU_S-1-5-19_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
    3⤵
    PID:1528
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsInstallerHives\HKU_S-1-5-20_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
    3⤵
    PID:2720
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKU\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsInstallerHives\HKU_S-1-5-21-696679853-3915825385-3233721679-1000_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
    3⤵
    PID:2676
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKU\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsInstallerHives\HKU_S-1-5-21-696679853-3915825385-3233721679-1000_Classes_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
    3⤵
    PID:976
- - C:\Windows\SYSTEM32\reg.exe
    reg.exe export "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsInstallerHives\HKU_S-1-5-18_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
    3⤵
    PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f98ee71829b1356367b2ad169cefe4d9c2301e44e458f7780e08c959c2046ad0
MD5 44cb488cefeae9465d34a8b67785a103
SHA1 4ff52ca9bd0cf301ecc9df4a2b0868ffd155e180
SHA512 a4bb176d39fbe11b776655d775021216499a5e4688560ea28c392187a51ee8c8c53f3dac73736f26024de9b02fec51293093ec4c882465ea089a043fc0a091af
SSDEEP 1536:rKLAozYoNz8zMSfKQDxflJneCUp9Y/h4iUxkaT/JKO8pv/cOdB4V3CNBQkj2jaVa:rKLAozYoNz8zMSfKQDxflJn9Up9Y/qie
TLSH
T122637392E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5303ce8313aa9fc3216d8e8a23d3da1eed34f5bbb8ac188953c41e74f3655ece
MD5 7cf05489a77727d60e3c30b8762186e9
SHA1 05f807f3f666223210af5f253550cd394b349380
SHA512 9b92f5ee1be79847427b1e7fcdf0c0d1b156008ee5bfc29023ffe0feba81d59fcfa09f55aa53e5fef1455eecd241dc428ce027da824cebd0c67a40b62ca73762
TLSH
T186419777F3DC8621CC8E403B50C9EC1932A6C7E7909E9FA3BB44D648A13F2A9CE51150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f2546c2845d45124a83d3bb6cc6f0413c11fc67762bfe9661ebc9ee5d8d006ac
MD5 e8dbb729606ddacd68129d98b51590f7
SHA1 4d31168fec7a133d44b44ec6d57f0f4add91b5cd
SHA512 97e2f0e408677e7f173aee56f4fd1c04cf3aa2c3ebb4f989ecc5471581136f7d3254864580a9204b922639968635c1449c3152724f0d10fa91e9071399d92bff
TLSH
T1EF117A33F3CC8724DC9A403650CEEC1036B6CBDB409EDE5BAB84D548B42F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
MD5 33f7a6fe6a1ea0bc7232e4b50743aaab
SHA1 f6389fac11178ade648f5f722858ade7790e8676
SHA512 64fed57e8e59a8d4c52029e5b9a9e95959a860dd2b01f96eda9e0484d0ae4572a4759db8892bacc9ddc3f3b2def74d2f9da00853aedc08b55520c731ed45658a
TLSH
T12C115733F3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c84583dfedffb1ab8abd6bff365dc1a3bbaed0f7b94533e01f720521b7632401
MD5 dd998d579d93e21b348fb9edb434e680
SHA1 1e63def5e42b4d9d22688d7514a29f7a385a9ebc
SHA512 bff01ca12cd8683ab9ef4e2c17926d48a11e04335d6af1188993b4975c28646e743db50d617439a1520819b84b35da7720b6aa598cd579f30384903de87415a6
TLSH
T127115733F3CC8664C89A413650DEAC1036B687DB519ECE9BBB84D154B43F69ACE61160
MD5 SHA1 SHA512 TLSH

Submit Download

C__VTROOT.txt

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\DirectoryTree\C__VTROOT.txt
Size 22B
SHA256 83110204fbfcf242d593765cdc8dd866f257c38480bb1b9cba15d15163d4a13e
MD5 c1df69a9ae5bacab29cdd57bcb81a6e6
SHA1 988fa7543f671d4f68a48c08f90d102cb8315be4
SHA512 45fc3de67704b674b9b20a65a96cf910c046a005e2820ceb5d16b932b12f2290ada5099480532a915e6eebf75f0c8b302b53f6147c0e7d4af53723c91d065b81
MD5 SHA1 SHA512

