00372c76b6db94076f971174fa45c4af3ea72344ce9bae1499a9218ba9eb0d72

Analysis

max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/06/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sample Qunty.bat
Size 1.9MB
Sample260606-weld1abs2t
SHA256 00372c76b6db94076f971174fa45c4af3ea72344ce9bae1499a9218ba9eb0d72
MD5 a41ad0308f3152de98244789020b0b0d
SHA1 4d6755b085d50bce2c790b33b2d00d9e177619ad
SHA512 addccc58cdd669b57150caad2b3f557dd112b405ad09d1c0d63ea8b8ecd263ff6dac7fd17f839fd80bc33f589ba99c282079ef9167f03f1838bd004083130f0d
SSDEEP 24576:8eXKWKw5MlKaRld+rHqVCqcdkNRLpj1MBCwEGhtm0:r
TLSH
T1FC95CFDDD06E45C68C043FC5BC281AC79B6987728A7400193BBB7E485F7B4BEC11AEA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4792	powershell.exe
752	powershell.exe
1808	powershell.exe
3316	powershell.exe
3568	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 4736	1808	powershell.exe	136

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\http:\schemas.microsoft.com\windows\2004\02\mit\task^>	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4792	powershell.exe
4792	powershell.exe
3316	powershell.exe
3316	powershell.exe
752	powershell.exe
752	powershell.exe
3568	powershell.exe
3568	powershell.exe
1580	powershell.exe
1580	powershell.exe
3568	powershell.exe
1580	powershell.exe
1808	powershell.exe
1808	powershell.exe
1808	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	3264	whoami.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	4736	MSBuild.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4792	1004	cmd.exe	91
PID 4792 wrote to memory of 4296	4792	powershell.exe	93
PID 4296 wrote to memory of 684	4296	cmd.exe	95
PID 684 wrote to memory of 4348	684	cmd.exe	96
PID 4296 wrote to memory of 4052	4296	cmd.exe	97
PID 4052 wrote to memory of 3588	4052	cmd.exe	98
PID 4296 wrote to memory of 4632	4296	cmd.exe	99
PID 4632 wrote to memory of 1632	4632	cmd.exe	100
PID 4296 wrote to memory of 3316	4296	cmd.exe	101
PID 4296 wrote to memory of 752	4296	cmd.exe	102
PID 752 wrote to memory of 1800	752	powershell.exe	108
PID 1800 wrote to memory of 3536	1800	cmd.exe	109
PID 3536 wrote to memory of 4032	3536	net.exe	110
PID 1800 wrote to memory of 4688	1800	cmd.exe	111
PID 1800 wrote to memory of 3928	1800	cmd.exe	113
PID 3928 wrote to memory of 3264	3928	cmd.exe	114
PID 1800 wrote to memory of 1236	1800	cmd.exe	115
PID 1236 wrote to memory of 2388	1236	net.exe	116
PID 1800 wrote to memory of 4316	1800	cmd.exe	117
PID 1800 wrote to memory of 3452	1800	cmd.exe	118
PID 3452 wrote to memory of 4592	3452	cmd.exe	119
PID 1800 wrote to memory of 2488	1800	cmd.exe	120
PID 2488 wrote to memory of 468	2488	cmd.exe	121
PID 1800 wrote to memory of 3568	1800	cmd.exe	122
PID 1800 wrote to memory of 1808	1800	cmd.exe	133
PID 1808 wrote to memory of 1280	1808	powershell.exe	134
PID 1280 wrote to memory of 5112	1280	csc.exe	135
PID 1808 wrote to memory of 4736	1808	powershell.exe	136
PID 1808 wrote to memory of 4736	1808	powershell.exe	136
PID 1808 wrote to memory of 4736	1808	powershell.exe	136
PID 1808 wrote to memory of 4736	1808	powershell.exe	136
PID 1808 wrote to memory of 4736	1808	powershell.exe	136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:XFL4+$q+$q+' a1b0c63b1c';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\System32\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"" a1b0c63b1c
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:4348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
        5⤵
        
