72f76c62a2ccf0075fd152ad26ec532a0e4a1a8f831f7f1b853a49ca100d287b

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe
Size 3.6MB
Sample261027-q46hksdw21
SHA256 72f76c62a2ccf0075fd152ad26ec532a0e4a1a8f831f7f1b853a49ca100d287b
MD5 7c3081bafdbf567251a9fd7d8d986fba
SHA1 74740ab9c5dc4d20d3980357ee60096e92289ba6
SHA512 19ac2d0d6b8b2708b7cee761dc0b8d10f60eb2df63fd433982638704d23e8fbb4751cc1f743c979cf7ff11fc38e278ae6ad2bb927fa5424946a6d77148559f55
SSDEEP 49152:u++MB9P91XphIl8pF58HsKkZrXvCHLvQu2XG8ZoI9Z9rqyI44HppuzGxHHY4LA:u+hBp75lKkBcwWGoqZ92yVG/uzGNVM
TLSH
T19806D02BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1244	powershell.exe
5536	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
2916	PeerService.exe
4012	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3296	tasklist.exe
640	tasklist.exe
4784	tasklist.exe
2328	tasklist.exe
3056	tasklist.exe
1852	tasklist.exe
5488	tasklist.exe
2348	tasklist.exe
1132	tasklist.exe
5812	tasklist.exe
6112	tasklist.exe
4408	tasklist.exe
4448	tasklist.exe
5324	tasklist.exe
5548	tasklist.exe
5580	tasklist.exe
3816	tasklist.exe
4020	tasklist.exe
5820	tasklist.exe
3504	tasklist.exe
5296	tasklist.exe
6080	tasklist.exe
2196	tasklist.exe
3432	tasklist.exe
4280	tasklist.exe
5252	tasklist.exe
5144	tasklist.exe
2404	tasklist.exe
5112	tasklist.exe
5604	tasklist.exe
4700	tasklist.exe
5208	tasklist.exe
4604	tasklist.exe
3744	tasklist.exe
5372	tasklist.exe
1712	tasklist.exe
5012	tasklist.exe
1460	tasklist.exe
3204	tasklist.exe
3828	tasklist.exe
5008	tasklist.exe
5864	tasklist.exe
1988	tasklist.exe
4544	tasklist.exe
4388	tasklist.exe
4888	tasklist.exe
4280	tasklist.exe
4688	tasklist.exe
1124	tasklist.exe
2772	tasklist.exe
2876	tasklist.exe
4144	tasklist.exe
1836	tasklist.exe
60	tasklist.exe
1932	tasklist.exe
3792	tasklist.exe
884	tasklist.exe
2820	tasklist.exe
5404	tasklist.exe
3056	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3544	cmd.exe
5568	cmd.exe
5600	cmd.exe
5216	cmd.exe
4272	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2668	timeout.exe
5456	timeout.exe
2052	timeout.exe
864	timeout.exe
2660	timeout.exe
764	timeout.exe
3304	timeout.exe
1684	timeout.exe
396	timeout.exe
4928	timeout.exe
3076	timeout.exe
4164	timeout.exe
5300	timeout.exe
4220	timeout.exe
4428	timeout.exe
4288	timeout.exe
1480	timeout.exe
5304	timeout.exe
2368	timeout.exe
1344	timeout.exe
776	timeout.exe
2704	timeout.exe
4528	timeout.exe
4732	timeout.exe
1188	timeout.exe
848	timeout.exe
1980	timeout.exe
3956	timeout.exe
2876	timeout.exe
3828	timeout.exe
4100	timeout.exe
1680	timeout.exe
5416	timeout.exe
5400	timeout.exe
5436	timeout.exe
4116	timeout.exe
5848	timeout.exe
2468	timeout.exe
1336	timeout.exe
3244	timeout.exe
4940	timeout.exe
732	timeout.exe
5896	timeout.exe
2784	timeout.exe
5380	timeout.exe
6120	timeout.exe
1868	timeout.exe
5064	timeout.exe
6056	timeout.exe
5768	timeout.exe
684	timeout.exe
3952	timeout.exe
4720	timeout.exe
5144	timeout.exe
4944	timeout.exe
5820	timeout.exe
3488	timeout.exe
5452	timeout.exe
2712	timeout.exe
5624	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1244	powershell.exe
1244	powershell.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	4144	tasklist.exe
Token: SeDebugPrivilege	5536	powershell.exe
Token: SeDebugPrivilege	5296	tasklist.exe
Token: SeDebugPrivilege	5008	tasklist.exe
Token: SeDebugPrivilege	4408	tasklist.exe
Token: SeDebugPrivilege	6080	tasklist.exe
Token: SeDebugPrivilege	1836	tasklist.exe
Token: SeDebugPrivilege	4020	tasklist.exe
Token: SeDebugPrivilege	5864	tasklist.exe
Token: SeDebugPrivilege	5252	tasklist.exe
Token: SeDebugPrivilege	5012	tasklist.exe
Token: SeDebugPrivilege	1460	tasklist.exe
Token: SeDebugPrivilege	5324	tasklist.exe
Token: SeDebugPrivilege	3056	tasklist.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	4888	tasklist.exe
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	60	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	4700	tasklist.exe
Token: SeDebugPrivilege	5548	tasklist.exe
Token: SeDebugPrivilege	5208	tasklist.exe
Token: SeDebugPrivilege	5144	tasklist.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	5488	tasklist.exe
Token: SeDebugPrivilege	1988	tasklist.exe
Token: SeDebugPrivilege	4688	tasklist.exe
Token: SeDebugPrivilege	3204	tasklist.exe
Token: SeDebugPrivilege	2348	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	3744	tasklist.exe
Token: SeDebugPrivilege	5580	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	3792	tasklist.exe
Token: SeDebugPrivilege	5404	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	1132	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	3056	tasklist.exe
Token: SeDebugPrivilege	4448	tasklist.exe
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	4784	tasklist.exe
Token: SeDebugPrivilege	6112	tasklist.exe
Token: SeDebugPrivilege	2328	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	5372	tasklist.exe
Token: SeDebugPrivilege	5820	tasklist.exe
Token: SeDebugPrivilege	5604	tasklist.exe
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	640	tasklist.exe