Submit Download

Output.txt

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\Output.txt
Size 4KB
SHA256 8643c92b23d0a20603854031d859e32de3fa5be59aabb8ffef7895c2f5316b1b
MD5 cf283d1752bb348604c677b103f11c3b
SHA1 fad24e802f3f4253dc4b7e32c03785c923b66624
SHA512 d81c28857f6b0cff6e848e96168865b82fe138d4c30a45c3923342db47ffc83356eb044fff83f3b42199f90371432137e0df9256299dc3ab0686b77bcb743260
SSDEEP 96:3UmgUpyFU6pjOXk7Lk90k+Ub4oxUhxRnVomM4HsEZSltAu:3jDyiijik7Lk90kVb4oxUhxEmM8u
TLSH
T1B8A15D45DB6E82D021F9B08B334D6C8C8222FC6772A921761598473D7B99E6C3FF51D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Machine.txt

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\Environment\Machine.txt
Size 68KB
SHA256 665f2cb09d5b90efe459cfa437af95c859d37f64c90058b7ee700e61925c1d64
MD5 515968117dccc5ef1a3396340e277f9a
SHA1 06fb4563b75d5e2cb2e42534c21d21f69964d79e
SHA512 543dd35d81aa030c0f9746972b5dee6529468c650b6099f726d410e6fa7b0871e45041dee5b7a94bd36a5b5d9398a3de147112ac0103d7ed0ebbf64399c32f30
SSDEEP 24:qkE7BSV7csw9x4MRMAbj9SUtPX77BgYt7COrv:TE7BSV7Mx4QLtP77BgYt7hrv
TLSH
T1AF6336A21BB4C790E0A11B34924B9A2192D8FA96B2121031738C3641EF3470EAE55AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msinfo32.nfo

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\MsInfo32\msinfo32.nfo
Size 162KB
SHA256 3c44635befe5eadcb7500608a7775c6f00d416871d7cf54aa274f93ab772d7ce
MD5 f30f64654a74cc452741ba10aa7886bc
SHA1 5370a18cec0af7858386fe059fd007a4c568b7d6
SHA512 94e73404311fe0c6df18e821aa63de5be1246ed5786ed2591f0c0d51954a8471fe20bc1309e7a6e925a2ada6a01126911a3650bda83159e7c6b223079018f722
SSDEEP 3072:m49MVcxpJoyVT9NAm7PRhvSJ00lKbgGBwrytcXuJpOT4V6/khmk/6V4TOp83ns90:m0
TLSH
T1D1F30D031BFC120AAEB7A9EC97714125B756F9F1AB58D08D20F2648DC0F6C638DA1797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handle.exe -a -u.txt

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\Sysinternals\handle\handle.exe -a -u.txt
Size 976KB
SHA256 a987a0aba9246707eab054fe2f1d7600387871746df45df827aa99194650c559
MD5 9aaf74b96a220680dcd3b9a18881edaa
SHA1 bacdfabe8f8180547379e975102f4ce22622c297
SHA512 6acb9ec469b54b87fc7ba23188fb25681578de8662d6448a587a6bc0afd69b0ccf991b2e1f5a077943cea884b7ccba6236ce94a49c6aa007bbef148dda3da447
SSDEEP 6144:YBZej5w7Om3qV7zZtX5wykzDht+wp9007ylDhUILH45VhvbAyKR9XPTRvL7n4+Sn:avsOOx4z7B
TLSH
T1D72558050502C9B14372E33432044A07D7E5E7E76A737D39319F6AA49B7338A7E9E2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Get-WindowsUpdateLog.log

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsUpdates\Get-WindowsUpdateLog.log
Size 1KB
SHA256 840cdb0db2ca353343af40616b92cae1987f3578513ed84e8ab98e9f2a05bc89
MD5 c92f6351728f78fb79d1709e78a5481b
SHA1 4988b71151b1addf04ebbcb05944f373fe5b6125
SHA512 cc29751e64e8d4726b0875bcf5a9818903461dfdf95a3496351a5bfc0153ea06cc30c96187960b8ba1b96f0785db966e06dc3ebde16ae47cedf15c11534418cd
TLSH
T14B218E873CB8C271D931DC7E82AF2B1AC351BD9B7345261476A88414BF05B53ED6E4D8
MD5 SHA1 SHA512 TLSH