        PID:3588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
        5⤵
        
        PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat' -Tail 26636 | Select-Object -First 38 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\svc_105417984_3352.ps1' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\svc_105417984_3352.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ovp13ezwyzz.bat" __hidden
        5⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of WriteProcessMemory
        
        PID:1800
      - C:\Windows\SysWOW64\net.exe
        
        net session
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /query /tn "SystemTelemetrics"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami 2>nul
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\whoami.exe
        
        whoami
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
      - C:\Windows\SysWOW64\net.exe
        
        net session
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn ""SystemTelemetrics"" /xml "C:\Users\Admin\AppData\Local\Temp\td_10805667.xml" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4316
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\ovp13ezwyzz.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\find.exe
        
        find /c /v ""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\ovp13ezwyzz.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\ovp13ezwyzz.bat"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:468
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\ovp13ezwyzz.bat' -Tail 124 -Encoding UTF8 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\svc_135020_151942176_16802.ps1' -Encoding UTF8"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3568
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\svc_135020_151942176_16802.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cuxmyi4s\cuxmyi4s.cmdline"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF77.tmp" "c:\Users\Admin\AppData\Local\Temp\cuxmyi4s\CSC41641454FB07411B99816D1D59A2F0B9.TMP"
        8⤵
        
        PID:5112
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
TLSH
T1A7416A303125B5D84D435F5308286ED663EF8749ABA89F5CB969221DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 d9e2c903ca3530aa279684dbe40c463ab74e688b1b802bb817cdaf633dd119ba
MD5 707ecf98eb2f302f220b4476a277cebe
SHA1 c543f0cd4d32f658300487cd3a89ea6d5ecc5fc0
SHA512 95bd108d4b3d300bd2ccbd25c127719c246820b5563d33a4c35e6cd5421e7b8af8266bb1e65d1d46ad0f550105c93f9c23e9f64f6f54701a58fd2c07fc7e46d8
SSDEEP 1536:zC+jH04tAHk1/rMrxyNhftflJdvYoqV3CNBQkj20lUst+hOOwUp7bNvv+Epa5bVl:zC+jH04tAHk1jMrxyNhftflJdvYoqV3s
TLSH
T1A9335093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 5e4f03554af759b76e42f44facc7a3e010974f29ee23dfd7e4d5d078bf8581ca
MD5 13a74c9fe622c1954eb4ce3bff4ea8f7
SHA1 f170e0f8e7481692621be66222fde5ab0c496f28
SHA512 0a2c38e9a36223abdd4250971ac2728ceb0f2ec1c53ad9a0333710e1314f220ac3f16b593bddd7a74aacb3582bf9b8a0dc3a84826f067352a664d7d70eb28ef0
