65f169c6d38873e5a01143b08b90afd4bcb6088beedc374ab93edc1e49caf152

Analysis

user interaction
yes
max time kernel
150s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cracked by @ntpx.exe
Size 535.5MB
Sample260522-vpp99sdw3s
SHA256 65f169c6d38873e5a01143b08b90afd4bcb6088beedc374ab93edc1e49caf152
MD5 977bbe9b31d8ad6fdeeddf87d5006c45
SHA1 2abe23a07751dc0ff8b750b5d2e38b5756fc05c0
SHA512 d8bea520cb1b56b72024f8b35babfe2162341c7da7f8a22ebe0f02e235a15e39a4af6077eabf15f97d6088a6b5a956083d6f3f6e5bb81a95807b4e5dc502f8ef
SSDEEP 3145728:RVLH7yDhpmFzVeQXBOn60rqVLH7yDhpmFzV:LLH74gs8LH74
TLSH
T152499C03F29A41E9E05DD175974A9633EA71B80A4B25B3CF2A5807522F77EF81B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cracked by @ntpx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cracked by @ntpx.exe

Loads dropped DLL 8 IoCs

pid	Process
1588	cracked by @ntpx.exe
1588	cracked by @ntpx.exe
1588	cracked by @ntpx.exe
1588	cracked by @ntpx.exe
1588	cracked by @ntpx.exe
1588	cracked by @ntpx.exe
1588	cracked by @ntpx.exe
3968	cracked by @ntpx.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Hide Artifacts: Ignore Process Interrupts 1 TTPs 46 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1160	powershell.exe
548	powershell.exe
2264	powershell.exe
4252	powershell.exe
4512	powershell.exe
5192	powershell.exe
5000	powershell.exe
5324	powershell.exe
5616	powershell.exe
5272	powershell.exe
5488	powershell.exe
5424	powershell.exe
2428	powershell.exe
4560	powershell.exe
2892	powershell.exe
5876	powershell.exe
5040	powershell.exe
700	powershell.exe
5468	powershell.exe
4532	powershell.exe
4768	powershell.exe
5244	powershell.exe
4816	powershell.exe
596	powershell.exe
5908	powershell.exe
4748	powershell.exe
1380	powershell.exe
5052	powershell.exe
456	powershell.exe
4912	powershell.exe
4936	powershell.exe
5720	powershell.exe
6080	powershell.exe
5980	powershell.exe
4920	powershell.exe
4452	powershell.exe
3584	powershell.exe
3724	powershell.exe
5936	powershell.exe
4228	powershell.exe
4204	powershell.exe
3132	powershell.exe
1936	powershell.exe
3800	powershell.exe
976	powershell.exe
5352	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1864	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	1864	cracked by @ntpx.exe
Token: SeShutdownPrivilege	1864	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	1864	cracked by @ntpx.exe
Token: SeShutdownPrivilege	1864	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	1864	cracked by @ntpx.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1588	1864	cracked by @ntpx.exe	84
PID 1864 wrote to memory of 5088	1864	cracked by @ntpx.exe	85
PID 1864 wrote to memory of 3968	1864	cracked by @ntpx.exe	86