Token: SeDebugPrivilege	1712	tasklist.exe
Token: SeDebugPrivilege	2876	tasklist.exe
Token: SeDebugPrivilege	3504	tasklist.exe
Token: SeDebugPrivilege	3828	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	884	tasklist.exe
Token: SeDebugPrivilege	3816	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 4272	5480	2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe	85
PID 4272 wrote to memory of 2156	4272	cmd.exe	87
PID 5480 wrote to memory of 2916	5480	2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe	88
PID 2916 wrote to memory of 5568	2916	PeerService.exe	91
PID 2916 wrote to memory of 3544	2916	PeerService.exe	92
PID 5568 wrote to memory of 1244	5568	cmd.exe	96
PID 3544 wrote to memory of 4280	3544	cmd.exe	97
PID 3544 wrote to memory of 2720	3544	cmd.exe	98
PID 4012 wrote to memory of 5600	4012	PeerService.exe	100
PID 4012 wrote to memory of 5216	4012	PeerService.exe	102
PID 5216 wrote to memory of 4144	5216	cmd.exe	105
PID 5216 wrote to memory of 3464	5216	cmd.exe	106
PID 5600 wrote to memory of 5536	5600	cmd.exe	107
PID 5216 wrote to memory of 1684	5216	cmd.exe	109
PID 3544 wrote to memory of 2052	3544	cmd.exe	108
PID 3544 wrote to memory of 5296	3544	cmd.exe	113
PID 3544 wrote to memory of 4100	3544	cmd.exe	114
PID 5216 wrote to memory of 5008	5216	cmd.exe	115
PID 5216 wrote to memory of 1480	5216	cmd.exe	116
PID 5216 wrote to memory of 1868	5216	cmd.exe	117
PID 3544 wrote to memory of 5400	3544	cmd.exe	118
PID 3544 wrote to memory of 4408	3544	cmd.exe	120
PID 3544 wrote to memory of 2280	3544	cmd.exe	121
PID 5216 wrote to memory of 6080	5216	cmd.exe	122
PID 5216 wrote to memory of 1352	5216	cmd.exe	123
PID 5216 wrote to memory of 5436	5216	cmd.exe	127
PID 3544 wrote to memory of 5452	3544	cmd.exe	128
PID 5216 wrote to memory of 1836	5216	cmd.exe	129
PID 5216 wrote to memory of 984	5216	cmd.exe	130
PID 3544 wrote to memory of 4020	3544	cmd.exe	131
PID 3544 wrote to memory of 2356	3544	cmd.exe	132
PID 5216 wrote to memory of 1980	5216	cmd.exe	133
PID 3544 wrote to memory of 3244	3544	cmd.exe	134
PID 3544 wrote to memory of 5864	3544	cmd.exe	135
PID 3544 wrote to memory of 4600	3544	cmd.exe	136
PID 5216 wrote to memory of 5252	5216	cmd.exe	137
PID 5216 wrote to memory of 2188	5216	cmd.exe	138
PID 3544 wrote to memory of 2368	3544	cmd.exe	139
PID 5216 wrote to memory of 3956	5216	cmd.exe	140
PID 5216 wrote to memory of 5012	5216	cmd.exe	141
PID 5216 wrote to memory of 1728	5216	cmd.exe	142
PID 3544 wrote to memory of 1460	3544	cmd.exe	143
PID 3544 wrote to memory of 4628	3544	cmd.exe	144
PID 5216 wrote to memory of 1344	5216	cmd.exe	145
PID 3544 wrote to memory of 5064	3544	cmd.exe	146
PID 5216 wrote to memory of 5324	5216	cmd.exe	149
PID 5216 wrote to memory of 3940	5216	cmd.exe	150
PID 3544 wrote to memory of 3056	3544	cmd.exe	151
PID 3544 wrote to memory of 3048	3544	cmd.exe	152
PID 3544 wrote to memory of 4944	3544	cmd.exe	153
PID 5216 wrote to memory of 396	5216	cmd.exe	154
PID 3544 wrote to memory of 4388	3544	cmd.exe	156
PID 3544 wrote to memory of 1256	3544	cmd.exe	157
PID 5216 wrote to memory of 4888	5216	cmd.exe	158
PID 5216 wrote to memory of 4788	5216	cmd.exe	159
PID 3544 wrote to memory of 4116	3544	cmd.exe	160
PID 5216 wrote to memory of 2668	5216	cmd.exe	161
PID 3544 wrote to memory of 2820	3544	cmd.exe	162
PID 3544 wrote to memory of 4868	3544	cmd.exe	163
PID 5216 wrote to memory of 60	5216	cmd.exe	164
PID 5216 wrote to memory of 4520	5216	cmd.exe	165
PID 3544 wrote to memory of 5896	3544	cmd.exe	166
PID 5216 wrote to memory of 5768	5216	cmd.exe	167
PID 5216 wrote to memory of 1124	5216	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4280
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4020
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5864
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3048
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4700
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3352
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:864
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5488
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:880
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2348
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1152
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2404
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4940
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5580
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5404
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4544
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3760
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:624
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5372
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1712
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4372
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3504
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5560
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:924
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5304