SSDEEP 1536:pYnC+jH04tAHk1/rMrxyNhftflJdvYoFi3j39MVvjMlUst+hOOwUp7bNvv+Epa5H:pYnC+jH04tAHk1jMrxyNhftflJdvYoFM
TLSH
T1AF334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 56KB
SHA256 2abb2c511fa6fe1e2bb924f2cc24cabcd4834165e81cec8b428597598ebc0604
MD5 290f9ecc53f84c91da944ceaeb523c29
SHA1 5fe1c9ae1cbcc1451cd20b4f2d7271fc4267b4a8
SHA512 057b6ae38bbd4f033bdf560548ee16e76da35c8455930b70ca25aaf85fbffdcc47a8c9ca7c4e4766922ae6972d4d84180153284d0868e1b0fb8458008139f9b0
SSDEEP 1536:DYW0C+jH04tAHk1mrMrxyNhftflJd/YoFi3jiRjdvRMlUstK4hOOwUp7bNvv+EpT:DYLC+jH04tAHk16MrxyNhftflJd/YoF+
TLSH
T1AC434192E9204D71E1A66F3EF15662227D343D4690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7f4b7ee2653ce208b03f8c0aa4bbec1822b3b3a1a36f78ac8871b4bb7b052852
MD5 bc2d78c0871bffb9aeedf88f2935dab9
SHA1 5eb0485f54de407163826e96233e3ca0aef97fe4
SHA512 cc1dc9241fc342298cfb605e4a3cc795544599ae9aa0f1af00e3322f1f39b90393f2f2589087b80f6d9123f78acec540bfbe1f2abe5c73969724f77279e1669c
TLSH
T1DC217633B39C8A22CCCA113A108D9C5036B683D7819ECE9FAFC4D605A17F9D9CB32190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b7c0da2e0c9b88992bec6cc565e21ae7c46e19df12e1e860dd42d63aa8d7b3e1
MD5 ea535b7ebd8383b15f24787cadb2a625
SHA1 d2e8c092e0778bb0f276897319bd2590f719c04e
SHA512 c75c2311bd3b2cceaf5fa0a6af1fd068227d5ee41160c28d22f31c968c7de77d23b08886d88eacc6cf08665bbd9c5765d314f17df95753630c66d58215d872d2
TLSH
T1A1115327B39C8921CC96163A509DAC1176B683DB81AEDE9F7FC4D214A07F984CB612A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 659f5725da2bae4a7d94dfa90af83b0e4054465ae8937e570473c1528866f03b
MD5 32535a8d767830ad16830ddca0d7e844
SHA1 91faee64f812c45f4f7e1dcab1b3fc8314446c6a
SHA512 0716d3b0d92627de5c427ba1b0a7ced71a57c49077e27c65d3a8d65a4014145f586ecdade44df908aacfc38d445092f61864ff51a0b4ac0fe35d1bd5cb576e7b
TLSH
T197217827B3DCCA21CC96163A109D9C1176B683C7819EDF9F6BC0D614A07F9D9CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 a964992ccd7b6f7980cfe35b62e6b5c8b070b84c8e28777d2ba03253ea00abb4
MD5 3ebccfb31b4316746adad7c1affd875b
SHA1 7ae35c8e605dfa6acdb21b87d66a195dada5e831
SHA512 a4fc2880e3a55ff38609861822f54bd948b3d53a3dd5d099438b15cf65a65cc418f56774fb5ad87342d4ffd52ac058dfb1ca8520677702fcf542cd85ff020542
SSDEEP 384:+rf+hWS9i+BdBe+OLsTszJkrWx12TVK6seYhIl/r03SQZLfYSP4jEdeW8q7:sfHOBemserm12TVNSiYSaRmEdX
TLSH
T12672B66E710F26C3C4D12378D10B095FE4F2DDCD131E07D9BB6AAF3B8AA8A5E5129458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESF77.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF77.tmp
Size 1KB
SHA256 dcdd03d75be68a11b00b888d032279b27eda95dfa1ce36bd069c6995e41a9d39
MD5 5574404735fb0909919f662c285b5267
SHA1 c8138fb4b2aad8b3343e6cba19a269f1f2616b8f
SHA512 4e523d6136fd1b03d09e616e4f4fbe495de2f882044775eb74ba8bcf4c54ec48ec8c7cce03d175be9e61c3d5a61f2c288036eaa725f35cbf8424a3b5a409c7ea
TLSH
T1CF21AF0187E94B0FF0B35731B9F6176BA279FC65EFA2575B854041281C51504EFB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d3anx13u.sbs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3anx13u.sbs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cuxmyi4s.dll