C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
"C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --gpu-preferences=SAAAAAAAAADgABQEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,11495746254947486706,1153295590121071130,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Loads dropped DLL
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --field-trial-handle=1836,i,11495746254947486706,1153295590121071130,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1836,i,11495746254947486706,1153295590121071130,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2456 /prefetch:1
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_Processor).Name"
  2⤵
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_DiskDrive | Select-Object -First 1).SerialNumber"
  2⤵
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_BaseBoard).SerialNumber"
  2⤵
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_VideoController | Where-Object { $_.Caption -notmatch 'Microsoft Basic|Virtual|Parsec|TeamViewer|AnyDesk|VNC|VMware|VirtualBox|Hyper-V|RDP|Citrix|Indirect' } | Select-Object -First 1).Name"
  2⤵
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:6008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:456
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --gpu-preferences=SAAAAAAAAADoABQEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,11495746254947486706,1153295590121071130,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:6092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a3cd526171c1318c7824e97a2b569d2512526723072087ee7d20e2093f6d3be4
MD5 b0537532ae1fd7cae7d92945f7ca20f4
SHA1 d2d4891e1ea1138c6169bf2dc79a4d535508261f
SHA512 488c16f9c53b71a6c7b7a3815481f4b76b9ca96ac4816632f2de4fe87a6ef550304a200fc5de90feb0e93dd3e526d524375ab697a93a67d2561c3dc994218417
TLSH
T1B021A827B3DCCA21CC86123A009D9C1172B283C7809ECFAF6BC0D600A07F9D8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 1fbb95fde0b16ecd3cacd5914f8750c6de116753d2227cb8350a043891dcb14c
MD5 94dae59660082117d4370cbd18d8eba8
SHA1 199df7fffe5e3817f6882207d5971efb3e740c95
SHA512 d2f50f4d18913731a1393dfa2030a36010224f9f288860cc92768b273b86695a20b251827c1252d3addecd0c234b8a9d73adf9e2a6a27790c0a206257cf5859c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37
MD5 b08c623a4c3d593e0197312ee60fd80b
SHA1 d758f831d82d40e2cf2b5303928840fef63c6e08
SHA512 0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500
TLSH
T11B217427B3DCC9A1CC86163A109D9C1176B783C780AEDFDF6BC0D614A1BF998CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 e64811c3e57476bb644539824034cabe2cabcb88941122193e2af328f5eb2133
MD5 217d9191dfd67252cef23229676c9eda
SHA1 80d940b01c28e3933b9d68b3e567adc2bac1289f
SHA512 86767aa3c0eec425b7c6dbfd70a4a334fb5b1227c05fb06fbb3845e7b6974008386276f441c8e66e2bf9b0ae0a76133c4e5602211788cd702eaeadd12c5ff757
TLSH
T198112223F38C8921CC96163A509DAC5172B686CB81AFDE9F7FC0C210E1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 c99619b5acdc7217bbd262106129ea1661b531c2890476300771b706477d9734
MD5 a5ace5b1e1392854c698257bee4f3e7a
SHA1 47aed60a3a2fc5157dd62b0849a411f616fb3072
SHA512 ed15a10ff08892d8a49b04c3b208016be3f416813ed233e30c2d41ceb0720b5c987101fa4dee8d5adafcfb823784c40011f1c1aba141110f3a7a5a276e14144e
TLSH
T100112223F38C8960CC96563A509DAC5172B686CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 a36a9813bf3b96ead474179b0a07fd96e13abc1920eb0a4828eca5fc34a27d12
MD5 393b0dd912015db6b9f455c13c931b61
SHA1 423466b784b87d0924a441df0b201be898972d5f
SHA512 b96f994b5a40b1e618886813cb5e2486ec0237de7d892ca10dbf7f441733b5161b30343de96e5b6df783373e02f14e41db5a5e63bed0aaaf907d1fb115041e0f
TLSH
T167112223F38C8920CC96163A509DAC5172B686CB81AFDF9F7FC0C210A5BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 473079088f98bf990b6977d9ef78b9304bc0c1e1c326a497657ff5adfb089ec6
MD5 effddbda8509125f47e5a754c218fc20
SHA1 759d1bebf0099e54ffe6ddd6f5dd2c682a51646f
SHA512 4ad1ba45d95cd4de371a7a273d89a706b0cda9a521a7aaacc422a6ed2b4f66ed5a279b67699bd1ae7cfc8c523755b154db8486571348e734578358ef0c559e91
TLSH
T177112223F38C8920CC96563A509DAC5172B686DB81AFDE9F7FC0C210A1BF984CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zftcx0bb.ygf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zftcx0bb.ygf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