Submit Download

OSversion.txt

Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OIKPOMQY_2026-10-23_08-30-59\WindowsState\WindowsVersion\OSversion.txt
Size 133B
SHA256 70ef5236a1af11bdbe284933c2a86f986164d5d0b702cce1c858a62e42ad5392
MD5 b00bc6b5698e656c3b31eb783729a435
SHA1 6e0e434fad60d63827d519a328caf7135fcef986
SHA512 c6fbace9a065e6b2f47a84e2624b9d8d8d19679e35e9bb48bed0ae7dace5292624118c4e604cb843436113ea580015085f905fb0833c80f1ce67c79997495b51
TLSH
T1A4C02B238520D0711C114203B0081B43F315D3730520414443CC2C0D14C3F0F431E439
MD5 SHA1 SHA512 TLSH

Submit Download

wuetl.XML.tmp.f7b740e8-42ca-4169-8423-6899c464edfc.00000

Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdateLog\wuetl.XML.tmp.f7b740e8-42ca-4169-8423-6899c464edfc.00000
Size 1.3MB
SHA256 94098ce646d2c1ca48f5f16a58a87477d2812fc51f42b7c1b55d577f78e2e76a
MD5 a4e366bff26a792911c2249efdf3ff9a
SHA1 59296f4b731241d3e22a9bbcbb2dcdb2246042ee
SHA512 bdc28f4fc4d6a06d03af777d9f6580683c6475478f2d14dcacfcb3aff80f2b9f1416f8267d8ec0c1301c2824766ddc30e9380f67edc46f58e50e4581742995a9
SSDEEP 1536:Cba74lY4Z7B0AO61gwICiOD9aC1WcTV4/iBUs1nz8zF0fbcZaKRxjTD3LeyZcQE1:ia7cNpOmgycZ618YSP9tzcDae
TLSH
T1A855AE34B1847E80EE4617974337B90924BB3FE731F581E8E0D9E9777346065A2A38A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuetl.log.tmp.f7b740e8-42ca-4169-8423-6899c464edfc.00000

Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdateLog\wuetl.log.tmp.f7b740e8-42ca-4169-8423-6899c464edfc.00000
Size 234KB
SHA256 126d10a7428409525fc9126a315cb5e3c83d51a1896beb099272882724c0b1fb
MD5 abf8cf8d3d01bcfb235ed3eceb76a42f
SHA1 c46c270d141be42d87fb334499288cc221c56514
SHA512 2537f3c1932173d39a4818432b7413d5741a4d8254408e1dea02a289dfa682d700ef34189da8a91c80ac7c0c4bd9a7ad813f8e9013633664742ab1188e60f8fd
SSDEEP 6144:6hlkfCq4PW3l6krJyGLV//QQz9pN6wgjcVC/4Fwgk0F0XqItQC5NfWzR2LHOA:vOh
TLSH
T16834A570931B69FE66E26B18E29658C41B15730BB62E731830FF46C4DB05E909FB49BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1izuubca.jxd.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1izuubca.jxd.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CisWarrantyTool.exe

Path C:\Users\Admin\AppData\Local\Temp\cwte592cb3\CisWarrantyTool.exe
Size 3.8MB
SHA256 9057dc841439c52e1a27d4f9413417cdc60f2d2174d5085a71a8da488605f254
MD5 51d1559409ee3f868d8a330fe321cbb3
SHA1 6165e62b448458f4dd8d6669959bff0445f376ea
SHA512 2bcc7b37a2adbe86cb79a0ac9d66a7d444411570ecff3bacec6bc230a2941070eee67a0f8be6bdf50ad2afdeac9e814d65f3bd2e4cc7968b4dd201c114242491
SSDEEP 49152:ZyMRQ9TA4okwvZlU313D9FYLDxQq9Qeypg6uJavyaPjONVhoFK8+ZUxZGoJdNIg:bWi9oeeuavFjOeFKpoJdNIg
TLSH
T13C068E0577A840E0C0B7C5389A928646E7B278550F35EBDF11A1AE6F3F33AD24D79722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdres.DLL