Path C:\Users\Admin\AppData\Local\Temp\cuxmyi4s\cuxmyi4s.dll
Size 3KB
SHA256 1906687973a76f27cce22689ec7f13d78ae63d849417c7b707db36953dbf8ce7
MD5 4b325f006141aaa5b01359d3125da4bd
SHA1 75b1b044406753ad5713cdd25c66dc001cff510b
SHA512 6eab4d99a53d26afbe2f0555d3c4a82c9d456e0cc03dde71ab0b7df72b8b7d01af59b447a100a94e87b8535ac6cd67a7b67952feba99d06657180310fd7fc4bc
TLSH
T10351CB1A9BE8462BF4730B30AEF3476677B5F8108FB3675E5D905218AC216549E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

ovp13ezwyzz.bat

Path C:\Users\Admin\AppData\Local\Temp\ovp13ezwyzz.bat
Size 935KB
SHA256 be887641ae75b800d50764f9da292bbf790b831ee0b14d1d232b565e9043b66d
MD5 5afb2fcd9f74ebd18ed5fbde69ade55c
SHA1 8334b8f7edc808054118b39bb1e94a1383050c27
SHA512 df71f28b4cb4ab32576c4e46f67ce48e9885a672f3b89d60d95034822c42ebd563a27e19dadada55b7bfa76d245f695ca1d6652ac04491f68322ebebbb8b2b12
SSDEEP 24576:8VZzu7viBrz5RJ0VsymAukKKZPq+mUL5bSLrCTmQx:VSUZvL4AN
TLSH
T15415CFF35103FCE61F6E1E0080483E651CBD2CEF9268B558BA8C0AE671E9554EE6DDB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_105417984_3352.ps1

Path C:\Users\Admin\AppData\Local\Temp\svc_105417984_3352.ps1
Size 2KB
SHA256 7026293fb34ae135fcbe92ddf66eea4a603f5741746a16152d7eedea71bcd4e6
MD5 73ad9fba255882c1083f6f18a9d969cf
SHA1 57300feb306a7dc3271d330fed18eecf0e2d629d
SHA512 77cf975f37bde5ac69cbf9c7db10f21cef28ec253ae553c7f51a66fabb240165c62630310b54b26871f9ddb93a658261d55778772e57b9a1298982675a7f30c9
TLSH
T14C51876A7795D56E09D7637279848682A429E33F8136DC00F7E9D6C4E10AF0503AE2CF
MD5 SHA1 SHA512 TLSH

Submit Download

svc_135020_151942176_16802.ps1

Path C:\Users\Admin\AppData\Local\Temp\svc_135020_151942176_16802.ps1
Size 928KB
SHA256 55aa8a5f4e5c698c0a95dd246c5a5779d7a024edfefee916367fa4a342ca18b0
MD5 c286233b8a056cc63bb73a612094a31d
SHA1 eae1116ea0a8075f7a6f542bf6b3ed41e7c24944
SHA512 c11ee975bc45a0437df958bdb5418e912c03556590ae1a8a101c792caa4bdfb8be07a6a958d987a5bdee317d92f5dde4b1a39a3e55163fee41611c01d99036dd
SSDEEP 24576:TVZzu7QiBrz5RJ0VsymAukKKZPq+mUL5bSLrCTmQU:i7UZvL4Ag
TLSH
T14315CFF34103FCE61F6E1E0080483E655CBD2CEF9268B558BA8C0AE671E9554EE6DDB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

td_10805667.xml

Path C:\Users\Admin\AppData\Local\Temp\td_10805667.xml
Size 1KB
SHA256 ed1ff8913301e7b30ccc148e8ceb45f9c596e47db0077d9ca67cb99a6bb430e0
MD5 e86e6bb5e14e198950c9c2a3f4e45550
SHA1 87aa7398721bae5cd5622dbb9613a17c48fdbbd2
SHA512 579958c93b8abf5c91e8377afb7e058bafc2f0e6326e8a57fa6f18ee569185c7ecebc206f1366ff9a939b3919218377560fe6981915697329e890f6c0d7db6a5
TLSH
T18A41D7709E61FE0FE577923BD45193C3A57B53514BA70030CDC88D7F688919611C391B
MD5 SHA1 SHA512 TLSH