evbA45A.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA45A.tmp
Size 1KB
SHA256 6f663ee9856827b7b9cf38acec4f249c5b19176f957c158131354f0abb3ccce2
MD5 e9356df67233463857c04da33ad45c38
SHA1 afcbfe5b68bea8472df7b3eaf67a86314924be51
SHA512 465b96cae86a1cb3ab25d1d740fbf86bb58c3c7d2ea64d901a8bbacb0e18978958d0649c39f809ee2ede5ce606ce3cb59e84ce455ae478b21e23608410f0695c
TLSH
T182315E13D6108AB6C15D473896E2992C26B8AC3457E916560FB0047DEC957704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evbA49A.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA49A.tmp
Size 1KB
SHA256 09fca3fb71d25b86c409e0ecca9b6674b91b4e3b11d62b4465c9d85bfa61b37d
MD5 1c937358f29c4914ba85bae452be5741
SHA1 9800ee0e5f7c3e6a45ca94d1cbcdaafbb0183f00
SHA512 44344a0af5522ea8f11e5b3316ecc505984dcb5d72dd70de9f5b58a46f0c8aefc00311fe9595bc1bdc361566737b8d4485af1ce9b59fe4b608f73edca8e17e62
TLSH
T1B7315E12D6108AB2C14D073A96D2996C26B8AC3453E95A560FB0047DFC853304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evbA518.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA518.tmp
Size 1KB
SHA256 e10065f646191ed62afc7af78f6be2d12d6cad8d5df3ee1bb12db6c3a92de004
MD5 9a0a215627aabfe09ec9ad1737a481a7
SHA1 d8f3a7276dfbdca98079f9c84d19b18f473caf85
SHA512 da7300a77a08de90be1a079e23a448a0c34b5138e6a3b2c488ea38a7c3844e0a7e874bb2b8eb5a2d63dfe49d1a204fa4bc243b28c4e854ac4e5ae19270998fba
TLSH
T165315E13D610CAB7C14D077896D2996C26B8AC3453E956560FB0047EEC893704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evbA528.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA528.tmp
Size 1KB
SHA256 544dcaf37718e1cab3c22ff714c17a2b7bf6612002bf003c7d25c18b46cdc163
MD5 25b350e524e3e0b8ce553b72d58a5afc
SHA1 8085d06b7bd003ba8750bcb3a8beafeeb02bfba6
SHA512 406de80a75527ba812f300f2d9422987c2ef1d469f84ceea2802d542ecf81bd1516cefe901feba3f65749e3795280f82a2e334906b9192f4c4ccb4ea7039a9dc
TLSH
T106315E12D6108AB2C18D073896D299AC66B8AC3453E91A560FF0047DEC853704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evbA539.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA539.tmp
Size 1KB
SHA256 7aa9ae8aaa315358c7c3c664bace1af30059014f10d15d68257e53850c75f922
MD5 d8fcced6f31829b232c999a0e0a06e17
SHA1 78f94292d460b8197a6b6d4dbdbdcbe06c3a8460
SHA512 50d18f543915374072fad2df8af0a337eed973fb8ebec77a111fb4edd90bf3b4e6d93af1133cb591b53d032b741b894a74eeac16a6dbe3a7908b88513f05f7f9
TLSH
T181315E53D6208AB2C14D077896E2992C26B8AC3453E9565A0FB0047DFC953B04A39D49
MD5 SHA1 SHA512 TLSH

Submit Download

evbA5A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA5A7.tmp
Size 1KB
SHA256 ad255b4bd994a099aa67dafe4a683a9bb4d798a7b2685781bc71236e2bed82a2
MD5 c35a793f8d969c9f76996ad984efe305
SHA1 5cdff7fd866e715af5cbc861c59d1865dc8f56c5
SHA512 0398fb216f52b2809e5c821785e68ba7b8d4f327dc2cdd3c2b3e250da7e9b45d5d6a0f48b74e3350a40e4b0f5933c8d9a1fa799312d55c170544fff1b5ebf852
TLSH
T16F315E13D610CAB2C14D073897D2992C26B8AC3463EA56560FB0047DFD857304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evbA5C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA5C8.tmp
Size 1KB
SHA256 692456011577b355a60871ce16be399ed827465094aa6cdc324df1c5a1d80a88
MD5 15e0bfa26a920d10b7e7eb7c1a4858fd
SHA1 c91fe40376c5754657b1d6fb8c5302cda082b607
SHA512 cb61a0c92e679634e55d66662ab6658044bdc3a3d701c1d508f07745db1e69774e2bcb728050caf52797e968773eed4fcd5e9c38ee76554d4b9efe3c4b423819
TLSH
T1AC315E12D6108AB2C15D07389AD29A2C27B8AC3493EA17160FF004BDEC953304A39D19
MD5 SHA1 SHA512 TLSH

Submit Download

evbA92D.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA92D.tmp
Size 1KB
SHA256 724447d07a89b5c2ae213777c9b98d3fc7f55ceeec773a9f4d5fad5988101067
MD5 61a50cd343f335d64fc6c42f87a856d7
SHA1 e84dec6baca7206a424fb6efa70b6f63d2fdbaae
SHA512 6b32a93f8247c1eb0ef436700c71fcc32487c5c401e1bf2830821d817a79d930b216854d5c70aa597762a65ae0aa459b5b697345449d32b77e5ed1d745cc9e38
TLSH
T158315E12D6108AB6C18D073897E2992C26B8AC3453E916560FB0447EEC893704A39D49
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download