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3464
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1868
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:984
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3956
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1728
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1344
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3940
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4788
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2668
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5604
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3684
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3828
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1616
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1680
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3792
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4884
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2712
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4136
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2696
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:848
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2332
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3124
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:884
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 63f3369719ec0f4063138a71ba369a25fb4824bc035eaa4072ee6a5a1812480a
MD5 e7d0883e28000a6270cf6b3b3f7b6c5a
SHA1 74d916eb15baa5ce4a168cd80d3d2c45d503daa2
SHA512 4b4ade064020959bc677689fa658816c8c498c8117df70a1ae4076533972593b4e2c3bf45d39e28662892e12db07641f14870ef69292e81030f8b3d7c92302f1
TLSH
T1C5112223F38C8920CC96163A509DAC5172B596CB81EEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xgzyhjnu.kwg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgzyhjnu.kwg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.7MB
SHA256 c30b754a9f50fdbc76e467339bdbc1e78c8b3bc7c80cba1495f3714184c3dcf1
MD5 c56bb4f31f800c211fcacef14ab23142
SHA1 71166906d9b081ad71ae6acd12db31cfce95bfe6
SHA512 bff96a7406df4dd15ada509d7f270f360628d46ef6f1784e8f5441b79d7869093c3036c79bd24bd080c6835f33a8df481b469a34caf0a6363da26050ee28d724
SSDEEP 196608:u+hBtOkSnByQyVG/uzGNVkByQyVG/uzGNVyAl3K8fCGnbP3Jzz:htOtNSG/lVsNSG/lVrl3KExL3Jzz
TLSH
T12486026BB26901E8D1BFD17CC9165903EBB2780543A0A7DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX9749.tmp

Path C:\Users\Admin\AppData\Roaming\PeerService\RCX9749.tmp
Size 2.0MB
SHA256 9b7b9b0836adf6ac47881abc32969f452f43444d9a4e7a48719c744a2072df98
MD5 a954f8f36cf7f2d9aa357e612cbae8dc
SHA1 cd46a5efc9646ea8fffa104bc7054b9f6cc55380
SHA512 c624b5953890cdbffb9de57a4d1b2907ed0ac8f4d4179a6201d44f85ac187cb56492b82ee09fe3e9ea763f881823d9e1737bc6337bde0d863c2fd860fed7acfd
SSDEEP 24576:lY++M/XZ9PSyTYkFxR7TphIig8pF5sXHW5KQxZDvPXVFCHZ+0H:u++MB9P91XphIl8pF58HsKkZrXvCHL
TLSH
T133A57D2BB26901E8E1BFD17CC9165907EBB1780503A0A7DF12E047A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-27-0x000001F5FE110000-0x000001F5FE132000-memory.dmp

Download

memory/1244-39-0x000001F5FE140000-0x000001F5FE35C000-memory.dmp

Download

memory/5536-43-0x00000256C0550000-0x00000256C076C000-memory.dmp

Download