Path C:\Users\Admin\AppData\Local\Temp\cwte592cb3\cmdres.DLL
Size 469KB
SHA256 7d3562140961f3746c3df8a34f2e0b7e409b3ad67cfd72dd06fc83558e0c66ad
MD5 351505060a1dbde609d2cdd6d160549b
SHA1 9dbf244681a823aa3966aacbdf3dad5c83750b87
SHA512 c5b1dce4641f4c0848241c57eb5a4331e7531e1a202b6b06942faa9b46654438aeb452a1d990acdbbadc3fa355aff1edef920f5dd4450bb38a54c91c6c3928b6
SSDEEP 6144:QTWISj6vlaOLKmo0XKvz2uMNkDAsdAoKXTA46jltt0p3XJ5sbQXbBAltzG:QTJG6vlaOLzXGnJDptto0bxt6
TLSH
T109A4394EEAC41877EC4184BF8D334252A7B16C5F33A0C24571A8B069BF7FB844A7D56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handle.exe

Path C:\Users\Admin\AppData\Local\Temp\cwte592cb3\handle.exe
Size 743KB
SHA256 84c22579ca09f4fd8a8d9f56a6348c4ad2a92d4722c9f1213dd73c2f68a381e3
MD5 9f637fba2d680e23da0266c1507f870f
SHA1 05d4842c6e9b5f9430dad76a20c2a4a6feae0bf0
SHA512 addf414497df3a057ba57afab06a61f0ffb7c50134b0c83b61fe6542ec25298b893a455b317262977786f30723a23948836b402d310d6ae4bee1e6cf17a0272c
SSDEEP 12288:Lsfe2MShO2bM1teJFN9rVY5C1lq7oFpuoIG6h:Lsfe2Y2bItIHY5C1lq0nus6h
TLSH
T126F47C01F7E440B5E5B36A304AB5D6569A3ABC650B30DADF2394466E1F33BC09E35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handle64.exe

Path C:\Users\Admin\AppData\Local\Temp\handle64.exe
Size 406KB
SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
MD5 89f845fc4898f2d47a3a81f0b57c60f1
SHA1 b04a2347a0f94e87215424d816f9912c7bc248d5
SHA512 50bc14c4221ad984c3aa98327ee9127f7470a9a2b0a953544440a7b05f60f7f91209a96bd87d0d8f1e05551863dd43193f7f4231f382d6ad75d9f0a245939f04
SSDEEP 6144:MjRme/IYVCQ45De1/8GzfaD3f7oxakAuXeh3ohaYLCAyI5ub:MN9rVY5C1lq7oFpuoIGi
TLSH
T12A948E05F7E400E9E5B7A6348D758546DA727C594B30D6AF23A4866E1F33BC08E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-71-0x000001E5B1830000-0x000001E5B183A000-memory.dmp

Download

memory/1828-74-0x000001E5B2990000-0x000001E5B2B9A000-memory.dmp

Download

memory/1828-73-0x000001E5B2600000-0x000001E5B2776000-memory.dmp

Download

memory/1828-66-0x000001E5B1800000-0x000001E5B181E000-memory.dmp

Download

memory/1828-70-0x000001E5B1820000-0x000001E5B1826000-memory.dmp

Download

memory/1828-65-0x000001E5B17D0000-0x000001E5B17DA000-memory.dmp

Download

memory/1828-64-0x000001E5B1710000-0x000001E5B17C2000-memory.dmp

Download

memory/1828-63-0x000001E5B16F0000-0x000001E5B170E000-memory.dmp

Download

memory/1828-69-0x000001E5B17F0000-0x000001E5B17F8000-memory.dmp

Download

memory/1828-68-0x000001E5B1840000-0x000001E5B185C000-memory.dmp

Download

memory/1828-67-0x000001E5B17E0000-0x000001E5B17EA000-memory.dmp

Download

memory/2284-54-0x000002C635030000-0x000002C635052000-memory.dmp

Download