Submit Download

CSC41641454FB07411B99816D1D59A2F0B9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cuxmyi4s\CSC41641454FB07411B99816D1D59A2F0B9.TMP
Size 652B
SHA256 b961e4998d671f61afde457b24db18dcaf17ecfaba8cbd54637cdac40796cc0e
MD5 cea4c965a659876710bac34f4edad672
SHA1 900196bf808a9103e39af50be0dc06a8f1132708
SHA512 14b0c69f9c0d2a5bca50d98a861bc7aa0ef19d8ccb7cec35ce422ddee882c1cd057ab13b25e2c54be5f9c9d6312b407b643beb4f5acd247c0edabc664bca0f3a
TLSH
T103F05E0963F8020EF1F34B30BEF683A3A5B9BC65DE3293ED244043192864910D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cuxmyi4s.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cuxmyi4s\cuxmyi4s.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

cuxmyi4s.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cuxmyi4s\cuxmyi4s.cmdline
Size 369B
SHA256 9387ebf44b976891f9f5da5365ca851e6204ea09b6b9683646f0a31d6fc3e16e
MD5 1e4d892c64647c8562fe3b698e44f907
SHA1 21992dd5c15e847790853d0a19f8d3ccd61ce680
SHA512 f07269e326d285d60d46e11e4d7faeedf60607f719fb24d97d75edfcd14846d69ee7a1de119c7bc70074b6a2dbe1b3f09012f1e00f0e6397c207efe3ac0da888
TLSH
T1AAE0D82AD257C6BD15D91017256BC9AC86B20A8B29C27FD85950C85ED01702467D1755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1580-61-0x0000022CEE9A0000-0x0000022CEE9E4000-memory.dmp

Download

memory/1580-64-0x0000022CEE9F0000-0x0000022CEEA66000-memory.dmp

Download

memory/1808-88-0x0000000006890000-0x00000000068A8000-memory.dmp

Download

memory/1808-90-0x0000000007D10000-0x000000000838A000-memory.dmp

Download

memory/1808-103-0x00000000050F0000-0x00000000050F8000-memory.dmp

Download

memory/1808-78-0x0000000005DE0000-0x0000000006134000-memory.dmp

Download

memory/1808-104-0x0000000005110000-0x0000000005118000-memory.dmp

Download

memory/3316-23-0x000001E744F40000-0x000001E74508E000-memory.dmp

Download

memory/3568-41-0x0000000003100000-0x0000000003136000-memory.dmp

Download

memory/3568-45-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/3568-65-0x00000000078A0000-0x0000000007936000-memory.dmp

Download

memory/3568-66-0x0000000006C00000-0x0000000006C1A000-memory.dmp

Download

memory/3568-67-0x0000000006C50000-0x0000000006C72000-memory.dmp

Download

memory/3568-63-0x0000000006720000-0x000000000676C000-memory.dmp

Download

memory/3568-62-0x00000000066F0000-0x000000000670E000-memory.dmp

Download

memory/3568-53-0x00000000060B0000-0x0000000006404000-memory.dmp

Download

memory/3568-44-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/3568-68-0x0000000007EF0000-0x0000000008494000-memory.dmp

Download

memory/3568-43-0x0000000005800000-0x0000000005822000-memory.dmp

Download

memory/3568-42-0x0000000005980000-0x0000000005FA8000-memory.dmp

Download

memory/4736-105-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4736-107-0x0000000005630000-0x00000000056F8000-memory.dmp

Download

memory/4792-0-0x0000023076FC0000-0x0000023076FD0000-memory.dmp

Download

memory/4792-9-0x0000023076F70000-0x0000023076F92000-memory.dmp

Download

memory/4792-1-0x0000023076FC0000-0x0000023076FD0000-memory.dmp

Download